PAS-C01 Technology Practice Question
You are an AWS administrator for a company running SAP S/4HANA on AWS. The system uses a three-tier architecture: web dispatchers, application servers, and a HANA database. All components are in a single VPC. Security requirements demand that the web dispatchers are in a public subnet, application servers in private subnets, and the database in a private subnet. The web dispatchers need to communicate with the application servers on port 443, and application servers communicate with the database on port 31341. You have configured security groups accordingly. However, the web dispatchers cannot connect to the application servers. The network ACL for the public subnet allows inbound HTTPS from the internet and outbound all traffic. The private subnet NACL allows inbound HTTPS from the public subnet and outbound all traffic. The security group for the web dispatchers allows outbound HTTPS to the application security group. The application security group allows inbound HTTPS from the web security group. What is the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet.
The issue is that network ACLs are stateless. The web dispatchers initiate outbound HTTPS connections to the application servers. The application servers respond using ephemeral ports. The public subnet NACL allows inbound HTTPS from the internet, but it does not allow inbound traffic on ephemeral ports from the private subnet. This blocks the return traffic. Therefore, option A is correct. Options B and C are incorrect because security groups are stateful and allow return traffic automatically. Option D is incorrect because the VPC's local route handles traffic between subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet.
Why this is correct
The response traffic from the application servers uses ephemeral ports; the public NACL must allow inbound on those ports from the private subnet.
- ✗
The security group for the application servers does not allow inbound HTTPS from the web dispatchers.
Why it's wrong here
It is configured to allow inbound HTTPS.
- ✗
The security group for the web dispatchers does not allow outbound HTTPS to the application security group.
Why it's wrong here
The stem states it does allow outbound HTTPS.
- ✗
The VPC does not have a route between the public and private subnets.
Why it's wrong here
VPC default local route allows communication between all subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.