PAS-C01 Encryption in transit Practice Question
An SAP system is deployed on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers must be encrypted in transit. Which action should be taken to meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure SSL/TLS certificates on the database and application servers
To encrypt traffic in transit between SAP application and database tiers, SSL/TLS certificates must be configured on both servers (B). This ensures that all data exchanged is encrypted. Security group rules (C) control access but do not provide encryption themselves; they only limit which traffic reaches the database, not whether that traffic is encrypted. No other option offers encryption. Therefore, only option B correctly fulfills the requirement of encrypting traffic in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Internet Gateway to the VPC
Why it's wrong here
An Internet Gateway is used for internet access, not encryption.
- ✓
Configure SSL/TLS certificates on the database and application servers
Why this is correct
Configuring SSL/TLS certificates on both servers encrypts the traffic between them in transit.
- ✗
Restrict security group rules to only allow traffic from the application tier
Why it's wrong here
Restricting security group rules limits access but does not encrypt traffic; it only controls which sources can connect.
- ✗
Create a VPC Peering connection between the subnets
Why it's wrong here
VPC Peering connects VPCs but does not encrypt traffic between them.
- ✗
Use network ACLs to allow only database traffic
Why it's wrong here
Network ACLs are stateless access control lists and do not provide encryption.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.