CCSP Server-Side Request Forgery (SSRF) Practice Question
A security engineer is investigating an incident where an attacker exploited a server-side request forgery (SSRF) vulnerability in a cloud application. The application runs in a cloud environment and uses internal metadata endpoints. Which mitigation should be prioritized to prevent future SSRF attacks?
⚠ Common exam trap
ISC2 often tests the misconception that input validation or WAFs are sufficient to stop SSRF, when in reality the most effective mitigation is network-layer egress filtering that blocks access to internal metadata endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict outbound network access from the application instances using network security controls
Restricting outbound network access from application instances using security groups directly prevents the application from reaching internal metadata endpoints and other internal services. This is a fundamental network-layer control that stops SSRF attacks at the source, regardless of input validation or request inspection, by blocking the outbound traffic that the attacker would exploit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement input validation to block malicious URLs
Why it's wrong here
Input validation can help filter malicious URLs but is easily bypassed and does not prevent the application from reaching internal endpoints. It is a weak defense against SSRF.
- ✓
Restrict outbound network access from the application instances using network security controls
Why this is correct
Restricting outbound network access using network security controls is the most effective mitigation as it prevents the application from initiating connections to the metadata service or other internal services.
- ✗
Deploy a web application firewall (WAF) to inspect outgoing requests
Why it's wrong here
A WAF inspects incoming traffic, not outgoing requests from the application. It does not prevent SSRF attacks where the application itself makes internal requests.
- ✗
Require token-based authentication for metadata service access
Why it's wrong here
Disabling the metadata service endpoint and enforcing token-based authentication adds an authentication layer but does not prevent the initial request from reaching the endpoint; network-level blocking is more fundamental.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.