ACM automatically renews the certificate when it is associated with an AWS service and the ACM CNAME remains publicly resolvable and ACM emits Amazon EventBridge or AWS Health events if it cannot validate the domain ahead of renewal are correct.

The first correct option means that for public certificates validated by DNS ACM will manage the renewal as long as the certificate is in use by a supported AWS service and the ACM validation CNAME record remains publicly resolvable. ACM will attempt to renew the certificate using the existing DNS validation without manual intervention when those conditions are met.

The second correct option explains how you are alerted when renewal cannot proceed. ACM publishes events to Amazon EventBridge and integrates with AWS Health when it cannot complete validation ahead of renewal so you can detect and remediate missing or broken DNS records before the certificate expires.

ACM sends renewal emails via Amazon SNS for DNS-validated certificates that are in service is incorrect because ACM does not rely on Amazon SNS to perform renewals and it does not use SNS as the primary renewal notification mechanism for DNS-validated certificates. Auto renewal is driven by validation state and service association rather than SNS notifications.

ACM contacts the external certificate authority to re-validate domain ownership for imported third-party certificates is incorrect because ACM cannot renew third party certificates. Certificates that were imported from external CAs must be renewed with that CA and then reimported into ACM if you want ACM to manage them.

AWS Support opens a proactive case and replaces the certificate automatically even if the validation record is missing is incorrect because ACM requires successful validation to renew certificates and AWS Support does not automatically open cases to replace certificates when validation fails. You must restore the validation record or manually replace the certificate.

Full AWS Practitioner Certification Question