Q65 — AWS SAA-C03 Ch.17

Question 65 of 89 | ← Chapter 17

Q1365. A company needs to provide secure remote access for administrators to manage Amazon EC2 instances that are located in private subnets. The company needs a solution that uses the following specifications:All shell commands and session activity are centrally logged for auditing purposes. Administrators authenticate by using multi-factor authentication(MFA). Instances do not have public IP addresses and do not allow inbound access from the internet. Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: A. Use AWS Systems Manager Session Manager and enable session logging to Amazon CloudWatch Logs. Require IAM policies that enforce MFA. Ensure that the EC2 instances have AWS Systems Manager Agent(SSM Agent) installed.

Explanation

The correct answer is A. Use AWS Systems Manager Session Manager and enable session logging to Amazon CloudWatch Logs. Require IAM policies that enforce MFA. Ensure that the EC2 instances have AWS Systems Manager Agent (SSM Agent) installed.Explanation:The company needs a secure, auditable, and low-overhead solution for remote access to EC2 instances in private subnets with:Centralized logging of all shell commands and session activity.MFA authentication for administrators.No public IPs or direct internet access for instances.Why Option A is the Best Choice:AWS Systems Manager Session ManagerNo need for SSH keys or bastion hosts Directly connects to instances via AWS API (secure and managed).Built-in MFA enforcement Requires IAM policies with aws:MultiFactorAuthPresent condition. Centralized logging to CloudWatch Logs All session activity (commands, outputs) is automatically recorded.Works with private subnets Instances do not need public IPs or internet access. Minimal operational overhead No additional infrastructure (e.g., bastion hosts, NAT gateways) required.IAM Policies Enforce MFAAdministrators must authenticate with MFA before accessing Session Manager.Example IAM policy condition:json"Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } } Why Other Options Are Incorrect:B. Configure an EC2 Instance Connect EndpointRequires SSH Less secure than Session Manager (no native MFA enforcement for Instance Connect). CloudTrail captures API calls, not session activity Does not log shell commands (only management actions like StartSession).Higher overhead Still needs IAM policies and potentially SSH key management.C. Install OpenSSH with local logging + NAT gatewayRequires NAT gateway for outbound access Increases cost and complexity (violates "no internet access" if not strictly controlled).Local shell history logging is unreliable Can be disabled or tampered with by users. MFA at SSH level is complex Requires additional tools (e.g., Google Authenticator PAM module).D. Deploy a bastion host with CloudWatch Agent loggingHigh operational overhead Must manage, patch, and secure the bastion host. Public subnet exposure Bastion host needs a public IP (attack surface). Logging is not centralized by default Requires additional configuration for CloudWatch Agent.Comparison Table:OptionCentralized Logging (Shell Commands)?MFA EnforcementNo Public IPs/Internet Access? Operational OverheadA(CloudWatch Logs)(IAM policy)(No internet needed)Low (managed by AWS) B (Only API calls via CloudTrail) (No native MFA)(No internet needed)Moderate (SSH setup) C (Local shell history) (Complex setup) (Requires NAT)High (SSH + NAT) D (Requires CloudWatch Agent)(SSH + MFA) (Bastion in public subnet)High (Bastion management) Conclusion:Option A is the most secure, scalable, and low-overhead solution because:Session Manager is a native AWS service No additional infrastructure needed. Centralized logging and MFA are built-in No manual configuration required.Works seamlessly with private subnets No public exposure.Avoid Options B, C, and D (they introduce security risks or unnecessary complexity).Final Answer: A