SOA-C03 practice question: Systems Manager for fleet operations (2 of 3)

Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A regional bank wants to remove its SSH bastion hosts. Its EC2 instances run in private subnets with no NAT gateway, and their security groups must not allow any inbound traffic. Engineers must still get interactive shell access, with each session logged to Amazon S3. The SSM Agent is already installed on the instances. Which TWO actions should a CloudOps engineer take? (Choose two.)

Choose two answers.

A. Create interface VPC endpoints for ssm, ssmmessages and ec2messages in the VPC, with private DNS turned on.
B. Allow inbound TCP port 443 from the VPC's CIDR range in the instances' security groups so that Session Manager can connect.
C. Create an EC2 Instance Connect Endpoint in the private subnets and allow SSH from it in the instances' security groups.
D. Attach an instance profile whose role includes the AmazonSSMManagedInstanceCore managed policy.
E. Create a gateway VPC endpoint for Systems Manager and add it to the private subnets' route tables.

Show the answer and explanation

Answers: A, D

A. Right: Correct. With no NAT gateway, the agent reaches Systems Manager through interface endpoints. Session Manager connections are outbound from the agent, so no inbound rules are needed. Learn more: Improve the security of EC2 instances by using VPC endpoints for Systems Manager (opens in a new tab)
B. Wrong: Session Manager does not connect inward to the instance. The agent makes outbound HTTPS connections, so no inbound rule is required. Learn more: AWS Systems Manager Session Manager (opens in a new tab)
C. Wrong: This removes the bastion host, but it needs an inbound SSH rule on the instances. The bank's rule forbids any inbound traffic. Learn more: Connect to your instances using EC2 Instance Connect Endpoint (opens in a new tab)
D. Right: Correct. The SSM Agent uses the instance's role to register with Systems Manager and open sessions. AmazonSSMManagedInstanceCore grants the core permissions it needs. Learn more: Configure instance permissions required for Systems Manager (opens in a new tab)
E. Wrong: Gateway endpoints are available only for Amazon S3 and DynamoDB. Systems Manager is reached through interface endpoints. Learn more: Gateway endpoints (opens in a new tab)

Explanation

Session Manager gives shell access with no open inbound ports, because the SSM Agent connects out to the service. The instance needs a role with AmazonSSMManagedInstanceCore and, without internet access, interface endpoints for the Systems Manager services. Session logging to S3 is then configured in Session Manager preferences, which also uses an S3 endpoint in a private VPC.

SOA-C03 practice question: Systems Manager for fleet operations (2 of 3)

Explanation

Study

Keep practicing