BrightKite’s DevOps team receives a GuardDuty finding: UnauthorizedAccess:EC2/SSHBruteForce targeting an EC2 instance in a public subnet. The instance currently allows TCP/22 and TCP/8080 from 0.0.0.0/0, but administrators need to retain SSH access from corporate offices. What is the most effective immediate remediation?
Choose an answer
Tap an option to check your answer.
Correct answer: Restrict the instance’s security group to allow SSH only from the corporate CIDR block and remove 0.0.0.0/0 from other open ports..
Why this is the answer
The most effective immediate remediation is to restrict the security group. The GuardDuty finding indicates an SSH brute-force attack, which is enabled by allowing SSH (TCP/22) from 0.0.0.0/0. Restricting SSH to the corporate CIDR block immediately mitigates this vulnerability while preserving necessary access. Additionally, removing 0.0.0.0/0 from other open ports (like TCP/8080) reduces the attack surface for those services. Attaching an AWS WAF web ACL is not applicable here because WAF protects web applications, not SSH. Adding a network ACL deny rule for a single source IP is insufficient as attackers often use multiple IPs. Disabling the Internet Gateway would stop all traffic, including legitimate application traffic, making it an overly disruptive and impractical solution.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed