DBS-C01 Deployment and Migration Practice Question
A company is deploying an Amazon RDS for MySQL database in a VPC. The database must be accessible only from a specific set of application servers in the same VPC. Which configuration provides the most secure access?
⚠ Common exam trap
Candidates often confuse subnet placement (Option B) with access control, mistakenly thinking a separate subnet inherently restricts traffic, when in fact security groups are the primary mechanism for instance-level firewall rules in a VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the security group inbound rule to reference the security group of the application servers
Referencing the application servers' security group as the source in the RDS inbound rule allows traffic only from those specific instances, regardless of IP changes. This follows the AWS security best practice of using security group IDs for fine-grained, stateful access control within a VPC, eliminating reliance on static IP addresses or CIDR ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the security group inbound rule to allow all traffic from the VPC CIDR
Why it's wrong here
Allows traffic from all resources in VPC, not just the app servers.
- ✗
Place the RDS instance in a separate subnet group
Why it's wrong here
Subnet groups do not control security group rules.
- ✗
Set the RDS instance to publicly accessible
Why it's wrong here
Public accessibility exposes the database to the internet.
- ✓
Set the security group inbound rule to reference the security group of the application servers
Why this is correct
Restricts access to resources with that security group.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.