SAA-C03 Design Secure Architectures Practice Question
A team wants to remove a bastion host used for administrative access to EC2 instances in private subnets. The instances should be reachable only for occasional troubleshooting by engineers who authenticate with AWS SSO. What is the best secure alternative within AWS, assuming the instances already have an instance profile attached?
⚠ Common exam trap
Many candidates think a bastion host is required for private subnet access, or they mistakenly believe that opening inbound ports (even with IP restrictions) is an acceptable alternative, failing to recognize that AWS Systems Manager Session Manager provides a fully managed, agent-based, port-free solution that aligns with the principle of least privilege and removes the bastion host entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager Session Manager, enabling the required SSM permissions in the instance profile and restricting access to engineers via IAM.
AWS Systems Manager Session Manager provides secure, auditable, agent-based access to EC2 instances without requiring a bastion host, open inbound ports, or SSH keys. By enabling the required SSM permissions (e.g., AmazonSSMManagedInstanceCore) in the instance profile and using IAM policies to restrict access to authenticated engineers via AWS SSO, you achieve a fully managed, secure, and compliant solution. This eliminates the need for a bastion host while maintaining the ability to troubleshoot instances in private subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Systems Manager Session Manager, enabling the required SSM permissions in the instance profile and restricting access to engineers via IAM.
Why this is correct
Session Manager avoids inbound SSH from the internet by initiating interactive sessions through Systems Manager. The instance profile must allow SSM actions like StartSession, and engineers’ IAM permissions restrict who can connect. This is a commonly recommended bastion-free alternative that improves security and reduces exposed network paths.
- ✗
Keep the bastion host but move it into a private subnet; engineers can connect by using a corporate VPN into the VPC.
Why it's wrong here
A bastion host remains a high-value target and still requires controlled network access. Even if the bastion is private, inbound connectivity and SSH exposure remain. Session Manager provides a more direct elimination of the bastion as well as auditability.
When this WOULD be correct
In a scenario where the team cannot use Systems Manager (e.g., instances are in a hybrid environment without internet access or SSM Agent) and must maintain a bastion host for administrative access, placing it in a private subnet with VPN access provides secure connectivity without public exposure.
- ✗
Attach a public IP to each private instance so engineers can SSH directly and use security groups to restrict access.
Why it's wrong here
Public IPs for instances in private subnets defeat the private-subnet isolation and increase attack surface. While security groups could limit access, it’s still direct internet exposure rather than brokered, permissioned management via AWS SSM.
When this WOULD be correct
In a scenario where instances must be directly accessible from the internet for a specific application (e.g., a public web server) and security groups are used to restrict access to known IPs, and there is no requirement for SSO or session management.
- ✗
Create a security group rule that allows engineers’ source IP addresses to reach instances over RDP on port 3389.
Why it's wrong here
Allowing RDP with IP-based controls still requires a management network path and does not remove exposure. It also doesn’t align with using AWS SSO-based authentication for secure access auditing and operational workflows.
When this WOULD be correct
This option would be correct in a scenario where engineers need to access Windows EC2 instances via RDP, the instances are in a public subnet, and the company has a static, known set of source IP addresses that can be tightly controlled via security groups, with no requirement for AWS SSO integration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use AWS Systems Manager Session Manager, enabling the required SSM permissions in the instance profile and restricting access to engineers via IAM.Correct answer▾
Why this is correct
Session Manager avoids inbound SSH from the internet by initiating interactive sessions through Systems Manager. The instance profile must allow SSM actions like StartSession, and engineers’ IAM permissions restrict who can connect. This is a commonly recommended bastion-free alternative that improves security and reduces exposed network paths.
✗Keep the bastion host but move it into a private subnet; engineers can connect by using a corporate VPN into the VPC.Wrong answer — click to see why▾
Why this is wrong here
Keeping a bastion host in a private subnet with VPN access still requires managing a bastion host, which the team wants to remove, and does not leverage AWS SSO for authentication as required.
★ When this WOULD be the correct answer
In a scenario where the team cannot use Systems Manager (e.g., instances are in a hybrid environment without internet access or SSM Agent) and must maintain a bastion host for administrative access, placing it in a private subnet with VPN access provides secure connectivity without public exposure.
Why candidates choose this
Candidates may think that moving the bastion to a private subnet with VPN is a secure improvement that eliminates public exposure, but they overlook the requirement to remove the bastion host entirely and use AWS SSO authentication.
✗Attach a public IP to each private instance so engineers can SSH directly and use security groups to restrict access.Wrong answer — click to see why▾
Why this is wrong here
Attaching a public IP to private instances exposes them directly to the internet, violating security best practices. The question requires secure, occasional troubleshooting with AWS SSO, not direct public access.
★ When this WOULD be the correct answer
In a scenario where instances must be directly accessible from the internet for a specific application (e.g., a public web server) and security groups are used to restrict access to known IPs, and there is no requirement for SSO or session management.
Why candidates choose this
Candidates may think that using security groups to restrict access by IP is sufficient, overlooking the broader security risk of exposing instances to the public internet and the need for centralized access control via SSO.
✗Create a security group rule that allows engineers’ source IP addresses to reach instances over RDP on port 3389.Wrong answer — click to see why▾
Why this is wrong here
This option suggests using RDP on port 3389, but the question specifies SSH access for Linux EC2 instances, not RDP. Additionally, relying on source IP restrictions is less secure than using AWS SSO and Systems Manager Session Manager, as IP addresses can be spoofed or changed.
★ When this WOULD be the correct answer
This option would be correct in a scenario where engineers need to access Windows EC2 instances via RDP, the instances are in a public subnet, and the company has a static, known set of source IP addresses that can be tightly controlled via security groups, with no requirement for AWS SSO integration.
Why candidates choose this
Candidates may think that restricting by source IP in a security group is sufficient for security, and they might overlook that the question specifies SSH (not RDP) and requires integration with AWS SSO for authentication.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.