SAP-C02 Design for New Solutions Practice Question
A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon ECS with Fargate. The compliance team requires that all data in transit between the application and the database must be encrypted. The database is an Amazon RDS for PostgreSQL instance. The application connects to the database using a connection string that includes the database endpoint. The security team has enabled encryption in transit on the RDS instance using a certificate. The application is currently failing to connect to the database with an error related to SSL/TLS. The development team verified that the connection string includes the sslmode=require parameter. What is the most likely cause of the connection failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1.
The most likely cause is that the RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1. Even though the application uses sslmode=require in the connection string, the RDS instance must enforce SSL connections by setting this parameter. Without it, the RDS instance may not require SSL, leading to a connection failure when the client attempts to negotiate SSL. Option A is incorrect because RDS uses certificates signed by a trusted CA; the issue is not about trust. Option B is incorrect because the database port is 5432, not 443. Option C is incorrect because Fargate containers include necessary SSL libraries by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The RDS instance is using a public certificate that is not trusted by the application.
Why it's wrong here
RDS uses a trusted certificate; the issue is that SSL is not enforced.
- ✗
The security group for the RDS instance does not allow inbound traffic on port 443.
Why it's wrong here
PostgreSQL uses port 5432, not 443.
- ✗
The Fargate task does not have the necessary SSL libraries installed.
Why it's wrong here
Fargate containers typically include SSL libraries.
- ✓
The RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1.
Why this is correct
The rds.force_ssl parameter must be set to enforce SSL connections.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.