Why defense in depth matters in AWS - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a security group that allows SSH access.

AWS

resource "aws_security_group" "example" {
  name        = "example"
  description = "Allow SSH access"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [[1]]
  }
}

Drag options to blanks, or click blank then click option'

A"::/0"

B"192.168.1.1/32"

C"10.0.0.0/16"

D"0.0.0.0/0"

Attempts:

3 left

💡 Hint

Common Mistakes

Using an IP address without CIDR notation

Using an IPv6 CIDR block when IPv4 is expected

Using "0.0.0.0/0" allows SSH access from any IP address, which is common in examples but not recommended for production.

2fill in blank

medium

Complete the code to enable encryption on an S3 bucket.

AWS

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = [1]
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"AES256"

B"aws:kms"

C"RSA"

D"none"

Attempts:

3 left

💡 Hint

Common Mistakes

Using unsupported encryption algorithms

Leaving encryption disabled

"AES256" enables Amazon S3-managed encryption, a common choice for server-side encryption.

3fill in blank

hard

Fix the error in the IAM policy statement to allow only read access to S3 buckets.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [1],
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

A"s3:PutObject"

B"s3:*"

C["s3:GetObject"]

D["s3:DeleteObject"]

Attempts:

3 left

💡 Hint

Common Mistakes

Using wildcard actions that allow more than read

Not using a list for the Action field

Read access requires the "s3:GetObject" action in a list format.

4fill in blank

hard

Fill both blanks to create a VPC with a public subnet and enable internet access.

AWS

resource "aws_vpc" "main" {
  cidr_block = [1]
}

resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = [2]
  map_public_ip_on_launch = true
}

Drag options to blanks, or click blank then click option'

A"10.0.0.0/16"

B"10.0.1.0/24"

C"192.168.0.0/16"

D"192.168.1.0/24"

Attempts:

3 left

💡 Hint

Common Mistakes

Using subnet CIDR outside the VPC range

Not enabling public IP mapping on subnet

The VPC uses a large CIDR block, and the subnet uses a smaller block within it to allow public IP mapping.

5fill in blank

hard

Fill all three blanks to define an IAM role with a trust policy for EC2 and attach a policy.

AWS

resource "aws_iam_role" "example" {
  name = "example-role"

  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {"Service": [1],
        "Action": [2]
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "example_attach" {
  role       = aws_iam_role.example.name
  policy_arn = [3]
}

Drag options to blanks, or click blank then click option'

A"ec2.amazonaws.com"

B"sts:AssumeRole"

C"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"

D"lambda.amazonaws.com"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong service in Principal

Using incorrect action in trust policy

Attaching wrong or missing policy ARN

The trust policy allows EC2 to assume the role, and the role is attached to the Amazon S3 read-only policy.