nerdexam
Amazon

SAA-C03 · Question #333

A company runs a three-tier web application in a VPC on AWS. The company deployed an Application Load Balancer (ALB) in a public subnet. The web tier and application tier Amazon EC2 instances are depl

The correct answer is B. Create an interface VPC endpoint for AWS Systems Manager Session Manager. Attach the E. Attach an AmazonSSMManagedInstanceCore AWS managed IAM policy to all the EC2 instance. AWS Systems Manager Session Manager allows secure, auditable SSH-like access to EC2 instances without the need to open SSH ports or manage bastion hosts. For this to work in a private subnet, an interface VPC endpoint is required (not a gateway endpoint). The EC2 instances must h

Submitted by olafpl· Mar 4, 2026Design Secure Architectures

Question

A company runs a three-tier web application in a VPC on AWS. The company deployed an Application Load Balancer (ALB) in a public subnet. The web tier and application tier Amazon EC2 instances are deployed in a private subnet. The company uses a self-managed MySQL database that runs on EC2 instances in an isolated private subnet for the database tier. The company wants a mechanism that will give a DevOps team the ability to use SSH to access all the servers. The company also wants to have a centrally managed log of all connections made to the servers. Which combination of solutions will meet these requirements with the MOST operational efficiency? (Select TWO.)

Options

  • ACreate a bastion host in the public subnet. Configure security groups in the public, private, and
  • BCreate an interface VPC endpoint for AWS Systems Manager Session Manager. Attach the
  • CCreate an IAM policy that grants access to AWS Systems Manager Session Manager. Attach the
  • DCreate a gateway VPC endpoint for AWS Systems Manager Session Manager. Attach the
  • EAttach an AmazonSSMManagedInstanceCore AWS managed IAM policy to all the EC2 instance

How the community answered

(27 responses)
  • A
    19% (5)
  • B
    67% (18)
  • C
    11% (3)
  • D
    4% (1)

Explanation

AWS Systems Manager Session Manager allows secure, auditable SSH-like access to EC2 instances without the need to open SSH ports or manage bastion hosts. For this to work in a private subnet, an interface VPC endpoint is required (not a gateway endpoint). The EC2 instances must have the AmazonSSMManagedInstanceCore policy attached to their IAM roles to allow Systems Manager operations. With Session Manager, all session activity can be logged centrally to Amazon CloudWatch Logs or S3, satisfying the audit requirement and improving operational efficiency over manual SSH and bastion configurations.

Community Discussion

No community discussion yet for this question.

Full SAA-C03 Practice