DBS-C01 Deployment and Migration Practice Question
A developer needs to deploy an Amazon RDS for MySQL DB instance that is accessible only from a specific EC2 instance in a VPC. Which configuration ensures this?
⚠ Common exam trap
Many candidates confuse IAM roles with network security, thinking they can control database access via IAM, when in fact IAM is used for API-level permissions and not for filtering TCP/IP traffic to an RDS instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the RDS instance in the same VPC as the EC2 instance and configure a security group inbound rule referencing the EC2 security group
Placing the RDS instance in the same VPC as the EC2 instance and configuring a security group inbound rule that references the EC2 instance's security group allows traffic only from that specific EC2 instance. Security group rules are stateful and support referencing other security groups as sources, which provides a precise and secure method for controlling database access without exposing the RDS instance to the broader network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an IAM role to allow the EC2 instance to connect to the RDS instance
Why it's wrong here
IAM roles control authentication, not network access.
- ✗
Enable public accessibility and assign a public IP to the RDS instance
Why it's wrong here
Public accessibility would make the DB accessible from the internet, violating the requirement.
- ✗
Place RDS and EC2 in different subnets and configure a network ACL
Why it's wrong here
Network ACLs are stateless and not specific to security group-level access.
- ✓
Place the RDS instance in the same VPC as the EC2 instance and configure a security group inbound rule referencing the EC2 security group
Why this is correct
This ensures traffic is allowed only from the specific EC2 security group.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.