SAA-C03 Question 55

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  Ans C - only one that makes sense: "...a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets" - operative word: "allows"

• Chose C5

  A: route table that connect... no idea what this option is trying to do but won't work for RDS B: SG are deny by default D: Peering connection between subnets? No idea what this is but happy to learn if such a thing exists. C: SG to allow input to private subnet means everything else will be blocked. Attaching this SG to DB instance means it will block everything except the private subnet instances which is where the required EC2 instances are.

• Chose C2

  RDS databases can only be accessed by EC2 instances located in private subnets: From the security group given to instances in the private subnets, the DB instances' security group will permit incoming traffic. Because of this, the RDS databases will only be accessible by EC2 instances located on the private subnets. Because of its safe architecture, Every other source of incoming traffic will be blocked by the security group that is linked to the database instances. The RDS databases will be better shielded from unwanted access thanks to this.