SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disable password authentication in the '/etc/ssh/sshd_config' file.

  Why this is correct

  Password authentication is susceptible to brute-force and dictionary attacks. Disabling it ensures that access is only possible via SSH keys, which are significantly harder to compromise. This is a foundational step in securing any Linux instance against remote unauthorized login attempts, making it a mandatory practice for enterprise-grade infrastructure security.

• ✗

  Change the default SSH port from 22 to a non-standard port like 2222.

  Why it's wrong here

  Changing the port is 'security through obscurity' and does not prevent access by determined attackers who can quickly scan all ports. It provides a false sense of security while complicating management. Modern security practices focus on disabling inbound access entirely through methods like Session Manager, rather than attempting to hide services.

• ✓

  Disable root user login in the '/etc/ssh/sshd_config' file.

  Why this is correct

  Disabling direct root login prevents an attacker from having full, unprivileged access to the system immediately upon successful credential theft. Instead, users must log in as a standard user and use sudo for privilege escalation, which provides an audit trail of commands executed, significantly improving the security posture of the instance.

• ✓

  Use AWS Systems Manager Session Manager instead of SSH.

  Why this is correct

  Session Manager provides shell access to instances without requiring inbound port 22 to be open. It uses IAM for authentication and authorization, providing central management and logging of all activity. Removing the need for open SSH ports drastically reduces the attack surface, making it the gold standard for secure infrastructure access.

• ✗

  Install a third-party antivirus agent on every EC2 instance.

  Why it's wrong here

  While antivirus can be part of a defense-in-depth strategy, it does not address the fundamental issue of securing the SSH protocol itself. The priority for hardening SSH should be preventing unauthorized network access and authentication, which is achieved through configuration changes and better access management tools like AWS Systems Manager.