PAS-C01 Technology Practice Question
An SAP system running on AWS is experiencing intermittent network connectivity issues between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. The network ACLs and security groups are properly configured. What is the most likely cause and solution?
⚠ Common exam trap
Many exam-takers assume security groups or NACLs are the cause of cross-AZ connectivity issues, but the real culprit is usually route table misconfiguration, as AWS relies on the local route for all intra-VPC traffic regardless of AZ boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables are not correctly configured for cross-AZ traffic; verify and update route tables
The most likely cause is that the route tables in the subnets do not have routes for the destination CIDR of the other Availability Zone (AZ). By default, each subnet in a VPC is associated with a route table, and for traffic to flow between subnets in different AZs, the route tables must include a local route for the VPC CIDR. If the route tables are misconfigured (e.g., missing the local route or pointing to an incorrect target), cross-AZ traffic will fail, causing intermittent connectivity issues between the application and database servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security groups are stateful and blocking return traffic; use network ACLs instead
Why it's wrong here
Security groups are stateful and allow return traffic automatically.
- ✓
The route tables are not correctly configured for cross-AZ traffic; verify and update route tables
Why this is correct
Cross-AZ traffic requires appropriate route table entries.
- ✗
Use AWS Transit Gateway to connect the subnets in different AZs
Why it's wrong here
Transit Gateway is for connecting multiple VPCs, not subnets within a VPC.
- ✗
The network ACLs are blocking traffic between Availability Zones; update the NACLs
Why it's wrong here
NACLs are stateless but if properly configured, they should allow traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.