PAS-C01 Connection Draining (Deregistration Delay) Practice Question
A company runs SAP Business Suite on AWS. The SAP application servers are behind an Application Load Balancer (ALB). The operations team notices that occasionally, some requests fail with HTTP 503 errors. The team checks the ALB and finds that the target group has healthy instances. The SAP application logs show no errors. What is the most likely cause of the 503 errors?
⚠ Common exam trap
The trap is that the target group shows healthy instances and the application logs show no errors, leading teams to overlook connection draining settings. The 503 error is likely due to the ALB routing requests to instances that are being de-registered before the connection draining timeout expires.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ALB connection draining timeout is set too low, causing requests to be routed to instances that are being de-registered.
Connection draining (also known as deregistration delay) allows the ALB to complete in-flight requests to instances that are being de-registered. If the timeout is set too low, the ALB may terminate connections prematurely, causing the client to receive a 503 error even though the target group shows healthy instances. Option A is incorrect because security group misconfigurations would typically result in connection timeouts or 504 errors, not 503. Option B is incorrect because an expired SSL certificate on the ALB would cause SSL handshake failures, not 503 errors. Option C is incorrect because if health checks were misconfigured, the ALB would route traffic to unhealthy instances, likely causing application errors rather than ALB-level 503 errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security groups for the application servers do not allow traffic from the ALB.
Why it's wrong here
If security groups blocked traffic, the health checks would fail and instances would be unhealthy.
- ✗
The SSL certificate on the ALB has expired.
Why it's wrong here
Expired SSL would cause TLS errors, not necessarily 503.
- ✗
The target group health checks are misconfigured, marking instances as healthy when they are not.
Why it's wrong here
The team already checked and found instances healthy; health check misconfiguration would show unhealthy instances.
- ✓
The ALB connection draining timeout is set too low, causing requests to be routed to instances that are being de-registered.
Why this is correct
Connection draining ensures in-flight requests complete, but if timeout is too short, requests may fail.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.