A CloudFront distribution for an eu-west-1–hosted app needs an ACM certificate for HTTPS, but the certificate won't associate with the distribution. What's the requirement?
A.The certificate must be in the same region as the app
That's the ALB rule — CloudFront is global and different.
B.CloudFront ACM certificates must be issued in us-east-1 — regardless of where the app runs
Correct. us-east-1 only for CloudFront.
C.Import the cert into every region
Multi-region import doesn't help a global service.
D.Use a self-signed certificate
Self-signed certs break browser trust.
Why this answer
CloudFront is a global service — its ACM certificates must live in us-east-1, the edge network's home region. One of the most-repeated exam traps: ALBs need same-region certs, CloudFront needs us-east-1.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security