CV0-004 Troubleshooting Practice Question
A user reports that they cannot connect to a RDS database instance from their application. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group. What should the administrator check NEXT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACL rules for the RDS subnet
The RDS security group already allows inbound traffic from the application server's security group, so the issue likely lies elsewhere. Network ACLs (NACLs) are stateless and apply to the subnet level; they must allow both inbound and outbound traffic in both directions for the connection. Checking NACL rules is the next step. Option A is incorrect because IAM policies control access permissions, not network connectivity. Option C is incorrect because route tables primarily govern traffic between subnets and to the internet; within the same VPC, routes are typically not the cause of this issue. Option D is incorrect because outbound rules on the RDS instance affect traffic leaving the RDS, not incoming connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM policy attached to the RDS instance
Why it's wrong here
IAM controls API calls, not network connectivity.
- ✓
Network ACL rules for the RDS subnet
Why this is correct
Network ACLs act as a firewall at subnet level and can block inbound traffic.
- ✗
Route table entries for the RDS subnet
Why it's wrong here
Routing typically not the issue within same VPC.
- ✗
Outbound security group rules on the RDS instance
Why it's wrong here
Outbound rules are not relevant for inbound connections.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.