Exam AWS Certified SysOps Administrator - Associate topic 1 question 72 discussion

Correct answer is A! VPN options are out of the question. We are left with add the IP address or a security group rule, but since you cannont create a security group rule that references a peer VPC security group, than the answer is clearly A.

A is correct. B is wrong for 2 reasons: a) You cannot reference the security group of a peer VPC that's in a different Region. Instead, use the CIDR block of the peer VPC. b) its refers to outbound rule of database not the inbound rule. https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html

VPC Peering and adding to inbound is key word

A -> initiate connection inbound

This line has the answer: but the database must remain only in us-east-1. Hence us-east-1 region vpc SG need to allow the connection.

why not B : security groups are typically associated within the same VPC why A : across different Regions, VPC peering is the preferred

A is the correct answer. B is totally wrong because adding the security group of the instances in eu-central-1 to the outbound rule of the database security group is logically adding the security group of The instances to outbound rule of database sg. Adding an INBOUND RULE to OUTBOUND RULE(outgoing traffic of the database) cannot be used to establish a VPC peering connection.

By creating a VPC peering connection between the two Regions and adding the security group of the instances in eu-central-1 to the outbound rule of the database security group, you can establish a direct network connection between the two VPCs and allow the instances in eu-central-1 to communicate with the database in us-east-1. This is the most operationally efficient solution because it allows for faster and more efficient communication between the two VPCs

aaaaaaaaa

Ans: A