Troubleshoot Amazon RDS for Oracle Connection Issues: Public Subnet and DB Subnet Group
A developer reports that an application is unable to connect to an Amazon RDS for Oracle database. The security group for the database allows inbound traffic on port 1521 from the application's security group. The database is publicly accessible. What should be checked next?
Quick Answer
The answer is to verify that the DB subnet group includes a public subnet with an internet gateway. This is correct because even when a database is marked as publicly accessible, the underlying DB subnet group must contain at least one subnet that is routed to an internet gateway; without that route, the public IP address assigned to the RDS instance cannot be reached from outside the VPC. On the AWS Certified Database Specialty DBS-C01 exam, this question tests your understanding of how network connectivity layers interact—specifically, that security group rules alone are insufficient if the subnet’s route table lacks an internet gateway. A common trap is assuming “publicly accessible” automatically grants external access, but the subnet group configuration is the gatekeeper. Memory tip: “Public subnet + IGW = public access; private subnet = no public access, regardless of the checkbox.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the DB subnet group includes a public subnet with an internet gateway.
The database is publicly accessible, meaning it must be in a public subnet that has an internet gateway attached. Even if the security group allows traffic, the subnet must be configured correctly for public access. Option A is incorrect because the 'remote_listener' parameter affects Oracle listener registration, not basic network connectivity. Option B is incorrect because backup retention is unrelated to connection issues. Option D is incorrect because CloudWatch Logs may not capture failed connection attempts at the network level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the DB parameter group for the 'remote_listener' parameter.
Why it's wrong here
Parameter group changes don't affect network connectivity.
- ✗
Check the automated backup retention period.
Why it's wrong here
Backup retention does not affect connectivity.
- ✓
Verify that the DB subnet group includes a public subnet with an internet gateway.
Why this is correct
Public accessibility requires a public subnet and internet gateway.
- ✗
Review the CloudWatch Logs for error logs.
Why it's wrong here
Error logs may not show failed connection attempts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer reports that an application is unable to connect to an Amazon RDS for MySQL DB instance. The security group for the DB instance allows inbound traffic on port 3306 from the application server's security group. The DB instance is in a VPC with both public and private subnets. The application server is in a private subnet. What is the most likely cause of the connection failure?
easy- A.The DB instance is in a public subnet and the application server is in a private subnet, so they cannot communicate.
- B.The security group for the DB instance does not allow inbound traffic from the application server's security group.
- ✓ C.The network ACL for the private subnet is blocking outbound traffic to the DB instance.
- D.The DB instance is not part of a DB subnet group that includes the private subnet.
Why C: The most likely cause is that the network ACL (NACL) for the private subnet is blocking outbound traffic to the DB instance. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit rules for both inbound and outbound. If the private subnet's NACL does not allow outbound traffic to the DB instance's subnet on port 3306, the application server cannot initiate the connection. Options A and B are incorrect because the security group already allows inbound traffic, and instances in public and private subnets within the same VPC can communicate via private IPs. Option D is incorrect; while a DB subnet group is required for RDS, it does not directly affect connectivity once the instance is running.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.