PAS-C01 Operations and Maintenance Practice Question
An SAP administrator is troubleshooting an issue where SAP application servers are unable to connect to the SAP HANA database. The database is running on an EC2 instance in a private subnet. The application servers are in a different VPC connected via VPC peering. The security group for the database instance allows TCP port 3$15$13 from the application server security group. Which additional configuration is MOST likely required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DNS resolution for the VPC peering connection.
VPC peering does not automatically enable DNS resolution for hostnames across peered VPCs. The application servers need to resolve the database's private DNS hostname to its private IP. By default, DNS resolution for peered VPCs is disabled. Enabling DNS resolution on the VPC peering connection allows the application servers to resolve the database's hostname, which is essential for connectivity. Option A is incorrect as the security group already allows the port; Option B is incorrect because the route tables already handle traffic via the peering connection; Option C is incorrect because network ACLs are not the core issue—the problem is DNS resolution, not NACL rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the security group to allow traffic from the application server subnet CIDR.
Why it's wrong here
The security group already allows traffic from the application server security group.
- ✗
Update the route tables to add a route to the database subnet.
Why it's wrong here
Route tables are needed for connectivity, but the symptom is DNS resolution failure.
- ✗
Add a rule to the network ACL to allow inbound traffic on port 3$15$13.
Why it's wrong here
NACLs are stateless, but the issue is DNS resolution, not network ACLs.
- ✓
Enable DNS resolution for the VPC peering connection.
Why this is correct
VPC peering requires DNS resolution to be enabled for hostname resolution across VPCs.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.