SCS-C02 Question 448
Select 3A company is hosting a mission-critical application on Amazon EC2 instances within a VPC. The application requires stringent access controls to ensure only authorized users can connect to the instances using SSH. The security team also wants to monitor and log all SSH access attempts to these instances for compliance purposes. Which combination of steps would meet these requirements?
- A
Use a security group to allow SSH access only from specific IP addresses.
- B
Enable AWS CloudTrail to log all SSH access attempts to the EC2 instances.
- C
Set up an IAM policy to restrict SSH access to authorized users.
- D
Deploy Systems Manager Session Manager to manage access to EC2 instances without the need for direct SSH connections.
- E
Use VPC Flow Logs to monitor and log SSH traffic to and from the EC2 instances.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet the requirements, the company needs to implement both access controls and logging mechanisms. Security Groups can restrict SSH access to specific IPs, Systems Manager Session Manager can eliminate the need for SSH while maintaining secure access, and VPC Flow Logs can provide the necessary logging of SSH traffic for compliance purposes. AWS CloudTrail and IAM policies are not directly suitable for managing or monitoring SSH connections.
- A. Correct.
Correct. Using a security group to allow SSH access only from specific IP addresses ensures that only trusted IPs can connect, adding a layer of security.
- B. Incorrect.
Incorrect. AWS CloudTrail logs API activity, but it does not directly capture SSH connection attempts, so this would not fulfill the requirement to monitor SSH access.
- C. Incorrect.
Incorrect. IAM policies manage AWS resource permissions, but they do not directly control SSH access to EC2 instances.
- D. Correct.
Correct. AWS Systems Manager Session Manager provides an alternative to SSH for managing instances securely, which aligns with the requirement for stringent access control.
- E. Correct.
Correct. VPC Flow Logs capture traffic metadata, including SSH traffic, which can be used to monitor and log access attempts.