Secure On-Premises to RDS Connectivity

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Create a VPC and two private subnets, place the RDS cluster there, and use AWS Site-to-Site VPN for secure encrypted connectivity.

Question

A company's software development team needs an Amazon RDS Multi-AZ cluster. The RDS cluster will serve as a backend for a desktop client that is deployed on premises. The desktop client requires direct connectivity to the RDS cluster. The company must give the development team the ability to connect to the cluster by using the client when the team is in the office. Which solution provides the required connectivity MOST securely?
  1. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Use AWS Site-to-Site VPN with a customer gateway in the company's office.
  2. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use AWS Site-to-Site VPN with a customer gateway in the company's office. Correct Answer
  3. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use RDS security groups to allow the company's office IP ranges to access the cluster.
  4. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Create a cluster user for each developer. Use RDS security groups to allow the users to access the cluster.

Key Takeaways

The core concept is network isolation combined with encrypted tunneling; the common trap is assuming security groups alone (Option C) provide sufficient protection without a private network path.

This question tests the design of secure database access from on-premises environments using AWS Site-to-Site VPN and Private Subnets. It establishes that placing RDS in private subnets prevents direct internet exposure.

Common mistake: Many candidates choose Option C, believing that restricting access via Security Groups based on IP ranges is sufficient. However, this leaves the database endpoints potentially reachable over the public internet if not strictly filtered, lacking the encryption and network isolation provided by a VPN and private subnets.

Expert Analysis

Why the Answer Is Correct

Option B is the correct choice because it combines two critical security controls: network isolation and encrypted transport. By placing the RDS cluster in private subnets, the instances are not assigned public IP addresses and cannot be reached directly from the internet. The AWS Site-to-Site VPN creates an encrypted tunnel between the on-premises office and the VPC, ensuring that data traverses the public internet securely. This satisfies the requirement for 'direct connectivity' while maintaining high security.

Why the Other Options Are Wrong

Option A places RDS in public subnets, which exposes the database to the internet even if accessed via VPN, violating best practices for database security. Option C relies solely on Security Groups. While it restricts source IPs, it does not encrypt the traffic in transit, nor does it prevent potential routing leaks or misconfigurations that could expose the instance. Option D also uses public subnets and adds unnecessary complexity with per-user accounts without solving the fundamental network exposure issue.

Community Comment Notes

Community consensus strongly favors Option B, with 80% of votes selecting it. Users emphasize that the VPN provides essential encryption ('site to site von adds additional security'). One commenter questioned why IP-based restrictions (Option C) weren't enough, highlighting the distinction between access control (Security Groups) and network security (VPN/Private Subnets). Another user noted that private subnets ensure the cluster is 'not publicly accessible,' reinforcing the primary security benefit.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always prioritize Private Subnets for backend services like databases. If remote access is required, use a VPN or Direct Connect rather than exposing endpoints publicly or relying solely on firewall rules.

Frequently Asked Questions

Why is Option C (Security Groups only) not secure enough?

Security Groups filter traffic but do not encrypt it. Traffic goes over the public internet unencrypted. Private Subnets + VPN ensures both isolation and encryption.

Can I use Public Subnets with a VPN for RDS?

No. Best practice dictates RDS should never be in public subnets. Even with a VPN, public IPs increase the attack surface unnecessarily.

More SAA-C03 FAQ →

Community Votes

B
80%
C
20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Bwhizzy 👍 6 Answered B
    The Correct Answer is B. Explanation: VPC and Private Subnets: By placing the RDS cluster in private subnets, you ensure that the RDS cluster is not publicly accessible from the internet. This significantly improves security as the database is only accessible through secure channels, not directly from the public internet. AWS Site-to-Site VPN: Using a Site-to-Site VPN establishes a secure, encrypted connection between the on-premises office and the AWS environment. This provides secure access to the RDS cluster without exposing it to the internet, ensuring that the developers can only access the cluster when connected to the office network. Customer Gateway: The customer gateway is configured in the company's office to handle the VPN connection, providing secure connectivity for the desktop client to the RDS cluster when the development team is in the office.
  2. blehbleh 👍 6 Answered B
    This is B site to site von adds additional security. We are going for more secure.
  3. kbgsgsgs 👍 3 Answered C
    The goal is to limit the team to only being in the office to be in the RDS cluster, so wouldn't checking IP ranges based on the office network rather than bringing up the internet be better suited to what you really need?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide