SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Systems Manager Session Manager

  Why this is correct

  Session Manager allows for secure instance management without bastion hosts. Since it doesn't require inbound ports to be open in security groups, it significantly reduces the attack surface. All sessions are logged to CloudWatch Logs or S3, providing detailed visibility into administrative actions for compliance and security auditing.

• ✗

  Amazon EC2 Instance Connect

  Why it's wrong here

  EC2 Instance Connect simplifies SSH access by using IAM to push temporary public keys to instances, but it still requires the instance to have a public IP or a bastion host. It also requires inbound port 22 to be open in the security group, which does not meet the requirement of eliminating SSH.

• ✗

  AWS CloudShell

  Why it's wrong here

  AWS CloudShell is a browser-based shell that provides command-line access to AWS resources, but it is not used for direct terminal access to specific EC2 instances. It runs in a managed environment outside of your VPC and cannot be used as a replacement for managing your own instance fleet's operating systems.

• ✗

  AWS Directory Service

  Why it's wrong here

  AWS Directory Service allows you to connect your AWS resources with an existing Active Directory, but it does not provide the underlying transport mechanism for terminal access. While it can be used for authentication, it still relies on protocols like SSH or RDP and the associated network infrastructure to function.