SAA-C03 Design Secure Architectures Practice Question

A financial services firm runs a three-tier web application on AWS. The security team wants to ensure that only the application tier can connect to the database tier on TCP port 5432, and that no other subnet can initiate connections to the database. The database runs on Amazon RDS for PostgreSQL in a dedicated subnet group. Which combination of controls enforces this requirement with the LEAST administrative effort?

⚠ Common exam trap

The trap here is reaching for network ACLs or route tables for tier isolation, when security group referencing is the intended mechanism for allowing one tier to reach another.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a security group for the database that allows inbound TCP 5432 from the application tier's security group, and assign it to the RDS instance.

Security groups are stateful and support referencing other security groups as sources, which allows the database to accept connections only from instances that carry the application tier's security group. This automatically scales with the application tier and avoids managing CIDR ranges or ephemeral ports. Network ACLs, route tables, and PrivateLink do not provide the same identity-aware, instance-level enforcement with minimal effort.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS PrivateLink to expose the database through a VPC endpoint and attach an endpoint policy that allows only the application tier.
Why it's wrong here
AWS PrivateLink is designed for accessing services and endpoints, not for exposing an RDS database to a specific tier within the same VPC. Endpoint policies apply to the endpoint, not to the database listener, and RDS does not natively support being fronted by PrivateLink for this purpose. This option adds cost and complexity without enforcing the required tier isolation.
✓
Create a security group for the database that allows inbound TCP 5432 from the application tier's security group, and assign it to the RDS instance.
Why this is correct
Referencing the application tier's security group as the source in the database security group's inbound rule allows only instances that carry that security group to connect on port 5432. This is the least-effort approach because it automatically adapts as application instances scale in or out, and it does not require managing individual IP addresses or network ACLs.
✗
Place the database in a private subnet and configure a route table that only the application tier can use to reach it.
Why it's wrong here
Route tables control where traffic is sent, not who is allowed to initiate connections. Any resource with a route to the database subnet could still attempt a connection, and route tables cannot enforce port-level or identity-based rules. This approach does not meet the requirement to restrict access to a specific tier and adds unnecessary network complexity.
✗
Create a network ACL on the database subnet that allows inbound TCP 5432 from the application subnet CIDR and denies all other inbound traffic.
Why it's wrong here
Network ACLs are stateless and subnet-level, so they cannot distinguish between instances in the same subnet or reference security groups. They also require managing ephemeral port ranges for return traffic, which adds complexity. While they can restrict traffic, they do not provide the identity-aware, instance-level control that the requirement demands, and they increase administrative effort.

Visual reference

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question