Exam AWS Certified Solutions Architect - Professional topic 1 question 409 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 409
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company manages more than 200 separate internet-facing web applications. All of the applications are deployed to AWS in a single AWS Region. The fully qualified domain names (FQDNs) of all of the applications are made available through HTTPS using Application Load Balancers (ALBs). The ALBs are configured to use public SSL/TLS certificates.
A Solutions Architect needs to migrate the web applications to a multi-region architecture. All HTTPS services should continue to work without interruption.
Which approach meets these requirements?

A. Request a certificate for each FQDN using AWS KMS. Associate the certificates with the ALBs in the primary AWS Region. Enable cross-region availability in AWS KMS for the certificates and associate the certificates with the ALBs in the secondary AWS Region.
B. Generate the key pairs and certificate requests for each FQDN using AWS KMS. Associate the certificates with the ALBs in both the primary and secondary AWS Regions.
C. Request a certificate for each FQDN using AWS Certificate Manager. Associate the certificates with the ALBs in both the primary and secondary AWS Regions.
D. Request certificates for each FQDN in both the primary and secondary AWS Regions using AWS Certificate Manager. Associate the certificates with the corresponding ALBs in each AWS Region.

Show Suggested Answer

Suggested Answer: D 🗳️
Certificates in ACM are regional resources. To use a certificate with Elastic Load Balancing for the same fully qualified domain name (FQDN) or set of FQDNs in more than one AWS region, you must request or import a certificate for each region. For certificates provided by ACM, this means you must revalidate each domain name in the certificate for each region. You cannot copy a certificate between regions.
Reference:
https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html

by Huy at Aug. 26, 2019, 4:48 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Huy

Highly Voted 3 years, 8 months ago

A & B mention about KMS which is not valid for SSL/TLS Cert Managment. ACM is regional service and each region must maintain its owns certificate list. So D should be correct in my opinion.

upvoted 40 times

...

examacc

Highly Voted 3 years, 8 months ago

Answer is D. As per AWS FAQ To use a certificate with Elastic Load Balancing for the same site (the same fully qualified domain name, or FQDN, or set of FQDNs) in a different Region, you must request a new certificate for each Region in which you plan to use it.

upvoted 18 times

...

cldy

Most Recent 3 years, 5 months ago

D is correct.

upvoted 1 times

...

AzureDP900

3 years, 5 months ago

D is right!

upvoted 1 times

...

cldy

3 years, 6 months ago

D. Request certificates for each FQDN in both the primary and secondary AWS Regions using AWS Certificate Manager. Associate the certificates with the corresponding ALBs in each AWS Region.

upvoted 2 times

...