SAA-C03 Q9 · Networking

Question

A company's software development team needs an Amazon RDS Multi-AZ cluster. The RDS cluster will serve as a backend for a desktop client that is deployed on premises. The desktop client requires direct connectivity to the RDS cluster. The company must give the development team the ability to connect to the cluster by using the client when the team is in the office. Which solution provides the required connectivity MOST securely?

Accepted Answer

Option B is correct because it satisfies all requirements with maximum security:

1. **Private subnets for RDS**: The database is placed in private subnets, meaning it has NO public IP address and is NOT directly accessible from the internet. This is the most secure placement for any database.

2. **AWS Site-to-Site VPN**: This creates an encrypted IPsec tunnel between the company's on-premises network and the AWS VPC. The VPN provides:
   - **Encrypted transit**: All data between the office and AWS travels through an encrypted tunnel
   - **Private connectivity**: The on-premises desktop clients can reach the RDS cluster via private IP addresses, as if they were on the same network
   - **No public internet exposure**: The database never needs to be exposed to the public internet

3. **Cu

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips