SAA-C03 · Question #333
A company runs a three-tier web application in a VPC on AWS. The company deployed an Application Load Balancer (ALB) in a public subnet. The web tier and application tier Amazon EC2 instances are depl
The correct answer is B. Create an interface VPC endpoint for AWS Systems Manager Session Manager. Attach the E. Attach an AmazonSSMManagedInstanceCore AWS managed IAM policy to all the EC2 instance. AWS Systems Manager Session Manager allows secure, auditable SSH-like access to EC2 instances without the need to open SSH ports or manage bastion hosts. For this to work in a private subnet, an interface VPC endpoint is required (not a gateway endpoint). The EC2 instances must h
Question
A company runs a three-tier web application in a VPC on AWS. The company deployed an Application Load Balancer (ALB) in a public subnet. The web tier and application tier Amazon EC2 instances are deployed in a private subnet. The company uses a self-managed MySQL database that runs on EC2 instances in an isolated private subnet for the database tier. The company wants a mechanism that will give a DevOps team the ability to use SSH to access all the servers. The company also wants to have a centrally managed log of all connections made to the servers. Which combination of solutions will meet these requirements with the MOST operational efficiency? (Select TWO.)
Options
- ACreate a bastion host in the public subnet. Configure security groups in the public, private, and
- BCreate an interface VPC endpoint for AWS Systems Manager Session Manager. Attach the
- CCreate an IAM policy that grants access to AWS Systems Manager Session Manager. Attach the
- DCreate a gateway VPC endpoint for AWS Systems Manager Session Manager. Attach the
- EAttach an AmazonSSMManagedInstanceCore AWS managed IAM policy to all the EC2 instance
How the community answered
(27 responses)- A19% (5)
- B67% (18)
- C11% (3)
- D4% (1)
Explanation
AWS Systems Manager Session Manager allows secure, auditable SSH-like access to EC2 instances without the need to open SSH ports or manage bastion hosts. For this to work in a private subnet, an interface VPC endpoint is required (not a gateway endpoint). The EC2 instances must have the AmazonSSMManagedInstanceCore policy attached to their IAM roles to allow Systems Manager operations. With Session Manager, all session activity can be logged centrally to Amazon CloudWatch Logs or S3, satisfying the audit requirement and improving operational efficiency over manual SSH and bastion configurations.
Community Discussion
No community discussion yet for this question.