SAA-C03 Design Secure Architectures Practice Question
This SAA-C03 practice question tests your understanding of design secure architectures. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: session Manager provides secure, audited shell access to EC2 instances.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company hosts a B2B file exchange site on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use? The design must avoid adding custom operational scripts.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Session Manager with the required instance role
AWS Systems Manager Session Manager allows administrators to establish secure shell access to EC2 instances without opening inbound SSH or RDP ports, using the Systems Manager agent and an IAM instance role. This meets the requirement for no internet-exposed ports and avoids custom operational scripts because Session Manager is a fully managed AWS service.
AWS Systems Manager Session Manager with the required instance role
Why this is correct
Session Manager provides audited shell access without inbound SSH/RDP exposure.
Related concept
Session Manager provides secure, audited shell access to EC2 instances.
✗
A public Elastic IP address on each instance
Why it's wrong here
Public IPs do not provide secure administrative access by themselves.
✗
An internet gateway attached to the private subnet
Why it's wrong here
Internet gateways do not make private administration secure.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume a bastion host is the only secure way to access private instances, but AWS Systems Manager Session Manager provides a fully managed, agent-based alternative that avoids opening any inbound ports and requires no custom scripts.
Detailed technical explanation
How to think about this question
Session Manager uses the AWS Systems Manager agent running on the EC2 instance to establish a bidirectional connection via WebSocket over HTTPS (port 443) to the AWS Systems Manager service, eliminating the need for any inbound firewall rules. Under the hood, the agent polls the service for session requests, and when a session is initiated, the service sends a message to the agent to start a shell, with all traffic encrypted and logged in AWS CloudTrail. In a real-world scenario, this is critical for compliance with security standards like PCI DSS that require strict network access controls.
KKey Concepts to Remember
Session Manager provides secure, audited shell access to EC2 instances.
It requires no inbound ports (SSH/RDP) to be open on the instance security group.
SSM Agent on the instance communicates outbound to the Systems Manager service.
IAM instance profiles grant necessary permissions for Session Manager access.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Session Manager provides secure, audited shell access to EC2 instances.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review session Manager provides secure, audited shell access to EC2 instances., then practise related SAA-C03 questions on the same topic to reinforce the concept.
The correct answer is: AWS Systems Manager Session Manager with the required instance role — AWS Systems Manager Session Manager allows administrators to establish secure shell access to EC2 instances without opening inbound SSH or RDP ports, using the Systems Manager agent and an IAM instance role. This meets the requirement for no internet-exposed ports and avoids custom operational scripts because Session Manager is a fully managed AWS service.
What should I do if I get this SAA-C03 question wrong?
Review session Manager provides secure, audited shell access to EC2 instances., then practise related SAA-C03 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Session Manager provides secure, audited shell access to EC2 instances.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.