← PAS-C01·Amazon Web Services

Question 21 of 1,733

Technology →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is to attach the same security group to both the ECS tasks and the RDS instance, then add a self-referencing inbound rule allowing traffic on port 3306 from that security group. This works because security group rules evaluate traffic based on the source security group’s associated elastic network interfaces, not IP addresses; when the same group is attached to the Fargate tasks’ ENIs, the self-referencing rule allows the RDS instance to accept connections from those tasks. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this scenario tests your understanding of how security group IDs function as sources in VPC networking, a common trap where candidates mistakenly add the task’s security group ID to the RDS inbound rule without attaching it to the tasks themselves. Remember: for security group self-referencing to work, the group must be physically attached to the source ENI—think “same group, same rule, same ENI.”

PAS-C01 Technology Practice Question

This PAS-C01 practice question tests your understanding of technology. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are also in private subnets. The security group for the RDS instance allows inbound traffic on port 3306 from the security group attached to the ECS tasks. However, the application cannot connect to the database. Which solution should the company implement to resolve this issue?

Question 1hardmultiple choice

Review the full subnetting walkthrough →

A
Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway
Why wrong: Assigning public IPs and using a NAT gateway is unnecessary for private subnet communication within the same VPC and could introduce security risks.
B
Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306
Using the same security group for both resources and allowing inbound from the group itself (self-reference) enables traffic between them, regardless of outbound rules. This is a common pattern for internal communication.
C
Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity
Why wrong: Placing resources in public subnets is not a best practice and may not be allowed due to security policies. Also, the issue is likely not about public vs private.
D
Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID
Why wrong: While this would work, it is less secure than using security group references and is not the best practice. The existing rule using the security group ID should already work if properly configured.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306

Option B is correct because when using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway
Why it's wrong here
Assigning public IPs and using a NAT gateway is unnecessary for private subnet communication within the same VPC and could introduce security risks.
✓
Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306
Why this is correct
Using the same security group for both resources and allowing inbound from the group itself (self-reference) enables traffic between them, regardless of outbound rules. This is a common pattern for internal communication.
Related concept
Read the scenario before looking for a memorised answer.
✗
Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity
Why it's wrong here
Placing resources in public subnets is not a best practice and may not be allowed due to security policies. Also, the issue is likely not about public vs private.
✗
Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID
Why it's wrong here
While this would work, it is less secure than using security group references and is not the best practice. The existing rule using the security group ID should already work if properly configured.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often assume security group rules using security group IDs require the source and destination to be in the same security group, but they actually require the source security group to be attached to the source resource's ENI, and the rule must be a self-referencing rule (allowing traffic from itself) to work correctly when both resources share the same security group.

Detailed technical explanation

How to think about this question

Security group rules using security group IDs as sources rely on the AWS VPC's internal mapping of network interfaces to security groups. When an ECS task with Fargate is launched, an elastic network interface (ENI) is created and attached to the task, and the security group is applied to that ENI. The RDS instance's security group rule referencing the same security group ID allows traffic from any ENI that has that security group, regardless of the ENI's IP address. This is a key advantage of security group-based rules over CIDR-based rules in dynamic environments like Fargate, where task IPs are ephemeral.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PAS-C01 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Design of SAP Workloads on AWS practice questions

Practise PAS-C01 questions linked to Design of SAP Workloads on AWS.

Technology practice questions

Practise PAS-C01 questions linked to Technology.

Migration practice questions

Practise PAS-C01 questions linked to Migration.

Operations and Maintenance practice questions

Practise PAS-C01 questions linked to Operations and Maintenance.

PAS-C01 fundamentals practice questions

Practise PAS-C01 questions linked to PAS-C01 fundamentals.

PAS-C01 scenario practice questions

Practise PAS-C01 questions linked to PAS-C01 scenario.

PAS-C01 troubleshooting practice questions

Practise PAS-C01 questions linked to PAS-C01 troubleshooting.

Practice this exam

Start a free PAS-C01 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PAS-C01 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PAS-C01 question test?

Technology — This question tests Technology — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306 — Option B is correct because when using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

What should I do if I get this PAS-C01 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.