PAS-C01 Design of SAP Workloads on AWS Practice Question
A company is planning to run SAP applications on AWS. The security team requires that all data transmitted between the SAP application servers and the SAP HANA database be encrypted in transit. The SAP HANA database is on an EC2 instance in the same VPC. The application servers are also in the same VPC. Which configuration should the company implement to meet the encryption requirement with minimal impact on performance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SAP HANA TLS/SSL encryption for the database connections
Enabling SAP HANA TLS/SSL encryption encrypts data in transit between application and database servers directly, with minimal performance impact as it is built into the SAP HANA client-server protocol. Option A is incorrect: AWS PrivateLink is used for private connectivity to services across VPCs or to AWS services, not for encrypting internal traffic within the same VPC, and introduces unnecessary complexity. Option C is incorrect: VPC peering connects separate VPCs but does not encrypt traffic by default; it also is not needed when both servers are in the same VPC. Option D is incorrect: a VPN connection adds network overhead and is designed for connectivity across networks or the internet, which is unnecessary and suboptimal for same-VPC communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS PrivateLink to connect the application to the database
Why it's wrong here
PrivateLink is for accessing services via endpoint, not for encrypting traffic within a VPC.
- ✓
Enable SAP HANA TLS/SSL encryption for the database connections
Why this is correct
TLS/SSL encryption secures data in transit between SAP application and database servers.
- ✗
Use VPC peering between the application and database subnets
Why it's wrong here
VPC peering does not encrypt data in transit.
- ✗
Set up a VPN connection between the application and database servers
Why it's wrong here
A VPN connection encrypts the IP layer between two network endpoints, but the SAP application and HANA database servers reside within the same VPC, so traffic never leaves the AWS network; a VPN therefore adds unnecessary encapsulation overhead without addressing the requirement for application-layer encryption. This option is tempting because VPNs are a standard solution for encrypting traffic across untrusted networks, such as between an on-premises data centre and AWS, where the correct choice would be to establish a Site-to-Site VPN.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.