Discuss Amazon SOA-C03 Exam Topic 1 Question 13

A CloudOps engineer launches an Amazon EC2 Linux instance in a public subnet. When the instance is running, the CloudOps engineer obtains the public IP address and attempts to remotely connect to the instance multiple times. However, the CloudOps engineer always receives a timeout error.

Which action will allow the CloudOps engineer to remotely connect to the instance?

AAdd a route table entry in the public subnet for the CloudOps engineer's IP address.

BAdd an outbound network ACL rule to allow TCP port 22 for the CloudOps engineer's IP address.

CModify the instance security group to allow inbound SSH traffic from the CloudOps engineer's IP address.

DModify the instance security group to allow outbound SSH traffic to the CloudOps engineer's IP address.

Suggested Answer: C

SSH access to a Linux EC2 instance requires inbound TCP port 22 to be allowed by the instance's security group from the administrator's source IP address. A timeout usually indicates that network traffic is being blocked before the SSH service can respond. Since the instance is in a public subnet and has a public IP address, the most likely missing control is an inbound security group rule. Security groups are stateful, so return traffic is automatically allowed after inbound SSH is permitted. Adding a route for the engineer's IP address is not needed because public subnets use a default route to the internet gateway. An outbound-only NACL or security group rule does not allow inbound SSH initiation. Therefore, the correct remediation is to allow inbound SSH from the engineer's public IP.

Get Premium SOA-C03 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Sergei Ivanov 11 days ago

C makes the most sense here because security groups are stateful and require inbound SSH.

Jian Zhang 24 hours ago

↳ replying to Sergei Ivanov

Makes sense, I landed on C as well.

Mica 15 days ago

Same here! Security groups are key for access.

Ozell 21 days ago

I feel confident about C. It's straightforward.

Cristal 26 days ago

Yeah, C is clear. Timeout means blocked access.

Donte 1 month ago

C is the best choice. Can't connect without allowing it.

Leonor 1 month ago

True, but inbound is crucial for connection.

Almeta 1 month ago

But what about B? Outbound rules matter too.

Gladys 2 months ago

Agreed, C makes sense. SSH needs to be allowed.

Mohammad 2 months ago

I think it's C. Security groups control inbound traffic.

Kristal 2 months ago

C is the clear answer. Can't connect without the right inbound rule!

Louvenia 2 months ago

I’m leaning towards A, but it seems less direct than C.

Valda 2 months ago

Definitely C. It's all about the right permissions.

Hollis 2 months ago

Right! If the security group blocks it, timeout errors happen.

Elbert 3 months ago

I feel like C is straightforward. Just allow SSH from my IP.

Edna 3 months ago

Option B could work too, but it's more about inbound rules.

Glenna 3 months ago

Agreed! If SSH isn't allowed, no connection.

Nakita 3 months ago

I think option C is the best choice. Security groups control inbound traffic.

Rhea 3 months ago

Is it really just a security group issue? Sounds too simple!

Shawnna 3 months ago

I thought public IPs were accessible by default?

Nicolette 4 months ago

Wait, why would you need to modify outbound rules? Seems off.

Elinore 4 months ago

Definitely option C! That's the way to go.

Tesha 4 months ago

You need to allow inbound SSH traffic for sure.

Willodean 4 months ago

I’m a bit confused about the outbound rules. I thought they were less important for connecting to an instance, so I’m leaning towards option C as well.

Cathrine 6 months ago

I practiced a similar question where modifying security groups was the key. I think option C is definitely the right choice.

Myong 6 months ago

I'm not entirely sure, but I feel like the network ACLs could be involved here too. Maybe option B?

Lauryn 6 months ago

I remember something about security groups being crucial for inbound traffic. I think option C makes the most sense.

Amazon SOA-C03 Exam - Topic 1 Question 13 Discussion