Firewall PBQs: AWS Certified Security - Specialty (SCS-C03)

A security audit has flagged the security group attached to an EC2 instance running a public-facing web application in a VPC. The instance should only accept HTTPS traffic from the internet and SSH access from the admin subnet (10.0.1.0/24). Currently, SSH is open to the world and there is no default deny rule. Review the current rules and correct the misconfigurations.