PAS-C01 Practice Test 5 — 10 Questions

Question 1

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

Accepted Answer

A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.. The CodePipeline service role needs permissions to write objects to the S3 bucket and list its contents to verify the upload. A custom policy with s3:PutObject and s3:ListBucket on the target bucket grants exactly these required actions, resolving the 'Access Denied' error during the Deploy stage.

Answer

CloudFrontFullAccess

Answer

AdministratorAccess

Answer

AmazonS3ReadOnlyAccess

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution requires the least operational overhead?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.. Option A is correct because a Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.

Answer

Use AWS Config rules to detect untagged buckets and trigger a Lambda function to add tags.

Answer

Configure each account's S3 bucket creation process to include tagging.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Question 3

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.

Question 4

A company is running a critical web application on EC2 instances behind an Application Load Balancer. During a recent deployment, a new version of the application was released, and within minutes, the error rate spiked. The operations team rolled back the deployment, but the error rate remained high. The team suspects that the ALB is still routing traffic to unhealthy instances. Which step should the team take to immediately stop routing traffic to the problematic instances?

Accepted Answer

Deregister the instances from the target group.. Option D is correct because deregistering the problematic EC2 instances from the target group immediately stops the Application Load Balancer from routing any new traffic to them. The ALB performs health checks on registered targets, but if an instance is unhealthy, it still remains in the target group and can receive traffic if the health check logic is misconfigured or if the instance is in a 'draining' state. Deregistration forces the ALB to complete any in-flight requests and then remove the instance from the routing table, providing an immediate stop to traffic.

Answer

Modify the ALB listener rules to point to a different target group.

Answer

Modify the health check interval to 5 seconds and the unhealthy threshold to 2.

Answer

Stop the EC2 instances from the AWS Management Console.

Question 5

An administrator is migrating an on-premises application to AWS. The application stores persistent data on a separate disk. The administrator launched an EC2 instance as a test and attached an additional EBS volume for the persistent data. The above exhibit shows the block device mapping for the test instance. Later, the administrator terminates the test instance, but the persistent data must be retained. However, after termination, the persistent data volume is also deleted. What is the most likely cause?

Accepted Answer

The administrator mistakenly stored the persistent data on the root volume (vol-0a1b2c3d4e5f67890), which has DeleteOnTermination set to true.. Option C is correct because the exhibit shows the root volume (vol-0a1b2c3d4e5f67890) as the only volume with DeleteOnTermination set to true. The administrator intended to store persistent data on a separate EBS volume, but the data was actually stored on the root volume. When the instance was terminated, the root volume was deleted due to its DeleteOnTermination flag being true, causing the loss of the persistent data.

Answer

The instance was stopped instead of terminated, and the persistent data volume was detached during the stop.

Answer

The persistent data volume (vol-0f1e2d3c4b5a67890) had DeleteOnTermination set to false, but the administrator inadvertently changed it before termination.

Answer

The persistent data volume was not properly attached to the instance before termination.

Question 6

A company is running SAP BusinessObjects on AWS. The application is deployed on EC2 instances with an Application Load Balancer. Users are reporting that the application is sometimes unreachable. What is the most likely cause?

Accepted Answer

The target group health checks are failing intermittently on the EC2 instances.. Intermittent unreachability of an application behind an Application Load Balancer (ALB) is most commonly caused by health checks failing on the target EC2 instances. When health checks fail intermittently, the ALB will periodically mark the instances as unhealthy and stop routing traffic to them, causing the application to become unreachable during those windows. This matches the symptom of 'sometimes unreachable' rather than a persistent failure.

Answer

The security group for the instances is not allowing traffic from the load balancer.

Answer

The load balancer is not configured with sticky sessions.

Answer

The Route 53 TTL is too short for DNS resolution.

Question 7

Match the SAP sizing parameter to its AWS EC2 equivalent.

Question 8

Match the AWS managed service to its SAP-related capability.

Question 9

Which TWO of the following are best practices for securing an SAP HANA database on AWS? (Choose two.)

Accepted Answer

Deploy the HANA instance in a private subnet without direct internet access.. Deploying the HANA instance in a private subnet without direct internet access ensures that the database is not exposed to the public internet, reducing the attack surface. This follows the AWS security best practice of using private subnets for sensitive workloads, with access only through bastion hosts or VPN/Direct Connect. It also aligns with SAP's own security recommendations for HANA deployments.

Answer

Disable SSL/TLS for client connections to improve performance.

Answer

Use a single Availability Zone to simplify network security group management.

Answer

Assign a public IP address to the HANA instance for easy access from the internet.

Question 10

A company is planning to run SAP S/4HANA on AWS and needs to ensure that the SAP system is backed up according to best practices. Which backup strategy is recommended?

Accepted Answer

Use EBS snapshots after quiescing the SAP system, combined with database backups to S3.. For SAP S/4HANA on AWS, the recommended backup strategy combines EBS snapshots taken after quiescing the SAP system (to ensure file system consistency) with database backups to Amazon S3. Quiescing the application ensures that all pending I/O operations are flushed and the file system is in a consistent state, preventing data corruption. Database backups to S3 provide a separate, application-consistent recovery point that can be used for point-in-time recovery, which is critical for SAP systems.

Answer

Use EBS snapshots of the data volumes without quiescing the application.

Answer

Store backup files on instance store volumes for quick recovery.

Answer

Use AWS Backup to take snapshots of the EC2 instance only.