ANS-C01 Network Design Practice Question
A company needs to allow a specific IP address range (203.0.113.0/24) to access an Amazon RDS database in a private subnet. The RDS instance is deployed in a VPC with no public access. Which configuration step is required?
⚠ Common exam trap
The trap here is that candidates often focus on firewall rules (security groups or NACLs) without realizing that a private subnet has no direct internet path, so a VPN or Direct Connect is required first to establish Layer 3 connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway
The RDS instance is in a private subnet with no public access, so it cannot be reached directly from the internet. To allow an on-premises IP range (203.0.113.0/24) to access it, you need a private connection such as an AWS Site-to-Site VPN. This creates an encrypted tunnel over the internet, and the route tables must be updated to direct traffic for the on-premises CIDR to the virtual private gateway (VGW), enabling private IP communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a security group rule allowing inbound traffic from 203.0.113.0/24
Why it's wrong here
This is necessary but not sufficient; there is no network path from that IP range to the private subnet.
- ✓
Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway
Why this is correct
A VPN provides a secure tunnel from on-premises to the VPC, and route tables direct traffic to the VPN gateway.
- ✗
Assign a public IP address to the RDS instance
Why it's wrong here
Assigning a public IP would expose the database to the internet, which is not desired and may not be allowed for security reasons.
- ✗
Modify the network ACL of the private subnet to allow inbound traffic from 203.0.113.0/24
Why it's wrong here
Same as A; a network path must exist first.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.