hardMultiple ChoiceObjective-mapped

CCSP Least privilege Practice Question

Exhibit

Refer to the exhibit. The following is an excerpt from a cloud infrastructure configuration file (Terraform HCL):

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  user_data     = <<-EOF
              #!/bin/bash
              apt-get update
              apt-get install -y nginx
              systemctl enable nginx
              systemctl start nginx
              EOF
  vpc_security_group_ids = [aws_security_group.web_sg.id]
}

resource "aws_security_group" "web_sg" {
  name        = "web_sg"
  description = "Allow HTTP traffic"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

A cloud security engineer reviews the Terraform configuration above. Which of the following is a security best practice that has been violated?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The security group allows unrestricted inbound traffic on port 80

The security group allows unrestricted inbound traffic on port 80 from any source (0.0.0.0/0), violating the principle of least privilege. This is a common security misconfiguration that exposes the instance to unnecessary risk. Option A is incorrect because while plain text user_data is not ideal, it is not a best practice violation in the same sense; secrets should not be in user_data, but the main issue here is the overly permissive security group. Option B is incorrect because the security group does not allow SSH access, which is actually a good security practice if SSH is not needed. Option D is incorrect because using a public AMI is not inherently a violation; the security risk depends on the AMI's trustworthiness.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user_data script should not be in plain text
Why it's wrong here
The user_data script being in plain text is a concern for secrets, but the primary security violation is the unrestricted inbound traffic on port 80.
✗
The security group does not allow SSH access
Why it's wrong here
The security group not allowing SSH access is actually a security best practice if SSH is not required, not a violation.
✓
The security group allows unrestricted inbound traffic on port 80
Why this is correct
The security group allows unrestricted inbound traffic on port 80 from 0.0.0.0/0, violating the principle of least privilege.
✗
The instance uses a public AMI
Why it's wrong here
Using a public AMI is not necessarily a security best practice violation; it depends on the source and verification of the AMI.

Go deeper

CCSP Least privilege Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question