PAS-C01 NLB health checks Practice Question
An SAP system uses a Network Load Balancer (NLB) to distribute traffic to SAP application servers. The application servers are in private subnets. The operations team notices that the health checks are failing for one of the application servers. The health check is configured to use TCP on port 3200. The application server's security group allows inbound traffic on port 3200 from the NLB's subnet CIDR. The network ACL allows inbound and outbound traffic on ephemeral ports. What is the most likely cause of the health check failure?
⚠ Common exam trap
A common trap is to assume that security group rules are the issue when health checks fail, even when the security group seems correctly configured. However, if the security group allows traffic from the NLB's subnet CIDR, the problem is more likely at the application level. Remember that health check failures can also occur if the application itself is not responding on the health check port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SAP application is not listening on port 3200.
The health check failure is isolated to one instance, and the security group is configured correctly to allow traffic from the NLB's subnet CIDR on port 3200. The network ACL allows ephemeral ports. Therefore, the most likely cause is that the SAP application on that instance is not listening on port 3200. This could be due to the application service not running, a misconfiguration, or the instance not being properly joined to the SAP system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group does not allow inbound traffic from the NLB's private IP addresses.
Why it's wrong here
Incorrect. The security group is configured to allow inbound traffic on port 3200 from the NLB's subnet CIDR, which is sufficient for NLB health checks. The NLB's health check source IPs are within that CIDR range, so this is not the issue.
- ✗
The network ACL is blocking the health check traffic.
Why it's wrong here
Incorrect. The network ACL allows inbound and outbound traffic on ephemeral ports, so it is not blocking the health check traffic.
- ✓
The SAP application is not listening on port 3200.
Why this is correct
Correct. The health check failure is isolated to one instance, and the network configuration (security group and NACL) is correct. Therefore, the most likely cause is that the SAP application on that instance is not listening on port 3200. This could be due to the application service not running, a misconfiguration, or the instance not being properly joined to the SAP system.
- ✗
The NLB is configured to use the instance's public IP address.
Why it's wrong here
Incorrect. NLB uses private IP addresses to communicate with targets, not public IPs. Also, the application servers are in private subnets, so they do not have public IPs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.