SCS-C02 Infrastructure Security Practice Question
Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)
⚠ Common exam trap
It's easy for candidates to confuse high availability (Multi-AZ) or cost-saving measures (disabling backups) with security controls, when in fact they do not address confidentiality, integrity, or access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.
Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.
Why this is correct
Network isolation improves security.
- ✗
Disable automated backups to reduce storage costs.
Why it's wrong here
Disabling backups does not improve security.
- ✗
Enable Multi-AZ deployment for fault tolerance.
Why it's wrong here
Multi-AZ is for availability, not security.
- ✗
Assign a public IP address to the RDS instance for easier access from the internet.
Why it's wrong here
Public exposure increases risk.
- ✓
Enable encryption at rest using AWS KMS.
Why this is correct
Encryption protects data at rest.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.