PAS-C01 · Question #68
A company recently implemented an architecture in which all the systems and components of the company's SAP environment are hosted on AWS. Front-end users connect from the corporate data center. SAP a
The correct answer is A. Use a NAT gateway to ensure connectivity between the instances in the private subnet and other. A NAT gateway (A) fulfills the core requirements: it allows instances in private subnets to initiate outbound connections to the internet and AWS services, while blocking all unsolicited inbound traffic from the internet (stateful NAT translation). For SAP support remote connecti
Question
A company recently implemented an architecture in which all the systems and components of the company's SAP environment are hosted on AWS. Front-end users connect from the corporate data center. SAP application servers and database servers are hosted in a private subnet. The company has the following requirements:
- Ensure that the instances in the private subnet can connect to the
internet and other AWS services.
- Prevent instances from receiving inbound traffic that is initiated by
someone on the inter-net.
- For SAP support, allow a remote connection between the company's
network and SAP. Ensure that access is available to the production environment as needed. Which solution will meet these requirements?
Options
- AUse a NAT gateway to ensure connectivity between the instances in the private subnet and other
- BUse NAT instances to ensure connectivity between the instances in the private subnet and other
- CUse a bastion host to ensure connectivity between the instances in the private subnet and other
- DUse an internet gateway to ensure connectivity between the instances in the private subnet and
How the community answered
(37 responses)- A84% (31)
- B8% (3)
- C3% (1)
- D5% (2)
Explanation
A NAT gateway (A) fulfills the core requirements: it allows instances in private subnets to initiate outbound connections to the internet and AWS services, while blocking all unsolicited inbound traffic from the internet (stateful NAT translation). For SAP support remote connections (SAP Router), the traffic flows outbound from the SAP system through the NAT gateway to SAP's network, satisfying the requirement without opening inbound ports. NAT instances (B) provide the same function but are self-managed EC2 instances that introduce operational overhead and are a legacy solution - AWS recommends NAT gateways. A bastion host (C) provides SSH jump access for administrators but does not address outbound internet connectivity for the SAP instances. An internet gateway (D) requires a public IP on the instance and would expose it to inbound internet traffic, violating the requirements.
Topics
Community Discussion
No community discussion yet for this question.