ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam
Go to Exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 82 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03
Question #: 82
Topic #: 1
[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company hosts its web applications in the AWS Cloud. The company configures Elastic Load Balancers to use certificates that are imported into AWS Certificate Manager (ACM). The company's security team must be notified 30 days before the expiration of each certificate.
What should a solutions architect recommend to meet this requirement?

  • A. Add a rule in ACM to publish a custom message to an Amazon Simple Notification Service (Amazon SNS) topic every day, beginning 30 days before any certificate will expire.
  • B. Create an AWS Config rule that checks for certificates that will expire within 30 days. Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when AWS Config reports a noncompliant resource.
  • C. Use AWS Trusted Advisor to check for certificates that will expire within 30 days. Create an Amazon CloudWatch alarm that is based on Trusted Advisor metrics for check status changes. Configure the alarm to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS).
  • D. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to detect any certificates that will expire within 30 days. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS).
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by Moonus at Oct. 16, 2022, 10:41 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
LeGloupier
Highly Voted 2 years, 2 months ago
B AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)
upvoted 84 times
824c449
8 months ago
It does not have a built-in rule for checking the expiration of ACM certificates directly.
upvoted 2 times
...
LeGloupier
2 years, 2 months ago
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
upvoted 14 times
...
ChrisG1454
1 year, 9 months ago
Answer B and answer D are possible according to this article. So, need to read B & D carefully to determine the most suitable answer. Reference: https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
upvoted 9 times
Bayebrymo
8 months ago
But from the link shared. It doesnt state that you should invoke lambda function as stated in option D. Option B is explicitly stated in the article as also worded in option B. So i think B should be the answer. My thought though. i stand to be corrected.
upvoted 7 times
...
TTaws
1 year, 5 months ago
Its B, simply because in option D - event bridge cannot "detect" anything.
upvoted 9 times
RupeC
1 year, 5 months ago
My understanding is that the ACM sends a Cert Expiration event to EventBridge. Thus EB. does not need to detect anything.
upvoted 3 times
pentium75
1 year ago
"ACM sends a Cert Expiration event to EventBridge" yes, but 45 (not 30) days before expiration.
upvoted 2 times
mrkmtei
8 months, 3 weeks ago
This can be configured to whatever you need in the Days to expiry box
upvoted 2 times
...
...
...
darekw
1 year, 4 months ago
AWS Certificate Manager (ACM) now publishes certificate metrics and events through Amazon CloudWatch and Amazon EventBridge. https://aws.amazon.com/about-aws/whats-new/2021/03/aws-certificate-manager-provides-certificate-expiry-monitoring-through-amazon-cloudwatch/
upvoted 4 times
...
...
...
Mia2009687
1 year, 5 months ago
B costs more than D To get a notification that your certificate is about to expire, use one of the following methods: Use the ACM API in Amazon EventBridge to configure the ACM Certificate Approaching Expiration event. Create a custom EventBridge rule to receive email notifications when certificates are nearing the expiration date. Use AWS Config to check for certificates that are nearing the expiration date. If you use AWS Config for this resolution, then be aware of the following: Before you set up the AWS Config rule, create the Amazon Simple Notification Service (Amazon SNS) topic and EventBridge rule. This makes sure that all non-compliant certificates invoke a notification before the expiration date. Activating AWS Config incurs an additional cost based on usage. For more information, see AWS Config pricing. https://repost.aws/knowledge-center/acm-certificate-expiration
upvoted 4 times
pentium75
11 months, 4 weeks ago
Nobody asked for cost optimization.
upvoted 9 times
...
...
...
ManoAni
Highly Voted 2 years, 2 months ago
Selected Answer: B
https://aws.amazon.com/premiumsupport/knowledge-center/acm-certificate-expiration/
upvoted 17 times
...
hilker1983
Most Recent 6 days, 15 hours ago
Selected Answer: D
Option D provides a reliable, automated, and straightforward solution that directly integrates ACM events, EventBridge, Lambda, and SNS for timely notifications.
upvoted 1 times
...
dipenich
2 weeks, 1 day ago
Selected Answer: D
EventBridge for Monitoring Expiration: EventBridge can detect certificate expiration events in ACM automatically, including those 30 days before expiration. Custom Notifications via Lambda and SNS: A Lambda function processes the detected event and formats a custom alert. This alert is sent through Amazon SNS to notify the security team.
upvoted 1 times
...
Tjazz04
2 weeks, 4 days ago
Selected Answer: B
Based on Copilot: Here's a summary of why Option B is the best choice for notifying the security team about expiring certificates: AWS Config: Continuously monitors and evaluates the compliance of AWS resources, including ACM certificates. EventBridge Integration: Automatically triggers alerts when AWS Config detects a noncompliant resource, such as an expiring certificate. Amazon SNS: Sends notifications to the security team, ensuring timely alerts 30 days before expiration. Option B is more integrated, reliable, and easier to manage compared to Options C and D, which involve more complexity and maintenance.
upvoted 1 times
...
Penjerla
2 weeks, 6 days ago
Selected Answer: B
Another reason it is not D. EventBridge event can by itself publish to SNS without invoking a lambda function
upvoted 1 times
...
EllenLiu
2 weeks, 6 days ago
Selected Answer: B
AWS config has a build-in rule 'acm-certificate-expiration-check' which can be used to Checks whether ACM Certificates in your account are marked for expiration within the specified number of days. Certificates provided by ACM are automatically renewed. ACM does not automatically renew certificates that you import.
upvoted 1 times
...
ddewit
1 month ago
Selected Answer: D
A. ACM does not support custom rules for notifications. Notifications are published via EventBridge, not directly to SNS or based on custom conditions like "30 days before expiration." B. AWS Config is better suited for compliance checks, not continuous monitoring of certificate expiration. Creating a custom rule for this purpose would be unnecessarily complex. C. Trusted Advisor does not monitor certificate expiration, and CloudWatch alarms are not applicable for this use case.
upvoted 4 times
...
Carlini2020
1 month, 2 weeks ago
Selected Answer: D
D is the one
upvoted 1 times
...
gebre.2006.refael
2 months, 1 week ago
D- because it notified 30 days BEFORE the expiration of each certificate
upvoted 1 times
...
ondan
2 months, 2 weeks ago
Selected Answer: D
The first of the two options I describe is to use the ACM built-in Certificate Expiration event, which is raised through Amazon EventBridge, to invoke a Lambda function. In this option, the function is configured to publish the result as a finding in Security Hub, and also as an SNS topic used for email subscriptions. As a result, an administrator can be notified of a specific expiring certificate, or an IT service management (ITSM) system can automatically open a case or incident through email or SNS.
upvoted 4 times
...
Tsige
2 months, 3 weeks ago
Answer is D. Operational Overhead: Using AWS Config for this purpose might add unnecessary operational overhead, as it involves additional configuration and management steps compared to a more direct EventBridge and Lambda setup.
upvoted 1 times
...
aturret
2 months, 3 weeks ago
Selected Answer: D
D
upvoted 1 times
...
tonybuivannghia
3 months, 1 week ago
Selected Answer: B
I think B is correct
upvoted 1 times
...
PaulGa
3 months, 2 weeks ago
Selected Answer: D
Ans D - I must admit it wasn't clear until I read... "zhaoxiaobing101" (1 week, 5 days ago): "AWS Config is primarily designed for compliance monitoring rather than straightforward event detection like certificate expiration. It requires setting up compliance rules and monitoring them, which adds complexity. By focusing directly on the task at hand, D minimizes operational overhead and simplifies the architecture, making it the better choice for the specific requirement of monitoring and alerting on certificate expiration."
upvoted 3 times
...
zhaoxiaobing101
3 months, 4 weeks ago
Selected Answer: D
AWS Config is primarily designed for compliance monitoring rather than straightforward event detection like certificate expiration. It requires setting up compliance rules and monitoring them, which adds complexity. By focusing directly on the task at hand, D minimizes operational overhead and simplifies the architecture, making it the better choice for the specific requirement of monitoring and alerting on certificate expiration.
upvoted 1 times
...
rpmaws
4 months, 1 week ago
Selected Answer: D
AWS config dont have capacity to check expiration
upvoted 1 times
...
Load full discussion...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago