SCS-C02 Question 91
Select 3An organization has deployed an application on Amazon EC2 instances within a VPC. The application requires secure access to an Amazon RDS database in the same VPC. The security team mandates that traffic between the EC2 instances and the RDS database must not traverse the public internet. Which combination of actions should you take to ensure compliance with this requirement?
- A
Ensure the EC2 instances and the RDS database are in the same VPC.
- B
Use a security group that allows inbound traffic from the EC2 instances to the RDS database on the appropriate port.
- C
Configure a NAT Gateway to route traffic between the EC2 instances and the RDS database.
- D
Enable VPC peering between the EC2 instances and the RDS database.
- E
Use a private subnet for both the EC2 instances and the RDS database.
Show answer and explanation
Correct answers: A, B, E
Explanation
To ensure that traffic between EC2 instances and an RDS database does not traverse the public internet, both resources must be placed in the same VPC. Additionally, security groups must be configured to allow the necessary traffic, and private subnets should be used to keep the resources isolated from public access. NAT Gateways and VPC peering are not relevant in this scenario as the communication remains within a single VPC.
- A. Correct.
Correct: By placing the EC2 instances and the RDS database in the same VPC, traffic between them will remain within the VPC and not traverse the public internet.
- B. Correct.
Correct: Security groups are required to allow specific traffic, such as database access, between the EC2 instances and the RDS database. Without this, the traffic would be blocked.
- C. Incorrect.
Incorrect: NAT Gateways are used to enable private subnets to access the internet or other AWS services. They are not required for communication within the same VPC.
- D. Incorrect.
Incorrect: VPC peering is used to allow traffic between different VPCs. It is unnecessary when the EC2 instances and RDS database are in the same VPC.
- E. Correct.
Correct: Using private subnets ensures that the resources do not have public IP addresses, further securing the communication within the VPC.