To me the solution does not match the questions.
Q. Ensure R3 prevents fragmented packets from reaching its local HTTP server.
The solution basically says allow all RIP messages, deny any fragments, permit only tcp with dst port 80 and deny everything else.
To me the solution should be allow RIP messages, deny any framgents and permit any ip.
Nowhere in the question does it say only permit HTTP traffic but specifially says to deny fragments.