CV0-004 Security Practice Question
A cloud administrator notices that a security group rule allowing SSH (port 22) from any IP address (0.0.0.0/0) was created for a Linux server. The server is used for administrative purposes only. Which security best practice should be applied to reduce the attack surface?
⚠ Common exam trap
Watch out — candidates often confuse authentication hardening (option A) or port obfuscation (option B) with network-layer access control, failing to recognize that the most fundamental security best practice is to limit the source IP range to trusted administrative networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict the source IP address to the company's public IP range
Restricting the source IP address to the company's public IP range (option D) directly reduces the attack surface by limiting SSH access to only trusted administrative networks. This is the most effective security best practice because it prevents unauthorized external hosts from even attempting to connect to port 22, regardless of authentication method or port obscurity. In cloud environments like AWS, security group rules are stateful and evaluated before any packet reaches the instance, making source IP restriction a fundamental layer of defense.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable password authentication and use SSH keys only
Why it's wrong here
While good practice, it doesn't address the overly permissive source IP.
- ✗
Change the SSH port to a non-standard port
Why it's wrong here
Hiding the port is not a robust security control; it can be discovered by scanning.
- ✗
Add a deny rule for SSH in the network ACL
Why it's wrong here
A deny rule in NACL would block all SSH, making the server inaccessible.
- ✓
Restrict the source IP address to the company's public IP range
Why this is correct
This limits SSH access to trusted IPs only.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.