An application team wants to use AWS Certificate Manager (ACM) to request public certificates for encrypting data in transit. The team will use an AWS managed distribution and caching service to improve performance for customers, with one primary custom domain and multiple alternate domain names. The domains are not hosted in Amazon Route 53. Certificates must automatically renew indefinitely. Which combination of steps should the team take? (Choose three.)

For certificates used with Amazon CloudFront, ACM certificates must be requested in the us-east-1 (N. Virginia) region. This is a hard requirement for CloudFront. DNS validation is the recommended method for ACM certificates as it allows for automatic renewal without manual intervention, which is crucial for indefinite renewal. It involves adding a CNAME record to your domain's DNS configuration, proving ownership. CloudFront is the AWS managed distribution and caching service mentioned. When configuring CloudFront, you specify the primary domain and any alternate domain names (CNAMEs) that the certificate covers, and then associate the ACM certificate for TLS termination. Incorrect options: Requesting a certificate in us-west-2 is incorrect because CloudFront requires certificates to be in us-east-1. Email validation requires manual approval, which does not support indefinite automatic renewal. Creating an Application Load Balancer is not the correct service for a global caching layer; CloudFront is.