Crucial Exams

ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Your security team is reviewing how administrators connect to a fleet of Windows and Linux virtual machines that reside in private subnets of a public cloud VPC. Today, each VM has its RDP or SSH port exposed through a network security group that permits traffic from the corporate public IP range. The team wants to further reduce the attack surface while still allowing engineers to manage the instances from the office. Which change best satisfies this objective?

  • Place a web proxy appliance in front of the private subnets so administrators can browse to the instances using HTTPS instead of RDP or SSH.

  • Create a client VPN that terminates in the VPC but leave the existing security-group rules open to 0.0.0.0/0 so engineers can connect whether the VPN is up or not.

  • Deploy a hardened bastion (jump) host in a small public subnet, allow SSH only from the corporate IP range to that host, and remove all direct internet-facing RDP/SSH rules from the other VMs.

  • Keep the current per-VM security-group rules but add TLS encryption on the RDP and SSH sessions to protect credentials in transit.

ISC2 Certified Cloud Security Professional (CCSP)
Cloud Security Operations
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot