PAS-C01 Design of SAP Workloads on AWS Practice Question
Network Topology
Refer to the exhibit. An SAP administrator runs the AWS CLI command and receives the output shown. The SAP application server (instance i-0abcd1234) is in 'running' state, but the SAP application is not reachable. The security group allows inbound traffic on port 3200. What is the MOST likely cause of the issue?
⚠ Common exam trap
A common mix-up: candidates assume security group rules are the sole determinant of traffic flow, forgetting that the OS firewall on the instance can independently block traffic even when AWS-level permissions are correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The operating system firewall on the instance is blocking port 3200.
The instance is in 'running' state and the security group allows inbound traffic on port 3200, yet the SAP application is unreachable. This indicates a host-level firewall (e.g., iptables, firewalld, or Windows Firewall) on the SAP application server is blocking inbound connections to port 3200, which operates independently of AWS security groups and network ACLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL for the subnet is blocking outbound traffic.
Why it's wrong here
NACLs are stateless; outbound traffic is usually allowed.
- ✗
The instance is in a stopped state.
Why it's wrong here
The output shows the instance is running.
- ✗
The security group inbound rule for port 3200 is not applied to the instance.
Why it's wrong here
The output does not show security group but the question states it allows port 3200.
- ✓
The operating system firewall on the instance is blocking port 3200.
Why this is correct
OS firewall can block traffic even if security group allows it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.