Q83 — AWS SAA-C03 Ch.10

Question 83 of 100 | ← Chapter 10

Q683. A company's software development team needs an Amazon RDS Multi-AZ cluster. The RDS cluster will serve as a backend for a desktop client that is deployed on premises. The desktop client requires direct connectivity to the RDS cluster.The company must give the development team the ability to connect to the cluster by using the client when the team is in the office.Which solution provides the required connectivity MOST securely?

• A. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Use AWS Site-to- Site VPN with a customer gateway in the company's office
• B. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use AWS Site- to-Site VPN with a customer gateway in the company's office ✓
• C. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use RDS security groups to allow the company's office IP ranges to access the cluster.
• D. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Create a cluster user for each developer. Use RDS security groups to allow the users to access the cluster

Correct Answer: B. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use AWS Site- to-Site VPN with a customer gateway in the company's office

Explanation

The most secure solution is: **B. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use AWS Site-to-Site VPN with a customer gateway in the company's office.** Here's why: * **Private Subnets:** By placing the RDS cluster in private subnets, you ensure that it's not directly accessible from the public internet. This significantly reduces the attack surface and enhances security.* **Site-to-Site VPN:** AWS Site-to-Site VPN establishes a secure, encrypted connection between your on-premises network and your AWS VPC. This allows the desktop client to connect to the RDS cluster securely over the VPN tunnel.* **Security Groups:** You can further enhance security by using security groups to restrict access to the RDS cluster. You can configure the security group to only allow traffic from the VPN endpoint. **Why other options are less secure:** * **A. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Use AWS Site-to-Site VPN with a customer gateway in the company's office.** This option exposes the RDS cluster to the public internet, increasing the risk of attacks.* **C. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use RDS security groups to allow the company's office IP ranges to access the cluster.** This option relies on allowing access based on IP addresses, which can be less secure than using a VPN tunnel.* **D. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Create a cluster user for each developer. Use RDS security groups to allow the users to access the cluster.** This option exposes the RDS cluster to the public internet and relies on security groups to restrict access. While security groups can be effective, they are not as secure as using a VPN tunnel. **In summary:** Option B provides the most secure connectivity by combining private subnets, Site-to-Site VPN, and security groups to restrict access to the RDS cluster.