AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 50
A SysOps Administrator needs to add SSL/TLS encryption for a website that uses an internet-facing Application Load Balancer (ALB). The Administrator is attempting to create a certificate using AWS Certificate Manager (ACM). After the request was submitted using the ALB fully qualified domain name (FQDN) it failed with the error "Domain Not Allowed."
How can the administrator fix this issue?
-
A
Submit a new request in ACM with the correct domain name rather than the ALB FQDN.
-
B
Contact AWS Support and verify the request by answering security challenge questions.
-
C
Use email validation and confirm ownership of the domain through the root account email address.
-
D
Use DNS validation and follow the instructions to add a CNAME record to the hosted zone in Amazon Route 53.
Reveal correct answer
Correct answer: A
Explanation
You must own the domain name that you register your certificate for. Also, users will not be entering the ALB FQDN in their browsers, they will be entering the domain name for the website. The Administrator must therefore submit a request to ACM using the domain name of the website. Validation can be via email or DNS. In Route 53 an Alias record can be created that maps the domain name to the ALB.
CORRECT: "Submit a new request in ACM with the correct domain name rather than the ALB FQDN" is the correct answer.
INCORRECT: "Use email validation and confirm ownership of the domain through the root account email address" is incorrect. You cannot confirm ownership for the FQDN of the ALB as this is owned by AWS.
INCORRECT: "Use DNS validation and follow the instructions to add a CNAME record to the hosted zone in Amazon Route 53" is incorrect. You cannot confirm ownership for the FQDN of the ALB as this is owned by AWS.
INCORRECT: "Contact AWS Support and verify the request by answering security challenge questions" is incorrect. This is not going to work, the Administrator needs to submit a request for the correct domain name, not the ALB FQDN.
References:
https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.html
https://aws.amazon.com/premiumsupport/knowledge-center/associate-acm-certificate-alb-nlb/
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
