DEA-C01 Data Operations and Support Practice Question
A data engineer is using AWS Glue to run an ETL job that reads from an Amazon RDS for PostgreSQL database and writes to Amazon S3. The job is configured with a JDBC connection to RDS. The engineer notices that the job fails intermittently with a 'Connection timed out' error. The RDS instance is in a private subnet, and the Glue job has been configured with a VPC connection. Which action should the engineer take to resolve the timeout issue?
⚠ Common exam trap
The trap here is assuming that scaling resources or using NAT gateways will fix network connectivity, when the issue is typically security group or subnet routing misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the Glue job's VPC connection has a security group that allows outbound traffic to the RDS instance's security group on the database port.
The intermittent connection timeout is likely caused by security group rules blocking traffic between the AWS Glue VPC connection and the RDS instance. The Glue job's ENI security group must allow outbound traffic to RDS, and the RDS security group must allow inbound traffic from the Glue security group on the database port. Ensuring these rules are correctly configured resolves the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the Glue job's VPC connection to use a NAT gateway for outbound traffic.
Why it's wrong here
A NAT gateway is used for instances in a private subnet to access the internet or other AWS services outside the VPC. Since RDS is within the same VPC (or peered VPC), a NAT gateway is not needed. The timeout is likely due to security group rules, not internet access.
- ✗
Increase the size of the Glue job's DPU capacity to handle more concurrent connections.
Why it's wrong here
Increasing DPUs provides more compute resources but does not affect network connectivity. A connection timeout is typically due to network or security group misconfiguration, not insufficient compute. While more DPUs can improve performance, they will not resolve a timeout caused by blocked traffic.
- ✓
Ensure the Glue job's VPC connection has a security group that allows outbound traffic to the RDS instance's security group on the database port.
Why this is correct
When AWS Glue runs in a VPC, it uses an elastic network interface (ENI) with a security group. To connect to RDS, the RDS security group must allow inbound traffic from the Glue ENI's security group on the database port. Additionally, the Glue security group must allow outbound traffic to RDS. Misconfigured security groups are a common cause of connection timeouts.
- ✗
Configure the Glue job to use a public internet gateway to connect to RDS.
Why it's wrong here
RDS is in a private subnet, so it is not accessible via the public internet. Using an internet gateway would not help and could introduce security risks. The correct approach is to ensure the VPC connection has proper routing and security group rules within the VPC.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.