ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified SysOps Administrator - Associate All Questions

View all questions & answers for the AWS Certified SysOps Administrator - Associate exam
Go to Exam

Exam AWS Certified SysOps Administrator - Associate topic 1 question 454 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate
Question #: 454
Topic #: 1
[All AWS Certified SysOps Administrator - Associate Questions]

A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account.

A SysOps administrator needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account.

What must the SysOps administrator do to meet this requirement?

  • A. Create a new AWS Key Management Service (AWS KMS) key in the shared account. Configure the key policy to give read access to the development account's root principal.
  • B. Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
  • C. Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
  • D. Create a new AWS Key Management Service (AWS KMS) key in the development account. Configure the key policy to give read access to the shared account’s root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by AMEJack at Aug. 12, 2024, 7:15 a.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Albanki
2 months, 2 weeks ago
Answer is C Requesting an ACM certificate is usually a two-step activity: 1. Request a certificate for a domain. 2. Verify your ownership of that domain. Step 2 is done by adding specific DNS records in your DNS. However, AWS makes step 2 easier for users that are requesting an ACM for a domain that is managed using Route 53 in the same account by adding the records almost automatically (at a click-of-a-button). Nonetheless, in case someone is not using Route 53 as DNS, or is using Route 53 in another account, then back to the original way of verification. Not to mention that the ACM Certificate is must be at the same account & region that you want to use it in.
upvoted 1 times
Albanki
2 months, 2 weeks ago
At the time of writing this comment, community votes are 50% B 50% C. Thus the long comment.
upvoted 1 times
...
...
numark
2 months, 2 weeks ago
ChatGPT states the answer is C.
upvoted 2 times
numark
2 months ago
Why not B?>>Requesting a new certificate from the shared account is not recommended because the certificate is needed for an application that resides in the development account. While the shared account manages the DNS, ACM certificates are intended to be managed within the account that hosts the application for the ease of reference and administration.
upvoted 1 times
...
...
siheom
4 months ago
Selected Answer: C
VOTE C
upvoted 4 times
...
getadroit
4 months, 1 week ago
Option C
upvoted 1 times
...
AMEJack
5 months, 3 weeks ago
Selected Answer: B
For customers who are using Amazon Route 53 DNS to manage DNS records, the ACM console can add records to your DNS configuration for you when you request a certificate. Your Route 53 DNS hosted zone for your domain must be configured in the same AWS account as the one you are making the request from, and you must have sufficient permissions to make a change to your Amazon Route 53 configuration.
upvoted 2 times
Aamee
3 months, 1 week ago
so u saying to request for a new Cert. using Shared account then if you opt for option B here?
upvoted 1 times
robotgeek
1 week, 1 day ago
The problem here is what you understand with "from"
upvoted 1 times
...
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago