ACM - AWS Certificate Manager

Question 1

True or False: ACM lets you run a public or private CA.

Answer 1

True.

Question 2

True or False: a public ACM uses a normal chain of trust, so it doesn’t require you to configure trust on your clients.

Answer 2

True.

Question 3

True or False: a private ACM certificate requires you to configure trust on your clients.

Answer 3

True.

Question 4

Can ACM generate certificates?

Answer 4

Yes

Question 5

What two verification methods can be used when ACM generates a certificate?

Answer 5

DNS or email verification.

Question 6

Why is DNS a better verification method when generating a certificate in ACM? (two reasons)

Answer 6

1. Simplicity: If your domain is hosted with R53, ACM can auto-create the DNS verification records.
2. Auto-renewal: ACM can auto-renew certs when DNS verification records are used.

Question 7

Can ACM import certificates from other sources?

Answer 7

Yes.

Question 8

ACM can only auto-renew one source of certificates - what is it?

Answer 8

Certificates generated by ACM.

Question 9

Whose responsibility is it to renew imported certificates?

Answer 9

Your responsibility (ie. not AWS/ACM)

Question 10

In general terms, what services can ACM certs be deployed to?

Answer 10

Supported services only.

Question 11

Can ACM certs be deployed to any AWS service?

Answer 11

No. Only supported services.

Question 12

Can ACM certs be used with EC2?

Answer 12

No.

Question 13

Which screen is the EC2 configuration for ACM located on?

Answer 13

Trick question. ACM does not support deployment to EC2.

Question 14

What are two common services that ACM is used with?

Answer 14

1. CloudFront.
2. Elastic Load Balancer.

Question 15

Is ACM a global or region-based service?

Answer 15

It’s a regional service.

Question 16

When using a service such as ELB with ACM, what is the rule regarding the region that each service is in?

Answer 16

They must be in the same region.

Question 17

How is cross-region ACM use configured?

Answer 17

Trick question - you can’t. ACM and the service must be in the same region.

Question 18

Which ACM region does a global service like CloudFront use? Why is this?

Answer 18

The us-east-1 region.
Because all CloudFront Distributions are located in us-east-1.

Question 19

Does S3 use ACM?

Answer 19

No.

Question 20

How does a certificate get deployed to CloudFront Edge Locations? (two steps)

Answer 20

1. ACM deploys the certificate to the distribution.
2. The distribution then sends the cert to the Edge Locations.