SCS-C02 Infrastructure Security Practice Question

A security engineer needs to ensure that an Amazon RDS database instance is not accessible from the internet. Which configuration step will achieve this?

⚠ Common exam trap

Many candidates assume security group rules alone can fully control internet access, overlooking the critical distinction between public and private IP assignment and subnet routing that determines actual internet reachability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set the DB instance to be not publicly accessible and place it in a private subnet.

Setting a DB instance to be not publicly accessible ensures that it does not receive a public IP address, and placing it in a private subnet (one without a route to an internet gateway) prevents any direct inbound or outbound traffic from the internet. This combination guarantees that the RDS instance is isolated from the public internet, aligning with the security requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Deploy the DB instance in a multi-AZ configuration.
Why it's wrong here
A Multi-AZ deployment replicates data synchronously to a standby in a different Availability Zone to provide high availability and automatic failover, but it does not alter the network path or DNS visibility of the database. Both the primary and standby are launched in the same VPC and inherit the same subnet-level routing, so an RDS instance in a public subnet or marked publicly accessible remains reachable from the internet regardless of Multi-AZ. Multi-AZ addresses resilience, not unauthorized internet access.
✗
Set the DB instance to be publicly accessible and restrict security group inbound rules.
Why it's wrong here
Setting the DB instance to publicly accessible gives it a public IP address and a resolvable public DNS endpoint, and RDS automatically provisions a route for internet-bound traffic. Even if you restrict the security group to specific CIDR blocks, the instance is still exposed to internet reachability, and any misconfigured rule or overly broad source could allow external connections. This approach violates the requirement of keeping the database inaccessible from the internet, because the instance's presence on the public network is neither necessary nor safe.
✓
Set the DB instance to be not publicly accessible and place it in a private subnet.
Why this is correct
Marking the DB instance as not publicly accessible prevents RDS from assigning any public IP address, and placing it in a private subnet with no route to an internet gateway ensures no inbound traffic can reach it from the internet. The database will only be reachable through its private IP address within the VPC, and clients must connect via resources in the same VPC, a VPN, or a bastion host. This configuration is the AWS best practice for database isolation.
✗
Use the default VPC security group for the DB instance.
Why it's wrong here
The default VPC security group automatically permits all inbound traffic from other resources in the same security group, which creates overly permissive trust relationships within the VPC, but it does not block internet traffic on its own. Using the default security group does not change whether the RDS instance is publicly accessible, nor does it influence subnet routing, so an instance marked publicly accessible would still be reachable from the internet despite the default security group. Default security groups are not designed for internet isolation and may inadvertently allow broad internal access, making them unsuitable for protecting a private database.

Visual reference

Go deeper

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question