DBS-C01 Database Security Practice Question
A security audit reveals that an Amazon RDS for MySQL DB instance is accessible from the internet. The security team requires that the database be accessible only from a specific set of application servers within the same VPC. Which solution should be implemented?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the DB instance's security group to allow inbound traffic only from the application servers' security group.
Modifying the DB instance's security group to allow inbound traffic only from the application servers' security group restricts access to only those instances, using the security group as a source for a more dynamic and manageable solution. Option B is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and allowing from the application servers' IP range is less flexible and secure than using security group references. Option C is incorrect because enabling encryption at rest protects data at rest but does not control network access. Option D is incorrect because moving to a private subnet and using a bastion host is unnecessary when the application servers are in the same VPC; a security group rule is simpler and more appropriate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the DB instance's security group to allow inbound traffic only from the application servers' security group.
Why this is correct
Security group references allow traffic from instances with that security group.
- ✗
Apply a network ACL that denies inbound traffic from 0.0.0.0/0 and allows from the application servers' IP range.
Why it's wrong here
Network ACLs are stateless and would require additional rules for return traffic; security groups are preferred.
- ✗
Enable encryption at rest on the DB instance to prevent unauthorized access.
Why it's wrong here
Encryption does not control network access.
- ✗
Move the DB instance to a private subnet and configure a bastion host for access.
Why it's wrong here
This adds complexity; the app servers are in the same VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)
easy- A.Place the DB instance in a public subnet.
- B.Modify the DB parameter group to restrict network access.
- ✓ C.Configure the security group to allow inbound traffic only from the application server's security group.
- ✓ D.Set the DB instance to be not publicly accessible.
- E.Configure a network ACL to deny inbound traffic from 0.0.0.0/0.
Why C: To meet the requirements, two configurations are needed. First, the DB instance must be set to not publicly accessible (Option D) to ensure it cannot be reached from the internet. Second, the security group associated with the DB instance must allow inbound traffic only from the application server's security group (Option C), which restricts access to resources within the VPC. Option A is incorrect because placing the DB instance in a public subnet would expose it to the internet. Option B is incorrect because the DB parameter group controls database engine settings, not network access. Option E is incorrect because network ACLs are stateless and a rule denying all inbound traffic would block legitimate traffic as well; security groups are the appropriate mechanism for this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.