AWS Certified SysOps Administrator – Associate — Question 372

A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account.

A SysOps administrator needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account.

What must the SysOps administrator do to meet this requirement?

Answer options

• A. Create a new AWS Key Management Service (AWS KMS) key in the shared account. Configure the key policy to give read access to the development account's root principal.
• B. Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
• C. Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
• D. Create a new AWS Key Management Service (AWS KMS) key in the development account. Configure the key policy to give read access to the shared account’s root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.

Correct answer: C

Explanation

To secure an application with an SSL/TLS certificate using AWS Certificate Manager (ACM), the certificate must be requested in the same AWS account where the application or load balancer is deployed (the development account). Because the Route 53 public hosted zones reside in the shared account, the administrator must create the CNAME validation records in the shared account's Route 53 hosted zone to complete DNS validation. AWS KMS keys are not involved in validating ACM certificates, making options A and D incorrect, and ACM certificates cannot be associated with resources in different accounts, making option B incorrect.