SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attach an internet gateway to the VPC and route the private subnet's traffic to it.

  Why it's wrong here

  Attaching an internet gateway to the VPC and routing the private subnet's traffic to it would make the private subnet effectively public, exposing the RDS instances to potential inbound internet traffic and defeating the purpose of isolation. An internet gateway only enables bidirectional internet connectivity; it does not establish a controlled path from the application servers in the public subnet to the database in the private subnet. The VPC's local route already allows subnet-to-subnet communication, so the actual missing piece is the security group rule, not an internet gateway.

• ✗

  Attach a NAT gateway to the private subnet and route traffic through it.

  Why it's wrong here

  A NAT gateway is designed to provide outbound internet access to instances in private subnets, not to accept inbound traffic from other subnets. Placing a NAT gateway in the private subnet would not allow the application servers to initiate connections to RDS, nor would it change the RDS security group that is currently blocking the traffic. The local VPC route already supports bidirectional traffic between the public and private subnets, so the connectivity problem is purely a firewall (security group) issue that a NAT gateway cannot solve.

• ✗

  Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

  Why it's wrong here

  Network ACLs are stateless and operate at the subnet level, so adding an allow rule for the public subnet CIDR would grant access to every host in that subnet, not just the application servers, violating least privilege. You would also need to configure a separate outbound rule to permit ephemeral return traffic, because NACLs do not automatically allow responses. Furthermore, the default network ACL already permits all traffic, so the restrictive component is the RDS security group, which a NACL change would not modify; security groups offer instance-level, stateful control and can reference an application security group for far more precise access.

• ✓

  Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.

  Why this is correct

  Create a security group for the RDS instances and add an inbound rule that allows the database port from the security group attached to the application servers. Because security groups can reference other security groups as sources, this rule automatically restricts access to only those instances that carry the application security group, regardless of their IP addresses or whether the application tier scales up or down. This stateful, least-privilege approach is the AWS best practice for tiered access within a VPC and directly resolves the connectivity failure without affecting other subnets or relying on broad CIDR ranges.

Go deeper

Related to this question