ANS-C01 Network Security, Compliance and Governance Practice Question

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer needs to restrict access to only the company's public IP range (203.0.113.0/24). What is the correct way to modify the security group rule?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.

The CIDR should be changed from 0.0.0.0/0 to 203.0.113.0/24. Option B is wrong because adding a second rule does not remove the open rule. Option C is wrong because security groups do not support deny rules; they are allow-only. Option D is wrong because removing the rule and adding a new deny rule is not how security groups work; security groups are allow-only.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.
Why this is correct
This restricts SSH access to the specified IP range.
✗
Add a new inbound rule allowing SSH from 203.0.113.0/24 and keep the existing rule.
Why it's wrong here
The open rule to 0.0.0.0/0 still exists, so access remains open to all.
✗
Remove the security group rule and add a new rule to deny SSH from 0.0.0.0/0.
Why it's wrong here
Security groups do not have deny rules; they only allow traffic.
✗
Create a network ACL that denies SSH from 0.0.0.0/0.
Why it's wrong here
NACLs are stateless and operate at subnet level; the security group still allows all traffic.

Visual reference

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question