Why security groups matter in AWS - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a security group that allows inbound HTTP traffic.

AWS

resource "aws_security_group" "web_sg" {
  name        = "web_sg"
  description = "Allow HTTP inbound"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "[1]"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

Aicmp

Btcp

Cudp

Dhttp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'udp' instead of 'tcp' for HTTP traffic.

Using 'http' as a protocol value, which is not valid.

The protocol for HTTP traffic is TCP, so the ingress rule must specify "tcp".

2fill in blank

medium

Complete the code to allow SSH access only from a specific IP address.

AWS

resource "aws_security_group" "ssh_sg" {
  name        = "ssh_sg"
  description = "Allow SSH inbound from office"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["[1]"]
  }
}

Drag options to blanks, or click blank then click option'

A192.168.1.100/32

B0.0.0.0/0

C10.0.0.0/16

D255.255.255.255/32

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0.0.0.0/0 which opens SSH to all IPs.

Using a broad CIDR block instead of a single IP.

To restrict SSH access to a single IP, use the IP with /32 mask, like "192.168.1.100/32".

3fill in blank

hard

Complete the code to create a security group that allows all inbound traffic.

AWS

resource "aws_security_group" "allow_all" {
  name        = "allow_all"
  description = "Allow all inbound traffic"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "[1]"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

A-1

Btcp

Cudp

Dicmp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'tcp' or 'udp' which only allow specific protocols.

Not using '-1' to represent all protocols.

Using protocol "-1" means all protocols, which is needed to allow all inbound traffic properly.

4fill in blank

hard

Fill both blanks to create a security group that allows HTTPS inbound and denies all other inbound traffic.

AWS

resource "aws_security_group" "https_only" {
  name        = "https_only"
  description = "Allow HTTPS inbound only"

  ingress {
    from_port   = [1]
    to_port     = [2]
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

A443

B80

C22

D53

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 80 which is for HTTP, not HTTPS.

Using different values for from_port and to_port.

HTTPS uses port 443, so both from_port and to_port must be 443 to allow only HTTPS inbound.

5fill in blank

hard

Fill all three blanks to create a security group that allows inbound SSH from a specific IP, HTTP from anywhere, and denies all other inbound traffic.

AWS

resource "aws_security_group" "custom_sg" {
  name        = "custom_sg"
  description = "Allow SSH from office and HTTP from anywhere"

  ingress {
    from_port   = [1]
    to_port     = [2]
    protocol    = "tcp"
    cidr_blocks = ["[3]"]
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

A22

C192.168.1.100/32

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0.0.0.0/0 for SSH which opens access to everyone.

Using different ports for from_port and to_port.

SSH uses port 22 for both from_port and to_port, and the CIDR block restricts access to the specific IP.

Practice

1. What is the main purpose of a security group in AWS?

easy

A. To control inbound and outbound network traffic to resources

B. To store data securely in the cloud

C. To manage user permissions for AWS services

D. To monitor the health of AWS resources

Solution

1. Step 1: Understand what security groups do

   Security groups act like virtual firewalls that control network traffic to and from AWS resources.

2. Step 2: Identify the main function

   The main function is to allow or block inbound and outbound traffic based on rules.

3. Final Answer:

   To control inbound and outbound network traffic to resources -> Option A

4. Quick Check:

   Security groups control traffic = A [OK]

Hint: Security groups control traffic flow to resources [OK]

Common Mistakes:

• Confusing security groups with data storage
• Thinking security groups manage user permissions
• Assuming security groups monitor resource health

2. Which of the following is the correct way to allow HTTP traffic on port 80 in a security group rule?

easy

A. Allow inbound TCP traffic on port 80

B. Allow outbound UDP traffic on port 80

C. Allow inbound TCP traffic on port 22

D. Allow inbound ICMP traffic on port 80

Solution

1. Step 1: Identify the protocol and port for HTTP

   HTTP uses TCP protocol on port 80.

2. Step 2: Match the correct rule

   Allowing inbound TCP traffic on port 80 correctly allows HTTP requests.

3. Final Answer:

   Allow inbound TCP traffic on port 80 -> Option A

4. Quick Check:

   HTTP = TCP port 80 inbound [OK]

Hint: HTTP uses TCP port 80 inbound [OK]

Common Mistakes:

• Allowing wrong protocol like UDP or ICMP for HTTP
• Allowing outbound instead of inbound traffic
• Using wrong port number like 22 (SSH)

3. Given a security group with these inbound rules:
- Allow TCP port 22 from 0.0.0.0/0
- Allow TCP port 80 from 192.168.1.0/24
Which IP address can access port 80?

medium

A. 10.0.0.5

B. 0.0.0.0

C. 192.168.1.15

D. 172.16.0.1

Solution

1. Step 1: Understand the CIDR block for port 80

   The rule allows TCP port 80 only from IPs in 192.168.1.0/24 range, which means 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP fits the range

   192.168.1.15 is inside the allowed range, others are not.

3. Final Answer:

   192.168.1.15 -> Option C

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.15 [OK]

Hint: Check if IP fits CIDR range for allowed port [OK]

Common Mistakes:

• Confusing 0.0.0.0/0 with specific ranges
• Assuming all IPs can access port 80
• Mixing up port 22 and port 80 rules

4. You created a security group rule to allow inbound SSH (port 22) from your office IP, but you still cannot connect. What is the most likely mistake?

medium

A. The rule allows outbound traffic instead of inbound

B. The office IP is not in the allowed CIDR range

C. The rule uses UDP instead of TCP for port 22

D. The security group is attached to the wrong resource

Solution

1. Step 1: Check rule direction and protocol

   Inbound SSH requires TCP on port 22 inbound; if rule is correct, this is fine.

2. Step 2: Verify security group attachment

   If the security group is not attached to the resource (like EC2 instance), rules won't apply.

3. Final Answer:

   The security group is attached to the wrong resource -> Option D

4. Quick Check:

   Security group must be attached to resource [OK]

Hint: Check if security group is attached to your resource [OK]

Common Mistakes:

• Ignoring security group attachment
• Confusing inbound and outbound rules
• Using wrong protocol for SSH

5. You want to secure a web server so only your company's office IP range (203.0.113.0/24) can access HTTP (port 80), but allow SSH (port 22) from anywhere for remote admins. Which security group rules should you create?

hard

A. Allow inbound TCP port 80 from 0.0.0.0/0 and inbound TCP port 22 from 203.0.113.0/24

B. Allow inbound TCP port 80 from 203.0.113.0/24 and inbound TCP port 22 from 0.0.0.0/0

C. Allow inbound TCP port 80 and 22 both from 203.0.113.0/24 only

D. Allow inbound TCP port 80 and 22 both from 0.0.0.0/0 only

Solution

1. Step 1: Match HTTP access to office IP range

   HTTP (port 80) should be allowed only from 203.0.113.0/24 to restrict access to office IPs.

2. Step 2: Allow SSH from anywhere

   SSH (port 22) should be open to 0.0.0.0/0 to allow remote admins from any IP.

3. Final Answer:

   Allow inbound TCP port 80 from 203.0.113.0/24 and inbound TCP port 22 from 0.0.0.0/0 -> Option B

4. Quick Check:

   HTTP restricted, SSH open = A [OK]

Hint: Restrict HTTP, open SSH from anywhere [OK]

Common Mistakes:

• Reversing IP ranges for ports
• Opening HTTP to all IPs
• Restricting SSH too much