SAP-C02 Question #213: Real Exam Question with Answer & Explanation

Question

A company recently deployed a new application that runs on a group of Amazon EC2 Linux instances in a VPC. In a peered VPC, the company launched an EC2 Linux instance that serves as bastion host. The security group of the application instances allows access only on TCP port 22 from the private IP of the bastion host. The security group of the bastion host allows access to TCP port 22 from 0.0.0.0/0 so that system administrators can use SSH to remotely log in to the application instances from several branch offices.While looking through operating system logs on the bastion host, a cloud engineer notices thousands of failed SSH logins to the bastion host from locations around the world. The cloud engineer wants to change how remote access is granted to the application instances and wants to meet the following requirements: - Eliminate brute-force SSH login attempts - Retain a log of commands run during an SSH session - Retain the ability to forward ports Which solution meets these requirements for remote access to the application instances?

Options

• AConfigure the application instances to communicate with AWS Systems Manager
• BUpdate the security group of the bastion host to allow traffic from only the public IP addresses of
• CConfigure an AWS Client VPN endpoint and Provision each system administrator wit a certificate
• DConfigure the application instances to communicate with AWS Systems Manager.