CSAA – Design Secure Architectures – wrong answer

[mikymg]

Hello,

This quiestion in the Architect Associate marks the correct answer as shown in the attached image:

A startup company is developing a new application in AWS. The architecture is a web application with an Amazon Elastic Container Service (Amazon ECS) cluster, an Amazon S3 bucket where the application assets are stored, and a managed Amazon RDS for MySQL Database. The database layer of the web application contains personally identifiable information (PII) data. As part of compliance requirements, data in both the RDS for MySQL database, and the S3 bucket should be securely accessed only by the ECS cluster.

How should the system be designed to satisfy this requirement?

I think the correct answer that the system marks is actually wrong because there’s no VPC endpoint to connect to the RDS, is only one, the s3 endpoint. With the s3 endpoint and the SG is enough to access securely to the RDS.

This mistake makes me choose the wrong answer in my first try,

Thanks