PAS-C01 Design of SAP Workloads on AWS Practice Question

Exhibit

Refer to the exhibit.

CloudFormation template snippet:
"SAPASCS": {
  "Type": "AWS::EC2::Instance",
  "Properties": {
    "InstanceType": "m5.large",
    "ImageId": "ami-0abcdef1234567890",
    "NetworkInterfaces": [{
      "DeviceIndex": "0",
      "SubnetId": "subnet-12345678",
      "AssociatePublicIpAddress": false,
      "Groups": ["sg-12345678"]
    }],
    "BlockDeviceMappings": [{
      "DeviceName": "/dev/sda1",
      "Ebs": {
        "VolumeSize": 50,
        "VolumeType": "gp2"
      }
    }],
    "Tags": [{"Key": "Name", "Value": "ASCS"}]
  }
}

An SAP administrator is deploying an SAP ASCS instance using CloudFormation. The deployment fails because the instance cannot be reached from other SAP components. Based on the exhibit, what is the most likely cause?

⚠ Common exam trap

The trap here is that candidates often focus on instance certification or storage requirements, overlooking the fundamental network connectivity issue caused by missing security group inbound rules for SAP-specific ports.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The security group does not allow inbound traffic on the required SAP ports.

The SAP ASCS instance must be reachable by other SAP components (e.g., PAS, AAS) on specific ports for services like the SAP Message Server (port 36xx/TCP) and SAP Enqueue Server (port 32xx/TCP). The exhibit shows the security group lacks inbound rules for these ports, so traffic from other components is blocked, causing the deployment to fail. Without proper inbound access, the ASCS instance cannot participate in the SAP system's communication, leading to the unreachability error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The instance type m5.large is not certified for SAP ASCS.
Why it's wrong here
m5.large is certified for SAP NetWeaver including ASCS.
✓
The security group does not allow inbound traffic on the required SAP ports.
Why this is correct
The template does not specify inbound rules; without proper security group rules, other components cannot connect.
✗
The instance lacks an IAM role to join the SAP domain.
Why it's wrong here
IAM roles are not required for basic network connectivity.
✗
The root volume is too small and uses gp2, which is not supported for SAP.
Why it's wrong here
50 GB gp2 is sufficient for the OS; SAP data is typically on separate volumes.

Go deeper

PAS-C01 Design of SAP Workloads on AWS Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question