hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Refer to the exhibit
Exhibit
{
"SecurityGroupIngress": [
{"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]},
{"IpProtocol": "tcp", "FromPort": 3306, "ToPort": 3306, "IpRanges": [{"CidrIp": "10.0.0.0/8"}]}
]
}Refer to the exhibit. The firewall rule is attached to a database server. Which hosts can connect to the database?
⚠ Common exam trap
ISC2 often tests the misconception that a firewall rule allowing a private IP range (like 10.0.0.0/8) also permits internet hosts, but the trap is that internet hosts cannot have source IPs in that private range unless they are behind NAT or VPN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Only hosts in the 10.0.0.0/8 range
The firewall rule allows inbound traffic on the database port from the 10.0.0.0/8 range. Since the database server is in a private subnet with no public IP, only hosts within that RFC 1918 address space can reach it. Option D is correct because the rule explicitly permits only 10.0.0.0/8, which includes internal hosts in that range.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No hosts can connect to the database
Why it's wrong here
Hosts in the 10.0.0.0/8 range can connect on port 3306.
- ✗
Both internet hosts and internal hosts
Why it's wrong here
Internet hosts cannot access port 3306; they are only allowed on port 443.
- ✗
Any host on the internet
Why it's wrong here
Only hosts in the 10.0.0.0/8 range are allowed on port 3306; internet hosts are allowed only on port 443.
- ✓
Only hosts in the 10.0.0.0/8 range
Why this is correct
The security group allows port 3306 traffic only from the 10.0.0.0/8 CIDR.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.