ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?
⚠ Common exam trap
Test-takers frequently confuse the directionality of NAT gateways (outbound only) or assume that placing a database in a public subnet with a network ACL is sufficient, overlooking the inherent security advantage of keeping the instance in a private subnet without public exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.
Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a public IP address to the DB instance and restrict access using a security group.
Why it's wrong here
Making the DB instance publicly accessible exposes it to the internet, which is less secure.
- ✗
Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.
Why it's wrong here
NAT gateways are for outbound traffic only; they do not support inbound connections from on-premises.
- ✗
Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.
Why it's wrong here
Network ACLs are stateless and less granular; public subnet also exposes the DB instance to the internet.
- ✓
Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.
Why this is correct
Private subnet with security group provides granular, stateful firewall control without internet exposure.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.