DBS-C01 Security group inbound rule Practice Question
Network Topology
Refer to the exhibit. An engineer runs the CLI command to check security groups attached to the RDS instance 'mydb'. The output shows only one security group. The engineer wants to ensure that only traffic from an application server with IP 10.0.1.5 is allowed to the database port 3306. Which security group rule should be added?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an inbound rule to allow traffic from 10.0.1.5/32 on port 3306.
To allow only the specific IP 10.0.1.5 to access the database, an inbound rule must be added to the security group allowing traffic on port 3306 (MySQL/Aurora) from source 10.0.1.5/32. Option B is correct. Option A is incorrect because it uses port 80 (HTTP) instead of the database port. Option C is incorrect because an outbound rule controls egress, not ingress; inbound rules are needed to allow incoming connections to the database. Option D is incorrect because it allows traffic from any IP (0.0.0.0/0), which is insecure and would violate the requirement to restrict access to a single IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an inbound rule to allow traffic from 10.0.1.5/32 on port 80.
Why it's wrong here
Port 80 is for HTTP, not MySQL.
- ✓
Add an inbound rule to allow traffic from 10.0.1.5/32 on port 3306.
Why this is correct
Correctly restricts access to the specific IP.
- ✗
Add an outbound rule to allow traffic to 10.0.1.5 on port 3306.
Why it's wrong here
Outbound rules control traffic leaving the database, which is not the concern.
- ✗
Add an inbound rule to allow traffic from 0.0.0.0/0 on port 3306.
Why it's wrong here
Allows all traffic, defeating security.
Visual reference
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.