DBS-C01 · Question #48
A company is deploying a solution in Amazon Aurora by migrating from an on-premises system. The IT department has established an AWS Direct Connect link from the company's data center. The company's…
The correct answer is B. Instruct the Data Analysts to download the root certificate and use the SSL certificate on the. Explanation When SSL/TLS is required at the cluster level, clients must present a valid SSL certificate to establish a connection - simply having correct credentials is not enough. The Data Analysts need to download the AWS root certificate authority (CA) bundle and configure…
Question
A company is deploying a solution in Amazon Aurora by migrating from an on-premises system. The IT department has established an AWS Direct Connect link from the company's data center. The company's Database Specialist has selected the option to require SSL/TLS for connectivity to prevent plaintext data from being set over the network. The migration appears to be working successfully, and the data can be queried from a desktop machine. Two Data Analysts have been asked to query and validate the data in the new Aurora DB cluster. Both Analysts are unable to connect to Aurora. Their user names and passwords have been verified as valid and the Database Specialist can connect to the DB cluster using their accounts. The Database Specialist also verified that the security group configuration allows network from all corporate IP addresses. What should the Database Specialist do to correct the Data Analysts' inability to connect?
Options
- ARestart the DB cluster to apply the SSL change.
- BInstruct the Data Analysts to download the root certificate and use the SSL certificate on the
- CAdd explicit mappings between the Data Analysts' IP addresses and the instance in the security
- DModify the Data Analysts' local client firewall to allow network traffic to AWS.
How the community answered
(24 responses)- A8% (2)
- B75% (18)
- C4% (1)
- D13% (3)
Explanation
Explanation
When SSL/TLS is required at the cluster level, clients must present a valid SSL certificate to establish a connection - simply having correct credentials is not enough. The Data Analysts need to download the AWS root certificate authority (CA) bundle and configure their database client to use it, which is why the Database Specialist (who likely already had the certificate configured) can connect while the Analysts cannot.
Why the distractors are wrong:
- A is incorrect because restarting the DB cluster is unnecessary - the SSL requirement is already active and working for the Database Specialist, so a restart would change nothing.
- C is incorrect because the question states the security group already allows all corporate IP addresses, making individual IP mappings redundant and unnecessary.
- D is incorrect because the Analysts can already reach Aurora (network connectivity is confirmed), and the issue is specifically SSL certificate configuration, not a firewall rule.
Memory Tip: Think of SSL/TLS as a two-step handshake - credentials (username/password) are Step 1, but the SSL certificate is Step 2, and you can't skip it when SSL is required. If one user connects and others don't, always check whether the client-side certificate setup is missing before assuming it's a network or credential issue.
Topics
Community Discussion
No community discussion yet for this question.