DEA-C01 Data Security and Governance Practice Question
A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the network ACL (NACL) associated with the Redshift cluster's subnet.
Even if the security group allows inbound traffic from a specific IP range, the network ACL (NACL) associated with the Redshift cluster's subnet can block traffic at the subnet level. NACLs are stateless and can override security group rules. Option A is incorrect because modifying the cluster parameter group does not control network-level access; public accessibility is a separate setting. Option B is incorrect because the engineer already verified the security group, but even if it is correctly attached, the NACL could still block traffic. Option C is incorrect because IAM roles control authentication and authorization, not network connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the Redshift cluster parameter group to enable public accessibility.
Why it's wrong here
Modifying the cluster parameter group does not control network access; public accessibility is a separate setting.
- ✗
Verify that the cluster's security group is attached to the Redshift cluster.
Why it's wrong here
Verifying security group attachment is redundant since the engineer already verified the group allows traffic; the issue is more likely at the subnet level.
- ✗
Check the IAM role associated with the Redshift cluster.
Why it's wrong here
IAM roles control permissions, not network-level access.
- ✓
Check the network ACL (NACL) associated with the Redshift cluster's subnet.
Why this is correct
Security groups are stateful and evaluated after subnet-level filtering; a restrictive NACL on the cluster's subnet silently drops inbound traffic before it reaches the security group. Checking the NACL is therefore the correct next diagnostic step.
Visual reference
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.