A city placed Amazon RDS in a public subnet and enabled public accessibility "for easier admin." Which redesign best hardens the database tier?
Select an answer to reveal the explanation.
Short Explanation
Databases belong in the vault room, not on the sidewalk with a welcome mat. Put RDS in private subnets, turn off public accessibility, and admin through a bastion or Session Manager. Public passwords, world-open Postgres, or no security groups make "easier admin" into easier breach.
Full Explanation
Production relational databases should reside in private subnets without public accessibility so they are not reachable from the internet. Administrators connect through controlled paths such as a hardened bastion host or AWS Systems Manager Session Manager to intermediate hosts, with security groups allowing only required sources. Publishing passwords, adding public IPs with open database ports, or removing security groups contradicts secure workload design.