DBS-C01 Deployment and Migration Practice Question
Network Topology
After migrating a database to Amazon RDS, an application on an EC2 instance in the same VPC cannot connect. The command in the exhibit shows the endpoint. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume that being in the same VPC guarantees connectivity, but AWS security groups are stateful and require explicit inbound rules, even for intra-VPC traffic, which is a core concept tested in the DBS-C01 exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the DB instance does not allow inbound traffic from the EC2 instance's security group.
The most likely cause is that the security group for the RDS DB instance does not have an inbound rule allowing traffic from the EC2 instance's security group on the database port (typically TCP 3306 for MySQL or 5432 for PostgreSQL). Even though both resources are in the same VPC, security groups act as virtual firewalls that must explicitly permit inbound connections from the source. The command output showing the endpoint confirms the DNS resolution works, so the issue is at the network access control layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EC2 instance is in a different VPC and needs a VPN connection.
Why it's wrong here
The problem states they are in the same VPC.
- ✓
The security group for the DB instance does not allow inbound traffic from the EC2 instance's security group.
Why this is correct
Security group rules control access; if not configured, connections are blocked.
- ✗
The DB instance endpoint is incorrect.
Why it's wrong here
The endpoint appears valid.
- ✗
The DB instance is not publicly accessible.
Why it's wrong here
Public accessibility is not required for internal VPC connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.