SCS-C02 Management and Security Governance Practice Question

Exhibit

Refer to the exhibit.

Resources:
  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890
      InstanceType: t2.micro
      SecurityGroupIds:
        - !Ref MySecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 100
            Encrypted: false
  MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

Refer to the exhibit. A company uses this CloudFormation template. What security best practice is being violated?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The security group allows SSH access from all IP addresses.

The security group allows SSH access from all IP addresses (0.0.0.0/0), which is a significant security risk that exposes the instance to unauthorized access. Option A is wrong because the instance type is a performance consideration, not a security best practice. Option C is wrong because specifying the AMI ID as a parameter is not a security requirement; it is a parameterization best practice but not security-related. Option D is wrong because while encryption is a security best practice, the most critical violation here is the open SSH access, as it directly exposes the instance to potential attacks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The instance type is too small for production workloads.
Why it's wrong here
Instance type is a capacity and performance choice, not a security control. Even if the instance is undersized, it would cause latency or outage issues, but it does not change the network exposure or data protection posture. Therefore, it cannot be the security violation this question is targeting.
✓
The security group allows SSH access from all IP addresses.
Why this is correct
Allowing SSH (port 22) from 0.0.0.0/0 in the security group exposes the instance's administration interface to the entire internet, enabling brute-force attacks, credential stuffing, and potential unauthorized access. This directly violates the principle of least privilege and is a well-known high-severity misconfiguration, making it the most immediate security risk in the template.
✗
The AMI ID is not specified as a parameter.
Why it's wrong here
Specifying the AMI ID directly in the template rather than as a parameter affects reusability and may break deployments if the AMI is updated or region-specific, but it does not expose resources to attackers. It is a maintainability issue, not a security control, so it is not the correct answer to a security-focused question.
✗
The EBS volume is not encrypted.
Why it's wrong here
While encrypting EBS volumes is a recommended security best practice to protect data at rest, its absence is not an immediate, publicly exploitable vulnerability in the way an open SSH port is. Encryption failures could lead to data exposure if a snapshot is stolen, but the open SSH rule presents a direct path for external access, so this option is less severe than the correct answer.

Go deeper

SCS-C02 Management and Security Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question