DBS-C01 Database Security Practice Question
A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?
⚠ Common exam trap
Many candidates confuse public and private IP addressing within a VPC, assuming that allowing the application server's public IP in the security group is sufficient, when in fact traffic between instances in the same VPC always uses private IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the security group inbound rule to allow traffic from the application server's private IP address.
The application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch the RDS instance in the default VPC.
Why it's wrong here
Placing the instance in a different VPC would complicate connectivity.
- ✗
Change the DB subnet group to include the application server's subnet.
Why it's wrong here
The DB subnet group defines which subnets the RDS instance can be in, not which subnets can connect to it.
- ✗
Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.
Why it's wrong here
Network ACLs are stateless and the application uses private IP; also security groups are sufficient.
- ✗
Modify the RDS instance to be publicly accessible.
Why it's wrong here
Public accessibility is not needed if the application is in the same VPC.
- ✓
Update the security group inbound rule to allow traffic from the application server's private IP address.
Why this is correct
The application connects from its private IP within the VPC, so the security group should allow that private IP.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.