DVA-C02 - Security (26% of the exam) - Section 2.6

Protect data in transit and at rest using TLS, AWS Certificate Manager and the correct choice between client-side and server-side encryption.

Protect data in transit using TLS certificates provisioned and renewed through AWS Certificate Manager, and choose between server-side and client-side encryption for data at rest based on who controls the keys. Recognise which approach places encryption responsibility with AWS versus with the application.

AWS Certificate ManagerTLSServer-side encryptionClient-side encryption

Practice question for this objective

Free sampleSecuritymedium

An internal microservice must authenticate calling clients with mutual TLS, where each client presents an X.509 certificate that the server validates against a private certificate authority the company controls. The team needs AWS to issue and manage these short-lived private client certificates without operating their own certificate authority infrastructure on servers. Which AWS approach should the developer use to issue the client certificates?

ARequest public certificates from AWS Certificate Manager for each client, since public ACM certificates are trusted by every internal service.
BUse AWS Private Certificate Authority to issue the private client certificates from a CA hierarchy the company owns and operates in AWS. Correct
CGenerate self-signed certificates on each client host and distribute the matching public keys to the server manually for trust.
DStore a shared client certificate in AWS Secrets Manager and have every client retrieve the same certificate at startup for the handshake.

AWS Private Certificate Authority issues and manages company-controlled private X.509 certificates for mutual TLS client authentication without self-managed CA servers. Mutual TLS with company-controlled client identity needs a private trust chain, which AWS Private CA provides as a managed certificate authority that issues and revokes internal X.509 certificates. Public ACM certificates establish server identity for public endpoints and cannot serve as privately issued client certificates.

Why A is wrong: Tempting because ACM issues certificates, but public ACM certificates are for server identity on public endpoints, not company-issued client certificates from a private trust chain.

Why B is correct: AWS Private CA runs a managed private CA that issues internal X.509 certificates for mutual TLS, which is exactly the use case for company-controlled client identity.

Why C is wrong: Self-signed certificates work technically but provide no managed CA, no central revocation, and no automated issuance, which the requirement explicitly asks AWS to handle.

Why D is wrong: A single shared certificate defeats per-client identity in mutual TLS, and Secrets Manager stores secrets rather than issuing or managing a certificate authority.

See more DVA-C02 practice questions, answers explained.

Exam traps in Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the DVA-C02 bank for this domain.

ACM will automatically renew the imported certificate before expiry because every certificate stored in ACM is covered by managed renewal regardless of origin.
Why it is wrong: Managed renewal applies only to certificates ACM issues, so an imported certificate is not auto-renewed even though it sits in ACM, making this statement incorrect.
Add a Lambda authorizer that inspects the request protocol and rejects any call that did not arrive over an encrypted TLS connection to the endpoint.
Why it is wrong: A Lambda authorizer evaluates identity for authorisation and adds custom code, and API Gateway already exposes only HTTPS, so building protocol-checking logic is unnecessary and misuses the authorizer.
Public ACM certificates install on EC2 once the instance role is granted the acm:GetCertificate permission to export them.
Why it is wrong: Tempting because IAM often unblocks access, but the private key of an ACM public certificate cannot be exported, so no permission enables direct installation on EC2.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.