ANS-C01 Security Group Practice Question
A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove any inbound rule that allows TCP port 22
Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an inbound rule to deny TCP port 22
Why it's wrong here
Incorrect. Security groups do not have deny rules; they only have allow rules. Traffic is denied by the absence of an allow rule.
- ✓
Remove any inbound rule that allows TCP port 22
Why this is correct
Correct. Removing the inbound allow rule for TCP port 22 implicitly blocks SSH traffic because security groups have an implicit deny for any traffic not explicitly allowed.
- ✗
Add an inbound deny rule for TCP port 22 to the network ACL
Why it's wrong here
Incorrect. This describes a network ACL rule, not a security group rule. Security groups are stateful and do not use deny rules.
- ✗
Add an outbound rule to deny TCP port 22
Why it's wrong here
Incorrect. Outbound rules control outbound traffic, not inbound. Security groups are stateful, so blocking outbound SSH would not affect inbound SSH connections.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer needs to restrict access to only the company's public IP range (203.0.113.0/24). What is the correct way to modify the security group rule?
easy- ✓ A.Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.
- B.Add a new inbound rule allowing SSH from 203.0.113.0/24 and keep the existing rule.
- C.Remove the security group rule and add a new rule to deny SSH from 0.0.0.0/0.
- D.Create a network ACL that denies SSH from 0.0.0.0/0.
Why A: The CIDR should be changed from 0.0.0.0/0 to 203.0.113.0/24. Option B is wrong because adding a second rule does not remove the open rule. Option C is wrong because security groups do not support deny rules; they are allow-only. Option D is wrong because removing the rule and adding a new deny rule is not how security groups work; security groups are allow-only.
Variation 2. A security engineer notices that a security group allows inbound SSH from 0.0.0.0/0. Which immediate action should be taken to reduce risk?
easy- ✓ A.Modify the security group inbound rule to allow SSH only from the company's public IP range
- B.Add a network ACL deny rule for SSH from 0.0.0.0/0
- C.Move the instances to a different subnet with a restrictive NACL
- D.Delete the security group and create a new one with the correct rules
Why A: The immediate action is to modify the security group inbound rule to restrict SSH access to only the company's public IP range (Option A). This reduces the attack surface by limiting exposure to trusted IPs. Option B is incorrect because adding a network ACL deny rule is not as effective since NACLs are stateless and the security group still allows inbound SSH from anywhere; also, NACLs operate at the subnet level and do not override security group rules for inbound traffic within the VPC. Option C is incorrect because moving instances to a different subnet is disruptive and does not address the current security group rule. Option D is incorrect because deleting the security group may affect running instances and is not the simplest immediate action.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.