SAP HANA Security Best Practices: Private Subnet and Encryption
Which TWO of the following are best practices for securing an SAP HANA database on AWS? (Choose two.)
Quick Answer
The answer is deploying the SAP HANA instance in a private subnet and enabling encryption at rest for HANA data and log volumes using AWS KMS. Placing the database in a private subnet without direct internet access minimizes the attack surface by ensuring the HANA system is only reachable through controlled pathways like a bastion host or VPN, while KMS-managed encryption protects stored data from physical media compromise. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this question tests your understanding of the shared responsibility model and the specific security controls recommended for SAP HANA on AWS, often appearing as a two-correct-answer scenario where a common trap is selecting public subnet placement or neglecting log volume encryption. Remember the mnemonic “Private and Encrypted” to recall that network isolation and data-at-rest protection are the foundational pair for securing HANA workloads.
⚠ Common exam trap
A common mix-up: candidates think disabling SSL/TLS improves performance (Option B) without recognizing that the performance gain is negligible compared to the catastrophic security risk, or they may incorrectly assume a public IP is acceptable for administrative access, overlooking the fundamental network isolation requirement for production databases.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the HANA instance in a private subnet without direct internet access.
Deploying the HANA instance in a private subnet without direct internet access ensures that the database is not exposed to the public internet, reducing the attack surface. This follows the AWS security best practice of using private subnets for sensitive workloads, with access only through bastion hosts or VPN/Direct Connect. It also aligns with SAP's own security recommendations for HANA deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy the HANA instance in a private subnet without direct internet access.
Why this is correct
Private subnet reduces attack surface.
- ✗
Disable SSL/TLS for client connections to improve performance.
Why it's wrong here
Disabling encryption exposes data in transit.
- ✗
Use a single Availability Zone to simplify network security group management.
Why it's wrong here
Single AZ does not provide redundancy and does not improve security.
- ✓
Enable encryption at rest for the HANA data and log volumes using AWS KMS.
Why this is correct
Encryption at rest protects data at the storage layer.
- ✗
Assign a public IP address to the HANA instance for easy access from the internet.
Why it's wrong here
Public IP exposes the instance directly.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are best practices for securing an SAP system on AWS? (Choose two.)
easy- A.Store database credentials in plaintext in application configuration files
- B.Disable AWS CloudTrail to reduce logs
- ✓ C.Use security groups to restrict inbound traffic to SAP application ports
- D.Allow all inbound traffic from 0.0.0.0/0 for easy access
- ✓ E.Encrypt data in transit using TLS/SSL certificates
Why C: Security groups act as a virtual firewall for EC2 instances, allowing you to control inbound and outbound traffic. Restricting inbound traffic to only the necessary SAP application ports (e.g., 3200 for SAP GUI, 443 for SAP Web Dispatcher) minimizes the attack surface and is a fundamental security best practice.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.