Restrict Database Access to Application Tier — Security Group Referencing
A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?
Quick Answer
The answer is to allow inbound database traffic from the security group attached to the application instances. This configuration is correct because security group referencing dynamically scales with your Auto Scaling group—when new application instances launch, they inherit the same security group and are automatically granted access without updating any rules. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of stateful security groups versus stateless network ACLs, and the common trap is choosing the public subnet CIDR, which would permit any instance in that subnet, not just your application tier. Remember that security groups support logical referencing of other groups, making them ideal for dynamic architectures where instance IPs change. A simple memory tip: think “group-to-group, not IP-to-IP” for scalable, secure database access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow inbound database port from the security group attached to the application instances in the public subnet.
Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet. Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Allow inbound database port from the security group attached to the application instances in the public subnet.
Why this is correct
This dynamically allows traffic from all application instances.
- ✗
Allow inbound database port from 0.0.0.0/0 in the database security group.
Why it's wrong here
This would expose the database to the internet.
- ✗
Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.
Why it's wrong here
Network ACLs are stateless and do not support security group references.
- ✗
Allow inbound database port from the public subnet CIDR block in the database security group.
Why it's wrong here
This would allow traffic from any instance in the public subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is designing a VPC with public and private subnets. The VPC will host web servers in public subnets and database servers in private subnets. The web servers need to send traffic to the database servers, and the database servers must not have direct internet access. Which TWO configurations should the engineer implement?
medium- A.Use network ACLs to block all inbound traffic to the private subnets.
- ✓ B.Configure security group rules to allow inbound traffic from the web server security group to the database security group.
- ✓ C.Do not add a route to an internet gateway in the route table for the private subnets.
- D.Attach an internet gateway to the VPC and route the private subnets to it.
- E.Add a NAT gateway in the public subnet and route the private subnets to it.
Why B: Security group rules are stateful and can reference other security groups as a source, allowing the web server security group to be specified as the source for inbound traffic to the database security group. This ensures that only traffic originating from the web servers is permitted to reach the database servers, providing a logical, application-layer firewall without exposing the databases to the internet. Option C is correct because omitting a route to an internet gateway from the private subnet's route table ensures that the database servers have no direct path to the internet, satisfying the requirement that they must not have direct internet access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.