Exam AWS Certified Database - Specialty topic 1 question 136 discussion

A. Answer Database port 3306 and better to allow only the specific subnet instead of the entire subnet.

A. Only allow incoming traffic from the sg-application-servers security group on port 3306.

Where on earth do these "Correct answers" come from? Allowing connections only from members of sg-application-servers is more restrictive than allowing traffic from the whole subnet. 3306 is probably the correct port for RDS. Therefore A

I'll go with C: Security groups contains rules allowing or denying access to specified IP address and TCP Ports. Then they are associated with resources (such as ec2, rds, etc). The question says that EC2 use the security group sg-application-servers. That is the sg-application-servers contains the rules that at this moment make the ec2 communication work. To allow the RDS instance talk with this ec2, is necessary to create a SG and specify the address of the ec2 instances in the ingress rules, referencing the port 3306. Or, allow the traffic from the entire subnet at this same port. I've read the security group doc again and dont see nothing about grouping aws resources to reference as some kind of "security resource group" as the A answer say. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

A. Only allow incoming traffic from the sg-application-servers security group on port 3306.

Ans: A

Answer A. most restrictive approach is to allow only incoming connections from SG of EC2 instance on port 3306

AAAAAAAAAAAA

A final answer