SOA-C03 · Question #152
A company runs thousands of Amazon EC2 instances that are based on the Amazon Linux 2 Amazon Machine Image (AMI). A SysOps administrator must implement a solution to record commands and output from…
The correct answer is C. Require all users to use AWS Systems Manager Session Manager when they need command. The most operationally efficient solution is C because AWS Systems Manager Session Manager is purpose-built for secure, auditable interactive access to EC2 instances at scale--without managing bastion hosts or distributing SSH keys. Session Manager can be configured to log…
Question
A company runs thousands of Amazon EC2 instances that are based on the Amazon Linux 2 Amazon Machine Image (AMI). A SysOps administrator must implement a solution to record commands and output from any user that needs an interactive session on one of the EC2 instances. The solution must log the data to a durable storage location. The solution also must provide automated notifications and alarms that are based on the log data. Which solution will meet these requirements with the MOST operational efficiency?
Options
- AConfigure command session logging on each EC2 instance. Configure the unified Amazon
- BRequire all users to use a central bastion host when they need command line access to an EC2
- CRequire all users to use AWS Systems Manager Session Manager when they need command
- DConfigure command session logging on each EC2 instance. Require all users to use AWS
How the community answered
(50 responses)- A2% (1)
- B6% (3)
- C84% (42)
- D8% (4)
Explanation
The most operationally efficient solution is C because AWS Systems Manager Session Manager is purpose-built for secure, auditable interactive access to EC2 instances at scale--without managing bastion hosts or distributing SSH keys. Session Manager can be configured to log session activity, including commands and output, to durable destinations such as Amazon CloudWatch Logs (and optionally Amazon S3). This directly satisfies the requirement to record interactive sessions and store logs durably. For automated notifications and alarms, CloudWatch Logs supports metric filters that transform matching log patterns into CloudWatch metrics. Those metrics can then drive CloudWatch alarms and notifications (for example, via Amazon SNS). This is a standard CloudOps pattern: centralize logs, derive metrics from security-relevant patterns, and alert automatically.
Topics
Community Discussion
No community discussion yet for this question.