Question 19 - Amazon DBS-C01 Real Exam Questions [Jan 2026 Update]

Q: 19

A company has a reporting application that runs on an Amazon EC2 instance in an isolated developer account on AWS. The application needs to retrieve data during non-peak company hours from an Amazon Aurora PostgreSQL database that runs in the companys production account The companys security team requires that access to production resources complies with AWS best security practices A database administrator needs to provide the reporting application with access to the production database. The company has already configured VPC peering between the production account and developer account The company has also updated the route tables in both accounts With the necessary entries to correctly set up VPC peering What must the database administrator do to finish providing connectivity to the reporting application? Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432. Add an outbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432. Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on all TCP ports. Add an inbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432_ Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432_ Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on all TCP ports

Your Answer

Correct Answer:

Explanation

The correct answer is

A. Add an inbound security group rule to the database security group that allows access from the

developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security

group that allows access to the production account VPC CIDR on port 5432.

The explanation is as follows:

To allow the reporting application to access the production database, the database administrator

needs to configure the security group rules for both the database and the EC2 instance. The security

group rules must allow traffic between the peered VPCs on the port that the database uses, which is

5432 for PostgreSQL1.

Option A is correct because it adds an inbound rule to the database security group that allows access

from the developer account VPC CIDR on port 5432. This means that the database can accept

connections from the EC2 instance in the peered VPC. It also adds an outbound rule to the EC2

security group that allows access to the production account VPC CIDR on port 5432. This means that

the EC2 instance can initiate connections to the database in the peered VPC.

Option B is incorrect because it adds an outbound rule to the database security group, which is not

necessary. The database does not need to initiate connections to the EC2 instance, only accept them.

It also does not add an inbound rule to the EC2 security group, which is not required. The EC2

instance does not need to accept connections from the database, only initiate them.

Option C is incorrect because it adds an inbound rule to the database security group that allows

access from the developer account VPC CIDR on all TCP ports. This is too permissive and violates the

principle of least privilege2. It also adds an inbound rule to the EC2 security group that allows access

to the production account VPC CIDR on port 5432. This is unnecessary and does not help with

connectivity.

Option D is incorrect because it adds an outbound rule to the EC2 security group that allows access

to the production account VPC CIDR on all TCP ports. This is too permissive and violates the principle

of least privilege2. It also does not add an outbound rule to the database security group, which is not

needed.

Reference: 1: [Working with PostgreSQL and pgAdmin - Amazon Aurora] 2: [Security best practices in

IAM - AWS Identity and Access Management]

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE