ANS-C01 practice question 24 of 35

A company needs to manage Amazon EC2 instances through command line interfaces for Linux hosts and Windows hosts. The EC2 instances are deployed in…

A company needs to manage Amazon EC2 instances through command line interfaces for Linux hosts and Windows hosts. The EC2 instances are deployed in an environment in which there is no route to the internet. The company must implement role-based access control for management of the instances. The company has a standalone on-premises environment. Which approach will meet these requirements with the LEAST maintenance overhead?

Answer options

A: Set up an AWS Direct Connect connection between the on-premises environment and the VPC where the instances are deployed. Configure routing, security groups, and ACLs. Connect to the instances by using the Direct Connect connection.

B: Deploy and configure AWS Systems Manager Agent (SSM Agent) on each instance. Deploy VPC endpoints for Systems Manager Session Manager. Connect to the instances by using Session Manager. Correct answer

C: Establish an AWS Site-to-Site VPN connection between the on-premises environment and the VPC where the instances are deployed. Configure routing, security groups, and ACLs. Connect to the instances by using the Site-to-Site VPN connection.

D: Deploy an appliance to the VPC where the instances are deployed. Assign a public IP address to the appliance. Configure security groups and ACLs. Connect to the instances by using the appliance as an intermediary.

Correct Answer:

B. Deploy and configure AWS Systems Manager Agent (SSM Agent) on each instance. Deploy VPC endpoints for Systems Manager Session Manager. Connect to the instances by using Session Manager.

Explanation

AWS Systems Manager Session Manager provides secure, auditable instance management without needing to open inbound ports, manage bastion hosts, or maintain SSH keys. It uses VPC endpoints to function in private subnets with no internet access. Access control is managed through AWS IAM roles and policies, directly fulfilling the role-based access control (RBAC) requirement with minimal operational overhead. This solution avoids the complexity of managing network infrastructure like VPN/Direct Connect or bastion hosts for simple instance access.

Why Incorrect

A. Direct Connect requires significant setup and cost. It also necessitates managing SSH keys and security group rules for SSH/RDP, which increases maintenance overhead compared to Session Manager's IAM-based approach.
C. A Site-to-Site VPN, similar to Direct Connect, adds network management overhead and requires manual management of credentials (like SSH keys) and security group rules for instance access.
D. A bastion host (appliance) introduces a single point of failure and requires ongoing maintenance (patching, user management). It also adds complexity to the network architecture.

References

1. AWS Systems Manager Documentation. (n.d.). AWS Systems Manager Session Manager. AWS. Retrieved from https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html (See "Session Manager prerequisites" section which mentions VPC endpoints for instances without internet access).

2. AWS Systems Manager Documentation. (n.d.). Step 5: (Optional) Configure VPC endpoints for Systems Manager. AWS. Retrieved from https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc-endpoints.html (Section describes using endpoints to avoid internet access).

3. AWS Identity and Access Management Documentation. (n.d.). Controlling access to Session Manager. AWS. Retrieved from https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-ssm-user-permissions.html (Section details using IAM policies for RBAC).

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test