DBS-C01 Database Security Practice Question
A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the security group to allow inbound traffic only from the application server's security group.
To meet the requirements, two configurations are needed. First, the DB instance must be set to not publicly accessible (Option D) to ensure it cannot be reached from the internet. Second, the security group associated with the DB instance must allow inbound traffic only from the application server's security group (Option C), which restricts access to resources within the VPC. Option A is incorrect because placing the DB instance in a public subnet would expose it to the internet. Option B is incorrect because the DB parameter group controls database engine settings, not network access. Option E is incorrect because network ACLs are stateless and a rule denying all inbound traffic would block legitimate traffic as well; security groups are the appropriate mechanism for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the DB instance in a public subnet.
Why it's wrong here
A public subnet has a route to the internet gateway, which would allow internet access.
- ✗
Modify the DB parameter group to restrict network access.
Why it's wrong here
Parameter groups do not control network access.
- ✓
Configure the security group to allow inbound traffic only from the application server's security group.
Why this is correct
This restricts access to the specific application server.
- ✓
Set the DB instance to be not publicly accessible.
Why this is correct
This ensures the instance does not have a public IP.
- ✗
Configure a network ACL to deny inbound traffic from 0.0.0.0/0.
Why it's wrong here
Network ACLs are stateless and less precise; security groups are preferred for this requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.