A security engineer is launching a website at example.com and needs to enforce HTTPS for all client connections. Which is a valid place to store the SSL/TLS certificate for this purpose?

AWS Certificate Manager (ACM) is the correct choice because it's a service specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and internal connected resources. For a website like example.com requiring HTTPS, ACM simplifies the entire certificate lifecycle, including renewal. Storing a custom SSL certificate in AWS Key Management Service (KMS) is incorrect because KMS is a service for managing encryption keys, not for storing and deploying SSL/TLS certificates for web servers. While KMS can protect keys, it doesn't serve certificates for HTTPS. A default SSL certificate stored in Amazon CloudFront is incorrect because while CloudFront can use SSL/TLS certificates, a "default" certificate is typically for the cloudfront.net domain, not for a custom domain like example.com. To use HTTPS with a custom domain on CloudFront, you need to provide your own certificate, usually via ACM. A default SSL certificate stored in Amazon S3 is incorrect because S3 is an object storage service and does not natively support serving HTTPS content with custom domains using certificates stored directly within S3 buckets. While S3 can host static websites, enforcing HTTPS with a custom domain typically involves CloudFront and ACM.