SAA-C03 Design Secure Architectures Practice Question
A media company runs a two-tier web application in a VPC. The web tier is in public subnets behind an internet-facing Application Load Balancer, and the database tier is in private subnets running Amazon RDS. A security review found that the RDS security group allows traffic from 0.0.0.0/0 on port 3306. What is the MOST secure way to restrict database access to only the web tier?
⚠ Common exam trap
The trap here is choosing a CIDR-based rule for convenience, when security group referencing is both narrower and resilient to instance IP changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the RDS security group inbound rule to allow port 3306 from the web tier's security group ID.
Security group referencing lets the database accept connections only from instances that belong to the web tier's security group, which is the tightest and most maintainable control. It removes the 0.0.0.0/0 exposure and automatically adapts as the web tier scales. VPC-wide CIDRs, public subnets, and network ACL CIDR rules are all broader or more fragile than a security group reference.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change the RDS security group inbound rule to allow port 3306 from the web tier's security group ID.
Why this is correct
Referencing the web tier's security group as the source allows traffic only from instances that carry that group, regardless of their IP addresses. This is the recommended pattern because it survives scaling and IP changes and removes the wide-open CIDR. It directly closes the exposure while preserving connectivity between the tiers, making it the most secure and maintainable fix.
- ✗
Create a network ACL on the database subnet that denies all traffic except port 3306 from the web subnet CIDR.
Why it's wrong here
Network ACLs are stateless and operate at the subnet boundary, so they cannot reference security groups and require managing both inbound and outbound ephemeral ports. Using subnet CIDRs also allows any instance in those subnets, not just the web tier. This is more complex and less precise than a security group reference, and it is easy to misconfigure.
- ✗
Change the RDS security group inbound rule to allow port 3306 from the VPC CIDR range.
Why it's wrong here
Allowing the entire VPC CIDR is broader than necessary and would permit any resource in the VPC, including future or compromised instances, to reach the database. It does reduce exposure compared with 0.0.0.0/0, but it does not scope access to the web tier specifically. This violates least privilege and fails the goal of restricting access to only the web tier.
- ✗
Move the RDS instance into a public subnet and attach an Elastic IP, then restrict access by IP allowlist.
Why it's wrong here
Placing a database in a public subnet exposes it to the internet and is a serious security regression. IP allowlisting is brittle because web tier instances change addresses as they scale or are replaced. This approach increases attack surface and operational overhead while failing to restrict access to the web tier in a reliable way, so it is not the most secure option.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.