ANS-C01 Network Security, Compliance and Governance Practice Question
A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish an AWS Site-to-Site VPN connection
An AWS Site-to-Site VPN connection establishes a secure, encrypted tunnel between the on-premises network and the Amazon VPC, allowing resources like RDS databases to be accessed privately without traversing the public internet. Option A is incorrect because a NAT gateway enables outbound internet traffic from a private subnet, not inbound private access from on-premises. Option B is incorrect because while Amazon RDS supports interface VPC endpoints, these endpoints are only accessible from within the VPC and do not provide connectivity from an on-premises network; a VPC endpoint alone does not meet the requirement. Option C is incorrect because VPC Peering connects two VPCs within AWS, not an on-premises network to a VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a NAT gateway in the VPC
Why it's wrong here
NAT gateway enables outbound internet for private subnets, not inbound access from on-premises.
- ✗
Create a VPC endpoint for RDS
Why it's wrong here
Although Amazon RDS supports Interface VPC endpoints, these endpoints only allow private access to RDS from within the VPC or via on-premises connections that already exist (like VPN or Direct Connect). A VPC endpoint alone does not provide connectivity from on-premises networks; it requires an underlying network connection such as VPN or Direct Connect. Therefore, using only a VPC endpoint does not meet the requirement.
- ✗
Configure VPC Peering between the on-premises network and the VPC
Why it's wrong here
VPC Peering does not support on-premises networks; it connects VPCs within AWS.
- ✓
Establish an AWS Site-to-Site VPN connection
Why this is correct
A VPN connection securely connects on-premises to the VPC, allowing private access to RDS.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.