CCSP Cloud Application Security Practice Question
Exhibit
Refer to the exhibit.
```
resource "aws_security_group" "web_sg" {
name = "web-sg"
description = "Security group for web servers"
vpc_id = aws_vpc.main.id
ingress {
description = "HTTP from VPC"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
```A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?
⚠ Common exam trap
Candidates often focus solely on ingress rules in security groups, neglecting the security risk of overly permissive egress rules, which can lead to data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict egress to specific ports.
The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a broader CIDR for ingress.
Why it's wrong here
Widening the ingress CIDR exposes the security group to additional source addresses, increasing the attack surface rather than reducing it. Narrowing ingress to specific trusted CIDRs or security group references is the change that restricts access to only required sources.
- ✓
Restrict egress to specific ports.
Why this is correct
Default security groups permit all outbound traffic, so an attacker with a foothold can exfiltrate data or reach command-and-control hosts on any port. Narrowing egress to only the ports the workload genuinely requires enforces least privilege outbound, directly satisfying the stem's demand to improve the configuration's security posture.
- ✗
Change protocol to UDP.
Why it's wrong here
Switching the protocol to UDP does not restrict who can reach the resource and may bypass stateful filtering assumptions; it neither authenticates nor narrows sources. Restricting ingress to specific trusted CIDRs or security group references is what actually limits exposure.
- ✗
Remove the ingress rule.
Why it's wrong here
Removing the ingress rule entirely may break legitimate traffic the application requires, so it is not the targeted hardening change. Restricting the rule's source CIDR to trusted ranges preserves required access while eliminating overly broad exposure.
Visual reference
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.