SCS-C03 · Question #128
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements: - No remote access…
The correct answer is C. Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy. AWS Systems Manager Session Manager provides secure, auditable, and portless access to EC2 instances. According to the AWS Certified Security - Specialty Study Guide, Session Manager allows administrators to connect to instances without opening inbound SSH or RDP ports, fully…
Question
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements:
- No remote access management ports to the EC2 instances can be exposed
internally or externally.
- All remote session activity must be recorded in an audit log.
- All remote access to the EC2 instances must be authenticated and
authorized by AWS IAM Identity Center. The company's DevOps team occasionally needs to connect to one of the EC2 instances to troubleshoot issues. Which solution will provide remote access to the EC2 instances while meeting the compliance requirements?
Options
- AGrant access to the EC2 serial console at the account level.
- BEnable EC2 Instance Connect and configure security group rules.
- CAssign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy
- DUse AWS Systems Manager Automation runbooks to open remote access ports.
How the community answered
(43 responses)- A9% (4)
- B2% (1)
- C81% (35)
- D7% (3)
Explanation
AWS Systems Manager Session Manager provides secure, auditable, and portless access to EC2 instances. According to the AWS Certified Security - Specialty Study Guide, Session Manager allows administrators to connect to instances without opening inbound SSH or RDP ports, fully satisfying strict compliance requirements. Session Manager integrates directly with AWS IAM Identity Center, ensuring that all access is authenticated and authorized using centralized identity management. Additionally, Session Manager automatically records session activity and can send logs to Amazon CloudWatch Logs or Amazon S3, providing a complete audit trail of all commands executed during a session.
Topics
Community Discussion
No community discussion yet for this question.