The answer is to modify the database security group by removing the 0.0.0.0/0 inbound rule and adding a rule that allows traffic only from the application servers’ security group on port 3306. This is the most effective immediate action to fix a publicly exposed RDS database because it directly eliminates the unrestricted internet access while preserving the necessary internal communication path, enforcing the principle of least privilege. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of cloud network segmentation and security group misconfigurations, a common trap where candidates might focus on encrypting the data or patching the database first, but the priority must be closing the public exposure to prevent data exfiltration. Remember the memory tip: “Close the door before locking the safe”—stop the public access immediately, then address encryption and other hardening measures.
CEH Wireless, IoT and Cloud Security Practice Question
This CEH practice question tests your understanding of wireless, iot and cloud security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?
Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.
This restricts access to only authorized sources, closing the exposure.
B
Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.
Why wrong: Logging does not block the open port.
C
Enable deletion protection on the RDS instance to prevent accidental removal.
Why wrong: Deletion protection does not affect network access.
D
Enable encryption at rest for the RDS instance using AWS KMS.
Why wrong: Encryption protects data if accessed, but the port remains open.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.
The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.
Why this is correct
This restricts access to only authorized sources, closing the exposure.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.
Why it's wrong here
Logging does not block the open port.
✗
Enable deletion protection on the RDS instance to prevent accidental removal.
Why it's wrong here
Deletion protection does not affect network access.
✗
Enable encryption at rest for the RDS instance using AWS KMS.
Why it's wrong here
Encryption protects data if accessed, but the port remains open.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may focus on encryption or logging as a quick fix, but the most critical and immediate action is to close the direct public network access to the database, as encryption and logging do not prevent an active attacker from connecting and stealing data.
Detailed technical explanation
How to think about this question
AWS security groups act as a stateful virtual firewall at the instance level. When a security group rule allows 0.0.0.0/0 on port 3306, any host on the internet can attempt a MySQL connection. The immediate fix is to replace that rule with a reference to the application servers' security group ID, which dynamically allows traffic only from instances in that group, even if their IPs change. This is a common misconfiguration in cloud environments where default 'allow all' rules are left in place after initial setup.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CEH question in full detail.
Wireless, IoT and Cloud Security — This question tests Wireless, IoT and Cloud Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306. — The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.
What should I do if I get this CEH question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.