PAS-C01 Design of SAP Workloads on AWS Practice Question
An administrator is troubleshooting an SAP system where the application server cannot connect to the database server. Both servers are in the same VPC but different subnets. Security groups allow traffic on the database port. What is the next step to diagnose the issue?
⚠ Common exam trap
Candidates often assume security groups are the only firewall layer, forgetting that NACLs are stateless and must be explicitly configured for both inbound and outbound traffic on each subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the Network ACLs for both subnets to ensure inbound/outbound rules allow the database port
Network ACLs (NACLs) are stateless, meaning they require explicit inbound and outbound rules for traffic to flow in both directions. Even if security groups allow the database port, a missing or misconfigured NACL rule on either subnet can silently drop traffic. Since the servers are in different subnets, checking NACLs is the next logical step after confirming security groups are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the DB Subnet Group configuration
Why it's wrong here
DB Subnet Group is for RDS, not relevant for EC2 connections.
- ✗
Verify route tables for the subnets
Why it's wrong here
Route tables control routing, not security rules.
- ✗
Review VPC Flow Logs for rejected traffic
Why it's wrong here
Flow Logs are for analysis, not immediate resolution.
- ✓
Check the Network ACLs for both subnets to ensure inbound/outbound rules allow the database port
Why this is correct
NACLs are stateless and must allow both inbound and outbound traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.