SAA-C03 Q681 · Networking

Question

A company has deployed a non-production Amazon EC2 instance by using an Amazon Linux AMI in a private subnet. The company wants to allow a group of developers to connect to the EC2 instance remotely by using SSH without exposing the EC2 instance to the internet. The developers must be able to connect to the EC2 instance through the AWS Management Console. Which solution will meet these requirements?

Accepted Answer

**EC2 Instance Connect Endpoint (EIC Endpoint)** is the purpose-built solution for this exact scenario. Here's why each element of option B is correct:

1. **EC2 Instance Connect Endpoint in the same subnet**: EIC Endpoint is a VPC-level resource that creates a private tunnel to reach EC2 instances in private subnets — no internet gateway, NAT gateway, or bastion host needed.

2. **Security group allows inbound on port 443**: This is a critical detail. The EIC Endpoint itself receives connections over **HTTPS (port 443)** from the AWS Management Console (or CLI). The endpoint then tunnels traffic to the EC2 instance on port 22 internally. So the **endpoint's** security group needs port 443 inbound, not port 22.

3. **AmazonEC2InstanceConnect IAM managed policy**: Developers need IAM permis

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips