Q44 — AWS SAA-C03 Ch.17

Question 44 of 89 | ← Chapter 17

Q1344. A company wants to use AWS Systems Manager to manage a fleet of Amazon EC2 instances. According to the company's security requirements, no EC2 instances can have internet access. A solutions architect needs to design network connectivity from the EC2 instances to Systems Manager while fulfilling this security obligation.Which solution will meet these requirements?

• A. Deploy the EC2 instances into a private subnet with no route to the internet.
• B. Configure an interface VPC endpoint for Systems Manager. Update routes to use the endpoint. ✓
• C. Deploy a NAT gateway into a public subnet. Configure private subnets with a default route to the NAT gateway.
• D. Deploy an internet gateway. Configure a network ACL to deny traffic to all destinations except Systems Manager.

Correct Answer: B. Configure an interface VPC endpoint for Systems Manager. Update routes to use the endpoint.

Explanation

The correct solution is B. Configure an interface VPC endpoint for Systems Manager. Update routes to use the endpoint.Explanation:Requirement: The EC2 instances must not have internet access but still need to communicate with AWS Systems Manager (SSM).Why Option B is correct:VPC Endpoints for Systems Manager: AWS Systems Manager supports interface VPC endpoints, which allow private connectivity to SSM services without requiring internet access. No Internet Route Needed: By using a VPC endpoint, EC2 instances in private subnets can communicate with SSM over AWS's internal network (without traversing the internet). Security Compliance: Since no internet gateway or NAT is involved, the instances remain isolated from the public internet while still accessing SSM.Why the other options are incorrect:A. Deploy the EC2 instances into a private subnet with no route to the internet. While this ensures no internet access, the instances cannot reach Systems Manager without additional configuration (like a VPC endpoint).C. Deploy a NAT gateway into a public subnet. Configure private subnets with a default route to the NAT gateway.A NAT gateway provides outbound internet access, which violates the security requirement of no internet access.D. Deploy an internet gateway. Configure a network ACL to deny traffic to all destinations except Systems Manager.An internet gateway still exposes instances to the internet, even if a network ACL restricts traffic. This is not compliant with the "no internet access" rule.Conclusion:Option B is the only solution that meets the security requirement (no internet access) while enabling communication with AWS Systems Manager via a private VPC endpoint.