ANS-C01 Network Management and Operations Practice Question
A company has a VPC with a public subnet and a private subnet. The public subnet has a bastion host (EC2) with a security group that allows SSH from a specific IP range. The private subnet has an RDS instance. The company wants to enable the bastion host to connect to the RDS instance. Which TWO steps are required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.
The bastion host needs network-level access to the RDS instance. The RDS security group must allow inbound from the bastion's security group, and the bastion must be in the same VPC or have network connectivity. The NACL must allow the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the RDS instance to use a custom DB parameter group with SSL enabled.
Why it's wrong here
SSL is for encryption, not for access control.
- ✓
Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.
Why this is correct
NACL must allow inbound traffic from the bastion to the RDS port.
- ✗
Assign a public IP address to the RDS instance.
Why it's wrong here
RDS instances typically are not assigned public IPs; they should be private.
- ✗
Create a route in the public subnet's route table to the RDS instance.
Why it's wrong here
The public subnet route table doesn't need a route to RDS; the bastion already has a route via the local route.
- ✓
Add a rule to the RDS security group that allows inbound traffic from the bastion host's security group.
Why this is correct
This allows the bastion to initiate connections to RDS.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.