CND Network Attacks And Defense Strategies Practice Question
During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.
Cloud providers (such as AWS) utilize IMDSv2, which requires session tokens, putting an explicit protection barrier against standard SSRF attacks. Additionally, restricting outbound application network calls and using IMDSv2 limits exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade the web server operating system and apply all vendor-supplied kernel patches.
Why it's wrong here
SSRF is an application-logic flaw, not an operating system kernel vulnerability.
- ✗
Implement a traditional Layer 3 network firewall rule to block all outbound TCP traffic on port 80.
Why it's wrong here
Blocking port 80 breaks regular web browsing and application dependencies.
- ✗
Install a host-based intrusion detection system (HIDS) to monitor web application log directories.
Why it's wrong here
HIDS monitors system integrity and logs post-facto; it does not block application-layer SSRF.
- ✓
Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.
Why this is correct
IMDSv2 uses session tokens that cannot be easily spoofed via standard SSRF web request vectors.
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.