A company recently deployed a new application that runs on a group of Amazon EC2 Linux instances in a VPC. In a peered VPC, the company launched an EC2 Linux instance that serves as bastion host. The security group of the application instances allows access only on TCP port 22 from the private IP of the bastion host. The security group of the bastion host allows access to TCP port 22 from 0.0.0.0/0 so that system administrators can use SSH to remotely log in to the application instances from several branch offices.While looking through operating system logs on the bastion host, a cloud engineer notices thousands of failed SSH logins to the bastion host from locations around the world. The cloud engineer wants to change how remote access is granted to the application instances and wants to meet the following requirements:

Eliminate brute-force SSH login attempts

Retain a log of commands run during an SSH session

Retain the ability to forward ports

Which solution meets these requirements for remote access to the application instances?

Question

A company recently deployed a new application that runs on a group of Amazon EC2 Linux instances in a VPC. In a peered VPC, the company launched an EC2 Linux instance that serves as bastion host. The security group of the application instances allows access only on TCP port 22 from the private IP of the bastion host. The security group of the bastion host allows access to TCP port 22 from 0.0.0.0/0 so that system administrators can use SSH to remotely log in to the application instances from several branch offices.While looking through operating system logs on the bastion host, a cloud engineer notices thousands of failed SSH logins to the bastion host from locations around the world. The cloud engineer wants to change how remote access is granted to the application instances and wants to meet the following requirements:

Eliminate brute-force SSH login attempts
Retain a log of commands run during an SSH session
Retain the ability to forward ports

Which solution meets these requirements for remote access to the application instances?

Accepted Answer

A. Configure the application instances to communicate with AWS Systems Manager

Answer

B. Update the security group of the bastion host to allow traffic from only the public IP addresses of

Answer

C. Configure an AWS Client VPN endpoint and Provision each system administrator wit a certificate

Answer

D. Configure the application instances to communicate with AWS Systems Manager.

A company recently deployed a new application that runs on a group of Amazon EC2 Linux instances in a VPC. In a peered VPC, the company launched an EC2 Linux instance that serves as bastion host…

Question

Options

How the community answered

Explanation

Community Discussion