Examkin

Question

Difficulty: Very hardAWS Management, Governance, and Developer Tools

An organization is designing a security and administration model for a hybrid server fleet consisting of both Amazon EC2 instances and on-premises physical servers. The security team has defined the following compliance requirements:

- All interactive administrative sessions must be logged, recorded, and audited.
- No inbound ports (such as SSH port 22 or RDP port 3389) can be opened in security groups or on-premises firewalls.
- Bastion hosts must be avoided to minimize operational overhead and attack surface.
- Administrative access must be controlled strictly via AWS Identity and Access Management (IAM).

Which AWS service and feature should the operations team use to meet these requirements?

  1. AWS Systems Manager Session ManagerAnswer
  2. B
    Amazon EC2 Instance Connect
  3. C
    AWS Systems Manager Run Command
  4. D
    AWS Directory Service

Answer

AWS Systems Manager Session Manager
The correct option is AWS Systems Manager Session Manager because it is designed to manage instances and on-premises servers securely using the Systems Manager Agent. The agent communicates using outbound HTTPS connections, which eliminates the need to open inbound administrative ports (such as SSH or RDP) in security groups or local firewalls. Furthermore, Session Manager integrates with IAM for access control, logs all session details to Amazon S3 or Amazon CloudWatch Logs for auditability, and does not require bastion hosts.

Step-by-Step Solution

1
Analyze the requirements for interactive administrative session access.
Identify that the solution must provide an interactive command-line shell or terminal session for administrators.
This rules out non-interactive tools that only execute scripts or commands asynchronously.
2
Evaluate the firewall and port constraints.
Identify that the solution cannot require any open inbound ports (like SSH port 22 or RDP port 3389) on the servers.
This rules out standard SSH tools and Amazon EC2 Instance Connect, which require inbound SSH traffic to be permitted in security groups.
3
Evaluate the hybrid infrastructure requirement.
Identify that the solution must support both Amazon EC2 instances and on-premises physical servers.
This rules out EC2-specific features like Amazon EC2 Instance Connect.
4
Determine the service that supports hybrid deployments, IAM integration, session logging, and outbound-only communications.
Select AWS Systems Manager Session Manager, as the Systems Manager Agent initiates outbound connections to the Systems Manager service, bypassing the need for inbound open ports, and supports auditing and hybrid nodes.
It fulfills all security, network, auditing, and platform requirements.

Key Concept

AWS Systems Manager Session Manager secure shell and terminal access for hybrid environments without open inbound ports.
Rate this question

Topics

AWS Management, Governance, and Developer Tools

More questions from this topic