A company wants to serve HTTPS traffic through an Application Load Balancer using a publicly trusted certificate that is provisioned and renewed automatically at no cost. Which service should provide the certificate?
A.AWS Certificate Manager (ACM)
Correct. ACM issues free public certs and handles renewal and deployment to the ALB.
B.AWS KMS
KMS manages encryption keys, not TLS certificates for load balancers.
C.A self-signed certificate generated on an EC2 instance
Self-signed certificates are not publicly trusted and require manual renewal.
D.AWS Secrets Manager
Secrets Manager stores secrets, it does not issue certificates.
Why this answer
ACM provisions public TLS certificates at no cost and renews them automatically. Certificates integrate directly with ALBs, CloudFront, API Gateway, and other services.
Correct answer: A · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption