PAS-C01 Practice Test 14 — 15 Questions

Question 1

A company is running SAP on AWS and needs to patch the operating system of multiple SAP application servers. The servers are in an Auto Scaling group behind an Application Load Balancer. What strategy minimizes downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a rolling update by updating the Auto Scaling group's launch configuration with a new AMI.. A rolling update with a launch template allows replacing instances one at a time, maintaining capacity. Option A is wrong because creating a new Auto Scaling group and shifting traffic using Route 53 is more complex and may cause downtime during the traffic shift. Option B is wrong because patching all instances at once via SSM may cause simultaneous reboots, leading to downtime. Option D is wrong because stopping all instances, applying patches, then starting them causes downtime.

Answer

Create a new Auto Scaling group with patched instances and shift traffic using Route 53.

Answer

Use AWS Systems Manager Patch Manager to patch all instances at once.

Answer

Stop all instances, apply patches, then start them.

Question 2

A company runs SAP S/4HANA on AWS using an ASCS and PAS cluster with SUSE Linux Enterprise Server. The cluster fails over unexpectedly several times a day. What is the most likely cause and solution?

Accepted Answer

Cluster quorum loss due to insufficient votes; add a third node or configure a witness. In a two-node SAP cluster, if the quorum vote count is insufficient, the cluster may lose quorum and trigger unnecessary failovers. The solution is to add a third node as a quorum device or configure a witness (e.g., an S3 bucket as a quorum disk in SUSE HAE). Option A is incorrect because high network latency would cause communication delays, not frequent failovers. Option C is incorrect because insufficient memory would cause performance issues, not cluster failovers. Option D is incorrect because incorrect ASCS instance configuration would cause SAP startup failures, not cluster failovers.

Answer

High network latency between nodes; use placement groups

Answer

Insufficient memory on the cluster nodes; increase memory

Answer

Incorrect ASCS instance configuration; verify SAP profiles

Question 3

A company runs an SAP HANA database on an r5.8xlarge EC2 instance. The operations team notices that the instance's CPU utilization spikes to 100% every night at 2 AM, causing SAP application timeouts. CloudWatch metrics show the spike corresponds to a backup process. Which action should be taken to resolve the issue?

Accepted Answer

Move the backup window to an earlier time when the system is less active.. Rescheduling the backup to a less active time reduces CPU contention directly. Option B is wrong because increasing instance size is costly and does not address the underlying scheduling issue. Option C is wrong because disabling backups compromises data protection. Option D is wrong because restarting the instance via CloudWatch alarm is a reactive measure that may cause data loss or downtime and does not fix the root cause.

Answer

Increase the instance size to handle the backup load.

Answer

Disable the nightly backup.

Answer

Implement CloudWatch alarm to restart the instance when CPU is high.

Question 4

A company is migrating its SAP ERP system to AWS. The system requires high availability across two Availability Zones. Which AWS service should be used to manage the virtual IP address for the SAP Central Services (ASCS/ERS) cluster?

Accepted Answer

Network Load Balancer. The correct approach for managing the virtual IP address for SAP Central Services (ASCS/ERS) across two Availability Zones is to use a Network Load Balancer (NLB). AWS does not support floating IPs across AZs, so an NLB is used to front the ASCS/ERS endpoints. The NLB uses health checks to route traffic to the active node, providing a single virtual IP (the NLB's DNS name or static IP) that clients can use. This is the recommended AWS pattern for SAP high availability. Route 53 is used for DNS failover but does not serve as a virtual IP itself; it can complement the NLB by pointing a hostname to the NLB's DNS name, but the virtual IP is managed by the NLB.

Answer

Elastic IP address

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 5

An SAP Basis administrator needs to apply an OS-level security patch to a fleet of SAP EC2 instances running Red Hat Enterprise Linux. The instances are part of an Auto Scaling group. Which approach is the MOST efficient and minimizes downtime?

Accepted Answer

Create a new AMI with the patch applied, update the launch template, and perform a rolling update via Auto Scaling.. The most efficient and minimizes downtime because it uses a rolling update strategy. By creating a new AMI with the patch applied and updating the launch template in the Auto Scaling group, instances are gradually replaced without stopping all at once. Option A is incorrect because manually terminating instances is not efficient and doesn't leverage Auto Scaling automation. Option B is incorrect because stopping all instances to apply a patch causes downtime. Option C is incorrect because while Systems Manager Patch Manager can apply patches, simultaneous patching without a rolling update risks service disruption, especially if reboots are required. The rolling update via Auto Scaling ensures high availability.

Answer

Create a custom AMI and manually terminate each instance to launch new ones.

Answer

Stop all instances, apply the patch using a script, and restart them.

Answer

Use AWS Systems Manager Patch Manager to apply the patch to all instances simultaneously.

Question 6

An SAP system administrator needs to ensure that all SAP application logs are centrally collected and monitored for errors. Which AWS service should they use to aggregate logs from multiple EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized, agent-based log aggregation solution. The CloudWatch Logs agent (or unified CloudWatch agent) can be installed on each EC2 instance to automatically collect, encrypt, and stream SAP application logs to a central CloudWatch Logs group. This allows the administrator to monitor logs in real time, set metric filters for error patterns, and trigger alarms without needing to build custom infrastructure.

Answer

Amazon S3 with server access logs

Answer

Amazon Kinesis Data Firehose

Answer

AWS Lambda to process logs from each instance

Question 7

A company uses SAP NetWeaver with an Oracle database on EC2. The operations team wants to automate the patching of the operating system while ensuring minimal downtime. Which AWS Systems Manager capability should be used?

Accepted Answer

AWS Systems Manager Patch Manager. (AWS Systems Manager Patch Manager) is correct because it automates OS patching with scheduling and maintenance windows, minimizing downtime for SAP NetWeaver on EC2. Option A (Automation) is for running predefined workflows, not specifically for patching. Option B (Run Command) is for ad-hoc command execution, not automated patching. Option C (OpsCenter) is for managing operational issues, not patching.

Answer

AWS Systems Manager Automation

Answer

AWS Systems Manager Run Command

Answer

AWS Systems Manager OpsCenter

Question 8

A company runs SAP S/4HANA on AWS with a multi-tier landscape (DEV, QAS, PRD). The PRD system uses a clustered setup with two application servers behind an Application Load Balancer. The database is a single-node HANA on an r5.24xlarge instance. The administrator receives an alert that the PRD application is slow. CloudWatch metrics show high CPU utilization on the two application servers (average 95%) and high DB connection count. The ALB shows increased request latency. The database CPU is at 60%. The administrator suspects a SQL query performance issue. What should be the first step to identify the root cause?

Accepted Answer

Enable detailed SQL trace in HANA to identify high-resource queries.. The symptoms (high CPU on app servers, high DB connections, increased ALB latency, DB CPU at 60%) strongly suggest a SQL query performance bottleneck, not a capacity issue. Enabling detailed SQL trace in HANA (option B) is the most direct first step to identify the specific high-resource queries causing the slowdown, as it captures execution plans, wait times, and resource consumption per query. This aligns with SAP's recommended troubleshooting methodology for HANA performance issues.

Answer

Configure CloudWatch Logs to capture HANA trace logs and analyze them.

Answer

Add two more application servers to distribute the load.

Answer

Increase the size of the HANA database instance to reduce CPU pressure.

Question 9

A company runs SAP Business Suite on AWS and wants to implement a disaster recovery (DR) solution with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The primary site is in us-east-1, and DR site will be in us-west-2. The database is running on SAP ASE. The company wants to minimize changes to the existing SAP environment and avoid complex replication setups. What is the most suitable DR approach?

Accepted Answer

Use AWS Backup to schedule snapshots of the EBS volumes and copy them to the DR region.. AWS Backup can schedule EBS snapshots every hour, meeting the RPO of 1 hour, and snapshots can be copied to the DR region (us-west-2). Restoring from these snapshots can be automated to achieve the RTO of 4 hours. This approach requires minimal changes to the existing SAP environment and avoids complex replication setups. Option A is incorrect because Multi-AZ replication is for high availability within a single region, not for disaster recovery across regions. Option B is incorrect because SAP ASE native replication would require significant changes to the database configuration and licensing, contradicting the requirement to minimize changes. Option D is incorrect because AWS Database Migration Service is designed for ongoing data replication and is not the best fit for a simple backup/restore DR strategy.

Answer

Deploy a Multi-AZ database in the primary region.

Answer

Set up SAP ASE native replication to a standby database in the DR region.

Answer

Use AWS Database Migration Service to continuously replicate data to the DR region.

Question 10

A company runs SAP S/4HANA on AWS using a distributed architecture with separate instances for the database (DB) and application (ASCS, PAS, AAS). The application servers are in an Auto Scaling group. After a recent scaling event, users report that they cannot log in to the system. The SAP dispatcher logs show that the application servers cannot connect to the message server. What is the most likely cause?

Accepted Answer

The new application servers are not registered in the SAP message server's configuration.. The most likely cause is that the new application servers launched by the Auto Scaling group are not registered in the SAP message server's configuration. In a distributed SAP system, each application server must be registered with the message server so that it can accept user logons and communicate with other components. If registration is missing, the dispatcher cannot connect to the message server, resulting in login failures. Option A (database connection string) would cause database connectivity issues, not message server issues. Option C (licenses) would affect logons globally, not just after scaling. Option D (security group outbound) would block all traffic, not specifically message server traffic.

Answer

The database connection string in the new application servers points to the wrong endpoint.

Answer

The SAP licenses are exhausted and need to be updated.

Answer

The security group of the application servers is not allowing outbound traffic to the DB server.

Question 11

An SAP system is running on an EC2 instance with an instance profile that grants access to an S3 bucket. The application is unable to read a specific object from the bucket. What is the first step to troubleshoot the issue?

Accepted Answer

Check the IAM policy attached to the instance profile. The instance profile grants the EC2 instance permissions to access the S3 bucket via IAM roles. If the application cannot read a specific object, the most likely cause is that the IAM policy attached to the instance profile does not include the necessary permissions (e.g., s3:GetObject) for that object. Checking the IAM policy is the first logical step because it directly controls the identity-based access for the instance.

Answer

Check the security group associated with the instance

Answer

Check the network ACLs

Answer

Check the S3 bucket policy

Question 12

A company runs SAP S/4HANA on AWS. The system uses an SAP HANA database with a single EC2 instance. The operations team needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The DR site is in a different AWS Region. The team currently takes daily EBS snapshots and sends them to the DR region using AWS Backup cross-region copy. However, the RPO is not met because snapshots are only taken daily. Which combination of actions should the team take to meet the RPO and RTO?

Accepted Answer

Set up HANA System Replication (HSR) between the primary and DR regions. In the DR region, maintain a standby HANA instance in sync. Use automated failover scripts.. HANA System Replication (HSR) provides near-continuous data replication, meeting the 15-minute RPO. In the DR region, maintaining a standby HANA instance in sync and using automated failover scripts can achieve the 1-hour RTO. Option A is wrong because increasing EBS snapshot frequency to every hour still does not meet the 15-minute RPO (snapshots are not continuous) and RTO may be longer due to restore time. Option B is wrong because CloudEndure Disaster Recovery is designed for server-level replication but is not optimized for HANA; it may not ensure database consistency and could impact performance. Option D is wrong because Amazon EBS multi-region replication does not guarantee database consistency for a running SAP HANA database.

Answer

Increase the frequency of EBS snapshots to every hour and use cross-region copy. Also, pre-warm the DR instance by restoring the latest snapshot.

Answer

Use AWS CloudEndure Disaster Recovery to replicate the entire EC2 instance to the DR region.

Answer

Use Amazon EBS multi-region replication for the HANA data volumes.

Question 13

An SAP HANA administrator is troubleshooting a performance issue on an EC2 instance (r5.8xlarge) running SAP HANA. The instance has two EBS volumes attached. Based on the exhibit, which additional information is needed to determine if the instance is optimized for SAP HANA?

Accepted Answer

Whether the instance is EBS-optimized or has dedicated EBS bandwidth.. SAP HANA requires high and consistent network throughput for data replication and client access, and the instance must be EBS-optimized or have dedicated EBS bandwidth to ensure that EBS I/O does not contend with network I/O. Without this confirmation, the administrator cannot guarantee that the instance meets SAP's performance requirements for HANA workloads, as non-optimized instances share the same network interface for both EBS and data traffic, leading to potential bottlenecks.

Answer

Whether the instance is in a placement group.

Answer

The volume type and IOPS of the attached EBS volumes.

Answer

Whether the AMI used is SAP-certified.

Question 14

A company is migrating its SAP ERP system to AWS and needs to ensure that the SAP application can communicate with the corporate LDAP server for authentication. The LDAP server is on-premises. Which AWS service should be used to establish a secure connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet using IPsec, enabling secure communication between the SAP application in the VPC and the on-premises LDAP server. This is the most straightforward and cost-effective option for establishing a secure connection when a dedicated physical link is not required.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS Transit Gateway

Question 15

A company runs SAP S/4HANA on AWS with a High Availability (HA) cluster spanning two Availability Zones (us-east-1a and us-east-1b). The cluster uses an Amazon FSx for NetApp ONTAP file system for the global transport directory. Recently, the cluster experienced a split-brain situation, leading to data corruption. The administrator wants to prevent this from recurring. The current setup uses a single FSx file system mounted on both cluster nodes. What should the administrator do to prevent split-brain?

Accepted Answer

Configure a STONITH (Shoot The Other Node In The Head) mechanism using AWS Lambda. STONITH (Shoot The Other Node In The Head) is a fencing mechanism that ensures a failed node is forcefully isolated or powered off before the other node takes over, preventing split-brain scenarios in High Availability clusters. Option A is incorrect because adding a third node increases complexity without addressing the root cause of split-brain. Option B is incorrect because increasing memory does not affect cluster communication or fencing. Option D is incorrect because cross-region replication is for disaster recovery, not for preventing split-brain.

Answer

Add a third cluster node in a third Availability Zone

Answer

Increase the memory on both EC2 instances

Answer

Set up cross-region replication for the FSx file system