PAS-C01 Design of SAP Workloads on AWS Practice Question
An SAP Basis administrator is configuring a high availability setup for SAP HANA on AWS using HANA System Replication (HSR) with automatic failover. The architecture includes a primary HANA node in us-east-1a and a secondary in us-east-1b. The administrator uses a Network Load Balancer (NLB) with a floating IP for the HANA virtual IP address. After a failover test, the secondary node becomes primary, but client applications cannot connect to the database. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NLB target group is not configured to include the secondary node's IP address.
With NLB and floating IP, the target group must be configured with the secondary's IP address as a target. If the target group only contains the primary's IP, failover breaks. Option A (security group) would affect all connections, not just after failover. Option B (DNS) is not used because the client would use the NLB endpoint directly; if the DNS name did not resolve to the NLB, connections would fail before failover. Option D (subnet) is possible but NLB can target cross-subnet. Option C is the most specific and common misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the NLB does not allow inbound traffic on port 3<0xEB><0x9C><0x9D><0xEB><0x9E><0x80>13.
Why it's wrong here
Security groups do not apply to NLB; they apply to targets.
- ✗
The SAP HANA client is using a DNS name that does not resolve to the NLB endpoint.
Why it's wrong here
Clients should use the NLB DNS name or IP, not HANA hostname.
- ✓
The NLB target group is not configured to include the secondary node's IP address.
Why this is correct
Without the secondary as a target, NLB cannot route to it after failover.
- ✗
The secondary HANA node is in a different subnet and not routable from the NLB.
Why it's wrong here
NLB can target cross-subnet if the subnet is in the same VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.