CEH Wireless, IoT and Cloud Security Practice Question
You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?
⚠ Common exam trap
The trap here is that candidates may focus on encryption or logging as a quick fix, but the most critical and immediate action is to close the direct public network access to the database, as encryption and logging do not prevent an active attacker from connecting and stealing data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.
The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.
Why this is correct
The 0.0.0.0/0 rule allows any IP address on the internet to attempt a connection to the database on the specified port (3306 for MySQL/MariaDB), representing a critical security vulnerability. By replacing it with a rule that permits inbound traffic only from the security group associated with the application servers, access is tightly controlled and limited to legitimate, internal components. This effectively eliminates the public exposure and directly addresses the network access vulnerability, adhering to the principle of least privilege.
- ✗
Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.
Why it's wrong here
While enabling RDS Enhanced Monitoring and logging connections is a valuable practice for auditing, performance analysis, and forensic investigations, it is a reactive measure. It records who connects or attempts to connect to the database but does not prevent unauthorized access attempts from occurring in the first place. The fundamental security flaw of an open port to the internet remains unaddressed, leaving the database vulnerable to brute-force attacks or exploits.
- ✗
Enable deletion protection on the RDS instance to prevent accidental removal.
Why it's wrong here
Deletion protection is a crucial operational safeguard designed to prevent an Amazon RDS instance from being accidentally or maliciously terminated, ensuring business continuity by protecting the database resource itself. However, it has no bearing on the network accessibility or security posture of the database. It does not modify inbound rules or restrict who can connect to the instance, thus failing to address the open port vulnerability.
- ✗
Enable encryption at rest for the RDS instance using AWS KMS.
Why it's wrong here
Encryption at rest, utilizing AWS Key Management Service (KMS), is an essential security control that protects data stored on the database's underlying storage volumes from unauthorized access if the physical storage is compromised. While vital for data confidentiality, it does not prevent unauthorized network connections to the database instance itself. The database port remains openly accessible to the internet, allowing potential attackers to attempt to connect and interact with the database, even if the data is encrypted on disk.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.