You have planned to host a web application on AWS. You create an EC2 Instance in a public subnet that needs to connect to an EC2 Instance that will host an Oracle database. Which steps would ensure a secure setup? (SELECT TWO)

Answer options:

A.Place the EC2 Instance with the Oracle database in the same public subnet as the Webserver for faster communication.
B.Place the ec2 instance that will host the Oracle database in a private subnet.
C.Create a database Security group which allows incoming traffic only from the Web server`s security group.
D.Ensure that the database security group allows incoming traffic from 0.0.0.0/0.

Correct Answer – B and C
The best and most secure option is to place the database in a private subnet. The below diagram from AWS Documentation shows this setup. Also, you ensure that access is not allowed from all sources but only from the web servers.
Option A is incorrect because DB instances are placed in Private subnets and allowed to communicate with web servers in the public subnet as per the best practice guidelines. 
Option D is incorrect because allowing all incoming traffic from the Internet to the DB instance is a security risk.
For more information on this type of setup, please refer to the below URL:
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html