DBS-C01 · Question #4
A media company is using Amazon RDS for PostgreSQL to store user data. The RDS DB instance currently has a publicly accessible setting enabled and is hosted in a public subnet. Following a recent…
The correct answer is B. Modify the associated security group. Add the required corporate network IPs and remove the E. Disable the publicly accessible setting. F. Connect to the DB instance using private IPs and a VPN. Explanation To restrict database access to only on-premises corporate IPs, the specialist must modify the Security Group (B) to whitelist only those specific corporate IPs (removing all others), disable the publicly accessible setting (E) so the DB instance no longer has a…
Question
A media company is using Amazon RDS for PostgreSQL to store user data. The RDS DB instance currently has a publicly accessible setting enabled and is hosted in a public subnet. Following a recent AWS Well-Architected Framework review, a Database Specialist was given new security requirements.
- Only certain on-premises corporate network IPs should connect to the
DB instance.
- Connectivity is allowed from the corporate network only.
Which combination of steps does the Database Specialist need to take to meet these new requirements? (Choose three.)
Options
- AModify the pg_hba.conf file. Add the required corporate network IPs and remove the unwanted
- BModify the associated security group. Add the required corporate network IPs and remove the
- CMove the DB instance to a private subnet using AWS DMS.
- DEnable VPC peering between the application host running on the corporate network and the VPC
- EDisable the publicly accessible setting.
- FConnect to the DB instance using private IPs and a VPN.
How the community answered
(47 responses)- A4% (2)
- B79% (37)
- C6% (3)
- D11% (5)
Explanation
Explanation
To restrict database access to only on-premises corporate IPs, the specialist must modify the Security Group (B) to whitelist only those specific corporate IPs (removing all others), disable the publicly accessible setting (E) so the DB instance no longer has a public DNS endpoint exposed to the internet, and use a VPN connection with private IPs (F) to create a secure, encrypted tunnel between the corporate network and the AWS VPC.
Why the distractors are wrong:
- A is incorrect because
pg_hba.confis not directly manageable in Amazon RDS - AWS handles host-based authentication at the infrastructure level, and security controls should be applied at the network layer, not the PostgreSQL config file. - C is incorrect because moving to a private subnet does not require AWS DMS (a migration service); subnet changes can be done via DB subnet groups, and DMS is unnecessary overhead for this task.
- D is incorrect because VPC Peering connects two VPCs, not an on-premises network to a VPC - that requires a VPN or Direct Connect, not peering.
Memory Tip
Think "Lock the door three ways": Guard the gate (Security Group rules), hide the address (disable public accessibility), and use a secret tunnel (VPN with private IPs). For on-premises-to-AWS connectivity, always think VPN, not VPC Peering.
Topics
Community Discussion
No community discussion yet for this question.