SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The VPC does not have DNS resolution enabled, so the RDS endpoint cannot be resolved.

  Why this is correct

  Amazon RDS exposes its database via a fully qualified domain name, such as `dbname.xxxxx.rds.amazonaws.com`, which the EC2 instance must resolve to an IP address. In a VPC, DNS resolution is governed by the `enableDnsSupport` attribute; if this is set to false, the VPC's Route 53 Resolver does not answer DNS queries. Without DNS resolution, the RDS endpoint cannot be translated into a private IP, so the connection attempt fails at the name resolution stage. This is the direct cause of the connectivity failure described.

• ✗

  The network ACL for the private subnet blocks inbound traffic from the public subnet.

  Why it's wrong here

  A network ACL (NACL) applies at the subnet boundary, but the default NACL that AWS creates for a VPC allows all inbound and outbound traffic. Even a custom NACL would need an explicit deny rule to block traffic between the public and private subnets, and the scenario does not indicate any such rule. Since the database's security group already permits traffic from the EC2 instance, the NACL is not the reason the connection fails—the real problem is that the RDS hostname cannot be resolved. Additionally, NACLs are stateless, meaning you would need to allow both inbound and outbound for the connection, but the default configuration already permits everything.

• ✗

  The security group of the RDS database does not allow outbound traffic.

  Why it's wrong here

  Security groups are stateful, so if you allow inbound traffic on the RDS security group, the corresponding outbound response is automatically permitted—even if no outbound rule exists. Thus, the fact that the RDS security group lacks outbound rules would not prevent the database from sending response packets back to the EC2 instance. The failure occurs before any database traffic is exchanged: the EC2 instance cannot even resolve the RDS endpoint because DNS resolution is disabled. A missing outbound rule in a security group only matters for initiating outbound connections, which is not the case here.

• ✗

  The EC2 instance does not have a public IP address.

  Why it's wrong here

  An EC2 instance in a public subnet does not need a public IP address to reach an RDS database inside the same VPC. All internal VPC traffic is routed over private IP addresses, and the RDS DNS endpoint resolves to a private IP in the VPC. Even if the instance had no public IP and no internet gateway route, it could still connect to RDS as long as the subnet's route table and the RDS security group allow the traffic. Therefore, the absence of a public IP address is unrelated to the DNS resolution failure that is preventing the connection.

Go deeper

Related to this question