SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the RDS Security Group to allow inbound traffic on the database port from the Application Security Group ID.

  Why this is correct

  Referencing the Security Group ID of the application tier is the most secure method for allowing traffic. It avoids relying on IP addresses, which can change in dynamic environments. This ensures that only resources associated with the application tier can reach the database, effectively isolating the database from unauthorized network segments.

• ✗

  Attach an Internet Gateway to the route table associated with the private subnet containing the RDS instance.

  Why it's wrong here

  Attaching an Internet Gateway to a private subnet creates a public subnet, exposing the RDS instance to the internet. Infrastructure security dictates that databases must reside in private subnets without routes to an IGW. Adding this route would violate core security compliance requirements for protecting sensitive backend database resources.

• ✗

  Configure the RDS Security Group to allow inbound traffic from the CIDR block of the VPC.

  Why it's wrong here

  Allowing traffic from the entire VPC CIDR is overly permissive and violates the principle of least privilege. If another compromised service in the VPC gains network access, it could attempt to connect to the database. Access should always be restricted to the specific resource or security group of the application tier.

• ✓

  Deploy the RDS instance in a private subnet and ensure no route to the Internet Gateway exists.

  Why this is correct

  Placing the database in a private subnet without a path to an Internet Gateway is a fundamental requirement for infrastructure security. This prevents direct inbound or outbound communication with the public internet, reducing the risk of data exfiltration or external reconnaissance attempts against the database instance's network interface and underlying services.

• ✗

  Enable Public Accessibility on the RDS instance to allow the Application tier to resolve the endpoint.

  Why it's wrong here

  Enabling public accessibility assigns a public IP to the RDS instance, which is a significant security risk. Applications should connect to RDS using the private DNS endpoint, which resolves to the private IP address within the VPC. Public accessibility is never required for internal application-to-database communication within a VPC environment.