A company runs thousands of Amazon EC2 instances that are based on the Amazon Linux 2 Amazon Machine Image (AMI). A SysOps administrator must implement a solution to record commands and output from…

Question

Options

• AConfigure command session logging on each EC2 instance. Configure the unified Amazon
• BRequire all users to use a central bastion host when they need command line access to an EC2
• CRequire all users to use AWS Systems Manager Session Manager when they need command
• DConfigure command session logging on each EC2 instance. Require all users to use AWS

• A
  14% (6)
• B
  5% (2)
• C
  74% (31)
• D
  7% (3)

Explanation

Option C is correct because AWS Systems Manager Session Manager provides a fully managed, centralized solution: it logs all session activity (commands + output) directly to Amazon S3 and/or CloudWatch Logs without any per-instance configuration, and CloudWatch Logs enables automated alarms and SNS notifications out of the box - satisfying all three requirements with minimal overhead.

Why the distractors fall short:

• Option A requires manually configuring logging on each of the thousands of instances - operationally expensive at scale and error-prone.
• Option B (bastion host) centralizes access but does not inherently record session output or integrate with CloudWatch for automated alarms; it also introduces a single point of failure you must maintain.
• Option D combines per-instance configuration with Session Manager - the manual per-instance setup is redundant since Session Manager already handles logging centrally, making it less efficient than pure Session Manager.

Memory tip: Think of Session Manager as "SSH without the ops burden" - no open ports, no key management, no bastion hosts, and built-in CloudWatch integration. Whenever an AWS exam question asks for durable logging + automated alarms + least operational overhead on EC2 sessions, Session Manager is the answer.

No community discussion yet for this question.