Q88 — AWS SAA-C03 Ch.17

Question 88 of 89 | ← Chapter 17

Q1388. A company uses an Amazon CloudFront distribution to serve content pages for its website. The company needsto ensure that clients use a TLS certificate when accessing the company's website. The company wants to automate the creation and renewal of the TLS certificates. Which solution will meet these requirements with the MOST operational efficiency?

Correct Answer: C. Use AWS Certificate Manager(ACM) to create a certificate. Use DNS validation for the domain.

Explanation

Let's analyze each option to determine the solution that meets the requirements of ensuring clients use a TLS certificate when accessing the website and automating the creation and renewal of the TLS certificates with the most operational efficiency:Option A: Use a CloudFront security policy to create a certificate Amazon CloudFront security policies are used to define security settings for the distribution, such as the minimum TLS version, cipher suites, and HTTP/2 support. However, CloudFront security policies do not have the capability to create TLS certificates. They are used to configure how CloudFront interacts with clients in terms of security protocols, not for certificate generation. So, this option is incorrect.Option B: Use a CloudFront origin access control (OAC) to create a certificate CloudFront origin access control (OAC) is used to restrict access to the origin server (e.g., an Amazon S3 bucket or an HTTP server) so that only CloudFront can access it. It is not related to the creation or management of TLS certificates. OAC helps in securing the origin - CloudFront communication, not in providing TLS certificates for client - CloudFront communication. Therefore, this option is incorrect.Option C: Use AWS Certificate Manager (ACM) to create a certificate. Use DNS validation for the domain AWS Certificate Manager (ACM) is a service that allows you to easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources. ACM can automatically create and renew TLS certificates.DNS validation is a highly automated and efficient way to validate domain ownership. When using DNS validation, you add a CNAME record to your domain's DNS settings. ACM can then automatically verify that you own the domain and issue the certificate. This process is mostly automated, reducing the operational overhead significantly. Once the certificate is issued, it can be easily associated with the CloudFront distribution, ensuring that clients use a TLS certificate when accessing the website. This option meets the requirements with high operational efficiency.Option D: Use AWS Certificate Manager (ACM) to create a certificate. Use email validation for the domain While AWS Certificate Manager (ACM) can also be used to create and manage TLS certificates, email validation is less operationally efficient compared to DNS validation. With email validation, ACM sends an email to a set of predefined email addresses associated with the domain (e.g., mailto:admin@domain.com, mailto:webmaster@domain.com). A person then has to manually check the email and follow the instructions to complete the validation process. This manual step adds operational overhead, especially in large - scale or automated environments. So, this option is less efficient than using DNS validation.Based on the above analysis, the solution that will meet the requirements with the most operational efficiency is to use AWS Certificate Manager (ACM) to create a certificate and use DNS validation for the domain.So the answer is C.