CCSP Cloud Application Security Practice Question
Exhibit
Refer to the exhibit.
```
resource "aws_security_group" "web_sg" {
name = "web-sg"
description = "Security group for web servers"
vpc_id = aws_vpc.main.id
ingress {
description = "HTTP from VPC"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
```A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?
⚠ Common exam trap
Candidates often focus solely on ingress rules in security groups, neglecting the security risk of overly permissive egress rules, which can lead to data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict egress to specific ports.
The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a broader CIDR for ingress.
Why it's wrong here
Broader CIDR would reduce security.
- ✓
Restrict egress to specific ports.
Why this is correct
Restricting egress limits data exfiltration risks.
- ✗
Change protocol to UDP.
Why it's wrong here
HTTP uses TCP; change would break functionality.
- ✗
Remove the ingress rule.
Why it's wrong here
Removing ingress would block web traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.