AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 172

Question

A company uses an Amazon API Gateway regional REST API to host its application API. The REST API has a custom domain. The REST API's default endpoint is deactivated. The company's internal teams consume the API. The company wants to use mutual TLS between the API and the internal teams as an additional layer of authentication. Which combination of steps will meet these requirements? (Choose two.)

Accepted Answer

Correct answer: A, E. The correct answer is A, E. Option A: Use AWS Certificate Manager (ACM) to create a private certificate authority (CA). Provision a client certificate that is signed by the private CA. Option E: Upload the root private certificate authority (CA) certificate to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the private CA certificate that is stored in the S3 bucket as the trust store. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale. AWS Certificate Manager provisions and renews TLS certificates automatically.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 172