A bank must issue private TLS certificates for internal services in eu-west-1 and us-east-1 from a bank-controlled private CA, with automatic certificate renewal and distinct trust per Region to limit blast radius. Which certificate authority design meets control, renewal, and isolation?
Select an answer to reveal the explanation.
Short Explanation
Shared trust across Regions is a single point of failure you don't want. Isolation with a separate private CA hierarchy per Region keeps a compromise from spreading everywhere.
Full Explanation
The correct design meets all three constraints together because bank-owned regional roots establish private control, regional trust anchors contain compromise to one Region, and short-lived certificates issued through ACM enable renewal without human handling for integrated load balancers and APIs. The single-root design with regional subordinates is operationally attractive and widely used for centralized governance, yet it fails isolation by concept because trust derives from one root, so root compromise or forced rotation impacts both Regions despite separate subordinates. The export-based regional hierarchy preserves control and isolation and is common for EC2-based mTLS, yet it fails renewal by concept because ACM automatic renewal applies only while the certificate remains associated with an integrated service, and once exported for host installation redeployment and restart must be orchestrated. The externally chained regional hierarchy preserves isolation and automation and is common when public trust is desired, yet it fails control by concept because the trust anchor ultimately depends on a commercial provider rather than a bank-controlled private root suitable for internal services. An exam caveat is that regional subordinates alone do not equal distinct trust, so look for separate roots when the stem explicitly demands blast-radius limitation. As a practical check, confirm in each Region a dedicated private CA ARN in the trust bundle, an ACM-managed short-lived certificate attached to the regional endpoint, and successful automatic renewal in CloudTrail and ACM validity dates.