PAS-C01 Design of SAP Workloads on AWS Practice Question
An architect is designing a network topology for an SAP system on AWS. The SAP application servers must be placed in private subnets, and the web dispatchers must be accessible from the internet. Which configuration should the architect use to meet these requirements?
⚠ Common exam trap
Test-takers frequently assume an Application Load Balancer (ALB) is always the best choice for internet-facing web traffic, but for SAP Web Dispatchers, a Network Load Balancer (NLB) is required because ALBs cannot handle non-HTTP protocols like DIAG and RFC, and they modify headers in ways that break SAP session persistence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web dispatchers in public subnets, the application servers in private subnets, and use a Network Load Balancer in front of the web dispatchers
Web dispatchers need direct internet accessibility, which is achieved by placing them in public subnets with an Internet Gateway route. The SAP application servers must remain in private subnets for security, and a Network Load Balancer (NLB) in front of the web dispatchers provides layer 4 load balancing and health checks without exposing the dispatchers' IPs directly, while preserving client IP for logging and security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all SAP servers in public subnets and use security groups to restrict access
Why it's wrong here
Public subnets expose servers to the internet, which is not a security best practice.
- ✗
Place the web dispatchers in private subnets and use a NAT Gateway for internet access
Why it's wrong here
NAT gateways provide outbound internet, not inbound, and private subnets cannot be directly accessed from the internet.
- ✗
Place all servers in private subnets and use an Application Load Balancer for internet access
Why it's wrong here
An ALB in a private subnet cannot be accessed from the internet; it must be in a public subnet.
- ✓
Place the web dispatchers in public subnets, the application servers in private subnets, and use a Network Load Balancer in front of the web dispatchers
Why this is correct
This design provides internet access to web dispatchers via a public-facing NLB while keeping application servers private.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.