Which of the below mentioned entries is required in the private subnet database security group DBSecGrp?

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet with port 80 and a Database server in the private subnet with port 3306. The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp).

Which of the below mentioned entries is required in the private subnet database security group DBSecGrp?
A . Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.
B . Allow Inbound on port 3306 from source 20.0.0.0/16
C . Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.
D . Allow Outbound on port 80 for Destination NAT Instance IP

View Answer

Answer: A

Explanation:

Since the Web server needs to talk to the database server on port 3306 that means that the database server should allow incoming traffic on port 3306. The below table from the aws documentation shows how the security groups should be set up.

Option B is invalid because you need to allow incoming access for the database server from the WebSecGrp security group.

Options C and D are invalid because you need to allow Outbound traffic and not inbound traffic For more information on security groups please visit the below Link: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC Scenario2.html

The correct answer is: Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp. Submit your Feedback/Queries to our Experts