An SAP specialist is building an SAP environment. The SAP environment contains Amazon EC2 instances that run in a private subnet in a VPC. The VPC includes a NAT gateway. The SAP specialist is…

Question

Options

• AOpen a security group for SAP ports to allow traffic on port 443.
• BCreate route table entries to allow traffic from the database EC2 instances to the NAT gateway.
• CTurn off the source/destination check for the database EC2 instances.
• DCreate an IAM role that has permission to access network traffic. Associate the role with the

• A
  5% (1)
• B
  5% (1)
• C
  82% (18)
• D
  9% (2)

Explanation

By default, every EC2 instance enforces a source/destination check, which drops any packet whose source or destination IP does not match the instance's own IP addresses. Overlay IP routing works by sending traffic destined for an IP address that is not natively assigned to the instance (the overlay IP). If the source/destination check is enabled, the EC2 hypervisor silently discards this traffic, breaking cluster communication. Disabling the source/destination check on the database EC2 instances allows them to receive and forward packets for the overlay IP. Options A (security group port 443) addresses TLS traffic rules, not routing. Option B (NAT gateway route) is unrelated to overlay IP path. Option D (IAM role) controls API permissions, not network packet routing.

No community discussion yet for this question.