DBS-C01 Deployment and Migration Practice Question
A company is deploying a new Amazon RDS for MariaDB instance. The database must be accessible from a specific set of EC2 instances in a VPC. How should the company configure security to allow access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security group for the RDS instance that allows inbound traffic from the EC2 instances' security group.
The recommended way to allow access from EC2 instances to an RDS instance is to create a security group for the RDS instance that allows inbound traffic on the database port from the security group attached to the EC2 instances. This leverages security group referencing, which is more secure and easier to manage than specifying IP addresses. Option A is incorrect because while assigning the same security group to both could work, it is not a best practice as it would allow all members of that group to communicate without granularity, and it does not follow the principle of least privilege. Option C is incorrect because IAM roles are used for authentication and authorization to AWS services, not for network-level access control. To access the RDS database, you still need to allow network traffic via a security group or NACL. Option D is incorrect because network ACLs are stateless and operate at the subnet level. While they can be used, security groups are the preferred method for controlling traffic to an RDS instance because they are stateful and more granular.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the same security group to both the RDS instance and the EC2 instances.
Why it's wrong here
Assigning the same security group to both the RDS instance and the EC2 instances could work but is not recommended because it does not provide fine-grained control and may allow unwanted traffic between resources.
- ✓
Create a security group for the RDS instance that allows inbound traffic from the EC2 instances' security group.
Why this is correct
Creating a security group for the RDS instance that allows inbound traffic from the EC2 instances' security group is the correct approach. It uses security group referencing, which is secure and easy to manage.
- ✗
Attach an IAM role to the EC2 instances that grants access to the RDS database.
Why it's wrong here
Attaching an IAM role to the EC2 instances grants permissions to call AWS APIs, but does not control network access to the RDS database. Network access must be allowed separately via security groups or NACLs.
- ✗
Configure a network ACL to allow inbound traffic from the EC2 instance IPs.
Why it's wrong here
Configuring a network ACL to allow inbound traffic from the EC2 instance IPs is possible, but security groups are preferred because they are stateful and more granular. NACLs are stateless and require additional configuration.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.