Back to AWS Elastic Beanstalk

Custom Domains and SSL

5 minutes 5 Questions

AWS Elastic Beanstalk allows businesses to use custom domain names and Secure Socket Layer (SSL) certificates for their applications. Custom domain names enable businesses to access their applications using a unique and recognizable URL, while SSL certificates ensure secure communication between th…

Test mode:
Start practice test
AWS Certified Solutions Architect - Custom Domains and SSL Example Questions

Test your knowledge of Custom Domains and SSL

Question 1

You need to secure your API hosted on Amazon API Gateway with a custom domain and SSL certificate. Which steps should you perform?

Correct Answer: Request an SSL certificate using AWS Certificate Manager (ACM), then create a custom domain with the certificate in API Gateway

To secure an API with a custom domain and SSL, you should first request an SSL certificate using AWS Certificate Manager (ACM), and then create a custom domain with the certificate in API Gateway. Other answers are either incorrect steps or not applicable.

Question 2

Your company needs to provision and manage SSL/TLS certificates for a custom domain used by an application on AWS and attach the certificates to services like an Application Load Balancer or Amazon CloudFront. Which AWS service should you use?

Correct Answer: AWS Certificate Manager (ACM)

AWS Certificate Manager (ACM) provisions, manages, and automatically renews public and private SSL/TLS certificates and integrates directly with AWS services such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway. KMS manages encryption keys and data encryption, not web certificates. IAM is for identity and access control and is not used to issue or manage SSL/TLS certificates for AWS services. SES is an email service and unrelated to SSL/TLS for web endpoints.

Question 3

You manage an Amazon CloudFront distribution that serves a custom domain using a public certificate issued by AWS Certificate Manager (ACM) in us-east-1. The certificate has expired because the DNS validation record was removed, so ACM could not auto-renew it. You need to restore HTTPS for the distribution as quickly as possible. What is the best approach?

Correct Answer: Request a new SSL certificate in ACM and update the CloudFront distribution with the new certificate

ACM public certificates automatically renew only if domain validation remains in place. If the DNS validation record was removed and the certificate has already expired, it cannot be auto-renewed. The correct remediation is to request a new public certificate in ACM in us-east-1 (the region required for CloudFront), complete DNS validation, and then update the existing CloudFront distribution to use the new certificate. Creating a new distribution is unnecessary, KMS is unrelated to certificate issuance/renewal, and you do not manually upload a renewed ACM-managed certificate to CloudFront.

More Custom Domains and SSL questions
15 questions (total)
Start 15 question test