Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics firm runs internal applications on EC2 instances in private subnets. Today, contractors reach them through a bastion host that uses shared SSH keys and an open inbound port 22. The security team wants to remove the bastion and the open port.
Each engineer must sign in with a personal identity, and every shell session must be recorded and kept for seven years in a central location. Engineers must reach only the instances tagged for their team, and access must be granted and removed from one place.
Which solution meets these requirements?
Choose one answer.
AA. Keep the bastion, replace the shared keys with one key for each engineer, and restrict port 22 on the bastion to the company office addresses, so that access is traced to each person.
BB. Use EC2 Instance Connect to push a temporary key for each SSH session, and rely on the CloudTrail records of each key push as the audit trail for later review of every engineer.
CC. Close port 22 and use Session Manager through the SSM Agent, with IAM Identity Center permission sets limited to each team's tagged instances and session logs kept in a central S3 bucket.
DD. Give each engineer a VPN into the VPC with full network access, and enable VPC flow logs on the subnets to keep a record of the sessions for later review.
Show the answer and explanation
Answer: C
A. Wrong: This keeps an inbound port and a bastion to patch, and it does not record shell sessions. Personal keys help with attribution, but the requirement to record every session is not met.
B. Wrong: Temporary keys are a good step, but CloudTrail records the key push, not the commands typed in the shell. The requirement to record and keep the session content is not met.
C. Right: Correct. Sessions go out through the agent, so no inbound port is needed, and each engineer signs in with a personal identity. The tag-based permission sets and central session logs meet the recording and access rules, and the bastion can be removed. Learn more: AWS Systems Manager Session Manager (opens in a new tab)
D. Wrong: Flow logs record connection metadata, not the content of shell sessions. Full network access also lets engineers reach every instance, which breaks the team tag limit.
Explanation
Session Manager reaches instances through the SSM Agent, so no inbound port or bastion is needed. Identity Center gives each engineer a personal sign-in, tag-based permissions limit the instances, and session logs are kept centrally. Shared or per-engineer keys, temporary keys and flow logs each miss a stated requirement.
Want more on Secure administrative access (Session Manager, EC2 Instance Connect)? The 5 full-length practice sets have 5 more Secure administrative access (Session Manager, EC2 Instance Connect) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →