Exam ANS-C00 topic 1 question 360 discussion

Exam question from Amazon's ANS-C00

Question #: 360
Topic #: 1

A company is migrating a legacy storefront web application to the AWS Cloud. The application is complex and will take several months to refactor. A solutions architect recommended an interim solution of using Amazon CloudFront with a custom origin pointing to the SSL endpoint URL for the legacy web application until the replacement is ready and deployed.
The interim solution has worked for several weeks. However, all browser connections recently began showing an HTTP 502 Bad Gateway error with the header
`X-Cache: Error from cloudfront.` Monitoring services show that the HTTPS port 443 on the legacy web application is open and responding to requests.
What is the likely cause of the error, and what is the solution?

A. The origin access identity is not correct. Edit the CloudFront distribution and update the identity in the origins settings.
B. The SSL certificate on the CloudFront distribution has expired. Use AWS Certificate Manager (ACM) in the us-east-1 Region to replace the SSL certificate in the CloudFront distribution with a new certificate.
C. The SSL certificate on the legacy web application server has expired. Use AWS Certificate Manager (ACM) in the us-east-1 Region to create a new SSL certificate. Export the public and private keys, and install the certificate on the legacy web application.
D. The SSL certificate on the legacy web application server has expired. Replace the SSL certificate on the web server with one signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy web application server.

Show Suggested Answer

Suggested Answer: D 🗳️

by walkwolf3 at Sept. 1, 2021, 10:09 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

walkwolf3

Highly Voted 3 years, 7 months ago

D A. Wrong. OAR should be correct, becasue it's been running for several weeks. If the origin server returns an expired certificate, an invalid certificate, or a self-signed certificate, or if the origin server returns the certificate chain in the wrong order, CloudFront drops the TCP connection, returns HTTP status code 502 (Bad Gateway), and sets the X-Cache header to Error from cloudfront. You can use an SSL/TLS certificate from the following sources on your custom origin: If your origin is an Elastic Load Balancing load balancer, you can use a certificate provided by AWS Certificate Manager (ACM). You also can use a certificate that is signed by a trusted third-party certificate authority and imported into ACM. For origins other than Elastic Load Balancing load balancers, you must use a certificate that is signed by a trusted third-party certificate authority (CA), for example, Comodo, DigiCert, or Symantec. From above, certificate on the web server is expired, you need to replace the cert which issued from a third-party CA. And the answer is D. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html

upvoted 10 times

Jazz888

3 years, 4 months ago

you are right. But what does "Monitoring services indicate that the traditional web application's HTTPS port 443 is accessible and accepting requests." mean?

upvoted 1 times

...

sapien45

3 years, 3 months ago

Thank you for the detailled explanations. D indeed

upvoted 1 times

...

lemist

Most Recent 2 years, 11 months ago

You can use an SSL/TLS certificate from the following sources on your custom origin: If your origin is an Elastic Load Balancing load balancer, you can use a certificate provided by AWS Certificate Manager (ACM). You also can use a certificate that is signed by a trusted third-party certificate authority and imported into ACM. For origins other than Elastic Load Balancing load balancers, you must use a certificate that is signed by a trusted third-party certificate authority (CA), for example, Comodo, DigiCert, or Symantec.

upvoted 1 times

...

borisgor

3 years, 5 months ago

Why not C? "To use an ACM certificate with Amazon CloudFront, you must request or import the certificate in the US East (N. Virginia) region" https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html

upvoted 3 times

...

mabalon

3 years, 6 months ago

Selected Answer: D

Answer D. If the origin server returns the following, CloudFront drops the TCP connection, returns HTTP status code 502 (Bad Gateway), and sets the X-Cache header to Error from cloudfront: - An expired certificate https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/http-502-bad-gateway.html

upvoted 4 times

...