ANS-C01 Network Security, Compliance and Governance Practice Question
A security engineer must ensure that all traffic between an application running on Amazon EC2 and an Amazon RDS database is encrypted in transit. The VPC has a public subnet for the EC2 instance and a private subnet for the RDS database. What is the MOST secure way to enforce encryption for this traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.
Configuring the RDS DB instance to require SSL/TLS connections ensures that the application encrypts data in transit when connecting to the database. This is the most secure way to enforce encryption for traffic between EC2 and RDS. Option A is incorrect because IAM database authentication controls access, not encryption. Option B is incorrect because a security group rule allowing only port 443 does not enforce encryption; it only restricts traffic to that port. Option D is incorrect because placing both resources in the same subnet does not enforce encryption, and a network ACL is stateless and cannot enforce encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable IAM database authentication for the RDS instance.
Why it's wrong here
IAM database authentication does not enforce encryption; it uses IAM credentials for access but does not encrypt the connection.
- ✗
Use a security group rule that allows traffic only on port 443.
Why it's wrong here
Security groups filter traffic based on IP addresses and ports, not encryption. Port 443 does not guarantee encryption.
- ✓
Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.
Why this is correct
Enabling SSL/TLS on RDS ensures that all connections to the database are encrypted in transit.
- ✗
Place both the EC2 instance and the RDS database in the same subnet and use a network ACL to enforce encryption.
Why it's wrong here
Network ACLs operate at the subnet level and cannot enforce encryption; they only allow or deny traffic based on rules.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.