A company hosts a public website on an Amazon EC2 instance. HTTPS traffic must be able to access the website. The company uses SSH for management of the web server. The website is on the subnet…

Question

Options

• AAllow port 22 from source 0.0.0.0/0.
• BAllow port 443 from source 0.0 0 0/0.
• CAllow port 22 from 192.168.100.0/24.
• DAllow port 22 from 10.0.1.0/24.
• EAllow port 443 from 10.0.1.0/24.

• A
  4% (1)
• B
  80% (20)
• D
  4% (1)
• E
  12% (3)

Explanation

B and C are correct because they follow the principle of least privilege: HTTPS (port 443) must be open to everyone since it's a public website, making 0.0.0.0/0 the correct source - but SSH (port 22) should only be reachable from the dedicated management subnet 192.168.100.0/24, not the entire internet or unrelated subnets.

Why the distractors fail:

• A is the most dangerous option - opening SSH to 0.0.0.0/0 exposes the server to brute-force attacks from the entire internet.
• D is a trap - it restricts SSH to the web subnet (10.0.1.0/24) instead of the management subnet (192.168.100.0/24), mixing two unrelated concerns.
• E is the opposite trap - limiting HTTPS to only the web subnet breaks public access entirely, defeating the purpose of a public website.

Memory tip: Match the service's audience to its source CIDR - "public service gets a public source (0.0.0.0/0), private management gets a private source (the management subnet)." If you see SSH + 0.0.0.0/0 as an answer choice, it's almost always wrong on AWS security exams.

No community discussion yet for this question.