SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add an inbound rule to the RDS security group that allows traffic from the VPC CIDR on port 3306.

  Why it's wrong here

  Adding an inbound rule that permits the entire VPC CIDR on port 3306 grants every resource within the VPC—including unrelated compute instances, containers, and future deployments—the ability to connect to the database. This violates the principle of least privilege because it is not scoped to the application server, and it becomes especially risky if the VPC spans multiple subnets or contains other environments that do not require database access.

• ✓

  Add an inbound rule to the RDS security group that allows traffic from the security group of the application server on port 3306.

  Why this is correct

  This is the correct approach: referencing the application server's security group (SG) as the source in the RDS inbound rule permits only traffic originating from network interfaces attached to that specific SG. This pattern—often called SG chaining—is dynamically updated if the instance's private IP changes, is not tied to subnet boundaries, and automatically covers any additional instances that later receive the same SG, making it the most precise and maintainable solution.

• ✗

  Add an inbound rule to the RDS security group that allows traffic from the subnet CIDR of the application server on port 3306.

  Why it's wrong here

  Using the application server's subnet CIDR is an improvement over the VPC CIDR but still over-permissive: any EC2 instance, container, or other resource launched into that subnet can reach the database on port 3306, not just the intended application server. Security group rules are evaluated against the source IP, so this approach cannot distinguish between different instances sharing the same subnet, and it would also include any future resources deployed in that subnet, leaving a broader attack surface than necessary.

• ✗

  Add an inbound rule to the RDS security group that allows traffic from 0.0.0.0/0 on port 3306.

  Why it's wrong here

  Opening port 3306 to 0.0.0.0/0 makes the RDS endpoint reachable from any IP on the Internet, thereby exposing your database credentials to brute-force attacks, SQL injection exploits, and unauthorised data retrieval. Even if the RDS instance is not publicly accessible, such a rule is a severe security misconfiguration and a common source of database breaches, violating the fundamental principle of never exposing a database to the public internet.

Go deeper

Related to this question