SCS-C02 Question 341
Select 2A company requires secure remote access to its Amazon EC2 instances without opening SSH or RDP ports to the internet. As the Security Engineer, how can you achieve this using AWS services?
- A
Use AWS Systems Manager Session Manager to establish sessions directly to the EC2 instances.
- B
Set up an OpenVPN server on an EC2 instance and use it for remote access.
- C
Use AWS Systems Manager Session Manager with IAM policies to control access permissions.
- D
Open the SSH port in the EC2 instance's security group and use key-based authentication.
- E
Enable EC2 Instance Connect and provide users with a temporary SSH key.
Show answer and explanation
Correct answers: A, C
Explanation
AWS Systems Manager Session Manager is a secure and auditable method for remote access to EC2 instances. It eliminates the need to open SSH or RDP ports, reducing the attack surface. By integrating with IAM policies, it provides fine-grained access control, making it the recommended solution for secure remote access in this scenario.
- A. Correct.
Correct. AWS Systems Manager Session Manager allows secure remote access to EC2 instances without the need for SSH or RDP ports to be open. It uses the AWS Management Console or AWS CLI for access.
- B. Incorrect.
Incorrect. While OpenVPN can provide secure remote access, it requires additional infrastructure and does not eliminate the need to manage SSH or RDP access directly.
- C. Correct.
Correct. AWS Systems Manager Session Manager integrates with IAM policies to provide fine-grained access control, ensuring secure and auditable connections.
- D. Incorrect.
Incorrect. Opening the SSH port exposes the EC2 instance to potential attacks, even if key-based authentication is used. This method does not align with the requirement of not opening ports to the internet.
- E. Incorrect.
Incorrect. While EC2 Instance Connect provides a way to connect using a temporary SSH key, it still requires the SSH port to be open, which violates the requirement of not opening ports to the internet.