AWS Certified Solutions Architect – Associate (SAA-C03) — Question 85

A company recently launched Linux-based application instances on Amazon EC2 in a private subnet and launched a Linux-based bastion host on an Amazon EC2 instance in a public subnet of a VPC. A solutions architect needs to connect from the on-premises network, through the company's internet connection, to the bastion host, and to the application servers. The solutions architect must make sure that the security groups of all the EC2 instances will allow that access.
Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

Answer options

• A. Replace the current security group of the bastion host with one that only allows inbound access from the application instances.
• B. Replace the current security group of the bastion host with one that only allows inbound access from the internal IP range for the company.
• C. Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company.
• D. Replace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host.
• E. Replace the current security group of the application instances with one that allows inbound SSH access from only the public IP address of the bastion host.

Correct answer: C, D

Explanation

The correct choice C ensures that the bastion host can receive connections from the company's external IP range, which is necessary for access from the on-premises network. Choice D is also correct as it allows the application instances to accept SSH connections only from the bastion host's private IP, ensuring that only the bastion host can access them. The other options either restrict access too much or do not align with the requirement of allowing secure access through the bastion host.