Exam AWS Certified Database - Specialty topic 1 question 136 discussion

Exam question from Amazon's AWS Certified Database - Specialty

Question #: 136
Topic #: 1

[All AWS Certified Database - Specialty Questions]

A company developed a new application that is deployed on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances use the security group named sg-application-servers. The company needs a database to store the data from the application and decides to use an Amazon RDS for MySQL DB instance. The DB instance is deployed in a private DB subnet.
What is the MOST restrictive configuration for the DB instance security group?

A. Only allow incoming traffic from the sg-application-servers security group on port 3306.
B. Only allow incoming traffic from the sg-application-servers security group on port 443.
C. Only allow incoming traffic from the subnet of the application servers on port 3306.
D. Only allow incoming traffic from the subnet of the application servers on port 443.

Show Suggested Answer

Suggested Answer: A 🗳️

by shantest1 at April 3, 2021, 3:55 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

shantest1

Highly Voted 3 years, 8 months ago

A. Answer Database port 3306 and better to allow only the specific subnet instead of the entire subnet.

upvoted 14 times

novice_expert

3 years, 1 month ago

Do we allow traffic from security group OR from resources that are assigned to the same security group ?

upvoted 1 times

...

Pranava_GCP

Most Recent 1 year, 9 months ago

Selected Answer: A

A. Only allow incoming traffic from the sg-application-servers security group on port 3306.

upvoted 1 times

Pranava_GCP

1 year, 9 months ago

Because 1) port 3306 is default port number for mySQL 2) a security group has to be explicitly assigned to an EC2 instance.

upvoted 1 times

...

aviathor

2 years ago

Selected Answer: A

Where on earth do these "Correct answers" come from? Allowing connections only from members of sg-application-servers is more restrictive than allowing traffic from the whole subnet. 3306 is probably the correct port for RDS. Therefore A

upvoted 2 times

...

Bernardes

2 years, 7 months ago

I'll go with C: Security groups contains rules allowing or denying access to specified IP address and TCP Ports. Then they are associated with resources (such as ec2, rds, etc). The question says that EC2 use the security group sg-application-servers. That is the sg-application-servers contains the rules that at this moment make the ec2 communication work. To allow the RDS instance talk with this ec2, is necessary to create a SG and specify the address of the ec2 instances in the ingress rules, referencing the port 3306. Or, allow the traffic from the entire subnet at this same port. I've read the security group doc again and dont see nothing about grouping aws resources to reference as some kind of "security resource group" as the A answer say. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

upvoted 1 times

im_not_robot

2 years, 3 months ago

C is wrong. Because allow the whole subnets mean allow all application on that subnet --> not secure. FYI: security group doesn't have 'Deny' rule. A is the answer. Security A allow traffic from Security B mean that Security A allow all resources using Security B

upvoted 1 times

...