Courseiva
Cloud Application SecurityeasyMultiple ChoiceObjective-mapped

CCSP Cloud Application Security Practice Question

Exhibit

Refer to the exhibit.

```
resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Security group for web servers"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "HTTP from VPC"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
```

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

⚠ Common exam trap

Candidates often focus solely on ingress rules in security groups, neglecting the security risk of overly permissive egress rules, which can lead to data exfiltration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Restrict egress to specific ports.

The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Use a broader CIDR for ingress.

    Why it's wrong here

    Broader CIDR would reduce security.

  • Restrict egress to specific ports.

    Why this is correct

    Restricting egress limits data exfiltration risks.

  • Change protocol to UDP.

    Why it's wrong here

    HTTP uses TCP; change would break functionality.

  • Remove the ingress rule.

    Why it's wrong here

    Removing ingress would block web traffic.

Visual reference

Client Server SYN (seq=100) SYN-ACK (seq=200, ack=101) ACK (ack=201) Connection established — data transfer begins

About these practice questions

One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.