SAP-C02 Design for New Solutions Practice Question
A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)
⚠ Common exam trap
Many candidates confuse security best practices (like using Parameter Store for credentials) with network-level access controls, leading them to select Option C instead of recognizing that only security group rules and subnet placement directly control connectivity and internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.
Option B is correct because PostgreSQL listens on TCP port 5432, and referencing the web tier's security group as the source in the RDS security group's inbound rule allows only those EC2 instances to reach the database on that port. Option D is correct because placing the web tier instances in a private subnet removes them from direct internet exposure while still allowing outbound access to the RDS endpoint. Option E is correct because setting the RDS instance's 'Publicly accessible' option to 'No' ensures the database receives only a private IP address and cannot be reached from the internet. Option A is wrong because a public subnet would expose the database to internet routing, contradicting the requirement. Option C, while a good credential-management practice, does not control network access or port restrictions and is therefore not part of the required steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch the database instance in a public subnet.
Why it's wrong here
A public subnet exposes the RDS instance to internet routing, contradicting the requirement that the database be unreachable from the internet. Public subnets are tempting because they suit internet-facing load balancers and bastion hosts, but RDS belongs in private subnets reachable only from the web tier's security group.
- ✓
Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.
Why this is correct
Referencing the web tier's security group as the source restricts inbound database traffic to those instances only, on port 5432. This enforces the requirement that connections arrive solely through the PostgreSQL port from the web tier, rather than any broader CIDR range.
- ✗
Store database credentials in AWS Systems Manager Parameter Store.
Why it's wrong here
Parameter Store secures credential storage and rotation, but it neither restricts database access to a specific port nor removes internet reachability, so it fails the stated security objectives. It is tempting because it is a genuine best practise for secrets management, and would be correct if the question asked how to avoid hard-coded credentials.
- ✓
Launch the web tier instances in a private subnet.
Why this is correct
Private subnets have no route to an internet gateway, so web tier instances cannot receive inbound connections from the internet. This supports the requirement that the database remain unreachable externally while instances still reach it internally within the VPC.
- ✓
Set the 'Publicly accessible' option of the RDS instance to 'No'.
Why this is correct
Setting Publicly accessible to No removes the RDS instance's public DNS endpoint and public IP, so it can only be reached from within the VPC. This directly satisfies the requirement that the database not be accessible from the internet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.