easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A developer accidentally launched an EC2 instance…
A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (IAM deny policies) and detective/reactive controls (AWS Config, Systems Manager remediation), and the trap here is that candidates may choose a detective or reactive option because they think 'alerting' or 'auto-remediation' is sufficient, when the question explicitly asks for the 'most effective preventive control.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to developer roles that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.
IAM policies can enforce preventive controls by denying the ec2:AuthorizeSecurityGroupIngress action when the CIDR is 0.0.0.0/0, which blocks the action at the API level before any rule is created. This is a preventive control because it stops the insecure configuration from being applied, rather than detecting or remediating it after the fact. By attaching this policy to developer roles, the team ensures that even if a developer attempts to add an overly permissive SSH rule, the request is denied by AWS IAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant developers full access to EC2 and rely on training.
Why it's wrong here
Training is not a technical control and is less effective.
- ✓
Attach an IAM policy to developer roles that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.
Why this is correct
This IAM policy condition prevents the action at the time of request.
- ✗
Use AWS Systems Manager to automatically remediate open SSH rules.
Why it's wrong here
Remediation is reactive, not preventive.
- ✗
Enable AWS Config rules to detect and alert on open SSH.
Why it's wrong here
Config rules are detective, not preventive.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.