hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Based on the exhibit, what is the most critical…
Exhibit
Refer to the exhibit.
{
"eventVersion": "1.05",
"userIdentity": {
"type": "Root",
"arn": "arn:aws:iam::123456789012:root",
"accountId": "123456789012"
},
"eventTime": "2020-03-15T14:30:00Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "AuthorizeSecurityGroupIngress",
"sourceIPAddress": "10.0.0.5",
"requestParameters": {
"groupId": "sg-12345678",
"ipPermissions": {
"items": [
{
"ipProtocol": "tcp",
"fromPort": 3389,
"toPort": 3389,
"ipRanges": [
{
"cidrIp": "0.0.0.0/0"
}
]
}
]
}
}
}Based on the exhibit, what is the most critical observation?
⚠ Common exam trap
The trap here is that candidates focus on the user or service name (e.g., 'root user' or 'EC2') rather than the actual security impact of opening RDP to the world, which is the most critical observation in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A root user is opening RDP to the world.
The most critical observation is that a root user is opening RDP (TCP/3389) to the world (0.0.0.0/0). This creates an extreme security risk because it exposes the administrative interface to the entire internet, allowing any attacker to attempt brute-force or exploit RDP vulnerabilities. In AWS CloudTrail, this event indicates a direct violation of the principle of least privilege and is a common vector for compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A root user is opening RDP to the world.
Why this is correct
Root access combined with an open RDP rule to 0.0.0.0/0 poses a severe security risk.
- ✗
A user is modifying a security group.
Why it's wrong here
While true, this is less critical than the specific change being made.
- ✗
The event is from EC2 service.
Why it's wrong here
This is just the service name; it does not indicate a security issue.
- ✗
The source IP is internal.
Why it's wrong here
The source IP being internal (10.0.0.5) suggests the change was made from within the network, which is not inherently problematic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.