Chapter 12

1. 3

You cannot modify the login.cnf file on RDS.

Provisioning a database in a public subnet is not secure.

Provisioning a database in a private subnet protected by security groups is the correct answer.

Using NACLs can help further secure a VPC, but you also need security groups, so this is incorrect.

2. 2

Exporting to S3 is not an option here.

Creating a snapshot, encrypting a copy of it, and then creating a new snapshot is the best option.

You cannot add encryption using Modify, so this is incorrect.

3. 3

You cannot restore a snapshot into a database with encryption enabled.

Using IAM authentication for each individual user will remove the reliance on shared passwords and will enforce the policy of each individual having their own account.

4. 2

Applications use the RDS endpoint to access the database, so the IP change would not break the service.

It is most likely the new EC2 is not in the security group...