PAS-C01 Practice Test 16 — 15 Questions

Question 1

An SAP administrator created the IAM policy shown in the exhibit to allow an EC2 instance to back up to an S3 bucket. However, the backup fails with an access denied error. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not grant permissions on the bucket itself.. The IAM policy shown in the exhibit grants permissions on individual objects within the S3 bucket (using the `arn:aws:s3:::bucket-name/*` resource ARN) but does not grant any permissions on the bucket itself (using `arn:aws:s3:::bucket-name`). For backup operations, the EC2 instance typically needs to list the bucket or check its existence before writing objects, which requires `s3:ListBucket` or similar actions on the bucket resource. Without these bucket-level permissions, the backup fails with an access denied error.

Answer

The actions specified are insufficient for backup operations.

Answer

The resource ARN is incorrectly formatted.

Answer

The bucket is in a different region than the EC2 instance.

Question 2

Which THREE of the following are best practices for securing SAP systems on AWS?

Accepted Answer

Enable AWS CloudTrail to log all API calls. Option A is correct because AWS CloudTrail records all API calls made in the AWS account, providing the audit trail and change visibility needed to detect unauthorized or suspicious activity against SAP infrastructure. Option B is correct because enabling encryption at rest with AWS KMS for SAP HANA data volumes protects sensitive business data and complies with SAP and regulatory requirements for data-at-rest protection. Option C is correct because security groups act as stateful virtual firewalls that restrict inbound and outbound traffic to SAP application servers, limiting exposure to only required ports and trusted sources. Option D is not a best practice because SAP system users should be authenticated through SAP's own mechanisms (such as SAP NetWeaver AS ABAP/Java authentication or SSO), not AWS IAM, which is designed for AWS resource access. Option E is not a best practice because hardcoding SAP credentials in application source code exposes secrets to anyone with repository access; credentials should be stored in AWS Secrets Manager or Systems Manager Parameter Store instead.

Answer

Use IAM users to authenticate SAP system users

Answer

Store SAP system credentials in application source code

Question 3

An SAP system on AWS is using an SAP HANA database. The database administrator wants to monitor memory usage and receive alerts when memory consumption exceeds 90%. Which THREE services can be used together to achieve this?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch custom metrics for SAP HANA (B) is correct because SAP HANA memory usage is not a native AWS metric; the SAP HANA CloudWatch integration (via the SAP HANA database's built-in CloudWatch plugin or AWS Data Provider for SAP) publishes HANA memory KPIs such as used memory as custom metrics into CloudWatch. Amazon CloudWatch Alarms (D) is correct because you create an alarm on that custom metric with a threshold of 90% (e.g., greater than 90 for the memory consumption percentage metric), which evaluates the metric and transitions to ALARM state when breached. Amazon Simple Notification Service (SNS) (A) is correct because the CloudWatch alarm's action is configured to publish to an SNS topic, which then delivers email/SMS/HTTP notifications to the database administrator. AWS Config (C) is not correct because it records and evaluates resource configuration compliance, not runtime memory utilization thresholds. Amazon Inspector (E) is not correct because it is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and network exposure, not a memory monitoring/alerting tool.

Answer

AWS Config

Answer

Amazon Inspector

Question 4

An SAP administrator configures Route 53 failover routing as shown. The health check associated with the primary record is failing. What will happen to client requests for sap.example.com?

Accepted Answer

Route 53 will return the secondary CNAME record. When the health check associated with the primary record fails, Route 53 automatically fails over to the secondary record. In this configuration, the primary record is an ALIAS record pointing to a load balancer, and the secondary record is a CNAME record. Since the primary is unhealthy, Route 53 returns the secondary CNAME record, directing clients to the failover endpoint.

Answer

Route 53 will return the ALIAS record for the primary load balancer

Answer

Route 53 will return an error

Answer

Route 53 will return both records

Question 5

Which TWO actions are recommended to ensure high availability for SAP NetWeaver on AWS? (Choose 2).

Accepted Answer

Use an Application Load Balancer with health checks to distribute traffic.. Option A is correct because an Application Load Balancer (ALB) performs health checks on registered targets and automatically routes traffic only to healthy SAP NetWeaver application instances, removing failed nodes from rotation and thus maintaining service availability. Option D is correct because deploying SAP application instances across multiple Availability Zones provides fault isolation — if one AZ experiences an outage, instances in the other AZ continue serving requests, which is the foundation of a highly available architecture on AWS. Option B is incorrect because confining resources to a single Availability Zone creates a single point of failure, which is the opposite of high availability. Option C is incorrect because EBS snapshots address data durability and backup/recovery, not continuous service availability during an instance or AZ failure. Option E is incorrect because t2 burstable instances are not certified or recommended for production SAP NetWeaver workloads and do not provide the performance or availability characteristics required.

Answer

Use a single Availability Zone to reduce latency.

Answer

Take frequent EBS snapshots to ensure data durability.

Answer

Use t2 instance types to reduce cost.

Question 6

Which TWO metrics should be monitored to ensure the health of an SAP HANA database running on AWS? (Select two.)

Accepted Answer

Disk I/O (read/write throughput). Option C (Disk I/O read/write throughput) is correct because SAP HANA is an in-memory database whose performance and availability depend heavily on fast, consistent storage I/O for persistence, log writes, savepoints, and reloading column store data from disk, so monitoring read/write throughput and latency on the underlying EBS volumes is essential to detect bottlenecks that can stall transactions or crash the database. Option D (HANA System Replication Lag) is correct because HSR is the primary HA/DR mechanism for HANA on AWS, and monitoring replication lag ensures the secondary site can meet the configured RPO; excessive lag indicates network, resource, or configuration problems that would cause data loss or failed takeover during a failover event. Option A (Elastic Load Balancer Latency) does not belong because ELBs are not part of a standard SAP HANA database architecture — HANA clients connect directly to the HANA instance (or via SAP application servers), so ELB metrics are irrelevant to HANA health. Option B (S3 Bucket Size) does not belong because S3 is used for backups, not for live HANA database operations, so bucket size is not a health metric for the running database. Option E (CPU Credit Balance) does not belong because CPU credits apply only to burstable T-series instances, which are not supported or recommended for production SAP HANA workloads that require dedicated, consistent compute performance.

Answer

Elastic Load Balancer Latency

Answer

S3 Bucket Size

Answer

CPU Credit Balance

Question 7

A company is migrating its SAP HANA database to AWS. The system requires high network throughput and low latency between the application and database tiers. Which AWS service should be used to achieve this?

Accepted Answer

Amazon EC2 placement group. Amazon EC2 placement groups, specifically cluster placement groups, provide low-latency, high-throughput networking by placing instances in a single Availability Zone within a logical group, ensuring they are physically close to each other. This minimizes network latency and maximizes throughput for tightly coupled workloads like SAP HANA, where application and database tiers require consistent, high-speed communication.

Answer

Amazon Route 53 latency-based routing

Answer

AWS Global Accelerator

Answer

Amazon EBS io2 Block Express volumes

Question 8

An SAP administrator is troubleshooting a high CPU utilization issue on an SAP application server running on an Amazon EC2 instance. The administrator suspects a specific ABAP program is consuming excessive resources. Which AWS service can be used to capture detailed performance metrics and identify the process?

Accepted Answer

Amazon CloudWatch Agent. The Amazon CloudWatch Agent can be installed on the EC2 instance to collect detailed system-level metrics, including per-process CPU utilization. It can capture metrics at sub-minute intervals and identify which process (e.g., a specific ABAP program) is consuming excessive CPU. This provides the granularity needed for SAP application server troubleshooting.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 9

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Accepted Answer

Check SAP application logs for errors, then check HANA database status using HDBSQL, then verify network connectivity using ping and telnet, then verify security group and NACL rules, then verify authentication credentials.. Troubleshooting should start with logs, then check database status, network, security groups, and authentication.

Answer

Check HANA database status using HDBSQL, then check SAP application logs for errors, then verify network connectivity using ping and telnet, then verify authentication credentials, then verify security group and NACL rules.

Answer

Verify network connectivity using ping and telnet, then verify security group and NACL rules, then check SAP application logs for errors, then check HANA database status using HDBSQL, then verify authentication credentials.

Answer

Verify authentication credentials, then check SAP application logs for errors, then check HANA database status using HDBSQL, then verify network connectivity using ping and telnet, then verify security group and NACL rules.

Question 10

Which THREE considerations are important when designing an SAP HANA multi-node (scale-out) deployment on AWS? (Choose three.)

Accepted Answer

Use a cluster placement group for low-latency network.. Option A is correct because SAP HANA scale-out relies on low-latency, high-throughput inter-node communication for the internode network, and an AWS cluster placement group packs instances close together in a single Availability Zone to reduce network latency and improve bandwidth. Option C is correct because the practical number of nodes in a scale-out deployment is constrained by each instance type's network bandwidth and EBS throughput/IOPS limits, since all nodes must communicate and persist data efficiently. Option E is correct because each HANA node requires its own dedicated EBS volume(s) for data and log persistence, as HANA's shared-nothing architecture distributes data across nodes and does not support concurrently shared block storage. Option B is not appropriate because EBS Multi-Attach is designed for clustered applications with a cluster-aware file system, not for HANA's shared-nothing data layout. Option D is incorrect because a single large EC2 instance describes a scale-up deployment, not the multi-node scale-out design being asked about.

Answer

Use EBS Multi-Attach to share volumes between nodes.

Answer

Use a single large EC2 instance with many vCPUs.

Question 11

Which TWO of the following are best practices for securing an SAP HANA database on AWS? (Choose two.)

Accepted Answer

Deploy the HANA instance in a private subnet without direct internet access.. Deploying the HANA instance in a private subnet without direct internet access ensures that the database is not exposed to the public internet, reducing the attack surface. This follows the AWS security best practice of using private subnets for sensitive workloads, with access only through bastion hosts or VPN/Direct Connect. It also aligns with SAP's own security recommendations for HANA deployments.

Answer

Disable SSL/TLS for client connections to improve performance.

Answer

Use a single Availability Zone to simplify network security group management.

Answer

Assign a public IP address to the HANA instance for easy access from the internet.

Question 12

A company runs SAP on AWS and uses AWS CloudTrail to monitor API activity. The security team wants to receive real-time notifications when specific SAP-related API calls are made. Which AWS service should they use to filter and forward these events?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can ingest AWS CloudTrail events (via the default event bus) and apply rules to filter for specific API calls, then route matching events to targets such as SNS, Lambda, or SQS for real-time notification. This is the standard serverless pattern for real-time CloudTrail alerting.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 13

A company wants to run SAP S/4HANA on AWS and needs to ensure that the SAP application and database are deployed according to AWS best practices. Which deployment method should they use?

Accepted Answer

AWS Launch Wizard for SAP. AWS Launch Wizard for SAP is the correct deployment method because it provides a guided, best-practice-based deployment experience specifically for SAP S/4HANA, automatically provisioning EC2 instances, storage, and networking while validating SAP requirements such as kernel compatibility, sizing, and high availability. It reduces manual effort and errors by integrating directly with AWS services like Amazon EBS and Elastic Load Balancing, ensuring compliance with SAP on AWS best practices.

Answer

Manual deployment using EC2 and RDS

Answer

AWS Quick Start for SAP

Answer

AWS CloudFormation with custom templates

Question 14

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP Web Dispatchers. The system is experiencing intermittent session drops. What is the most likely cause?

Accepted Answer

The ALB is not configured for sticky sessions.. The ALB operates at Layer 7 and, by default, distributes each request independently across healthy targets. SAP Web Dispatchers maintain user session state (e.g., logon tickets, application context) locally. Without sticky sessions (session affinity) enabled on the ALB, subsequent requests from the same user can be routed to a different Web Dispatcher, causing the new dispatcher to lack the session context and dropping the user's session. Enabling stickiness based on the ALB-generated cookie ensures all requests from a session are sent to the same Web Dispatcher, preventing these intermittent drops.

Answer

The ALB deletion protection is enabled.

Answer

The ALB health check interval is too short.

Answer

Cross-zone load balancing is not enabled on the ALB.

Question 15

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Answer

Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

Answer

AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

Answer

AWS Snowball Edge to ship the data physically, then import to RDS.