nerdexam
Amazon

DBS-C01 · Question #146

A company developed a new application that is deployed on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances use the security group named sg-application- servers. The…

The correct answer is A. Only allow incoming traffic from the sg-application-servers security group on port 3306. Database port 3306 and better to allow only the specific subnet instead of the entire subnet.

Submitted by devops_kid· Mar 6, 2026Database Security

Question

A company developed a new application that is deployed on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances use the security group named sg-application- servers. The company needs a database to store the data from the application and decides to use an Amazon RDS for MySQL DB instance. The DB instance is deployed in private DB subnet. What is the MOST restrictive configuration for the DB instance security group?

Options

  • AOnly allow incoming traffic from the sg-application-servers security group on port 3306.
  • BOnly allow incoming traffic from the sg-application-servers security group on port 443.
  • COnly allow incoming traffic from the subnet of the application servers on port 3306.
  • DOnly allow incoming traffic from the subnet of the application servers on port 443.

How the community answered

(42 responses)
  • A
    83% (35)
  • B
    10% (4)
  • C
    2% (1)
  • D
    5% (2)

Explanation

Database port 3306 and better to allow only the specific subnet instead of the entire subnet.

Topics

#RDS MySQL#security groups#network security#least privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DBS-C01 Practice