You have two Elastic Compute Cloud (EC2) instances inside a Virtual Private Cloud (VPC) in the same Availability Zone (AZ) but in different subnets. One instance is running a database, and the other instance an application that will interface with the database.

Answer options:

A.Security groups are set to allow the application host to talk to the database on the right port/protocol.
B.Both instances are the same instance class and using the same key-pair.
C.The default route is set to a NAT instance or Internet Gateway (IGW) for them to communicate.
D.A network ACL that allows communication between the two subnets.

Answer - A and D
In order to have the instances communicate with each other, you need to properly configure both Security Group and Network access control lists (NACLs). For the exam, remember that the Security Group operates at the instance level, whereas the NACL operates at the subnet level.
Option A is CORRECT because the security groups must be defined to allow the webserver to communicate with the database server. An example image from the AWS documentation is given below:
Option B is incorrect because it is not necessary to have the two instances of the same type or the same key-pair.
Option C is incorrect because configuring NAT instance or NAT gateway will not enable the two servers to communicate with each other. NAT instance/NAT gateway is used to enable the communication between instances in the private subnets and the Internet.
Option D is CORRECT because the two servers are in two separate subnets. In order for them to communicate with each other, you need to configure the NACLas shown below:
For more information on VPC and Subnets, please visit the below URL-
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html