DBS-C01 Deployment and Migration Practice Question
Network Topology
Refer to the exhibit. A company is migrating from an on-premises MySQL database to Amazon RDS for MySQL. The DBA wants to connect to the RDS instance using the endpoint shown. What additional step is required to allow the DBA's client to connect?
⚠ Common exam trap
The DBS-C01 exam often tests the misconception that making an RDS instance publicly accessible alone is sufficient for connectivity, but the security group rule is the actual gatekeeper; public accessibility only assigns a public IP, while the security group still blocks traffic without an explicit inbound rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the security group to allow inbound traffic on port 3306 from the client IP
Amazon RDS security groups act as a virtual firewall controlling inbound and outbound traffic. By default, no inbound traffic is allowed on port 3306 (MySQL). To permit the DBA's client to connect, you must modify the security group associated with the RDS instance to add an inbound rule that allows TCP traffic on port 3306 from the client's IP address (or a range that includes it). Without this rule, the connection is blocked at the network level regardless of other configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the security group to allow inbound traffic on port 3306 from the client IP
Why this is correct
Security group rules control inbound traffic; port 3306 must be open.
- ✗
Create a Route 53 record for the endpoint
Why it's wrong here
The endpoint DNS is already provided; no additional Route 53 record is needed.
- ✗
Create a MySQL user that matches the client's IP
Why it's wrong here
A MySQL user is needed, but that is part of setup, not the connection issue.
- ✗
Change the RDS instance to be publicly accessible
Why it's wrong here
The instance may already be public; the endpoint is shown, but security group still needs to allow access.
Visual reference
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.