PAS-C01 Practice Test 17 — 15 Questions

Question 1

A company is running SAP NetWeaver on AWS with a multi-ABAP application server setup. They want to implement a load balancing solution for HTTP traffic to the SAP Web Dispatcher. The solution must be highly available and support SSL termination. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7, can route HTTP/HTTPS traffic to SAP Web Dispatchers, supports SSL termination natively, and integrates with AWS Auto Scaling and health checks to provide high availability. SAP Web Dispatcher expects HTTP-based load balancing, and ALB’s content-based routing and stickiness features align with SAP’s recommended architecture for multi-ABAP application server setups.

Answer

Amazon CloudFront

Answer

Classic Load Balancer (CLB)

Answer

Network Load Balancer (NLB)

Question 2

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application stores session state in an ElastiCache Redis cluster (Cluster Mode disabled). The operations team receives alerts that the application is experiencing intermittent timeouts and high error rates. Upon investigation, they find that the Redis cluster's CPU utilization is consistently above 90%, and there are frequent 'MAXMEMORY' evictions. The application team confirms that they recently increased the number of concurrent users and added more session data per user. The current Redis cluster is a single cache.r5.large node with 13.37 GB of memory. Which of the following should the operations team do FIRST to address the performance issues?

Accepted Answer

Enable Cluster Mode and add multiple shards to distribute the data across nodes.. The correct first step is to enable Cluster Mode and add multiple shards because the performance issue stems from CPU saturation and memory pressure on a single Redis node. Cluster Mode distributes data across multiple shards, reducing per-node CPU load and memory usage, which directly addresses the high CPU utilization and 'MAXMEMORY' evictions caused by increased concurrent users and session data.

Answer

Upgrade the instance type to cache.r5.2xlarge to double the memory and compute capacity.

Answer

Create a read replica in a different Availability Zone and redirect read traffic to it.

Answer

Change the eviction policy to 'allkeys-lru' to maximize memory utilization.

Question 3

A company is deploying SAP NetWeaver on AWS and needs to ensure that the SAP application servers can communicate with the SAP HANA database using the hostname. The environment uses a Windows Domain Controller for Active Directory. Which DNS resolution strategy should be used?

Accepted Answer

Use AWS Directory Service for Microsoft Active Directory with DNS. AWS Directory Service for Microsoft Active Directory provides a managed DNS service that integrates with Active Directory. This allows SAP application servers to resolve the SAP HANA database hostname via DNS, which is essential for SAP NetWeaver's hostname-based communication. The managed service ensures automatic DNS record updates and supports Windows-native DNS resolution without requiring custom infrastructure.

Answer

Configure DHCP option sets to use custom DNS

Answer

Install a DNS server on an Amazon Linux instance

Answer

Use Amazon Route 53 Resolver outbound endpoint

Question 4

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP application are logged for auditing purposes. The administrator wants to store these logs in Amazon S3 for long-term retention. Which AWS service should be used to capture the API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and can deliver logs to S3. Option A is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because Config records configuration changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 5

An SAP Basis team is implementing SAP HANA system replication across two AWS Availability Zones. The HANA primary instance uses Provisioned IOPS SSD (io2) EBS volumes. The secondary instance must be kept in sync with minimal data loss. Which networking configuration is required to ensure low-latency, high-throughput replication traffic between the instances?

Accepted Answer

Enable Enhanced Networking (ENA) on both instances.. The correct configuration is to enable Enhanced Networking (ENA) on both instances. ENA provides high throughput and low latency for SAP HANA replication traffic across Availability Zones. ClassicLink is deprecated, VPN adds unnecessary latency, and VPC peering is not needed between subnets already in the same VPC. Cluster placement groups cannot span Availability Zones.

Answer

Use ClassicLink to connect the instances.

Answer

Set up a VPN connection between the instances.

Answer

Configure VPC peering between the two subnets.

Question 6

Refer to the exhibit. An EC2 instance is running and has a public IP address. A security engineer needs to verify that the instance is not publicly accessible from the internet. Which additional step is required?

Accepted Answer

Check the security group inbound rules.. Security group inbound rules determine whether traffic from the internet is allowed to reach the instance. Option A is incorrect because having a public IP does not guarantee accessibility; the security group must allow inbound traffic. Option B is incorrect because the route table's internet gateway entry is necessary but not sufficient; inbound rules must permit access. Option D is incorrect because network ACLs provide stateless filtering at the subnet level, but the question specifically requires verifying that the instance is not publicly accessible, which is primarily controlled by security group inbound rules.

Answer

Check if the instance has a public IP.

Answer

Check the route table for an internet gateway.

Answer

Check the network ACL of the subnet.

Question 7

A company is running SAP NetWeaver on AWS with an Oracle database on an EC2 instance. The database uses Oracle Data Guard for disaster recovery across Regions. The primary database is in us-east-1, and the standby is in us-west-2. The database size is 500 GB and the network link between Regions has about 100 Mbps throughput. During a recent disaster recovery drill, the failover to the standby took over 2 hours because the Data Guard redo logs were not fully applied. The team wants to reduce the recovery time objective (RTO). They are considering using Amazon S3 to store archived redo logs, increasing the bandwidth, or using a different replication method. What is the MOST effective action to reduce the RTO?

Accepted Answer

Increase the network bandwidth between the Regions to reduce redo log shipping lag.. Increasing the bandwidth between Regions will reduce the lag in redo log shipping, allowing the standby to apply logs more quickly and be ready faster. Option A is incorrect because storing archived logs on S3 still requires transferring them to the standby. Option B is incorrect because EBS replication does not apply to cross-Region scenarios. Option C is incorrect because ASM is a storage management layer, not a replication solution.

Answer

Configure the primary database to automatically archive redo logs to Amazon S3, and have the standby download them from S3.

Answer

Use Oracle Automatic Storage Management (ASM) to mirror data across Regions.

Answer

Replace Oracle Data Guard with Amazon EBS snapshot replication across Regions.

Question 8

A company is running SAP ERP on AWS with an Oracle database. The application servers are deployed in an Auto Scaling group across three Availability Zones. The database is hosted on a single EC2 instance in us-east-1a. The company wants to improve availability with minimal changes to the application. The database must be highly available with automatic failover and no data loss. The database size is 1 TB. The current RTO is 2 hours and RPO is 1 hour. The company is considering using Oracle Data Guard for replication. Which solution should the company implement to meet the HA requirements?

Accepted Answer

Configure Oracle Data Guard with synchronous replication and Fast-Start Failover (FSFO) to automatically fail over to a standby instance in another AZ.. Oracle Data Guard with synchronous replication ensures zero data loss by committing transactions only after they are written to both primary and standby redo logs. Fast-Start Failover (FSFO) automates the failover process without manual intervention, meeting the RTO of 2 hours and RPO of 1 hour while requiring minimal application changes since the database remains Oracle-native.

Answer

Use AWS Database Migration Service (DMS) to replicate the Oracle database to a second EC2 instance in another AZ, and use an Amazon Route 53 health check to redirect traffic.

Answer

Migrate the Oracle database to Amazon RDS for Oracle with Multi-AZ deployment and automatic failover.

Answer

Configure Oracle Data Guard with asynchronous replication to a standby instance in us-east-1b, and use a custom script to detect failure and promote the standby.

Question 9

An SAP HANA database on AWS is using EBS io2 volumes. The company wants to monitor the read and write latency of the database volumes. Which CloudWatch metrics should be used?

Accepted Answer

VolumeReadLatency and VolumeWriteLatency.. CloudWatch provides the `VolumeReadLatency` and `VolumeWriteLatency` metrics specifically to monitor the average time (in seconds) for read and write I/O operations on EBS volumes. For SAP HANA on io2 volumes, these metrics directly reflect storage performance and are critical for detecting latency issues that could impact database throughput and transaction response times.

Answer

VolumeIdleTime and VolumeTotalReadTime.

Answer

VolumeThroughputPercentage and VolumeConsumedReadWriteOps.

Answer

VolumeQueueLength and VolumeThroughput.

Question 10

An SAP administrator is troubleshooting connectivity between SAP application servers and the SAP HANA database. The database security group has an inbound rule as shown in the exhibit. The application servers are in security group sg-12345. However, the application servers cannot connect to the database. What is the most likely reason?

Accepted Answer

The port number is incorrect for SAP HANA.. SAP HANA uses TCP port 30015 by default for client connections (3<instance>15). If the security group inbound rule specifies a different port, such as 30013 or 31015, the application servers will be unable to establish a TCP connection to the database. The exhibit likely shows an incorrect port number, making option D the most likely cause.

Answer

The source should be the IP address range of the application servers.

Answer

The rule uses the wrong protocol; it should be UDP.

Answer

The outbound rule on the application server security group is missing.

Question 11

A company runs SAP ERP on AWS. The system needs to be highly available with automatic failover in case of an Availability Zone failure. Which architecture should be used?

Accepted Answer

SAP HANA System Replication across two Availability Zones with automatic failover. SAP HANA System Replication (HSR) across two Availability Zones with automatic failover is the correct architecture because it provides synchronous or asynchronous replication of the SAP HANA database at the storage or log level, enabling automatic failover to a standby instance in a different AZ when the primary fails. This meets the requirement for high availability and automatic failover during an AZ failure, as HSR is the native SAP mechanism for database-level HA on AWS, unlike generic AWS services that do not handle SAP-specific application state or replication requirements.

Answer

Route 53 failover routing policy

Answer

Auto Scaling group with multiple EC2 instances in different AZs

Answer

AWS RDS Multi-AZ deployment

Question 12

A company wants to implement a disaster recovery (DR) strategy for its SAP landscape on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. They need to replicate SAP HANA database asynchronously with a Recovery Point Objective (RPO) of 15 minutes. Which AWS service should they use?

Accepted Answer

SAP HANA System Replication. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for asynchronous replication of HANA databases, capable of achieving an RPO of 15 minutes or less. It replicates at the database level using log shipping and is tightly integrated with HANA's recovery processes, making it the correct choice for this DR scenario.

Answer

AWS Elastic Disaster Recovery (DRS)

Answer

Amazon S3 cross-region replication for HANA backup files

Answer

AWS Database Migration Service (DMS) with ongoing replication

Question 13

An SAP system administrator is planning to migrate an on-premises SAP ERP system to AWS. The system uses Oracle Database. Which THREE AWS services can be used to migrate the Oracle database to Amazon RDS for Oracle with minimal downtime? (Choose 3)

Accepted Answer

AWS Schema Conversion Tool (SCT). Options C and D are the correct AWS services for migrating an Oracle database to Amazon RDS for Oracle with minimal downtime. Option A (Oracle Data Guard) is not an AWS service; it is an Oracle database feature and does not meet the requirement of being an AWS service. Option B (AWS Snowball Edge) is for offline data transfer, not live migration. Option E (AWS CloudEndure Migration) is for server migration, not database migration. AWS Schema Conversion Tool (SCT) ensures schema compatibility, and AWS Database Migration Service (DMS) performs continuous replication to minimize downtime.

Answer

Oracle Data Guard

Answer

AWS Snowball Edge

Answer

AWS CloudEndure Migration

Question 14

An SAP administrator wants to deploy a SAP system across two Availability Zones for high availability. The administrator runs the command shown in the exhibit. How many subnets are available for the deployment?

Accepted Answer

2. The output shows two subnets, one in us-east-1a and one in us-east-1b. Option A is wrong because there are two subnets. Option C is wrong because there are not four. Option D is wrong because there are exactly two.

Answer

4

Answer

3

Answer

1

Question 15

An SAP administrator is deploying an SAP ASCS instance using CloudFormation. The deployment fails because the instance cannot be reached from other SAP components. Based on the exhibit, what is the most likely cause?

Accepted Answer

The security group does not allow inbound traffic on the required SAP ports.. The SAP ASCS instance must be reachable by other SAP components (e.g., PAS, AAS) on specific ports for services like the SAP Message Server (port 36xx/TCP) and SAP Enqueue Server (port 32xx/TCP). The exhibit shows the security group lacks inbound rules for these ports, so traffic from other components is blocked, causing the deployment to fail. Without proper inbound access, the ASCS instance cannot participate in the SAP system's communication, leading to the unreachability error.

Answer

The instance type m5.large is not certified for SAP ASCS.

Answer

The instance lacks an IAM role to join the SAP domain.

Answer

The root volume is too small and uses gp2, which is not supported for SAP.