nerdexam
Amazon

SOA-C03 · Question #41

A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems…

The correct answer is A. Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to. The question asks how to enable SSH access to a private EC2 instance without internet exposure. EC2 Instance Connect Endpoint provides a secure, managed tunnel for SSH/RDP connectivity to instances in private subnets.

Submitted by saadiq_pk· Mar 5, 2026Networking

Question

A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic. A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet. Which solution will meet this requirement?

Options

  • ACreate an EC2 Instance Connect endpoint in the private subnet. Update the security group to
  • BCreate a Systems Manager endpoint in the private subnet. Update the security group to allow
  • CCreate an EC2 Instance Connect endpoint in the public subnet. Update the security group to
  • DCreate a Systems Manager endpoint in the public subnet. Create an IAM role that has the

How the community answered

(29 responses)
  • A
    79% (23)
  • B
    3% (1)
  • C
    10% (3)
  • D
    7% (2)

Why each option

The question asks how to enable SSH access to a private EC2 instance without internet exposure. EC2 Instance Connect Endpoint provides a secure, managed tunnel for SSH/RDP connectivity to instances in private subnets.

ACreate an EC2 Instance Connect endpoint in the private subnet. Update the security group toCorrect

EC2 Instance Connect Endpoint (EIC Endpoint) must be created in the same private subnet as the target instance to establish a secure tunnel for SSH connections without requiring the instance to have a public IP or internet gateway access. The security group only needs to allow inbound SSH (port 22) from the EIC endpoint's security group, keeping the instance fully private. This solution directly satisfies SSH connectivity without internet exposure.

BCreate a Systems Manager endpoint in the private subnet. Update the security group to allow

A Systems Manager (SSM) endpoint enables Session Manager shell access over HTTPS (port 443), not SSH; while it provides private connectivity, it does not facilitate SSH protocol access as required by the question.

CCreate an EC2 Instance Connect endpoint in the public subnet. Update the security group to

An EC2 Instance Connect Endpoint placed in the public subnet cannot establish a private tunnel to an instance residing in the private subnet, as the endpoint must be in the same subnet or have direct routing to the target instance's subnet without traversing the public internet.

DCreate a Systems Manager endpoint in the public subnet. Create an IAM role that has the

A Systems Manager endpoint in the public subnet does not provide SSH connectivity, and placing it in the public subnet unnecessarily exposes the management plane; additionally, SSM Session Manager uses port 443 and does not support native SSH tunneling without additional port forwarding configuration.

Concept tested: EC2 Instance Connect Endpoint for private SSH access

Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html

Topics

#EC2 Instance Connect endpoint#private subnet#SSH access#security groups

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SOA-C03 Practice