An application deployed on EC2 instances connects to data in an Amazon RDS instance. In production the app cannot connect, although the database is reachable from a bastion host shell. Web server logs repeatedly show: *** Error Establishing a Database Connection Which of the following could explain the connection failures? (Choose two.)

The database security group needs an ingress rule to allow incoming connections from the web servers. Without this, the web servers cannot initiate a connection to the database. The bastion host can connect because its IP address or security group is likely permitted by a separate ingress rule. Additionally, if the application attempts to connect on a port different from what the RDS instance is configured to listen on (e.g., application tries port 3307, but RDS is on 3306), the connection will fail. This is a common misconfiguration. The database security group's egress rules control outbound traffic from the database, not inbound connections to it, so that's incorrect. SSL certificates are for secure communication, not initial connection establishment. If the database were still provisioning, the bastion host also wouldn't be able to connect.