hardMultiple ChoiceObjective-mapped
350-701 Practice Question: Reviews the security group rules for an EC2…
Network Topology
A security engineer reviews the security group rules for an EC2 instance. Based on the exhibit, which security concern should be addressed immediately?
⚠ Common exam trap
Cisco often tests the misconception that security groups need explicit deny rules or that allowing SSH from multiple IP ranges is automatically a security issue, when the real immediate concern is an overly permissive RDP rule from all sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RDP is allowed from all sources (0.0.0.0/0)
Allowing RDP (TCP port 3389) from 0.0.0.0/0 exposes the EC2 instance to brute-force attacks and unauthorized remote access from the entire internet. Security groups are stateful and only support allow rules, so this overly permissive ingress rule is a critical security risk that must be removed or restricted to trusted IP ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSH is allowed from the entire internet because it uses TCP port 22
Why it's wrong here
SSH is restricted to specific CIDRs, not all internet.
- ✗
There is no deny rule to block malicious traffic
Why it's wrong here
Security groups are default deny; inbound traffic not explicitly allowed is blocked, but the RDP rule still allows all.
- ✓
RDP is allowed from all sources (0.0.0.0/0)
Why this is correct
Exposing RDP to the internet is a critical security risk.
- ✗
SSH access is allowed from two separate IP ranges
Why it's wrong here
Both ranges are internal (10.0.0.0/8) and a small public range (203.0.113.0/24); this is not an immediate concern.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.