easyMultiple ChoiceObjective-mapped

CCSP Least Privilege Practice Question

Exhibit

Refer to the exhibit.

Resources:
  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web server security group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

Refer to the exhibit. A cloud template defines a network security rule as shown. What is the security concern with this configuration?

⚠ Common exam trap

The trap here is that while HTTPS on port 443 is a common and generally safe protocol, the source IP range (0.0.0.0/0) makes the rule overly permissive. Candidates often focus on the protocol or port number rather than the source IP range.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It allows inbound traffic from all IP addresses on port 443, which is overly permissive.

The rule allows inbound traffic on port 443 (HTTPS) from 0.0.0.0/0, which means any IP address on the internet can reach the resource. This is overly permissive and violates the principle of least privilege, as it exposes the service to potential attacks from any source without restriction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It allows SSH access on port 22.
Why it's wrong here
No SSH rule is defined.
✗
It allows HTTP traffic on port 80, not HTTPS.
Why it's wrong here
The rule is for port 443, which is HTTPS.
✗
It does not allow outbound traffic.
Why it's wrong here
Security groups are stateful; outbound is allowed by default.
✓
It allows inbound traffic from all IP addresses on port 443, which is overly permissive.
Why this is correct
Best practice is to restrict source IPs to known ranges.

Go deeper

CCSP Least Privilege Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question