SAP-C02 Design for New Solutions Practice Question
A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)
⚠ Common exam trap
Many candidates confuse security best practices (like using Parameter Store for credentials) with network-level access controls, leading them to select Option C instead of recognizing that only security group rules and subnet placement directly control connectivity and internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.
The database security group should allow inbound traffic on port 5432 (the default PostgreSQL port) from the web tier security group. This creates a security group-level firewall rule that restricts database access to only the web tier instances, ensuring no other sources can connect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch the database instance in a public subnet.
Why it's wrong here
Public subnets are internet-facing; database should be in private subnet.
- ✓
Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.
Why this is correct
Security group rules restrict traffic to only the web tier.
- ✗
Store database credentials in AWS Systems Manager Parameter Store.
Why it's wrong here
This is a best practice but does not address network security.
- ✓
Launch the web tier instances in a private subnet.
Why this is correct
Private subnets have no direct internet access, enhancing security.
- ✓
Set the 'Publicly accessible' option of the RDS instance to 'No'.
Why this is correct
This ensures no public IP is assigned to the database.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.