PAS-C01 Technology Practice Question
A small business runs its SAP Business One on a single EC2 instance in AWS. The database is SAP HANA, and the application is also on the same instance. The company wants to ensure that in the event of an instance failure, they can quickly restore the system from backups. They take daily EBS snapshots of the root volume and the data volume. One day, the instance fails and becomes unreachable. The IT administrator attempts to launch a new instance from the most recent AMI, but the new instance does not have the same private IP address, causing connectivity issues for the company's on-premises systems that use VPN to connect to the SAP server. The company uses a Site-to-Site VPN connection to the VPC. What should the administrator do to ensure that the private IP address is preserved after recovery?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Elastic Network Interface (ENI) with the desired private IP, attach it to the instance, and after failure, detach it from the old instance and attach to the new instance.
An Elastic Network Interface (ENI) can retain a fixed private IP address. By creating an ENI with the desired private IP and attaching it to the original instance, after a failure you can detach the ENI from the failed instance (or simply launch a new instance and attach the ENI) to preserve the same private IP. This ensures that the on-premises VPN connection, which relies on that IP, continues to work. Option A is incorrect because modifying the subnet's CIDR does not guarantee that the specific IP address remains available; it might still be used by another resource or cause routing issues. Option B is incorrect because creating a new AMI from the failed instance does not preserve the private IP; the new instance launched from that AMI will receive a dynamically assigned IP from the subnet unless you specify a static IP, but that is not part of the AMI process. Option C is incorrect because Elastic IP addresses are public IPs; the VPN connection between on-premises and the VPC uses private IP addresses, so using an Elastic IP would not resolve the private IP connectivity issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the VPC subnet to use a smaller CIDR range to ensure the IP is available.
Why it's wrong here
This does not help; the IP may still be taken by another instance.
- ✗
Create a new AMI from the failed instance and use that AMI to launch a new instance, specifying the same private IP in the subnet.
Why it's wrong here
Private IPs are assigned automatically; you cannot guarantee the same IP unless you use an ENI.
- ✗
Assign an Elastic IP to the instance and update the VPN configuration to use the Elastic IP.
Why it's wrong here
Elastic IP is a public IP, not private; the VPN uses private IPs.
- ✓
Create an Elastic Network Interface (ENI) with the desired private IP, attach it to the instance, and after failure, detach it from the old instance and attach to the new instance.
Why this is correct
ENI retains the private IP and can be moved to another instance.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.