Stateful behavior of security groups in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify that the security group allows inbound HTTP traffic.

AWS

security_group = {
  "IpPermissions": [
    {
      "IpProtocol": "tcp",
      "FromPort": 80,
      "ToPort": 80,
      "IpRanges": [
        {"CidrIp": "[1]"}
      ]
    }
  ]
}

Drag options to blanks, or click blank then click option'

Alocalhost

B192.168.1.1/32

C255.255.255.0

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using an IP address without a CIDR suffix.

Using a private IP range that blocks public access.

The CIDR block 0.0.0.0/0 allows inbound HTTP traffic from any IP address.

2fill in blank

medium

Complete the code to allow outbound HTTPS traffic in the security group.

AWS

security_group = {
  "IpPermissionsEgress": [
    {
      "IpProtocol": "tcp",
      "FromPort": 443,
      "ToPort": 443,
      "IpRanges": [
        {"CidrIp": "[1]"}
      ]
    }
  ]
}

Drag options to blanks, or click blank then click option'

A10.0.0.0/8

B0.0.0.0/0

C172.16.0.0/12

D192.168.0.0/16

Attempts:

3 left

💡 Hint

Common Mistakes

Restricting outbound traffic to private IP ranges only.

Using an IP address without CIDR notation.

The CIDR block 0.0.0.0/0 allows outbound HTTPS traffic to any IP address.

3fill in blank

hard

Fix the error in the security group rule that blocks all inbound traffic except SSH.

AWS

security_group = {
  "IpPermissions": [
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "IpRanges": [
        {"CidrIp": "[1]"}
      ]
    }
  ]
}

Drag options to blanks, or click blank then click option'

A22.22.22.22/32

B255.255.255.255/32

C0.0.0.0/0

Dlocalhost

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0.0.0.0/0 which allows SSH from anywhere.

Using invalid IP addresses or missing CIDR suffix.

Using 22.22.22.22/32 restricts SSH access to a single IP address, blocking all others.

4fill in blank

hard

Fill both blanks to create a security group rule that allows inbound TCP traffic on port 8080 only from a specific subnet.

AWS

security_group = {
  "IpPermissions": [
    {
      "IpProtocol": "[1]",
      "FromPort": [2],
      "ToPort": 8080,
      "IpRanges": [
        {"CidrIp": "10.0.1.0/24"}
      ]
    }
  ]
}

Drag options to blanks, or click blank then click option'

Atcp

Budp

C8080

D80

Attempts:

3 left

💡 Hint

Common Mistakes

Using UDP protocol for TCP traffic.

Setting FromPort to a different port than ToPort.

The protocol must be tcp and the FromPort must be 8080 to allow traffic on port 8080.

5fill in blank

hard

Fill all three blanks to define a security group rule that allows outbound UDP traffic on port 53 to all IP addresses.

AWS

security_group = {
  "IpPermissionsEgress": [
    {
      "IpProtocol": "[1]",
      "FromPort": [2],
      "ToPort": [3],
      "IpRanges": [
        {"CidrIp": "0.0.0.0/0"}
      ]
    }
  ]
}

Drag options to blanks, or click blank then click option'

Atcp

B53

Cudp

D80

Attempts:

3 left

💡 Hint

Common Mistakes

Using TCP instead of UDP for DNS traffic.

Setting port numbers incorrectly.

UDP protocol is used for DNS queries on port 53. Both FromPort and ToPort must be 53.