ACM Integration with ALB and Route 53

ANS-C01 By islever Editorial Last updated

Design DNS solutions that meet public, private, and hybrid requirements. Design solutions that integrate load balancing to meet high availability, scalability, and security requirements.

Short answer

A Request a public ACM certificate, configure the ALB to use it, and point the Route 53 Alias A record to the ALB.

Question

A company wants to use SSL/TLS certificates that are issued by AWS Certificate Manager (ACM) to secure the company's social media web application. The application runs on backend Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to manage DNS records. The company needs to integrate ACM with the EC2 instances and Route 53.
Which solution will meet this requirement?
  1. Request a public certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the public certificate Configure the A record in Route 53 to point to the ALB alias. Correct Answer
  2. Request a private certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the private certificate. Configure the A record in Route 53 to point to the ALB domain name.
  3. Request two private certificates from ACM for the domain name that is configured in Route 53. Configure the ALB to use one private certificate. Configure the A record in Route 53 to point to the ALB alias. Configure the backend EC2 instances to use the second private certificate.
  4. Request a private certificate and a public certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the public certificate. Configure the A record in Route 53 to point to the ALB domain name. Configure the backend EC2 instances to use the private certificate.

Key Takeaways

This question tests the requirement for a public SSL/TLS certificate for a public-facing application and the proper Route 53 Alias record configuration for an ALB.

Securing a public-facing web application on AWS requires a public SSL/TLS certificate from ACM deployed on an Application Load Balancer, with Route 53 routing traffic via an Alias A record. This configuration ensures public clients trust the certificate and connect efficiently to the ALB.

Common mistake: Choosing a private certificate or attempting to apply ACM certificates directly to EC2 instances, ignoring that public certificates are required for public trust and can only be attached to load balancers or CloudFront distributions.

Expert Analysis

Why the Answer Is Correct

A social media web application is inherently public-facing, requiring a certificate issued by a publicly trusted Certificate Authority so that end-user browsers do not show security warnings. AWS Certificate Manager (ACM) public certificates are designed exactly for this purpose and can be directly associated with an Application Load Balancer (ALB). In Route 53, configuring an Alias A record to point to the ALB is the AWS best practice, as it provides highly available and cost-free routing compared to a standard CNAME record.

Why the Other Options Are Wrong

Options B and C incorrectly use private certificates on the ALB, which would cause browser trust errors for public internet clients because private certificates are signed by a private CA. Option D unnecessarily complicates the architecture by attempting to configure a private certificate on the backend EC2 instances; while private certificates can be exported for EC2, the prompt does not require end-to-end TLS encryption. Furthermore, Option D uses a standard A record pointing to the ALB domain name (acting as a CNAME) rather than the preferred Alias record, which is less efficient at the zone apex.

Community Comment Notes

As Gramterre noted, "You need to present a certificate signed by a public authority to the web application clients." This reinforces that a public ACM certificate is mandatory for a public-facing application, and the Route 53 record must point to the ALB alias.

Official Reference

https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

For public-facing applications, always select a public ACM certificate to ensure client trust. Remember that ACM public certificates cannot be directly installed on EC2 instances; they must be attached to supported services like ALB or CloudFront, which terminate the TLS connection.

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Gramterre 👍 1
    Correct answer is A. You need to present a certificate signed by a public authority to the web application clients. The route53 record should point to the ALB Alias.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Global Accelerator with private ALB: restrict access to accelerator IPs

S-grade

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide