Default security group behavior in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a default security group that allows all inbound traffic from anywhere.

AWS

resource "aws_security_group" "default" {
  name        = "default"
  description = "Default security group"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = [[1]]
  }
}

Drag options to blanks, or click blank then click option'

A"self"

B"sg-12345678"

C"0.0.0.0/0"

D"::/0"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a security group ID instead of a CIDR block.

Using "self" which is not a valid CIDR block.

Using IPv6 CIDR block when IPv4 is expected.

The CIDR block "0.0.0.0/0" allows inbound traffic from all IP addresses.

2fill in blank

medium

Complete the code to allow all outbound traffic in the default security group.

AWS

resource "aws_security_group" "default" {
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = [[1]]
  }
}

Drag options to blanks, or click blank then click option'

A"::/0"

B"0.0.0.0/0"

C"self"

D"sg-87654321"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a security group ID instead of a CIDR block.

Using "self" which is invalid here.

Using IPv6 CIDR block when IPv4 is expected.

The default security group allows all outbound traffic to all IP addresses, so the CIDR block is "0.0.0.0/0".

3fill in blank

hard

Fix the error in the ingress rule to allow traffic only from the same security group.

AWS

resource "aws_security_group" "default" {
  ingress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    [1] = aws_security_group.default.id
  }
}

Drag options to blanks, or click blank then click option'

Asource_security_group_id

Bself

Ccidr_blocks

Dsecurity_groups

Attempts:

3 left

💡 Hint

Common Mistakes

Using cidr_blocks instead of source_security_group_id.

Using security_groups which is deprecated.

Using self which is not a valid attribute.

To allow traffic from the same security group, use the attribute source_security_group_id with the security group ID.

4fill in blank

hard

Fill both blanks to define an ingress rule that allows all protocols and ports from the same security group.

AWS

resource "aws_security_group" "default" {
  ingress {
    from_port       = [1]
    to_port         = [2]
    protocol        = "-1"
    source_security_group_id = aws_security_group.default.id
  }
}

Drag options to blanks, or click blank then click option'

A0

B-1

C65535

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Setting ports to 65535 or -1 which is invalid for all protocols.

Using different values for from_port and to_port.

To allow all ports, set both from_port and to_port to 0 when protocol is "-1" (all protocols).

5fill in blank

hard

Fill all three blanks to create an egress rule that allows all outbound IPv4 traffic.

AWS

resource "aws_security_group" "default" {
  egress {
    from_port   = [1]
    to_port     = [2]
    protocol    = [3]
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

A0

B65535

C"-1"

D"0"

Attempts:

3 left

💡 Hint

Common Mistakes

Using protocol "0" which means ICMP only.

Setting ports incorrectly or mismatching protocol.

To allow all outbound IPv4 traffic, set from_port to 0, to_port to 0, and protocol to "-1" which means all protocols.