SCS-C03 · Question #111
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements: - No remote access m
The correct answer is C. Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy. No remote access management ports exposed: Systems Manager Session Manager does not require the opening of any inbound ports on the EC2 instances, which ensures compliance with the policy that no remote management ports should be exposed internally or externally. Remote session a
Question
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements:
- No remote access management ports to the EC2 instances can be exposed
internally or externally.
- All remote session activity must be recorded in an audit log.
- All remote access to the EC2 instances must be authenticated and
authorized by AWS IAM Identity Center.
- The company's DevOps team occasionally needs to connect to one of the
EC2 instances to troubleshoot issues. Which solution will provide remote access to the EC2 instances while meeting the compliance requirements?
Options
- AGrant access to the EC2 serial console at the account level. Create an IAM policy that allows an
- BEnable EC2 instance Connect on the AMI of the EC2 instances. Configure the appropriate
- CAssign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy
- DUse AWS Systems Manager Automation runbooks to open remote access ports to the EC2
How the community answered
(47 responses)- A6% (3)
- B2% (1)
- C77% (36)
- D15% (7)
Explanation
No remote access management ports exposed: Systems Manager Session Manager does not require the opening of any inbound ports on the EC2 instances, which ensures compliance with the policy that no remote management ports should be exposed internally or externally. Remote session activity recorded in an audit log: Session Manager automatically records all session activity in AWS CloudTrail and Amazon CloudWatch Logs. This meets the requirement for audit logs of remote session activity. Authentication and authorization by AWS IAM Identity Center: With Session Manager, access to EC2 instances is managed through IAM policies, ensuring that access is authenticated and authorized using AWS IAM Identity Center (formerly known as AWS Single Sign-On).
Topics
Community Discussion
No community discussion yet for this question.