A VPC has four subnets:
Subnet
Description
Subnet1
Contains a route table entry with destination: 0.0.0.0/0 and target: VPC Internet Gateway ID
Subnet2
Contains a route table entry with destination 0.0.0.0/0 and target: NAT Gateway ID
Subnet3
Contains an EC2 instance that serves as a bastion host
Subnet4
Contains an NSG Inbound Rule with Source: 0.0.0.0/0; Protocol: TCP; and Port Range: 1433
What would be the recommended subnet for hosting an RDS database instance?

Answer options:

A.Subnet1
B.Subnet2
C.Subnet3
D.Subnet4

Answer: B
Security best practice would state that RDS Database instances should be deployed to a private subnet. A private subnet would only have private IPs with no direct access to the public internet. Outbound connectivity would be provided via a NAT gateway.
Option A is incorrect because Subnet1 has direct connectivity to the public internet via the Internet gateway. Thus, it is characterized as a public subnet and would not be a recommended location for deploying databases.
Option B is CORRECT because Subnet2 is a suitable choice for deploying RDS instances as it is characterized as a private subnet.
Option C is incorrect because Bastion hosts allow direct inbound connections from the public internet. This means that Subnet3 would not be a good choice to host databases.
Option D is incorrect because Subnet4 contains an NSG rule that allows inbound connectivity from the public internet on the database port (1433). This makes it a poor candidate to host databases.
Reference:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html