Install the Application Tunnels app from the Atlassian Marketplace is the correct first step to connect a self-managed Atlassian instance through an application tunnel.

You must install the Application Tunnels app from the Atlassian Marketplace so that the tunnel components and connectors are available. The app provides the tooling and workflows that create and manage the secure tunnel and it is installed before you configure links, ports, or keys on the target server.

Configure an upstream port and add an HTTP connector is not the first step because those network and connector settings are configured after the tunneling app or agent is installed and the tunnel framework is in place. You do not begin by manually opening upstream ports before installing the tunnel software.

Create a tunneled application link to the self-hosted instance is incorrect as the initial action because creating the tunneled link depends on the Application Tunnels app being present and configured first. The application link is created once the tunnel endpoint and permissions are established.

Install the security key on the target server is not the right first action because security keys or certificates are usually part of the installation or later configuration steps for the tunnel. The required app must be installed first so the correct key generation or installation process can be followed.

Full AWS Practitioner Certification Question