Amazon SOA-C03 Exam - Topic 3 Question 4 Discussion

Actual exam question for Amazon's SOA-C03 exam

Question #: 4
Topic #: 3

A CloudOps engineer is configuring an Amazon CloudFront distribution to use an SSL/TLS certificate. The CloudOps engineer must ensure automatic certificate renewal.

Which combination of steps will meet this requirement? (Select TWO.)

AUse a certificate issued by AWS Certificate Manager (ACM).

BUse a certificate issued by a third-party certificate authority (CA).

CConfigure CloudFront to automatically renew the certificate when the certificate expires.

DConfigure email validation for the certificate.

EConfigure DNS validation for the certificate.

Show Suggested Answer

Suggested Answer: A, E

The AWS Cloud Operations and Security documentation specifies that for Amazon CloudFront, automatic certificate renewal is only supported for certificates issued by AWS Certificate Manager (ACM). When a certificate is managed by ACM and validated through DNS validation, ACM automatically renews the certificate before expiration without requiring manual intervention.

Option A ensures that the certificate is issued and managed by ACM, enabling full integration with CloudFront. Option E (DNS validation) is essential for automation; AWS performs revalidation automatically as long as the DNS validation record remains in place.

By contrast, email validation (Option D) requires manual user confirmation upon renewal, which prevents automatic renewals. Certificates issued by third-party certificate authorities (Option B) are manually managed and must be reimported into ACM after renewal. CloudFront does not have a direct feature (Option C) to renew certificates; it relies on ACM's lifecycle management.

Thus, combining ACM-issued certificates (A) with DNS validation (E) ensures continuous, automated renewal with no downtime or human action required.

by Junita at Oct 31, 2025, 01:26 AM

Limited Time Offer

25%

Off

Get Premium SOA-C03 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Alexis

9 days ago

A and C could work too. Automatic renewal is key.

upvoted 0 times

...

Cherelle

14 days ago

I agree, A is essential. E makes sense for automation.

upvoted 0 times

...

Val

19 days ago

C is definitely not needed if you're using ACM!

upvoted 0 times

...

Leonor

24 days ago

B is a no-go if you want auto-renewal.

upvoted 0 times

...

Laticia

30 days ago

Wait, can CloudFront really auto-renew? Sounds too good to be true.

upvoted 0 times

...

Micaela

1 month ago

Totally agree with A! AWS ACM makes it easy.

upvoted 0 times

...

Curtis

1 month ago

A) and E) are the way to go!

upvoted 0 times

...

Carla

2 months ago

Automatic renewal? That's like having a self-cleaning oven - why didn't I think of that?

upvoted 0 times

...

Mignon

2 months ago

Hmm, I thought B was the right answer. Guess I need to study more cloud security.

upvoted 0 times

...

Rolf

2 months ago

I’m a bit confused about whether CloudFront handles automatic renewal itself or if we need to set something up. I don’t recall seeing option C in my notes.

upvoted 0 times

...

Marsha

2 months ago

I practiced a similar question where we had to choose between email and DNS validation, and I think DNS is generally preferred for automation.

upvoted 0 times

...

Dexter

2 months ago

I’m not entirely sure, but I feel like configuring DNS validation could be important for the certificate management process. Maybe option E?

upvoted 0 times

...

Lucy

2 months ago

I agree, using ACM and DNS validation is the way to go.

upvoted 0 times

...

Shonda

3 months ago

I think A and E are the best choices. ACM is easy to manage.

upvoted 0 times

...

Janessa

3 months ago

A and E are the correct options.

upvoted 0 times

...

Caitlin

3 months ago

C is a trap answer, CloudFront doesn't automatically renew certificates.

upvoted 0 times

...

My

3 months ago

I remember that using AWS Certificate Manager is crucial for automatic renewal, so I think option A is definitely one of the answers.

upvoted 0 times

...

Paola

4 months ago

I'm not sure about B. Does using a third-party certificate mean I can't get automatic renewal?

upvoted 0 times

...

Sherly

4 months ago

I'm pretty confident that A and E are the way to go. Using an ACM certificate and configuring DNS validation should cover the automatic renewal requirement.

upvoted 0 times

...