SAA-C03 Design Secure Architectures Practice Question

A solutions architect is configuring a VPC for a three-tier web application. The database tier must not be reachable from the internet, and only the application tier should be able to initiate connections to the database on port 3306. The application tier runs on EC2 instances in a separate subnet. Which configuration enforces this requirement?

⚠ Common exam trap

The trap here is relying on subnet routing alone for isolation while leaving the database port open to a broad CIDR, which permits lateral access from other resources inside the VPC.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Place the database instances in a private subnet and attach a security group that allows inbound MySQL traffic from the application tier's security group on port 3306.

A security group rule that names the application tier's security group as the source grants access based on identity rather than IP range, so only those instances can reach the database on port 3306. Hosting the database in a private subnet removes any internet route, which is what keeps the tier unreachable from outside the VPC.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Place the database instances in a private subnet and attach a network ACL that allows inbound traffic from the application subnet's CIDR range on port 3306.
Why it's wrong here
A network ACL filters at the subnet boundary and is stateless, so return traffic must also be explicitly allowed. Allowing the application subnet CIDR does not restrict which instances may connect, and unlike a security group reference it does not follow instances as they scale or move, so the access is broader and more fragile than required.
✗
Place the database instances in a private subnet and attach a security group that allows inbound traffic on port 3306 from 0.0.0.0/0, relying on the subnet's lack of an internet route for protection.
Why it's wrong here
Allowing 0.0.0.0/0 on the database port means any resource that can route to the subnet, including other VPC subnets or peered networks, can attempt a connection. Relying on routing alone ignores lateral movement inside the VPC and removes the defense-in-depth that a scoped security group rule provides.
✓
Place the database instances in a private subnet and attach a security group that allows inbound MySQL traffic from the application tier's security group on port 3306.
Why this is correct
Referencing the application tier's security group as the source means only instances that carry that group can open a connection to port 3306, regardless of their IP addresses. A private subnet has no route to an internet gateway, so the database tier is not reachable from the internet, satisfying both parts of the requirement.
✗
Place the database instances in a public subnet and attach a security group that allows inbound MySQL traffic only from the application tier's public IP addresses.
Why it's wrong here
A public subnet has a route to an internet gateway, so the database could be reachable from the internet if the security group or routing is ever misconfigured. Pinning access to specific public IP addresses breaks when instances are replaced by Auto Scaling and does not provide the same identity-based control as a security group reference.

Visual reference

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question