CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Bastion Host on EC2

  Why it's wrong here

  A bastion host approach requires launching and maintaining a separate EC2 instance that acts as a jump box, with TCP port 22 (SSH) opened to admin CIDRs and an SSH key pair distributed to users. This creates an always-on management instance that must be patched, monitored, and protected against brute-force attacks, and it remains a standing attack surface and potential single point of failure. Systems Manager Session Manager eliminates this need by allowing shell access without any inbound security group rules or bastion infrastructure, so the correct answer focuses on the service that replaces this traditional pattern.

• ✓

  AWS Systems Manager Session Manager

  Why this is correct

  AWS Systems Manager Session Manager establishes an interactive shell through an agent-resident outbound connection to the AWS Systems Manager service, so no inbound ports need to be open on the EC2 instance nor do SSH keys or bastion hosts need to be provisioned. Access is governed by IAM policies that can restrict which users can start sessions and what actions they can perform, with session activity optionally recorded to Amazon S3 and CloudTrail for compliance and auditing. This is the only listed option that directly provides secure, auditable remote shell access to EC2 instances without exposing management ports.

• ✗

  AWS Direct Connect

  Why it's wrong here

  AWS Direct Connect is a private, dedicated network connection between an on-premises data center and an AWS VPC, usually used to reduce costs, increase bandwidth, or maintain a more consistent network path than the public internet. Although it changes the underlying transport, it does nothing to manage or secure shell access to EC2 instances; an administrator would still need to open SSH ports or deploy a bastion host in the VPC, or separately adopt a service like Systems Manager Session Manager. Therefore Direct Connect addresses network connectivity, not the remote administration concern in the question, and it does not remove the need for inbound ports or jump hosts.

• ✗

  Amazon VPC Endpoints

  Why it's wrong here

  Amazon VPC Endpoints enable private connection between a VPC and supported AWS services (for example S3 via a gateway endpoint, or Systems Manager via interface endpoints) without traffic traversing the internet, NAT, or an internet gateway. They do not, however, provide an interactive remote shell to EC2 instances; endpoints are a network path to service APIs, not a compute administration mechanism. Even if an EC2 instance can reach SSM through a VPC endpoint, the actual shell functionality still comes from Session Manager, not from the endpoint itself, so VPC Endpoints alone cannot replace SSH or bastion hosts.

Go deeper

Related to this question