PAS-C01 Practice Test 10 — 10 Questions

Question 1

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replatform the application by migrating the Oracle database to Amazon RDS for Oracle. The company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Answer

Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

Answer

Store the data in Amazon S3 and use Athena for querying

Answer

Refactor the application to use Amazon DynamoDB as the database

Question 2

A company is migrating a SAP system to AWS and wants to use AWS Systems Manager for patching. Which TWO prerequisites are required to use AWS Systems Manager Patch Manager?

Accepted Answer

The AWS Systems Manager Agent (SSM Agent) must be installed on the EC2 instance.. Option C is correct because Patch Manager relies on the AWS Systems Manager Agent (SSM Agent) running on the instance to receive and execute patch commands; without the SSM Agent installed and running, the instance cannot be managed by Systems Manager. Option D is correct because the instance needs an IAM instance profile/role granting Systems Manager permissions (e.g., the AmazonSSMManagedInstanceCore policy) so the agent can register with the service and retrieve patch baselines and commands. Option A is incorrect because instances in private subnets can be managed via SSM VPC endpoints or NAT, so a public subnet is not required. Option B is incorrect because Patch Manager supports multiple operating systems, including Windows Server and various Linux distributions, not just Amazon Linux 2. Option E is incorrect because a maintenance window is optional; patching can be run on demand via Run Command without configuring a maintenance window or reboot option.

Answer

The EC2 instance must be in a public subnet.

Answer

The EC2 instance must be running Amazon Linux 2.

Answer

A maintenance window must be configured with a reboot option.

Question 3

A company runs an SAP HANA database on an EC2 instance with a single EBS volume. The database is experiencing high I/O latency during peak hours. Which solution would provide consistent, low-latency performance without downtime?

Accepted Answer

Replace the existing volume with an EBS io2 Block Express volume.. Replacing the existing volume with an EBS io2 Block Express volume provides consistent, low-latency performance with high IOPS and throughput, specifically designed for I/O-intensive workloads like SAP HANA. This can be done without downtime by using features such as EBS multi-attach or logical volume mirroring to migrate data while the instance runs. Option C is incorrect because the Elastic Fabric Adapter (EFA) is a network interface for HPC inter-instance communication, not a storage I/O offload solution; it does not directly reduce storage latency. Option A (migrating to instance store) would require data migration and potential downtime. Option D (switching to gp3) may not offer the same level of consistent low latency and high IOPS as io2 Block Express.

Answer

Migrate the database to an instance with NVMe instance store volumes.

Answer

Attach an Elastic Fabric Adapter (EFA) to the instance to offload storage I/O.

Answer

Switch the volume type to EBS gp3 with maximum throughput.

Question 4

A company needs to monitor the CPU utilization of SAP EC2 instances and send an alert if it exceeds 90% for 5 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (option B) monitor metrics like CPU utilization and can trigger actions such as sending alerts when a threshold is exceeded for a specified duration. Option A (AWS Config) is used for configuration compliance and inventory. Option C (AWS Trusted Advisor) provides best-practice checks. Option D (AWS CloudTrail) is for API auditing and governance.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 5

A company is migrating its SAP ERP system to AWS and needs to minimize network latency between the SAP application servers and the database. Which AWS service or feature should be used to meet this requirement?

Accepted Answer

Place the application and database servers in the same placement group.. Placement groups in AWS, specifically cluster placement groups, provide low-latency network performance by ensuring that EC2 instances are placed in close physical proximity within a single Availability Zone. This minimizes network latency between SAP application servers and the database, meeting the requirement for high-throughput, low-latency communication critical for SAP ERP workloads.

Answer

Use AWS Global Accelerator for the application servers.

Answer

Set up VPC peering between the application and database VPCs.

Answer

Use an Elastic Load Balancer in front of the application servers.

Question 6

A company runs SAP NetWeaver application servers on EC2 instances in a private subnet. The SAP GUI clients connect from the corporate network over an AWS Site-to-Site VPN. The security team wants the SAP application servers to have no outbound internet access but still be able to receive operating system patches from an internal repository hosted in Amazon S3. Which configuration should the company implement?

Accepted Answer

Create an S3 gateway VPC endpoint, attach it to the route table of the private subnet, and allow the instance security group to reach the endpoint's prefix list.. An S3 gateway VPC endpoint keeps traffic to Amazon S3 on the AWS network and requires no internet gateway or NAT device. By associating the endpoint with the private subnet route table and allowing the endpoint prefix list in the security group, the SAP application servers can retrieve patches from the internal S3 repository without any outbound internet connectivity.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0, then restrict outbound traffic with a security group that only allows the patch repository.

Answer

Configure the instances with an Elastic IP address and a security group that allows only the S3 service prefix list.

Answer

Deploy a NAT gateway in the private subnet and route S3 traffic through it so the instances can download patches.

Question 7

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the MOST likely cause?

Accepted Answer

The target instances are failing health checks.. ALB returns HTTP 503 Service Unavailable when no healthy targets are available in the target group to receive the request. If the target EC2 instances (web dispatchers) are failing health checks, the ALB marks them unhealthy and, once all targets are unhealthy, returns 503 to clients. This is the most likely cause of the observed failures.

Answer

The SSL certificate on the ALB has expired.

Answer

Security groups allow too much traffic.

Answer

The ALB is out of capacity.

Question 8

A company uses Amazon CloudWatch Logs to store SAP application logs. The Security team requires that logs be encrypted at rest using a customer-managed KMS key (CMK). How can this be achieved?

Accepted Answer

Associate the KMS key with the CloudWatch Logs log group.. CloudWatch Logs encrypts log data at rest using an AWS KMS key, and the customer-managed key (CMK) is associated at the log group level, not the log stream. Associating a CMK with the log group ensures all log events stored in that group are encrypted with the customer-managed key, satisfying the requirement for CMK-based encryption at rest.

Answer

Enable default encryption on the S3 bucket where logs are exported.

Answer

Use an encrypted EBS volume for the EC2 instances generating the logs.

Answer

Enable encryption on the CloudWatch Logs log stream.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.. Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Answer

Use AWS Config rules to detect noncompliant buckets and send notifications.

Answer

Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.

Question 10

A company is migrating a SAP system to AWS and needs to ensure that the database migration from SAP ASE to Amazon Aurora is successful with minimal downtime. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports heterogeneous migrations from SAP ASE (Sybase) to Amazon Aurora with minimal downtime. DMS can continuously replicate ongoing changes from the source database to the target using change data capture (CDC), allowing the source system to remain operational during the migration and enabling a cutover with only a brief outage.

Answer

AWS Snowball Edge

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync