Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 406 discussion

Remember guys that SG is not used for Deny action, just Allow

'must be accessible only to the web servers' is the key here. Option B almost threw me off, but with this then all that exists in the public subnet would be able to access the DB security group. Therefore C,D well applies the principle of least privilege.

The following are the default rules for a security group that you create: Allows no inbound traffic Allows all outbound traffic

Remember guys that SG is not used for Deny action, just Allow

To meet the requirements of allowing access to the web servers in the public subnet on port 443 and the Amazon RDS for MySQL DB instance in the database subnet on port 3306, the best solution would be to create a security group for the web servers and another security group for the DB instance, and then define the appropriate inbound and outbound rules for each security group. 1. Create a security group for the web servers in the public subnet. Add a rule to allow traffic from 0.0.0.0/0 on port 443. 2. Create a security group for the DB instance. Add a rule to allow traffic from the web servers' security group on port 3306. This will allow the web servers in the public subnet to receive traffic from the internet on port 443, and the Amazon RDS for MySQL DB instance in the database subnet to receive traffic only from the web servers on port 3306.

CD - Correct ans.

I choose CE

CE support @sitha

Answer: CE . The solution is to deny accessing DB from Internet and allow only access from webserver.

C & D are the right choices. correct

why not CE?

cdcdcdcdcdc