SCS-C02 Infrastructure Security Practice Question
A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?
⚠ Common exam trap
Candidates often confuse security groups with network ACLs, assuming security groups can have explicit deny rules, when in fact only NACLs support deny rules and operate at the subnet level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.
Network ACLs (NACLs) are stateless and operate at the subnet level, allowing you to explicitly deny inbound SSH traffic from 0.0.0.0/0. This approach is more secure and scalable than security group rules because NACLs can block traffic before it reaches the instance, and they support explicit deny rules, which security groups do not. Security groups only support allow rules, so you cannot add a deny rule to block SSH traffic; you must omit the allow rule, which is less explicit and can be accidentally overridden.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.
Why it's wrong here
Security groups are stateful, resource-level firewalls that only support allow rules; you cannot create a deny rule in a security group. Traffic is implicitly denied when no allow rule matches, so attempting to add an explicit deny for port 22 is an invalid configuration. For blocking SSH you must rely on a stateless network ACL at the subnet boundary, which supports explicit deny.
- ✓
Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.
Why this is correct
A network ACL (NACL) is a stateless firewall applied at the subnet level, and it explicitly supports both allow and deny rules. By adding a deny rule for inbound TCP port 22 from 0.0.0.0/0 with a low rule number, you block all SSH traffic from any source from entering the subnet. This is the correct method because security groups cannot provide an explicit deny, and the NACL rule operates at the subnet boundary rather than at individual resources.
- ✗
Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.
Why it's wrong here
Adding an allow rule for port 22 before a deny rule in a network ACL is contradictory and likely leaves the deny rule ineffective. NACL rules are evaluated in ascending order by rule number, so if the allow rule has a lower number, SSH traffic will be permitted before the deny is ever evaluated; if the deny has a lower number, the allow rule is irrelevant. The correct approach is to use a single deny rule with a low rule number, because allowing traffic that you intend to block is a misconfiguration and violates least-privilege principles.
- ✗
Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.
Why it's wrong here
Security groups are not a VPC-level construct; they are attached directly to elastic network interfaces or resources such as EC2 instances, so you cannot apply a security group rule to the whole VPC. Additionally, security groups are allow-only and do not support explicit block or deny rules, making this option doubly invalid. To block port 22 at the VPC level, you would use a network ACL on each subnet within the VPC, not a security group.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.