Discuss Amazon SOA-C03 Exam Topic 3 Question 4

A CloudOps engineer is configuring an Amazon CloudFront distribution to use an SSL/TLS certificate. The CloudOps engineer must ensure automatic certificate renewal.

Which combination of steps will meet this requirement? (Select TWO.)

AUse a certificate issued by AWS Certificate Manager (ACM).

BUse a certificate issued by a third-party certificate authority (CA).

CConfigure CloudFront to automatically renew the certificate when the certificate expires.

DConfigure email validation for the certificate.

EConfigure DNS validation for the certificate.

Suggested Answer: A, E

The AWS Cloud Operations and Security documentation specifies that for Amazon CloudFront, automatic certificate renewal is only supported for certificates issued by AWS Certificate Manager (ACM). When a certificate is managed by ACM and validated through DNS validation, ACM automatically renews the certificate before expiration without requiring manual intervention.

Option A ensures that the certificate is issued and managed by ACM, enabling full integration with CloudFront. Option E (DNS validation) is essential for automation; AWS performs revalidation automatically as long as the DNS validation record remains in place.

By contrast, email validation (Option D) requires manual user confirmation upon renewal, which prevents automatic renewals. Certificates issued by third-party certificate authorities (Option B) are manually managed and must be reimported into ACM after renewal. CloudFront does not have a direct feature (Option C) to renew certificates; it relies on ACM's lifecycle management.

Thus, combining ACM-issued certificates (A) with DNS validation (E) ensures continuous, automated renewal with no downtime or human action required.

Get Premium SOA-C03 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

28 comments · newest first

Mabel 7 months ago

I prefer A and D. Email validation is straightforward.

Alexis 8 months ago

A and C could work too. Automatic renewal is key.

Cherelle 8 months ago

I agree, A is essential. E makes sense for automation.

Val 8 months ago

C is definitely not needed if you're using ACM!

Leonor 8 months ago

B is a no-go if you want auto-renewal.

Laticia 9 months ago

Wait, can CloudFront really auto-renew? Sounds too good to be true.

Micaela 9 months ago

Totally agree with A! AWS ACM makes it easy.

Curtis 9 months ago

A) and E) are the way to go!

Carla 9 months ago

Automatic renewal? That's like having a self-cleaning oven - why didn't I think of that?

Mignon 9 months ago

Hmm, I thought B was the right answer. Guess I need to study more cloud security.

Rolf 9 months ago

I’m a bit confused about whether CloudFront handles automatic renewal itself or if we need to set something up. I don’t recall seeing option C in my notes.

Marsha 10 months ago

I practiced a similar question where we had to choose between email and DNS validation, and I think DNS is generally preferred for automation.

Dexter 10 months ago

I’m not entirely sure, but I feel like configuring DNS validation could be important for the certificate management process. Maybe option E?

Lucy 10 months ago

I agree, using ACM and DNS validation is the way to go.

Shonda 10 months ago

I think A and E are the best choices. ACM is easy to manage.

Janessa 10 months ago

A and E are the correct options.

Caitlin 11 months ago

C is a trap answer, CloudFront doesn't automatically renew certificates.

My 11 months ago

I remember that using AWS Certificate Manager is crucial for automatic renewal, so I think option A is definitely one of the answers.

Paola 11 months ago

I'm not sure about B. Does using a third-party certificate mean I can't get automatic renewal?

Sherly 11 months ago

I'm pretty confident that A and E are the way to go. Using an ACM certificate and configuring DNS validation should cover the automatic renewal requirement.

Marci 12 months ago

I'm a bit confused about the difference between options C and D. Do I need to configure both email and DNS validation?

Lacey 12 months ago

Okay, I think I've got this. A and E seem like the right combination to ensure automatic renewal.

Ira 12 months ago

Hmm, this one seems tricky. I'll need to think through the options carefully.

Nadine 7 months ago

↳ replying to Ira

Agreed, DNS validation is easier to manage.

Breana 7 months ago

↳ replying to Ira

What about DNS validation? Seems like a good choice.

Emeline 7 months ago

↳ replying to Ira

Definitely! It simplifies the process.

Celeste 7 months ago

↳ replying to Ira

I think using AWS Certificate Manager is a must.

Helga 11 months ago

↳ replying to Ira

So, A and E? That sounds solid!

Amazon SOA-C03 Exam - Topic 3 Question 4 Discussion