Question 1,687 of 1,616
PAS-C01 Design of SAP Workloads on AWS Practice Question
An SAP system on AWS experiences intermittent connectivity issues between the SAP Central Services (SCS) instance and the application servers. The SCS instance is in a private subnet in us-east-1a, and the application servers are spread across us-east-1a and us-east-1b. Security groups allow traffic on all required ports. What is the MOST likely cause of the intermittent connectivity?
⚠ Common exam trap
Many exam-takers assume security groups are the only firewall layer and forget that network ACLs are stateless and require explicit rules for return traffic, especially when instances span multiple Availability Zones where subnet-level ACLs differ.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACLs are blocking the traffic.
Network ACLs are stateless and must explicitly allow both inbound and outbound traffic on ephemeral ports. If the outbound rules for the SCS subnet's NACL do not allow return traffic on high ports (e.g., 1024–65535), or if the application servers' subnet NACL blocks inbound traffic from the SCS instance, connections will intermittently fail. Security groups are stateful and automatically allow return traffic, but NACLs are not, making them the likely culprit for intermittent connectivity across different Availability Zones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route tables do not have a route for the SCS subnet.
Why it's wrong here
Incorrect routing would cause persistent, not intermittent, failure.
- ✓
The network ACLs are blocking the traffic.
Why this is correct
Network ACLs are stateless and can cause intermittent issues if inbound rules allow but outbound rules deny return traffic.
- ✗
The Internet Gateway is misconfigured.
Why it's wrong here
Internet Gateway is not involved in private subnet communication.
- ✗
The VPC peering connection is not established correctly.
Why it's wrong here
No VPC peering is mentioned.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.