mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: During a routine security audit, an analyst finds…
During a routine security audit, an analyst finds that several critical servers have misconfigured firewall rules allowing inbound SSH access from the entire internet. Which immediate action should the analyst take?
⚠ Common exam trap
ISC2 often tests the distinction between 'documenting' a finding and taking immediate remediation for a critical vulnerability, where candidates mistakenly choose documentation over action because they confuse audit procedures with incident response priorities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the firewall rules to allow SSH only from specific management IPs
The immediate priority is to eliminate the critical vulnerability by restricting inbound SSH access to only authorized management IPs. This aligns with the principle of least privilege and the immediate remediation steps in security incident response, as leaving the misconfiguration active even briefly exposes the servers to potential compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable SSH on all servers
Why it's wrong here
Disabling SSH may be too disruptive; restricting access is more balanced.
- ✗
Notify the server owners and wait for their response
Why it's wrong here
Waiting introduces risk; the analyst should take immediate action if authorized.
- ✗
Document the finding and include it in the audit report
Why it's wrong here
Documentation is important, but immediate remediation takes precedence over reporting.
- ✓
Modify the firewall rules to allow SSH only from specific management IPs
Why this is correct
This directly mitigates the vulnerability by restricting access.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.