Your team has a Tomcat-based Java application you need to deploy into development, test, and production environments. After some research, you opt to use Elastic Beanstalk due to its tight integration with your developer tools and RDS due to its ease of management. Your QA team lead points out that you need to roll a sanitized set of production data into your environment on a nightly basis. Similarly, other software teams in your organization want access to that same restored data via their EC2 instances in your VPC. What of the following would be the optimal setup for persistence and security that meets the above requirements?

Answer options:

A.Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in your application subnets.
B.Create your RDS instance separately and add its IP address to your application’s DB connection strings in your code. Alter its security group to allow access to it from hosts within your VPC’s IP address block.
C.Use the ElasticBeanstalk to deploy your application in various environments. Create your RDS instance separately, controlled by automation, and pass it`s DNS name to your app`s DB connection string as an environment variable. After this, restore the sanitized copy of production data to the RDS instance. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself.
D.Create your RDS instance separately and pass its DNS name to your DB connection string as an environment variable. Alter its security group to allow access to it from hosts in your application subnets.

Answer - C
The main consideration in this question is only the EC2 instances in your VPC. You should be able to access RDS instances, and the setup should support persistence.
Option A is incorrect because the RDS instance will be part of the Elastic Beanstalk environment and would not be optimal for persistence.
Option B is incorrect because you should always use the DNS endpoint of the RDS instance, not the IP address, as this option suggests.
Option C is CORRECT because (a) it uses a separate RDS instance (not part of Beanstalk), (b) it uses the DNS name of the RDS instance to the app`s DB connection string for accessing the same and (c) it correctly configures the security group such that only the valid client machines have access to RDS instance. ( need to create security group on the client machines first )
Option D is incorrect because the security group is not configured correctly as it gives access to all the hosts in the application subnets.