PAS-C01 Technology Practice Question
An SAP system uses AWS Direct Connect to connect to on-premises networks. The SAP application servers are in a private subnet with a NAT gateway for outbound internet. The SAProuter instance is behind an Internet-facing Network Load Balancer (NLB). Connections from SAP support to the SAProuter timeout. What is the likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the SAProuter instance does not allow inbound traffic from the NLB.
The issue is that connections from SAP support to the SAProuter timeout. The SAProuter instance is behind an Internet-facing NLB, which distributes traffic to targets. For the NLB to forward traffic to the SAProuter instance, the instance's security group must allow inbound traffic from the NLB's source IP or security group. Without this rule, the NLB health checks fail and traffic is not forwarded, causing timeouts. Option A (wrong protocol/port) is possible but less likely since the NLB is configured for SAProuter. Option C (Direct Connect advertising) is irrelevant because the connection is from the internet, not on-premises. Option D (NAT gateway) is for outbound traffic only and does not affect inbound connections from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NLB target group is configured with the wrong protocol or port for SAProuter.
Why it's wrong here
The NLB target group should use TCP port 3298; misconfiguration would cause timeouts.
- ✓
The security group for the SAProuter instance does not allow inbound traffic from the NLB.
Why this is correct
This is a possible cause, but the question asks for the most specific cause given the symptom.
- ✗
The Direct Connect virtual interface is not advertising the SAProuter's IP address.
Why it's wrong here
Direct Connect is for on-premises connectivity, not internet.
- ✗
The NAT gateway does not allow inbound traffic from the internet.
Why it's wrong here
NAT gateway is for outbound only; inbound is not needed.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.