PAS-C01 · Question #131
A company has deployed a highly available SAP NetWeaver system on SAP HANA into a VPC. The system is distributed across multiple Availability Zones within a single AWS Region. SAP NetWeaver is running
The correct answer is B. Deploy a Network Load Balancer. Configure the overlay IP address as a target. D. Use AWS Transit Gateway. Configure the overlay IP address as a static route in the transit. The core challenge is routing traffic to the overlay IP address - a virtual/floating IP used by SUSE HA Extension that moves between nodes during failover - from clients that connect via existing private connectivity (e.g., Direct Connect or VPN). Why B (Network Load Balancer) is
Question
A company has deployed a highly available SAP NetWeaver system on SAP HANA into a VPC. The system is distributed across multiple Availability Zones within a single AWS Region. SAP NetWeaver is running on SUSE Linux Enterprise Server for SAP. SUSE Linux Enterprise High Availability Extension is configured to protect SAP ASCS and ERS instances and uses the overlay IP address concept. The SAP shared files /sapmnt and /usr/sap/trans are hosted on an Amazon Elastic File System (Amazon EFS) file system. The company needs a solution that uses already-existing private connectivity to the VPC. The SAP NetWeaver system must be accessible through the SAP GUI client tool. Which solutions will meet these requirements? (Choose two.)
Options
- ADeploy an Application Load Balancer. Configure the overlay IP address as a target.
- BDeploy a Network Load Balancer. Configure the overlay IP address as a target.
- CUse an Amazon Route 53 private zone. Create an A record that has the overlay IP address as a
- DUse AWS Transit Gateway. Configure the overlay IP address as a static route in the transit
- EUse a NAT gateway. Configure the overlay IP address as a target.
How the community answered
(23 responses)- A13% (3)
- B74% (17)
- C4% (1)
- E9% (2)
Explanation
The core challenge is routing traffic to the overlay IP address - a virtual/floating IP used by SUSE HA Extension that moves between nodes during failover - from clients that connect via existing private connectivity (e.g., Direct Connect or VPN).
Why B (Network Load Balancer) is correct: SAP GUI uses SAP's proprietary DIAG protocol, which operates at Layer 4 (TCP). An NLB operates at Layer 4 and can register an overlay IP address as a target, correctly forwarding TCP traffic to whichever ASCS node currently owns the overlay IP. An ALB (Option A) operates at Layer 7 (HTTP/HTTPS) and cannot handle the DIAG protocol, making it unsuitable.
Why D (AWS Transit Gateway with static route) is correct: When clients connect over existing private connectivity (Direct Connect/VPN), that traffic enters the AWS network through a Transit Gateway. By adding the overlay IP as a static route pointing into the VPC, the Transit Gateway correctly forwards packets destined for the overlay IP to the right place. Without this static route, the Transit Gateway has no knowledge of the overlay IP and will drop the traffic.
Why the others are wrong:
- A (ALB): Layer 7 only; cannot forward DIAG/SAP GUI traffic.
- C (Route 53 A record): DNS resolution alone does not solve routing. The overlay IP still needs a path from the on-premises network into the VPC; Route 53 does not create that path.
- E (NAT Gateway): NAT gateways are for outbound internet access from private subnets - they play no role in routing inbound overlay IP traffic.
Topics
Community Discussion
No community discussion yet for this question.