SCS-C02 Question 254
Select 2Your organization is deploying an Amazon EC2 instance to host a critical web application. As part of the security hardening process, you need to implement host-based security to protect the instance against unauthorized access and malicious activity. Which combination of actions should you take to secure the instance? (Select TWO.)
- A
Configure a host-based firewall, such as iptables or AWS Systems Manager Session Manager, to control inbound and outbound traffic.
- B
Remove unnecessary software and disable unused services running on the instance.
- C
Enable public SSH access to the instance to allow developers to troubleshoot directly if needed.
- D
Use a key pair with the default username to allow SSH access to the instance.
- E
Regularly update and patch the operating system and installed applications on the instance.
Show answer and explanation
Correct answers: A, B
Explanation
Host-based security involves measures taken directly on the instance to enhance its security posture. Configuring a host-based firewall ensures that only authorized traffic can reach the instance, while removing unnecessary software and disabling unused services reduces the attack surface. Both of these actions are essential components of a comprehensive security hardening process.
- A. Correct.
Configuring a host-based firewall is a critical step in controlling traffic to and from the instance. Tools like iptables or AWS Systems Manager Session Manager help enforce security policies at the host level.
- B. Correct.
Removing unnecessary software and disabling unused services reduces the attack surface of the EC2 instance, which is a key part of security hardening.
- C. Incorrect.
Enabling public SSH access for developers is a poor security practice. Instead, you should use more secure methods such as Systems Manager Session Manager or restrict access to specific IPs using security groups.
- D. Incorrect.
Using a key pair with a default username is insecure. AWS recommends using unique usernames and key pairs, and enforcing least privilege access.
- E. Incorrect.
While regular updates and patching are critical for security, this option pertains more to ongoing maintenance rather than initial host-based security hardening.