SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A bastion host with SSH open to 0.0.0.0/0

  Why it's wrong here

  A bastion host with SSH open to 0.0.0.0/0 is flawed because it allows any source IP on the internet to attempt connections to the management endpoint. While key-based authentication is required, the broad exposure dramatically increases the risk of brute-forcing, protocol-level attacks, and zero-day exploits. A production design should restrict SSH to trusted IP ranges via security groups or replace direct SSH with a managed service like Session Manager.

• ✓

  AWS Systems Manager Session Manager with the required instance role

  Why this is correct

  AWS Systems Manager Session Manager is correct because it provides secure, audited shell access to the instances without requiring any inbound SSH/RDP ports or an internet-facing management interface. The EC2 instance must have the SSM Agent installed and an IAM instance role with AmazonSSMManagedInstanceCore, and a VPC endpoint or standard internet route for the agent to communicate with the AWS control plane. Each session is logged to AWS CloudTrail and can be streamed to S3 or CloudWatch, giving administrators full auditability.

• ✗

  A public Elastic IP address on each instance

  Why it's wrong here

  Assigning a public Elastic IP address to each instance is wrong because it exposes the compute resources directly to the internet, but does nothing to control or authenticate administrative access. It simply gives the instance a reachable address, which actually increases the attack surface and requires additional security group and key management. Public EIPs do not provide session auditing, identity-based authorization, or the managed access benefits expected of an administrative solution.

• ✗

  An internet gateway attached to the private subnet

  Why it's wrong here

  Attaching an internet gateway to the private subnet is incorrect because an internet gateway merely enables two-way communication with the internet for resources that have public IPs; it does not create a secure administrative path. Doing so would defeat the purpose of a private subnet, since instances could become publicly reachable, and it offers no identity control or auditing. Secure administration should use VPC endpoints to AWS Systems Manager or a managed VPN/Direct Connect, not an IGW that simply opens the subnet.

Go deeper

Related to this question