PAS-C01 Practice Test 17 — 15 Questions

Question 1

An operations team manages an SAP ERP system on AWS that uses a single EC2 instance for the SAP central services (SCS) and multiple instances for application servers. The system is running in a VPC with both public and private subnets. The team notices that the SCS instance is unreachable from the application servers after a maintenance window where network ACLs were updated. The application servers are in private subnets, and the SCS instance is in a public subnet. The team has verified that the security groups allow the required traffic. Which step should the team take to resolve the connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the network ACL rules for both the public and private subnets.. Network ACLs are stateless and can block traffic even if security groups allow it. Since the issue occurred after NACLs were updated, the most likely cause is that the NACL rules for the public or private subnets are blocking the required traffic between the SCS instance and application servers. Reviewing and correcting the NACL rules should resolve the connectivity issue.

Answer

Verify that the route tables have a route to the internet gateway.

Answer

Assign an Elastic IP to the SCS instance.

Answer

Check the security group rules on the application servers.

Question 2

A company wants to ensure that its SAP systems on AWS are compliant with internal security policies. Which AWS service can be used to continuously monitor and evaluate resource configurations?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and evaluates the configurations of AWS resources against desired policies, such as internal security policies for SAP systems. It provides detailed configuration snapshots, compliance history, and automated remediation via AWS Config Rules, which can be custom or managed, to ensure ongoing compliance.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 3

A company is migrating a large SAP Business Warehouse (BW) system to AWS. The system uses SAP HANA as the database. The migration plan involves using SAP HANA System Replication (HSR) for near-zero downtime. During the initial synchronization, the network bandwidth is limited to 1 Gbps. The source database is 5 TB. How long will the initial synchronization approximately take, assuming no other bottlenecks?

Accepted Answer

Approximately 12 hours. 5 TB = 5,000 GB = 40,000 Gb (since 1 GB = 8 Gb). At 1 Gbps, time = 40,000 seconds ≈ 11.1 hours. This simple calculation ignores overhead, but among the options, 12 hours is the closest. The other options are unrealistic.

Answer

Approximately 2 hours

Answer

Approximately 6 hours

Answer

Approximately 24 hours

Question 4

A company is migrating SAP applications to AWS and needs to replicate data from on-premises Active Directory to AWS Managed Microsoft AD for authentication. Which AWS service should be used?

Accepted Answer

AWS Directory Service for Microsoft Active Directory. AWS Directory Service for Microsoft Active Directory (also known as AWS Managed Microsoft AD) is a managed service that allows you to run Microsoft Active Directory in the AWS cloud. It supports trust relationships with on-premises AD, enabling replication of users and groups for authentication. This is the correct service for replicating on-premises AD to AWS for authentication.

Answer

AWS Transit Gateway

Answer

AWS Resource Access Manager (RAM)

Answer

AWS AD Connector

Question 5

A company is migrating its SAP environment to AWS. The operations team needs to ensure that all changes to the SAP infrastructure are tracked and that unauthorized changes are detected. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules, which is exactly what is needed to track changes to SAP infrastructure and detect unauthorized modifications. It provides a configuration timeline and can trigger remediation or alerts when a resource drifts from the desired state. CloudTrail records API activity but does not evaluate configuration compliance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 6

An SAP system on AWS is configured with a Multi-AZ deployment for high availability. During a failover test, the operations team notices that the secondary instance does not take over correctly. What is the most likely cause?

Accepted Answer

The route tables or security groups do not allow traffic to the secondary instance.. In a Multi-AZ SAP deployment on AWS, the standby/secondary instance must be reachable over the network for the failover mechanism (e.g., SAP ASCS/ERS cluster with Pacemaker or SIOS) to promote it and redirect clients. If route tables or security groups don't permit traffic to the secondary ENI/instance, the cluster heartbeat or client redirection fails, so the secondary never takes over. This is the most common misconfiguration in SAP HA setups on AWS.

Answer

The SAP application layer is not configured to retry connections.

Answer

The CloudWatch alarm thresholds for failover are set too high.

Answer

The secondary instance's IP address is not automatically updated in DNS.

Question 7

Which TWO actions should an SAP administrator take to ensure high availability for an SAP HANA database on AWS? (Choose two.)

Accepted Answer

Enable SAP HANA system replication. Option A (Enable SAP HANA system replication) is correct because SAP HANA system replication continuously replicates data from a primary to a secondary HANA instance, enabling fast failover and near-zero data loss, which is the native SAP high-availability mechanism for HANA databases. Option D (Use a Multi-AZ deployment for the database) is correct because placing the primary and secondary HANA nodes in different AWS Availability Zones protects against a full AZ outage, and AWS supports this via Multi-AZ patterns with overlay IPs and cluster managers like Pacemaker. Option B is incorrect because a single large instance is a vertical scaling choice that creates a single point of failure, not high availability. Option C is incorrect because manual snapshots are point-in-time backups for recovery, not automatic failover or continuous availability. Option E is incorrect because a single EBS volume, regardless of IOPS, remains a single point of failure and does not provide HA.

Answer

Deploy the database on a single large instance

Answer

Schedule regular manual snapshots

Answer

Use a single EBS volume with high IOPS

Question 8

A company runs SAP on AWS using a multi-AZ deployment. The database is an SAP HANA system replicated across two Availability Zones. During a recent failure, the standby HANA instance did not take over automatically. The operations team finds that the HANA replication status was 'ERROR' before the failure. What is the most likely reason for the failed takeover?

Accepted Answer

The HANA system replication was not in sync; data was not fully replicated to the standby.. For an SAP HANA system replication takeover to succeed, the standby must be in sync with the primary; if replication status is 'ERROR', the standby lacks the latest data and cannot safely take over. The cluster's fencing and instance number consistency are important but secondary to replication health. High network latency could cause replication issues but would not directly prevent takeover if replication were in sync.

Answer

The standby HANA instance had a different instance number than the primary.

Answer

The fencing mechanism was not configured correctly in the cluster.

Answer

The network latency between the two Availability Zones was too high.

Question 9

An SAP system running on AWS uses a shared file system via Amazon EFS for transport directories. The system administrator notices that file operations are slow across multiple application servers. The EFS file system is configured with Bursting Throughput mode. What is the most effective way to improve performance?

Accepted Answer

Switch the file system to Provisioned Throughput mode and set a higher throughput value.. Provisioned Throughput mode allows you to specify a higher throughput level for your Amazon EFS file system, providing consistent performance independent of burst credits. Option B is incorrect: using EFS Access Points does not affect throughput, they enforce access permissions. Option C is incorrect: reducing operations during off-peak hours may conserve burst credits but does not directly increase performance; significant improvement requires Provisioned Throughput. Option D is incorrect: additional mount targets in each AZ do not increase throughput as they share the same file system throughput.

Answer

Use EFS Access Points to enforce a different UID/GID for each application server.

Answer

Increase the burst credit balance by reducing file operations during off-peak hours.

Answer

Create additional mount targets in each Availability Zone to distribute load.

Question 10

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. They want to minimize downtime and ensure data consistency. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is designed for minimal-downtime database migrations. Option B is correct. Option A (SCT) is used for schema conversion, not the migration itself. Option C (Server Migration Service) is for server-level migrations. Option D (DataSync) is for file-based data transfer.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Question 11

A company is migrating its SAP system to AWS and wants to ensure that the migration does not violate any SAP licensing requirements. Which of the following is a correct licensing consideration?

Accepted Answer

SAP licenses must be purchased separately from SAP or an SAP partner. SAP software licenses are independent of the underlying cloud infrastructure provider. AWS provides the infrastructure (compute, storage, network) but does not resell or include SAP licenses. Therefore, customers must obtain SAP licenses directly from SAP or an authorized SAP partner, exactly as they would for on-premises deployments. This ensures compliance with SAP's licensing terms, which are based on metrics such as users, processors, or other SAP-defined measures, not on AWS account structure or deployment tools.

Answer

SAP licenses are based on the number of AWS accounts used

Answer

SAP licenses are automatically included when you use AWS Launch Wizard

Answer

SAP licenses are not required for non-production environments in AWS

Question 12

A company runs its SAP HANA database on an EC2 instance with EBS volumes. The database requires consistent low-latency I/O with a high number of IOPS. The current configuration uses EBS gp2 volumes. During peak loads, the application experiences performance degradation. Which change will provide the most consistent performance for SAP HANA?

Accepted Answer

Migrate to EBS io2 Block Express volumes with provisioned IOPS.. Migrating to EBS io2 Block Express volumes with provisioned IOPS provides the most consistent performance for SAP HANA. io2 Block Express volumes are designed for high-performance, low-latency workloads, offering up to 256,000 IOPS and sub-millisecond latency, with durability of 99.999%. They also support multi-attach and are ideal for critical databases like SAP HANA.

Answer

Switch to EBS st1 (Throughput Optimized HDD) volumes.

Answer

Configure multiple EBS gp2 volumes in a RAID 0 array to increase IOPS.

Answer

Increase the size of the existing gp2 volumes to gain higher baseline IOPS.

Question 13

An SAP system is deployed across multiple Availability Zones using an Application Load Balancer (ALB) for the SAP Web Dispatcher. Users report that sessions are frequently dropped during peak hours. Which configuration change should resolve this?

Accepted Answer

Enable sticky sessions (session affinity) on the ALB target group.. Enabling sticky sessions (session affinity) on the ALB target group ensures that all requests from a user session are routed to the same Web Dispatcher instance. Without session affinity, the ALB distributes requests across multiple Web Dispatcher instances, and if the session state is stored locally on each instance, subsequent requests may land on a different instance that does not have the session data, causing the session to be dropped. This is a common issue during peak hours when the load balancer distributes traffic more aggressively.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the number of Web Dispatcher instances in each Availability Zone.

Answer

Enable deletion protection on the ALB.

Question 14

A company is migrating its SAP landscape to AWS and plans to use an SAP HANA multi-node scale-out configuration. Which THREE considerations are important for the network design?

Accepted Answer

Use a placement group to ensure nodes are in close proximity. Option A is correct because SAP HANA scale-out nodes exchange frequent, latency-sensitive data (for example, during distributed query processing and table redistribution), and an AWS cluster placement group packs the instances close together within a single Availability Zone to provide low-latency, high-throughput networking. Option B is correct because SAP recommends isolating HANA inter-node communication on a dedicated network interface so that the high-volume internode traffic does not contend with client, application, or storage traffic, which AWS supports by attaching multiple ENIs to an instance. Option E is correct because SAP HANA scale-out requires very low round-trip latency between all nodes (SAP guidance targets well under 1 ms RTT, with AWS cluster placement groups typically delivering single-digit microseconds), and exceeding this degrades or invalidates the certified scale-out performance. Option C is not appropriate because a NAT Gateway is used for outbound internet access from private subnets, not for node-to-node traffic within the cluster. Option D is not appropriate because inter-node communication should use private IP addresses inside the VPC for security and performance, not public IPs.

Answer

Use a NAT Gateway for inter-node traffic

Answer

Use public IP addresses for inter-node communication

Question 15

A company runs SAP ERP on AWS using a Multi-AZ RDS for SAP HANA database. The operations team needs to automate the rotation of the database master password. Which AWS service should be used to securely store and rotate the password?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing and automatically rotating secrets such as database credentials. It natively supports Amazon RDS (including RDS for SAP HANA) with built-in rotation Lambda functions that can rotate the master password without manual intervention. Parameter Store, while capable of storing secrets, does not provide automated rotation. CloudHSM is for dedicated hardware security modules, and IAM is for identity and access management, not secret storage and rotation.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)