PAS-C01 Technology Practice Question
An SAP system running on AWS is experiencing intermittent connectivity issues between the SAP application servers and the database server. Both are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. The issue occurs only during peak hours. Which of the following is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse the stateless nature of network ACLs with the stateful behavior of security groups, assuming that allowing inbound traffic automatically permits return traffic, which is not the case for NACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACLs do not have rules to allow ephemeral ports for return traffic.
The intermittent connectivity issue during peak hours points to a resource exhaustion problem. Network ACLs are stateless, meaning they must explicitly allow both inbound and outbound traffic, including ephemeral ports (typically 1024-65535) used for return traffic. If the NACL outbound rules do not allow these ephemeral ports, return traffic from the database server to the application server will be dropped, especially under high load when many connections are established simultaneously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security group outbound rules are blocking return traffic.
Why it's wrong here
Security groups are stateful; return traffic is allowed regardless of outbound rules.
- ✗
The VPC peering connection is throttling traffic.
Why it's wrong here
No VPC peering is mentioned; both servers are in the same VPC.
- ✓
Network ACLs do not have rules to allow ephemeral ports for return traffic.
Why this is correct
NACLs are stateless; failing to allow ephemeral ports can cause intermittent connectivity during high traffic.
- ✗
Security group inbound rules are misconfigured.
Why it's wrong here
Security groups are stateful; if outbound is allowed, return traffic is automatically allowed.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.