PAS-C01 Design of SAP Workloads on AWS Practice Question
An SAP administrator wants to ensure that the SAP application server can communicate with the HANA database using the private IP address within the same VPC. What configuration is necessary?
⚠ Common exam trap
A common mix-up: candidates confuse the need for external connectivity (internet or VPN) with internal VPC communication, mistakenly thinking that a NAT Gateway or Internet Gateway is required for any traffic between subnets, when in fact AWS VPCs natively route private IP traffic within the same VPC using the VPC router and security groups for access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a security group rule allowing traffic on the HANA database port from the application server's security group.
Within the same VPC, AWS resources can communicate using private IP addresses without internet or VPN connectivity. The key requirement is that the security group attached to the HANA database must allow inbound traffic on the HANA database port (typically 3<span+>15<span+>17 or 3<span+>00<span+>15 for HANA) from the security group associated with the SAP application server. This ensures that only traffic originating from the application server is permitted, maintaining security while enabling private IP communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Internet Gateway to the VPC.
Why it's wrong here
Internet Gateway is for public internet access.
- ✗
Set up a NAT Gateway for the database subnet.
Why it's wrong here
NAT Gateway is for outbound internet access.
- ✗
Establish a VPN connection to the on-premises network.
Why it's wrong here
VPN is for hybrid connectivity, not internal.
- ✓
Configure a security group rule allowing traffic on the HANA database port from the application server's security group.
Why this is correct
Security groups control traffic within VPC.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.