SAA-C03 Design Secure Architectures Practice Question
This SAA-C03 practice question tests your understanding of design secure architectures. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: session Manager provides secure, audited shell access to EC2 instances.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company hosts a image sharing application on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use? The design must avoid adding custom operational scripts.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Session Manager with the required instance role
AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection via the AWS API, eliminating the need for a bastion host or public IP. This meets the requirement of avoiding custom operational scripts because Session Manager is a fully managed service with no additional configuration beyond the agent and role.
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think a bastion host or public IP is necessary for administrative access, failing to recognize that AWS Systems Manager Session Manager provides secure, agent-based access without opening any inbound ports or requiring custom scripts.
Detailed technical explanation
How to think about this question
Session Manager leverages the AWS Systems Manager agent, which initiates an outbound HTTPS connection (port 443) to the AWS Systems Manager service endpoint. The agent uses the IAM instance role to authenticate and then receives commands via a WebSocket tunnel, allowing interactive shell sessions without any inbound firewall rules. In real-world scenarios, this is critical for compliance with security standards like PCI DSS or SOC 2, where minimizing attack surface by eliminating open management ports is a key requirement.
KKey Concepts to Remember
Session Manager provides secure, audited shell access to EC2 instances.
It operates without requiring inbound SSH or RDP ports to be open.
Instances require the SSM agent and an IAM role with `AmazonSSMManagedInstanceCore` policy.
Session Manager connections are outbound from the instance to the SSM service endpoint.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Session Manager provides secure, audited shell access to EC2 instances.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review session Manager provides secure, audited shell access to EC2 instances., then practise related SAA-C03 questions on the same topic to reinforce the concept.
The correct answer is: AWS Systems Manager Session Manager with the required instance role — AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection via the AWS API, eliminating the need for a bastion host or public IP. This meets the requirement of avoiding custom operational scripts because Session Manager is a fully managed service with no additional configuration beyond the agent and role.
What should I do if I get this SAA-C03 question wrong?
Review session Manager provides secure, audited shell access to EC2 instances., then practise related SAA-C03 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Session Manager provides secure, audited shell access to EC2 instances.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.