PAS-C01 Design of SAP Workloads on AWS Practice Question
A company is running SAP S/4HANA on AWS. The SAP application servers and database are in the same VPC. The security team requires encryption in transit between all SAP components. Which combination of services and configurations meets this requirement?
⚠ Common exam trap
Many exam-takers assume network-level encryption services like Transit Gateway or VPN are required for in-transit encryption, but the question specifically requires encryption between SAP components, which is natively achieved through SAP SNC at the application layer, not through AWS networking features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SAP SNC with TLS certificates on all SAP instances.
SAP SNC (Secure Network Communications) with TLS certificates provides end-to-end encryption for communication between SAP components, including application servers and databases, regardless of network topology. Since all SAP components reside in the same VPC, the encryption requirement is satisfied at the application layer without relying on network-level encryption. SNC ensures that data in transit between SAP systems is encrypted using X.509 certificates, meeting the security team's mandate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Transit Gateway with encryption enabled.
Why it's wrong here
Transit Gateway does not natively encrypt traffic.
- ✓
Enable SAP SNC with TLS certificates on all SAP instances.
Why this is correct
SNC encrypts SAP-specific communications.
- ✗
Use AWS VPN to connect all SAP instances to a single endpoint.
Why it's wrong here
VPN is for site-to-site, not inter-instance encryption.
- ✗
Create a VPC peering connection between the application and database subnets.
Why it's wrong here
VPC peering does not encrypt traffic.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.