Question 77 of 1,711
DEA-C01 Data Security and Governance Practice Question
A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the network ACL (NACL) associated with the Redshift cluster's subnet.
Even if the security group allows inbound traffic from a specific IP range, the network ACL (NACL) associated with the Redshift cluster's subnet can block traffic at the subnet level. NACLs are stateless and can override security group rules. Option A is incorrect because modifying the cluster parameter group does not control network-level access; public accessibility is a separate setting. Option B is incorrect because the engineer already verified the security group, but even if it is correctly attached, the NACL could still block traffic. Option C is incorrect because IAM roles control authentication and authorization, not network connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the Redshift cluster parameter group to enable public accessibility.
Why it's wrong here
Modifying the cluster parameter group does not control network access; public accessibility is a separate setting.
- ✗
Verify that the cluster's security group is attached to the Redshift cluster.
Why it's wrong here
Verifying security group attachment is redundant since the engineer already verified the group allows traffic; the issue is more likely at the subnet level.
- ✗
Check the IAM role associated with the Redshift cluster.
Why it's wrong here
IAM roles control permissions, not network-level access.
- ✓
Check the network ACL (NACL) associated with the Redshift cluster's subnet.
Why this is correct
Network ACLs operate at the subnet level and can block inbound traffic even if security groups allow it, making this the correct next step.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.