ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The most secure approach is to establish a default-deny posture and then explicitly permit only the required flows. Changing the zone target to DROP causes any packet that does not match a rule to be discarded. Two inbound rules are then added to allow TCP 22 and TCP 8443 only from the 10.0.0.0/16 corporate CIDR, satisfying the administration and application access requirements. Two outbound rules permit TCP 443 to the specific Git server (10.20.30.40) and to the S3 interface endpoint's address range, enabling just the needed egress traffic. Because the target is DROP, all other ingress and egress attempts are automatically blocked, fully enforcing least privilege.

A configuration that retains an ACCEPT target but tries to block unwanted traffic leaves any overlooked port open. Allowing only inbound rules while leaving the default outbound ACCEPT policy would still let the instance contact arbitrary external hosts. Relying solely on the VPC security group does not meet the stated requirement to enforce controls at the host operating-system level.