PAS-C01 Operations and Maintenance Practice Question
Exhibit
ResourceRecordSet: {
Name: "sap.example.com.",
Type: "A",
AliasTarget: {
HostedZoneId: "Z2FDTNDATAQYW2",
DNSName: "dualstack.my-alb-1234567890.us-east-1.elb.amazonaws.com.",
EvaluateTargetHealth: true
}
}Refer to the exhibit. An SAP administrator is configuring Route 53 to point a custom domain name to an Application Load Balancer (ALB) that fronts SAP Web Dispatchers. The record set is configured as shown. However, when users access sap.example.com, they receive a 503 error. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the ALB is not allowing inbound traffic on port 443 from the internet.
A 503 error from an ALB typically indicates that the ALB is not receiving traffic or that the target group is unhealthy. However, in this scenario, the correct answer is B: the security group for the ALB is not allowing inbound traffic on port 443 from the internet. Without that rule, the ALB cannot accept HTTPS requests, resulting in a 503. EvaluateTargetHealth being true (Option A) is a correct configuration for alias records and does not cause a 503. The Alias Target (Option C) is correctly set to the ALB's DNS name; 'dualstack' is part of that DNS name and is legitimate. A failing target group health check (Option D) would cause a 503, but the question specifies that users receive 503 when accessing the domain, and the most likely cause given the exhibit is the missing security group rule on the ALB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EvaluateTargetHealth is set to true, which is causing the record to be marked as unhealthy.
Why it's wrong here
EvaluateTargetHealth set to true is correct for alias records and does not directly cause a 503 error.
- ✓
The security group for the ALB is not allowing inbound traffic on port 443 from the internet.
Why this is correct
If the ALB security group blocks inbound HTTPS traffic from the internet, users cannot connect, resulting in a 503 error.
- ✗
The Alias Target is incorrect; it should be the ALB's DNS name without 'dualstack'.
Why it's wrong here
The alias target should include 'dualstack' to support both IPv4 and IPv6; omitting it would cause DNS resolution issues, not a 503.
- ✗
The health check for the ALB target group is failing, causing Route 53 to return 503.
Why it's wrong here
While a failing target group health check can cause a 503, the security group misconfiguration is a more common and likely cause given the scenario.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.