nerdexam
Amazon

SAA-C03 · Question #801

A company needs to provide secure remote access for administrators to manage Amazon EC2 instances that are located in private subnets. The company needs a solution that uses the following…

The correct answer is A. Use AWS Systems Manager Session Manager and enable session logging to Amazon. AWS Systems Manager Session Manager provides secure, auditable access to EC2 instances in private subnets without requiring a bastion host or public IPs. It supports MFA enforcement via IAM policies and central logging of all session activity to CloudWatch Logs, minimizing…

Submitted by anna_se· Mar 4, 2026Design Secure Architectures

Question

A company needs to provide secure remote access for administrators to manage Amazon EC2 instances that are located in private subnets. The company needs a solution that uses the following specifications:

  • All shell commands and session activity are centrally logged for

auditing purposes

  • Administrators authenticate by using multi-factor authentication

(MFA)

  • Instances do not have public IP addresses and do not allow inbound

access from the internet Which solution will meet these requirements with the LEAST operational overhead?

Options

  • AUse AWS Systems Manager Session Manager and enable session logging to Amazon
  • BConfigure an EC2 Instance Connect Endpoint. Enforce IAM based MFA. Use AWS CloudTrail to
  • CInstall and configure OpenSSH with local shell history logging on each EC2 instance. Use a NAT
  • DDeploy a bastion host in a public subnet with MFA enabled SSH access. Install the CloudWatch

How the community answered

(45 responses)
  • A
    82% (37)
  • B
    9% (4)
  • C
    2% (1)
  • D
    7% (3)

Explanation

AWS Systems Manager Session Manager provides secure, auditable access to EC2 instances in private subnets without requiring a bastion host or public IPs. It supports MFA enforcement via IAM policies and central logging of all session activity to CloudWatch Logs, minimizing operational overhead.

Community Discussion

No community discussion yet for this question.

Full SAA-C03 Practice