SCS-C03 · Question #39
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application processing sensitive data. Compliance requirements include no exposed management ports, full session…
The correct answer is C. Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy. AWS Systems Manager Session Manager provides secure, auditable shell access to EC2 instances without opening inbound ports. According to AWS Certified Security - Specialty guidance, Session Manager records all session activity to CloudWatch Logs or Amazon S3 and integrates with…
Question
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application processing sensitive data. Compliance requirements include no exposed management ports, full session logging, and authentication through AWS IAM Identity Center. DevOps engineers occasionally need access for troubleshooting. hich solution will provide remote access while meeting these requirements?
Options
- AGrant access to the EC2 serial console and allow IAM role access.
- BEnable EC2 Instance Connect and configure security groups accordingly.
- CAssign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy
- DUse Systems Manager Automation to temporarily open remote access ports.
How the community answered
(40 responses)- A15% (6)
- B10% (4)
- C70% (28)
- D5% (2)
Explanation
AWS Systems Manager Session Manager provides secure, auditable shell access to EC2 instances without opening inbound ports. According to AWS Certified Security - Specialty guidance, Session Manager records all session activity to CloudWatch Logs or Amazon S3 and integrates with IAM Identity Center for centralized authentication. This solution meets all requirements: no exposed ports, full audit logging, and identity-based access control. EC2 Instance Connect and serial console access do not integrate with Identity Center and may expose management paths.
Topics
Community Discussion
No community discussion yet for this question.