A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 10.0.0.0/16. The public subnet uses CIDR 10.0.0.0/24. The user plans to host a web server in the public subnet with port 80 and a Database server in the private subnet with port 3306. The user configures the security groups for the web server (WebSecGrp) and the Database server (DBSecGrp). Which of the below mentioned entries is required in the database security group DBSecGrp?

Answer options:

A.Allow Inbound on port 3306 for the Source WebSecGrp.
B.Allow Inbound on port 3306 from the source 10.0.0.0/16.
C.Allow Outbound on port 3306 for the Destination WebSecGrp.
D.Allow Outbound on port 80 for the Destination NAT Instance IP.

Answer – A
Since the Web server needs to talk to the database server on port 3306, the database server should allow the incoming traffic on port 3306. The below table from the AWS documentation shows how the security groups should be set up.
Option B is incorrect because you need to allow incoming access for the database server from the WebSecGrp security group.
Option C is incorrect because you need to allow inbound traffic on port 3306.
Option D is incorrect because there is no need to open port 80 in this scenario.
For more information on security groups, please visit the below Link:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html