A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle. After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account. Which combination of steps should the developer take to meet these requirements MOST cost-effectively? (Choose two.)
Select 2 answers.
Marked answer: E
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose CE1
The cert is 10kb and not a secret so s3 is the cheapest and also for E one time change and future cert change are just s3 update
Chose AE1
In AWS, a Root CA certificate (Public CA) can be stored using either AWS Secrets Manager or AWS Certificate Manager (ACM). Secrets Manager is a secure way to store sensitive data like certificates and API keys, while ACM helps manage public and private certificates for use within AWS.
Chose AE1
beyond cost effective. AWS always recommend the secured way. in that case, it will be A and E
