DBS-C01 Deployment and Migration Practice Question

Exhibit

Refer to the exhibit.

CloudFormation template snippet:

Resources:
  MyRDSInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t3.medium
      Engine: MySQL
      MultiAZ: true
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      VPCSecurityGroups:
        - !Ref MyDBSecurityGroup
      StorageType: gp2
      AllocatedStorage: 100
      BackupRetentionPeriod: 7
      DeletionProtection: true

  MyDBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for RDS
      VpcId: !Ref MyVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: 10.0.0.0/16

  MyDBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Subnet group for RDS
      SubnetIds:
        - subnet-12345678
        - subnet-87654321

  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0abcdef1234567890
      SecurityGroupIds:
        - !Ref MyEC2SecurityGroup
      SubnetId: subnet-12345678

  MyEC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for EC2
      VpcId: !Ref MyVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

Refer to the exhibit. A developer deploys this CloudFormation template. An application on the EC2 instance cannot connect to the RDS MySQL database. What is the MOST likely cause?

⚠ Common exam trap

It's easy for candidates to assume a VPC CIDR rule in the RDS security group will automatically cover all EC2 instances in the VPC, but they overlook that the EC2 instance's private IP might be outside that CIDR (e.g., due to subnet allocation or NAT) or that security group referencing is required for proper traffic flow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The EC2 security group allows inbound MySQL from 0.0.0.0/0 but the RDS security group only allows traffic from the VPC CIDR, which does not include the EC2 security group.

The RDS security group only allows inbound MySQL traffic from the VPC CIDR (e.g., 10.0.0.0/16), but the EC2 instance's security group is not referenced. Since the EC2 instance's private IP may fall outside that CIDR (e.g., if it uses a different subnet or a public IP), the RDS security group blocks the connection. Security group rules must explicitly reference the EC2 security group ID to allow traffic from that specific instance, not just the VPC CIDR.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The EC2 security group allows inbound MySQL from 0.0.0.0/0 but the RDS security group only allows traffic from the VPC CIDR, which does not include the EC2 security group.
Why this is correct
RDS SG should allow traffic from EC2 SG, not just VPC CIDR.
✗
The RDS instance has encryption enabled, preventing access from EC2.
Why it's wrong here
Encryption does not block network connectivity.
✗
The RDS instance has DeletionProtection enabled, which blocks connections.
Why it's wrong here
DeletionProtection prevents deletion, not connections.
✗
The EC2 instance is in a different Availability Zone than the RDS instance.
Why it's wrong here
Multi-AZ does not prevent connectivity across AZs.

Visual reference

Go deeper

DBS-C01 Deployment and Migration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question