DBS-C01 Database Security Practice Question
A company runs an e-commerce platform on AWS. The application uses an Amazon RDS for MySQL Multi-AZ database instance. The security team recently conducted an audit and found that the database is accessible from the internet because the public accessibility setting is enabled. The security team has disabled public accessibility and updated the security group to allow inbound traffic only from the application's security group. However, after these changes, the application can no longer connect to the database. The application is running on EC2 instances in the same VPC. The RDS instance is also in the same VPC. The security group for the RDS instance allows inbound MySQL traffic (port 3306) from the application's security group. The application's security group allows all outbound traffic. The application's EC2 instances have a public IP address and are in a public subnet. The RDS instance is in a private subnet. The VPC has an internet gateway attached. What is the most likely cause of the connection failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the RDS instance still allows traffic from the public IP addresses of the EC2 instances, but the EC2 instances now have different public IPs.
The most likely cause is that the security group for the RDS instance still contains a rule allowing inbound traffic from the public IP addresses of the EC2 instances. After disabling public accessibility, the EC2 instances in the public subnet may receive new public IPs if they are stopped and started, or the original rule may have referenced specific public IPs that are no longer valid. The application's connection attempts using the old public IPs fail. Although the security group was updated to allow traffic from the application's security group, the old rule might not have been removed, or the application was not using the security group reference. Since the EC2 instances are in the same VPC, the private IP communication should work with the security group reference, but if the old rule is still present and the public IPs changed, the connection might fail. Options A and D are incorrect because same-VPC communication does not require VPC peering or a NAT gateway. Option C is incorrect because the public DNS name resolves to the private IP within the VPC even after public accessibility is disabled, so it should work.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The RDS instance is in a private subnet and cannot receive inbound traffic from the public subnet EC2 instances without a VPC peering or VPN.
Why it's wrong here
Incorrect. EC2 instances in the same VPC can communicate with RDS in a private subnet without VPC peering or VPN. Security group and NACL rules control traffic.
- ✓
The security group for the RDS instance still allows traffic from the public IP addresses of the EC2 instances, but the EC2 instances now have different public IPs.
Why this is correct
Correct. The security group still allows inbound from the public IPs of the EC2 instances, but those IPs may have changed (e.g., after an instance restart). The connection fails because the old public IPs are no longer assigned to the EC2 instances.
- ✗
The application is using the RDS public DNS name, which no longer resolves after disabling public accessibility.
Why it's wrong here
Incorrect. When public accessibility is disabled, the RDS DNS name resolves to the private IP within the VPC. The connection should work from EC2 instances in the same VPC. The issue is not with DNS resolution.
- ✗
The EC2 instances need a NAT gateway to communicate with the RDS instance in the private subnet.
Why it's wrong here
Incorrect. EC2 instances in a public subnet can reach RDS in a private subnet directly within the same VPC. A NAT gateway is used for outbound-only traffic to the internet, not for inbound traffic to RDS.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.