SCS-C02 Infrastructure Security Practice Question
A company wants to block SSH access (port 22) to all EC2 instances from the internet, but allow SSH from a specific management VPN IP range (10.0.0.0/16). Which configuration should be used?
⚠ Common exam trap
A common mix-up: candidates confuse the stateless nature of network ACLs with the stateful behavior of security groups, leading them to choose a network ACL solution (Option C) without considering the need for explicit outbound rules, or they incorrectly think security groups can deny specific IP ranges (Option D).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a security group to allow inbound SSH from 10.0.0.0/16 only.
Security groups are stateful firewalls that control inbound and outbound traffic at the instance level. By configuring a security group to allow inbound SSH (port 22) only from the management VPN IP range (10.0.0.0/16), all other inbound traffic on port 22 is implicitly denied because security groups operate on a default-deny principle. This meets the requirement to block SSH from the internet while permitting access from the specified internal range.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a security group to allow inbound SSH from 10.0.0.0/16 only.
Why this is correct
A security group acts as a stateful instance-level firewall with an implicit deny-all for inbound traffic, so configuring a rule that allows inbound TCP port 22 from only 10.0.0.0/16 satisfies the requirement. Because security groups only contain permissive rules, any SSH connection sourced outside that CIDR is automatically blocked by the default deny, without needing an explicit deny. This approach also automatically allows return traffic for established sessions due to statefulness, so no separate outbound rule is required.
- ✗
Use an IAM policy to restrict SSH access to the management IP range.
Why it's wrong here
IAM policies govern which principals can perform AWS API actions such as ec2:RunInstances or ssm:StartSession; they never filter network-layer protocols like TCP port 22. SSH access to an instance is controlled at the network level by security groups, network ACLs, or the instance's own firewall, not by IAM. Even a highly restrictive IAM policy could not prevent an internet-facing SSH connection if a security group permitted it, because IAM has no visibility into or control over packet flow.
- ✗
Configure a network ACL to allow inbound SSH from 10.0.0.0/16 and deny from 0.0.0.0/0.
Why it's wrong here
Configuring a Network ACL to allow inbound SSH from 10.0.0.0/16 and explicitly deny 0.0.0.0/0 is incorrect because Network ACLs are stateless, meaning they do not track connection state. While the inbound rules might appear to achieve the objective, the stateless nature requires explicit outbound rules for the return SSH traffic on ephemeral ports, which is not accounted for and complicates management. This option is tempting as Network ACLs provide granular, subnet-level traffic control, and are suitable for broad, stateless filtering, such as blocking all traffic from a known malicious IP range or permitting specific traffic types at the subnet boundary.
- ✗
Configure a security group to allow inbound SSH from 0.0.0.0/0 and deny from 10.0.0.0/16.
Why it's wrong here
Security group rules are always permissive and cannot express explicit deny entries; the only deny is the implicit default that applies to traffic not matched by an allow rule. Therefore, a rule allowing 0.0.0.0/0 from port 22 permits all sources, including 10.0.0.0/16, and a separate deny from 10.0.0.0/16 is both syntactically impossible and semantically overwritten. To achieve the goal, you must instead rely on the implicit deny by listing only the trusted management CIDR as an allowed source.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.