A SysOps administrator is troubleshooting connectivity between an Amazon EC2 instance in S… — AWS Certified SysOps Administrator - Associate

A SysOps administrator is troubleshooting connectivity between an Amazon EC2 instance in Subnet A ( $10.0.3.0/24$ ) within VPC A ( $10.0.0.0/16$ ) and an Amazon RDS MySQL DB instance in Subnet B ( $172.16.4.0/24$ ) within VPC B ( $172.16.0.0/16$ ). A VPC peering connection (`pcx-99998888`) has been established and is active. However, the EC2 instance cannot connect to the database. Which of the following configuration changes must be performed to allow traffic between the EC2 instance and the database? (Select TWO.)

Add a route to the route table associated with Subnet B with a destination of $10.0.3.0/24$ and a target of `pcx-99998888`.Answer
Configure the security group of the RDS DB instance to allow inbound traffic on TCP port 3306 from the CIDR block $10.0.3.0/24$ .Answer
C
Attach an Internet Gateway to VPC B and add a route in Subnet B's route table pointing to $10.0.3.0/24$ with the target set to the Internet Gateway.
D
Configure the outbound rules of the stateless Network ACL for Subnet A to allow TCP port 3306 traffic to Subnet B, while leaving outbound ephemeral ports ( $1024$ - $65535$ ) disabled.
E
Create a Gateway VPC Endpoint for Amazon RDS in VPC A, and select Subnet A's route table to automatically route the database traffic.

Answer

To establish connectivity across the VPC peering connection, the administrator must add a route in Subnet B's route table pointing the destination CIDR

10.0.3.0/24

to the peering connection key `pcx-99998888`, and configure the RDS DB instance's security group to allow inbound traffic on TCP port 3306 from the EC2 instance's subnet CIDR

10.0.3.0/24

The correct options involve configuring the routing table for Subnet B to include a route targeting the EC2 subnet range via the peering connection, and modifying the RDS security group to allow inbound database connections from that range. Because VPC peering requires bidirectional routing config, adding the route in Subnet B completes the routing loop. Modifying the security group allows the connection to pass through the instance's stateful firewall.

Step-by-Step Solution

Verify and configure routing tables in both VPCs.

Adding a route in Subnet B's route table targeting the peered CIDR

10.0.3.0/24

via `pcx-99998888` ensures that traffic can flow symmetrically.

VPC peering requires explicit route table entries in both VPCs to direct traffic destined for the peer network over the peering connection.

Update security group rules.

The RDS DB instance's security group is configured to allow inbound traffic on port 3306 from the CIDR block

10.0.3.0/24

Since security groups are stateful and default to blocking inbound traffic, the target resource must explicitly allow the incoming database connection.

Key Concept

VPC Peering Routing and Security Group Configuration

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic