Question 50 of 1,663
Restrict RDS Database Access to Specific IPs or EC2 Instances
A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)
Quick Answer
The correct answer is to remove the 0.0.0.0/0 rule and add an inbound rule referencing the security group ID of the EC2 instances. This works because security group referencing allows you to restrict RDS access by security group rather than by IP, enabling dynamic, stateful filtering that automatically adapts as EC2 instances are added or removed within the referenced group. On the AWS Certified Database Specialty DBS-C01 exam, this scenario tests your understanding of VPC security group chaining for database access—a common trap is choosing IP-based rules, which break if instance IPs change or scale. Remember that within the same VPC, referencing a security group ID is more resilient and aligns with AWS best practices for least-privilege access. Memory tip: “Group the groups”—when restricting RDS access, think security group IDs, not IPs, for elastic, maintainable control.
⚠ Common exam trap
It's easy for candidates to confuse network ACLs with security groups, thinking that modifying the NACL at the subnet level is sufficient, but they overlook that NACLs are stateless and less granular, while security group referencing provides precise, stateful control for instance-to-instance communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the inbound rule for 0.0.0.0/0 on the RDS security group.
Removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.
Why it's wrong here
Network ACLs are stateless, so allowing inbound port 3306 from the EC2 instance’s private IP would also require a corresponding outbound rule for ephemeral ports to permit return traffic, which the existing configuration does not specify. This option is tempting because network ACLs can filter traffic at the subnet boundary, and in a scenario where the RDS instance lacked a security group or required subnet-level restrictions, modifying the ACL would be a valid additional layer. However, the security group attached to the RDS instance already controls inbound access, and the correct approach is to replace the overly permissive 0.0.0.0/0 rule with a rule referencing the EC2 instance’s security group, which is stateful and automatically handles return traffic.
- ✓
Remove the inbound rule for 0.0.0.0/0 on the RDS security group.
Why this is correct
Removing the overly permissive rule is necessary to restrict access.
- ✓
Add an inbound rule to the RDS security group referencing the security group ID of the EC2 instances.
Why this is correct
Referencing the EC2 security group allows traffic only from instances using that security group, following best practices.
- ✗
Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.
Why it's wrong here
Placing the database in a public subnet is insecure and unnecessary; subnet group changes do not affect security group rules.
- ✗
Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.
Why it's wrong here
This would still allow any resource in the VPC, which is broader than needed.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon RDS for PostgreSQL and needs to ensure that only specific IP addresses can connect to the database. Which configuration should be used?
medium- A.Configure the DB subnet group to allow only specific IP addresses.
- B.Set the rds.force_ssl parameter in the DB parameter group.
- C.Create an IAM policy that restricts access to the RDS API based on source IP.
- ✓ D.Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.
Why D: VPC security groups act as a virtual firewall that controls inbound and outbound traffic to the DB instance. By modifying the security group to allow inbound traffic only from specific IP addresses, you restrict database access to those IPs. Option A is incorrect because DB subnet groups define which subnets the RDS instance can reside in, not IP filtering. Option B is incorrect because the rds.force_ssl parameter enforces SSL connections, not IP restrictions. Option C is incorrect because IAM policies control permissions to AWS API actions, not network-level access to the database.
Last reviewed: Jun 11, 2026
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.