PAS-C01 Operations and Maintenance Practice Question

Correct answer & explanation

The security group inbound rule already references the application server's security group (sg-12345), which allows traffic from any instance with that security group. However, network ACLs (NACLs) are stateless and must allow both inbound and outbound traffic separately. If the NACL does not have an inbound rule allowing traffic on port 3300 (the default HANA database port), the traffic will be blocked at the subnet level despite the security group rule. Modifying the NACL to allow inbound traffic on port 3300 is required. Option A is incorrect because the security group rule already allows traffic from the application server's IP via the security group reference. Option B is incorrect because the application server's security group only controls outbound traffic to the database; the inbound rule on the database SG is already sufficient. Option D is incorrect because the NACL must be configured properly; the security group rule alone does not guarantee connectivity if the NACL blocks the traffic.