PAS-C01 Practice Test 19 — 15 Questions

Question 1

An SAP administrator runs the AWS CLI command shown in the exhibit to check the configuration of an SAP HANA EC2 instance. The instance is running in us-east-1a. They need to deploy a second SAP HANA instance for high availability in a different Availability Zone. Which Availability Zone should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

us-east-1b. For SAP HANA high availability, the secondary instance must be deployed in a different Availability Zone within the same AWS Region to achieve multi-AZ resilience. Since the primary instance is in us-east-1a, the correct choice is us-east-1b, which is a distinct Availability Zone in the same region (us-east-1). This ensures low-latency replication and compliance with SAP's requirement for synchronous replication within a single region.

Answer

us-west-2a

Answer

Any Availability Zone

Answer

us-east-1a

Question 2

An SAP system on AWS uses a shared file system via Amazon EFS for transport directory (/usr/sap/trans). The system experiences slow batch jobs. Monitoring shows high read latency on EFS. Which action would most likely reduce latency?

Accepted Answer

Use EFS Max I/O performance mode or Provisioned Throughput. EFS Max I/O performance mode is designed to scale to higher levels of aggregate throughput and IOPS with lower latencies for workloads like SAP transport directories that experience high concurrency and throughput demands. Provisioned Throughput allows you to specify a higher throughput level independent of the amount of data stored, directly addressing the high read latency issue. This is the most effective action because it optimizes the file system's performance characteristics for the SAP batch job workload.

Answer

Use a larger EC2 instance for the application server

Answer

Migrate the transport directory to Amazon S3

Answer

Move the transport directory to instance store volumes

Question 3

A company has a mission-critical SAP S/4HANA system running on AWS with a multi-node HANA database. The system must be highly available with an RPO of 0 and an RTO of less than 30 minutes. The database uses SAP HANA System Replication (HSR) with synchronous replication. Which THREE components are essential for this high-availability architecture?

Accepted Answer

An ENSA2 (Enqueue Replication 2) enqueue server.. SAP S/4HANA with a multi-node HANA database requires the ENSA2 (Enqueue Replication 2) enqueue server to replicate the application-level lock table synchronously between the active and standby central services (ASCS and ERS) instances. This ensures that in the event of a failover, the enqueue locks are preserved, preventing data inconsistencies and enabling a seamless transition within the required RTO of less than 30 minutes.

Answer

An Application Load Balancer to distribute traffic between HANA nodes.

Answer

A VPN connection between the two Availability Zones.

Question 4

An SAP administrator notices that the SAP HANA database on an EC2 instance is experiencing high I/O latency. The instance is using EBS gp2 volumes. Which change would most effectively reduce I/O latency for the SAP HANA data volume?

Accepted Answer

Switch to io2 Block Express EBS volumes for the data volume.. Io2 Block Express volumes provide consistent, high-performance IOPS with sub-millisecond latency, which is critical for SAP HANA data volumes. Unlike gp2, which relies on burst credits and has variable performance, io2 Block Express delivers predictable low latency and up to 256,000 IOPS per volume, directly addressing the high I/O latency issue.

Answer

Use instance store SSDs for the SAP HANA data volume.

Answer

Increase the size of the EBS gp2 volume to increase baseline IOPS.

Answer

Configure RAID 0 across multiple gp2 volumes.

Question 5

An SAP administrator needs to ensure that all changes to an SAP system's AWS resources are tracked and that alerts are sent when SSH access to EC2 instances is modified. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure, including changes to EC2 security groups that control SSH access. By enabling CloudTrail, you can monitor for events like AuthorizeSecurityGroupIngress and trigger alerts via CloudWatch Events or Lambda when SSH (port 22) rules are modified, meeting the audit and alerting requirements.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 6

An SAP administrator is reviewing a CloudFormation template snippet shown in the exhibit. The template creates an EC2 instance for SAP. What is missing from the template to ensure the instance is placed in a specific subnet?

Accepted Answer

The SubnetId property is not specified in the NetworkInterface. The CloudFormation template snippet shows a NetworkInterface property being used to attach the EC2 instance to a VPC network. When you specify a NetworkInterface, you must include the SubnetId within that interface definition to place the instance in a specific subnet. Without SubnetId, the instance will be launched into the default subnet of the default VPC, which may not be the intended subnet for SAP workloads requiring specific network segmentation or latency constraints.

Answer

The InstanceType is not suitable for SAP

Answer

The ImageId is invalid

Answer

The SecurityGroup reference is missing

Question 7

An SAP administrator receives an alert that the HANA database has switched to read-only mode. The administrator checks the disk space and finds that the /hana/data volume is 100% full. What is the most efficient way to resolve this issue?

Accepted Answer

Increase the size of the EBS volume using the console or CLI. EBS volumes can be increased in size online without downtime using the AWS Management Console or CLI, providing immediate additional space to resolve the read-only issue. Option A is incorrect because deleting backup files may not free enough space and is not a long-term solution. Option B is incorrect because restarting the database does not add storage space. Option C is incorrect because creating a new EC2 instance with larger disks requires migration and causes unnecessary downtime compared to simply increasing the EBS volume size.

Answer

Delete old HANA backup files from the volume

Answer

Restart the HANA database to clear temporary files

Answer

Create a new EC2 instance with larger disks and migrate

Question 8

A company is deploying a mission-critical SAP S/4HANA system on AWS. They need to ensure the highest level of availability and minimize data loss. Which TWO strategies should they implement? (Choose two.)

Accepted Answer

Set up HANA System Replication in synchronous mode across two Availability Zones. HANA System Replication in synchronous mode ensures that every committed transaction is written to the primary and replicated to a secondary HANA instance before the commit is acknowledged. This provides near-zero data loss (RPO=0) and, combined with automatic failover, supports high availability across Availability Zones.

Answer

Use EC2 Spot Instances for the primary application server

Answer

Configure automated EBS snapshots every 5 minutes

Answer

Use Amazon RDS Multi-AZ for the HANA database

Question 9

A company has deployed SAP BusinessObjects (BO) on AWS using a multi-tier architecture with a Windows-based application server and a SQL Server database hosted on Amazon RDS. The application server is behind an Application Load Balancer (ALB) that handles HTTPS traffic. Users report that sometimes they receive a '502 Bad Gateway' error when accessing the BO web interface. The error occurs intermittently and is not reproducible on demand. The operations team checks the ALB logs and sees that the target response time occasionally exceeds 120 seconds. The BO application has a default timeout of 60 seconds. The team also notices that the ALB idle timeout is set to 60 seconds. What is the most likely cause of the 502 errors?

Accepted Answer

Increase the idle timeout of the Application Load Balancer to 180 seconds.. The 502 errors occur because the ALB idle timeout (60 seconds) matches the BO application's default timeout (60 seconds), but the ALB logs show target response times occasionally exceed 120 seconds. When the ALB idle timeout expires before the backend completes its response, the ALB closes the connection and returns a 502 error. Increasing the ALB idle timeout to 180 seconds allows sufficient time for the backend to respond, preventing premature connection termination.

Answer

Place an Amazon CloudFront distribution in front of the ALB to cache responses and reduce load.

Answer

Increase the max_connections parameter in the RDS SQL Server instance.

Answer

Increase the deregistration delay on the ALB target group to 300 seconds.

Question 10

A company is running SAP HANA on AWS and needs to back up the database to Amazon S3. Which approach provides the most efficient and cost-effective backup strategy?

Accepted Answer

Use SAP HANA Backint agent to back up directly to S3.. The SAP HANA Backint agent is the native, certified integration for backing up SAP HANA directly to Amazon S3. It leverages the SAP HANA backup API to stream data directly to S3 without intermediate storage, providing the most efficient path with minimal overhead and cost, as you only pay for S3 storage and API calls.

Answer

Use AWS Storage Gateway with tapes.

Answer

Take EBS snapshots of the HANA data volumes.

Answer

Copy HANA data files to EC2 instance store.

Question 11

An SAP administrator is setting up an S3 bucket to store SAP HANA backup files. The backups must be encrypted at rest using an AWS KMS customer managed key. Which bucket policy condition key should be used to enforce that only requests using KMS encryption with that specific key are allowed?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that only requests using a specific AWS KMS customer managed key for server-side encryption are permitted. This key is evaluated against the `x-amz-server-side-encryption-aws-kms-key-id` header in the request, ensuring that backups are encrypted with the exact KMS key ID specified in the bucket policy.

Answer

kms:EncryptionContext

Answer

s3:ServerSideEncryption

Answer

s3:x-amz-server-side-encryption

Question 12

An organization is migrating a legacy SAP ERP system to AWS. The current system runs on IBM AIX with Oracle Database. They plan to use SAP HANA on AWS. Which AWS service should they use to assess the source system's readiness and generate a migration plan?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service (AWS MGN) is the correct service for assessing source system readiness and generating a migration plan for SAP systems to AWS. It provides automated readiness checks and migration orchestration. Option A (AWS CloudEndure Migration) is a predecessor of AWS MGN and is now integrated; it is not the recommended current service. Option C (AWS Database Migration Service - DMS) is for database migration only, not full system assessment. Option D (AWS Schema Conversion Tool - SCT) handles schema conversion, not assessment or migration planning.

Answer

AWS CloudEndure Migration

Answer

AWS Database Migration Service (DMS)

Answer

AWS Schema Conversion Tool (SCT)

Question 13

An administrator is reviewing a CloudFormation template to deploy an SAP ASCS instance. The template snippet is shown in the exhibit. What is a potential issue with this configuration for a production deployment?

Accepted Answer

The instance type m5.large is not certified for SAP ASCS.. The m5.large instance type is not certified for SAP ASCS on AWS. SAP requires specific instance types that have passed SAP's certification tests for high-availability and performance requirements of the ASCS (ABAP Central Services) role. Using an uncertified instance type can lead to unsupported configurations, potential performance issues, and lack of SAP support.

Answer

The AMI ID is not specified correctly.

Answer

The security group is not defined in the template.

Answer

The tags are not sufficient for SAP discovery.

Question 14

A company wants to migrate a 50 TB SAP HANA database to AWS with minimal downtime. Which migration approach should be used?

Accepted Answer

Configure SAP HANA System Replication (HSR) between source and target.. SAP HANA System Replication (HSR) is the recommended method for migrating large HANA databases with minimal downtime, typically achieving near-zero downtime by replicating data continuously. Option B is incorrect because exporting the database to a file and uploading to S3 involves significant downtime for the export and restore process. Option C is incorrect because AWS SCT is used for schema conversion to different database engines, not for migrating HANA to HANA; converting to Aurora would change the database system and incur additional complexity and downtime. Option D is incorrect because AWS DMS does not support SAP HANA as a source for ongoing replication, and even if it did, HSR is more efficient for HANA-to-HANA migration.

Answer

Export the database to a file and upload to Amazon S3, then restore on RDS for HANA.

Answer

Use AWS SCT to convert the HANA schema to Aurora.

Answer

Use AWS DMS with ongoing replication from HANA to HANA.

Question 15

Which THREE of the following are best practices for securing SAP systems on AWS?

Accepted Answer

Encrypt EBS volumes using AWS KMS.. Encrypting EBS volumes using AWS KMS is a best practice because it ensures data at rest is protected with encryption keys managed by AWS Key Management Service. This is critical for SAP systems that handle sensitive business data, as it meets compliance requirements and prevents unauthorized access to the underlying storage. KMS integration with EBS provides transparent encryption with minimal performance impact, and key rotation policies can be enforced automatically.

Answer

Place all SAP instances in public subnets for easier access.

Answer

Store AWS credentials in the SAP application code for API access.