Question 430 of 1,663
DBS-C01 Monitoring and Troubleshooting Practice Question
A database specialist is trying to connect to an Amazon RDS for MySQL instance from an EC2 instance but receives a 'Connection timed out' error. The security group for the RDS instance allows inbound traffic on port 3306 from the security group of the EC2 instance. What should the specialist check next?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the network ACL associated with the subnet of the RDS instance to ensure it allows inbound traffic on port 3306 and outbound traffic on ephemeral ports.
The 'Connection timed out' error suggests the packet is being dropped at the network layer, likely by a network ACL. Since the security group allows inbound on port 3306, the next step is to check the network ACL associated with the RDS instance's subnet. Network ACLs are stateless, so they must allow both inbound traffic on port 3306 and outbound traffic on ephemeral ports for the response. Option B is incorrect because a timed out error occurs before the TCP handshake completes, so DNS resolution is not the issue. Option C is incorrect because an internet gateway and public route are irrelevant if both instances are in the same VPC or connected privately. Option D is incorrect because the security group for the EC2 instance can be stateful and typically allows outbound traffic by default; the timeout is not caused by missing outbound rules on the EC2 side.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the network ACL associated with the subnet of the RDS instance to ensure it allows inbound traffic on port 3306 and outbound traffic on ephemeral ports.
Why this is correct
Network ACLs are stateless and must allow both inbound and outbound traffic.
- ✗
Check that the RDS instance has a public DNS name and the EC2 instance can resolve it.
Why it's wrong here
The error is a timeout, not a DNS resolution issue.
- ✗
Ensure that the VPC has an internet gateway attached and the route table has a route to it.
Why it's wrong here
If both instances are in the same VPC, internet gateway is not needed.
- ✗
Verify that the security group for the EC2 instance allows outbound traffic on port 3306.
Why it's wrong here
Outbound traffic is typically allowed by default; the issue is likely network ACL.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is receiving timeout errors when connecting to an Amazon ElastiCache for Redis cluster from an Amazon EC2 instance. The security group for the EC2 instance allows outbound traffic to the Redis cluster's security group on port 6379. The Redis cluster's security group does not allow inbound traffic from the EC2 instance. What is the most likely cause of the timeout?
easy- A.The network ACL for the Redis subnet is blocking inbound traffic on port 6379
- ✓ B.The Redis cluster security group does not have an inbound rule allowing traffic from the EC2 security group on port 6379
- C.The subnet route table does not have a route to the Redis cluster
- D.The Redis cluster is not accessible from within the same VPC
Why B: Security groups are stateful, meaning that if an outbound rule allows traffic, the return traffic is automatically allowed. However, inbound traffic must be explicitly permitted by the target security group. In this scenario, the EC2 instance's security group allows outbound traffic to the Redis cluster's security group on port 6379, but the Redis cluster's security group does not have an inbound rule allowing traffic from the EC2 security group on that port. Therefore, the connection is blocked, causing timeout errors. Option A is incorrect because network ACLs are stateless and would affect both inbound and outbound traffic, but the issue is specifically with security groups. Option C is incorrect because subnet route tables control network routing, not port-level access. Option D is incorrect because ElastiCache for Redis clusters are accessible within the same VPC if proper security group rules are configured.
Last reviewed: Jun 20, 2026
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.