Learn the correct process for a SysOps administrator to obtain a new SSL/TLS certificate for an application deployed in an AWS development account when Route 53 is managed in a shared account.
Table of Contents
Question
A company uses a multi-account structure in the AWS Cloud. The company’s environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account.
A SysOps administrator needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account.
What must the SysOps administrator do to meet this requirement?
A. Create a new AWS Key Management Service (AWS KMS) key in the shared account. Configure the key policy to give read access to the development account’s root principal.
B. Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
C. Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
D. Create a new AWS Key Management Service (AWS KMS) key in the development account. Configure the key policy to give read access to the shared account’s root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.
Answer
C. Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
Explanation
The correct answer is C. To obtain a new SSL/TLS certificate for an application deployed in the development account, the SysOps administrator must:
- Request a new certificate using AWS Certificate Manager (ACM) from within the development account where the application is deployed. This ensures the certificate is issued to and can be used by resources in the development account.
- Use Route 53 from the shared account to create the necessary DNS validation record sets in the relevant hosted zone to validate domain ownership. Since the company manages all Route 53 hosted zones from the shared account, the validation records must be created there, even though the ACM certificate request originates from the development account.
The other options are incorrect because:
A. Creating an AWS KMS key in the shared account is not relevant for obtaining an ACM SSL/TLS certificate in the development account.
B. The ACM certificate request must be made from the development account where the application is deployed, not from the shared account.
D. Creating an AWS KMS key with a policy granting access to the shared account is not necessary or relevant for ACM certificate validation using Route 53 DNS records.
In summary, the key steps are to request the ACM certificate from the account where it will be used, but create the Route 53 DNS validation records from the account that hosts the relevant domain’s hosted zone.
Amazon AWS Certified SysOps Administrator – Associate certification exam assessment practice question and answer (Q&A) dump including multiple choice questions (MCQ) and objective type questions, with detail explanation and reference available free, helpful to pass the Amazon AWS Certified SysOps Administrator – Associate exam and earn Amazon AWS Certified SysOps Administrator – Associate certification.