mediumMultiple Choice
ISC2 CC Practice Question: During a routine security audit, an analyst finds…
During a routine security audit, an analyst finds that several critical servers have misconfigured firewall rules allowing inbound SSH access from the entire internet. Which immediate action should the analyst take?
⚠ Common exam trap
ISC2 often tests the distinction between 'documenting' a finding and taking immediate remediation for a critical vulnerability, where candidates mistakenly choose documentation over action because they confuse audit procedures with incident response priorities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the firewall rules to allow SSH only from specific management IPs
The immediate priority is to eliminate the critical vulnerability by restricting inbound SSH access to only authorized management IPs. This aligns with the principle of least privilege and the immediate remediation steps in security incident response, as leaving the misconfiguration active even briefly exposes the servers to potential compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable SSH on all servers
Why it's wrong here
Disabling SSH outright severs administrative access to the servers, so remediation cannot be performed and legitimate management traffic stops. It is tempting because closing the port eliminates the exposure, and disabling a service is valid when SSH is genuinely unused. Here the requirement is restricting inbound access to trusted sources, not removing the service.
- ✗
Notify the server owners and wait for their response
Why it's wrong here
Awaiting the owners' response leaves the exposure exploitable while the notification is processed. Notifying owners is correct for changes needing their scheduled maintenance window, but an internet-reachable SSH service on critical servers demands immediate containment.
- ✗
Document the finding and include it in the audit report
Why it's wrong here
Documenting the finding leaves the exposed SSH ports open, so the misconfiguration persists during the audit cycle. Reporting suits governance and compliance tracking, where remediation is handled separately by another team. Here the analyst must act immediately to restrict the inbound rule, since documentation alone does not close internet-facing access.
- ✓
Modify the firewall rules to allow SSH only from specific management IPs
Why this is correct
Restricting inbound SSH to known management IPs closes the internet-wide exposure immediately, satisfying the audit's demand for prompt remediation. Unlike disabling SSH entirely or merely logging, it preserves administrative access while removing the attack surface the misconfiguration created.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.