Get Your CertDOP-C02PlayCompete
‹ All DOP-C02 questions

DOP-C02 Practice Question 50: Session Manager Replaces Bastion

AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 5 · question 10 of 10

Security and Compliancehard

An audit flagged the way engineers reach production Amazon EC2 instances: two bastion hosts with a shared SSH key pair, port 22 open to the corporate CIDR, and no record of what anyone actually ran. The company now requires no inbound ports open on any instance, per-engineer access that can be granted and revoked centrally and takes effect immediately, and an encrypted transcript of every interactive session. The production instances have no public IP addresses, sit in private subnets, and have no route to the internet.

Which solution meets all of these requirements?

Select one answer
Show answer and explanation

Answer:

  • B. Use AWS Systems Manager Session Manager with per-engineer IAM policies, session logging to an encrypted Amazon S3 bucket or CloudWatch Logs log group, and interface VPC endpoints for Systems Manager so the private instances can reach the service

Session Manager "provides secure node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys." Access is "using only AWS Identity and Access Management (IAM) policies," so administrators "have a single place to grant and revoke access" and a revocation is effective on the next authorization. For the transcript, session log data can be sent to an S3 bucket or a CloudWatch Logs log group, "with or without encryption using your AWS KMS key." The no-internet constraint is handled by AWS PrivateLink: VPC endpoints for Systems Manager "limit all network traffic between your managed nodes, Systems Manager, and Amazon EC2 to the Amazon network," so SSM Agent on a private instance can reach the service without a NAT gateway.

Option A keeps the architecture the audit objected to. Port 22 is still open on the bastion hosts, so the no-inbound-ports requirement fails immediately, and per-engineer key pairs still produce no record of the commands run.

Option C changes only where the connection lands. A Network Load Balancer still forwards inbound SSH to a listening port, and VPC flow logs record source, destination, and bytes, never the commands typed in a session.

Option D is the closest wrong answer. An EC2 Instance Connect Endpoint does remove the bastion and the inbound port, but CloudTrail records the API call that established the connection, not the session content, so there is still no transcript. The NAT gateway is also unnecessary work compared with interface endpoints.

Reference: AWS Systems Manager Session Manager

Practice Test 5 ›

Study guides for DOP-C02

AWS Service Control Policies Explained: SCPs and DenialsAWS service control policies explained: how SCPs cap permissions, why admins still get access denied, inheritance, deny vs allow lists and the exam traps.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.
What Is AWS Lambda? Triggers, Concurrency and Cold StartsWhat is AWS Lambda? How functions run, cold starts, triggers vs event source mappings, concurrency, layers, aliases, pricing and the exam traps.
AWS CloudOps Engineer Associate (SOA-C03) exam guideAWS Certified CloudOps Engineer – Associate (SOA-C03) replaced SysOps Administrator. Format, cost, the five domains, what changed and how to prepare.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is Amazon EC2? Instances, AMIs, EBS and Auto ScalingAmazon EC2 explained: instances, AMIs, instance types, security groups, EBS, Auto Scaling groups and pricing options, with the traps AWS exams set.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.