Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Amazon SOA-C03 Exam - Topic 4 Question 10 Discussion

A company runs applications on Amazon EC2 instances. The company wants to ensure that SSH ports on the EC2 instances are never open. The company has enabled AWS Config and has set up the restricted-ssh AWS managed rule.A CloudOps engineer must implement a solution to remediate SSH port access for noncompliant security groups.What should the engineer do to meet this requirement with the MOST operational efficiency?
B) Configure the AWS Config rule to identify noncompliant security groups. Configure the rule to use the AWS-DisableIncomingSSHOnPort22 AWS Systems Manager Automation runbook to remediate noncompliant resources.
A) Configure the AWS Config rule to identify noncompliant security groups. Configure the rule to use the AWS-PublishSNSNotification AWS Systems Manager Automation runbook to send notifications about noncompliant resources.
C) Make an AWS Config API call to search for noncompliant security groups. Disable SSH access for noncompliant security groups by using a Deny rule.
D) Configure the AWS Config rule to identify noncompliant security groups. Manually update each noncompliant security group to remove the Allow rule.

Amazon SOA-C03 Exam - Topic 4 Question 10 Discussion

Actual exam question for Amazon's SOA-C03 exam
Question #: 10
Topic #: 4
[All SOA-C03 Questions]

A company runs applications on Amazon EC2 instances. The company wants to ensure that SSH ports on the EC2 instances are never open. The company has enabled AWS Config and has set up the restricted-ssh AWS managed rule.

A CloudOps engineer must implement a solution to remediate SSH port access for noncompliant security groups.

What should the engineer do to meet this requirement with the MOST operational efficiency?

Show Suggested Answer Hide Answer
Suggested Answer: B

The AWS Cloud Operations and Governance documentation specifies that AWS Config can be paired with AWS Systems Manager Automation runbooks for automatic remediation of noncompliant resources.

For SSH restrictions, the restricted-ssh managed rule detects any security group allowing inbound traffic on port 22. To automatically remediate these findings, AWS provides the AWS-DisableIncomingSSHOnPort22 runbook. This runbook programmatically removes inbound rules that allow port 22 traffic from affected security groups.

This approach achieves continuous compliance with minimal human intervention. By contrast, sending notifications (Option A) does not enforce remediation, API-based scripts (Option C) add operational overhead, and manual remediation (Option D) violates automation best practices.

Therefore, the most efficient CloudOps solution is Option B, using AWS Config with the AWS-DisableIncomingSSHOnPort22 automation runbook for automatic, scalable enforcement.


by Amina at Mar 05, 2026, 06:56 PM

Limited Time Offer

25%

Off

Get Premium SOA-C03 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Patrick
24 days ago
C sounds too manual, not efficient at all.
upvoted 0 times
...
Isidra
29 days ago
I disagree, A is better for notifications first.
upvoted 0 times
...
Kenneth
1 month ago
Option B seems like the best choice for automation.
upvoted 0 times
...
Alba
1 month ago
D is way too much work, no way that's efficient!
upvoted 0 times
...
Virgina
1 month ago
Wait, can we really automate SSH port disabling like that?
upvoted 0 times
...
Judy
2 months ago
C sounds too manual, not efficient at all.
upvoted 0 times
...
Socorro
2 months ago
I disagree, A is better for notifications first.
upvoted 0 times
...
Delmy
2 months ago
Option B seems like the best choice for automating the fix.
upvoted 0 times
...
Tammara
2 months ago
I feel like manually updating each security group in option D would be too time-consuming. I think we should focus on automation for efficiency.
upvoted 0 times
...
Justine
2 months ago
I’m a bit confused about the difference between the AWS Systems Manager runbooks. Is the DisableIncomingSSHOnPort22 the one we should use here?
upvoted 0 times
...
Paris
3 months ago
I think option B sounds familiar because we practiced a similar question about automating compliance checks. It seems like the most efficient way to handle noncompliant security groups.
upvoted 0 times
...
Fanny
3 months ago
I remember we discussed AWS Config rules in class, but I'm not sure which automation runbook is the best for this specific case.
upvoted 0 times
...

Save Cancel