DBS-C01 Database Security Practice Question
A company uses Amazon RDS for PostgreSQL and needs to ensure that only specific IP addresses can connect to the database. Which configuration should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.
VPC security groups act as a virtual firewall that controls inbound and outbound traffic to the DB instance. By modifying the security group to allow inbound traffic only from specific IP addresses, you restrict database access to those IPs. Option A is incorrect because DB subnet groups define which subnets the RDS instance can reside in, not IP filtering. Option B is incorrect because the rds.force_ssl parameter enforces SSL connections, not IP restrictions. Option C is incorrect because IAM policies control permissions to AWS API actions, not network-level access to the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the DB subnet group to allow only specific IP addresses.
Why it's wrong here
DB subnet groups determine which subnets the DB instance resides in, but do not filter incoming IP addresses.
- ✗
Set the rds.force_ssl parameter in the DB parameter group.
Why it's wrong here
This parameter enforces SSL connections but does not restrict by IP address.
- ✗
Create an IAM policy that restricts access to the RDS API based on source IP.
Why it's wrong here
IAM policies control API-level access, not database connections at the network level.
- ✓
Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.
Why this is correct
Security groups act as a virtual firewall and can restrict inbound traffic based on IP addresses.
Visual reference
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.