PAS-C01 Design of SAP Workloads on AWS Practice Question
A company is deploying a new SAP BusinessObjects system on AWS. The system will consist of multiple servers: a CMS database server, an audit database server, and several processing servers. The administrator needs to ensure that all servers can communicate with each other and with corporate on-premises systems via a VPN connection. The AWS environment is in a single VPC with public and private subnets. Which network architecture should be used to meet these requirements?
⚠ Common exam trap
Watch out — candidates often confuse the purpose of a NAT Gateway (outbound internet only) with a bastion host (administrative access) or mistakenly think public subnets are acceptable for SAP servers, ignoring the security and compliance requirements for private, isolated workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place servers in private subnets and use a NAT Gateway for outbound internet and a VPN gateway for on-premises connectivity.
Placing the SAP BusinessObjects servers in private subnets ensures they are not directly exposed to the internet, which is a security best practice. A NAT Gateway provides outbound internet access for tasks like software updates, while a VPN Gateway (or Virtual Private Gateway) establishes encrypted connectivity to the corporate on-premises systems, meeting the requirement for inter-server and hybrid communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place servers in private subnets and use a NAT Gateway for outbound internet and a VPN gateway for on-premises connectivity.
Why this is correct
Private subnets with NAT and VPN provide secure connectivity.
- ✗
Place all servers in public subnets with Elastic IPs and use security groups to restrict access.
Why it's wrong here
Public subnets expose servers unnecessarily.
- ✗
Use a single public subnet for all servers and rely on network ACLs for isolation.
Why it's wrong here
Public subnet not recommended for security.
- ✗
Place servers in private subnets and use a bastion host for all inter-server communication.
Why it's wrong here
Bastion host is for administrative access, not for server-to-server traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.