The answer is that the public subnet’s network ACL lacks an inbound rule for ephemeral ports, which blocks the return traffic from the application servers. This is because security groups are stateful—they automatically allow reply traffic for an approved outbound connection—so the web dispatchers’ outbound HTTPS rule and the application security group’s inbound HTTPS rule work correctly. However, network ACLs are stateless, meaning each direction of traffic must be explicitly permitted; the response from the application servers uses a random ephemeral port, and the public subnet NACL only allows inbound HTTPS (port 443) from the internet, not ephemeral ports from the private subnet. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this scenario tests your understanding of the stateful versus stateless distinction in multi-tier SAP architectures, a common trap where candidates assume security group statefulness extends to NACLs. Remember the mnemonic: “Security groups remember, NACLs forget”—so always check both inbound and outbound ephemeral port rules when NACLs are involved.
PAS-C01 Technology Practice Question
This PAS-C01 practice question tests your understanding of technology. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are an AWS administrator for a company running SAP S/4HANA on AWS. The system uses a three-tier architecture: web dispatchers, application servers, and a HANA database. All components are in a single VPC. Security requirements demand that the web dispatchers are in a public subnet, application servers in private subnets, and the database in a private subnet. The web dispatchers need to communicate with the application servers on port 443, and application servers communicate with the database on port 31341. You have configured security groups accordingly. However, the web dispatchers cannot connect to the application servers. The network ACL for the public subnet allows inbound HTTPS from the internet and outbound all traffic. The private subnet NACL allows inbound HTTPS from the public subnet and outbound all traffic. The security group for the web dispatchers allows outbound HTTPS to the application security group. The application security group allows inbound HTTPS from the web security group. What is the issue?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet.
Option B is correct because security groups are stateful; if the application security group allows inbound HTTPS from the web security group, the return traffic is automatically allowed. However, network ACLs are stateless, so the private subnet NACL must allow inbound traffic from the public subnet, which it does, but it must also allow outbound return traffic from the application servers to the web dispatchers. The outbound rule in the private NACL allows all traffic, so that is not the issue. Actually, the problem is likely that the web dispatchers are in a public subnet with a NACL that allows inbound HTTPS from the internet, but the application servers are in a private subnet and need to send return traffic. Since NACLs are stateless, the private subnet NACL must allow inbound HTTPS from the web dispatchers, which is configured, but also outbound traffic from the application servers. The outbound rule allows all, so that's fine. The real issue could be that the web dispatchers' security group does not allow inbound traffic from the application servers for the return traffic? But security groups are stateful, so no. Let's re-evaluate: The web dispatchers initiate connection to application servers on port 443. The application servers respond. The web dispatchers' security group must allow outbound HTTPS to the application servers, which it does. The application servers' security group must allow inbound HTTPS from the web dispatchers, which it does. Since security groups are stateful, the return traffic is allowed. So the issue might be with routing? But all in same VPC. Perhaps the web dispatchers are in a public subnet without a route to the private subnet? Actually, by default, VPC has local route. So routing is fine. The most common issue is that the network ACL for the private subnet must allow inbound ephemeral ports for the response traffic. Since NACLs are stateless, the outgoing response from application servers uses ephemeral ports, and the private subnet NACL must allow outbound traffic on those ports. The outbound rule allows all, so that's fine. But the public subnet NACL must allow inbound ephemeral ports for the response traffic coming back to the web dispatchers. The public subnet NACL allows inbound HTTPS from the internet, but not necessarily ephemeral ports from the private subnet. So the issue is that the public subnet NACL does not allow inbound traffic on ephemeral ports from the private subnet. Option A is incorrect because security groups are fine. Option C is incorrect because security groups are stateful. Option D is incorrect because routing should work.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet.
Why this is correct
The response traffic from the application servers uses ephemeral ports; the public NACL must allow inbound on those ports from the private subnet.
The VPC does not have a route between the public and private subnets.
Why it's wrong here
VPC default local route allows communication between all subnets.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related PAS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Technology — This question tests Technology — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet. — Option B is correct because security groups are stateful; if the application security group allows inbound HTTPS from the web security group, the return traffic is automatically allowed. However, network ACLs are stateless, so the private subnet NACL must allow inbound traffic from the public subnet, which it does, but it must also allow outbound return traffic from the application servers to the web dispatchers. The outbound rule in the private NACL allows all traffic, so that is not the issue. Actually, the problem is likely that the web dispatchers are in a public subnet with a NACL that allows inbound HTTPS from the internet, but the application servers are in a private subnet and need to send return traffic. Since NACLs are stateless, the private subnet NACL must allow inbound HTTPS from the web dispatchers, which is configured, but also outbound traffic from the application servers. The outbound rule allows all, so that's fine. The real issue could be that the web dispatchers' security group does not allow inbound traffic from the application servers for the return traffic? But security groups are stateful, so no. Let's re-evaluate: The web dispatchers initiate connection to application servers on port 443. The application servers respond. The web dispatchers' security group must allow outbound HTTPS to the application servers, which it does. The application servers' security group must allow inbound HTTPS from the web dispatchers, which it does. Since security groups are stateful, the return traffic is allowed. So the issue might be with routing? But all in same VPC. Perhaps the web dispatchers are in a public subnet without a route to the private subnet? Actually, by default, VPC has local route. So routing is fine. The most common issue is that the network ACL for the private subnet must allow inbound ephemeral ports for the response traffic. Since NACLs are stateless, the outgoing response from application servers uses ephemeral ports, and the private subnet NACL must allow outbound traffic on those ports. The outbound rule allows all, so that's fine. But the public subnet NACL must allow inbound ephemeral ports for the response traffic coming back to the web dispatchers. The public subnet NACL allows inbound HTTPS from the internet, but not necessarily ephemeral ports from the private subnet. So the issue is that the public subnet NACL does not allow inbound traffic on ephemeral ports from the private subnet. Option A is incorrect because security groups are fine. Option C is incorrect because security groups are stateful. Option D is incorrect because routing should work.
What should I do if I get this PAS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related PAS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.