SOA-C02 Practice Question: SSM Run Command for executing scripts across a…
A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?
⚠ Common exam trap
It's easy for candidates to assume EC2 Instance Connect or a bastion host are acceptable workarounds, but both still rely on SSH (port 22), which is explicitly prohibited by the security policy, whereas SSM Run Command operates over HTTPS and fully complies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket
SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket
Why this is correct
Run Command invocations use the SSM Agent's existing outbound HTTPS connection (port 443) — no inbound rule changes are needed. The command output for each instance is stored separately in S3, allowing the team to review per-instance results. Commands can target instances by tag (e.g., Environment=production) to avoid listing all 150 instance IDs manually.
- ✗
Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script
Why it's wrong here
A bastion host still relies on SSH, and the security policy explicitly prohibits SSH for this fleet. To use this approach, the security group on each of the 150 instances would need an inbound rule allowing TCP port 22 from the bastion's security group, directly violating that policy. Additionally, orchestrating a for loop over 150 instances from a single bastion introduces non-transparent failure handling, no centralized logging, and no audit trail; Run Command avoids all of this by using the SSM Agent's outbound HTTPS connection.
- ✗
Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script
Why it's wrong here
EC2 Instance Connect pushes a temporary SSH public key to the instance metadata and then opens an SSH connection. It still uses SSH and requires port 22 to be open in the security group — violating the policy.
- ✗
Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in
Why it's wrong here
Terminating and relaunching instances is a destructive, disproportionate way to collect a configuration inventory. It causes downtime and risks losing instance store data or stateful configuration, and the replacement AMI cannot contain the inventory of the running instances because that data has not yet been captured. The correct approach is to non-disruptively execute a command in-place via SSM Run Command, which targets the existing instances with no relaunch required.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?
hard- A.Use Patch Manager to apply the script as a patch baseline.
- B.Create an Automation document and execute it.
- ✓ C.Use Run Command with a target based on the tag.
- D.Create a State Manager association with the script.
Why C: Run Command enables you to run commands on EC2 instances immediately and only once, using tags to target specific instances. Option A is incorrect because Patch Manager is designed for applying patches, not running arbitrary scripts. Option B is incorrect because Automation documents are for multi-step workflow orchestration, not simple one-time script execution. Option D is incorrect because State Manager is for recurring configurations or ensuring a desired state over time, not immediate one-time execution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.