PAS-C01 Practice Exam 2 — 20 Questions

Question 1

A company is migrating a critical application to AWS using a phased approach. The application uses a custom Linux distribution that is not supported by AWS Application Migration Service. Which THREE steps should the company take to migrate the application? (Choose THREE)

Accepted Answer

Use AWS Server Migration Service (SMS) to replicate the on-premises server to AWS.. AWS Server Migration Service (SMS) is the correct choice because it is an agentless service that can replicate on-premises servers running custom Linux distributions as long as they are supported by the underlying hypervisor. SMS uses incremental replication to create Amazon Machine Images (AMIs) from the source server, enabling a lift-and-shift migration without requiring the application to be converted to a different OS. This approach directly addresses the scenario where AWS Application Migration Service does not support the custom Linux distribution.

Answer

Convert the application to run on Amazon Linux 2 to simplify future management.

Answer

Use AWS Database Migration Service (DMS) to migrate the application server.

Question 2

A team is migrating an Oracle database to Amazon RDS for MySQL using AWS DMS with ongoing replication (CDC). The initial load succeeded, but the CDC task fails with the error shown in the exhibit. The source Oracle database is on-premises. Which action should the team take to resolve the issue?

Accepted Answer

Connect to the source Oracle database and enable full supplemental logging by executing the command: ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;. AWS DMS requires full supplemental logging on the source Oracle database to capture all column values for CDC (ongoing replication). Without it, DMS cannot reconstruct the complete row changes from the redo logs, causing the CDC task to fail. Enabling full supplemental logging with `ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;` ensures that every column is logged, allowing DMS to replicate all changes correctly.

Answer

Configure binary logging on the target MySQL RDS instance.

Answer

Stop and restart the DMS task to clear the error.

Answer

Switch the target database to Amazon RDS for Oracle to maintain compatibility.

Question 3

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Question 4

Drag and drop the steps to perform a backup and restore of an SAP HANA database using AWS Backup into the correct order.

Question 5

Drag and drop the steps to configure an SAP Fiori front-end server on AWS behind an Application Load Balancer (ALB) into the correct order.

Question 6

Drag and drop the steps to implement disaster recovery for SAP S/4HANA using AWS Elastic Disaster Recovery (DRS) into the correct order.

Question 7

A company is migrating a legacy application to AWS. The application requires a static IP address that does not change during instance stop/start. The application also needs to be highly available across two Availability Zones. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use a Network Load Balancer with an Elastic IP address. A Network Load Balancer (NLB) supports static IP addresses by allowing you to associate an Elastic IP address with each of its Availability Zone subnets. This provides a fixed entry point that does not change when backend instances are stopped or started, meeting the requirement for a static IP. Combined with an Auto Scaling group spanning two Availability Zones, the NLB ensures high availability by distributing traffic across healthy instances in both zones.

Answer

Place the instances in a placement group to ensure high availability

Answer

Use an Application Load Balancer to distribute traffic to the instances

Question 8

A company wants to centralize monitoring of EC2 instance metrics across multiple AWS accounts. Which solution is MOST scalable and cost-effective?

Accepted Answer

Set up CloudWatch cross-account observability with a monitoring account.. CloudWatch cross-account observability allows you to centralize monitoring by designating a monitoring account that can view metrics, logs, and traces from multiple source accounts. This approach is scalable because it uses a single monitoring account without requiring manual logins or complex data pipelines, and it is cost-effective because you only pay for the metrics you ingest and store in the monitoring account, avoiding redundant data transfers or storage costs.

Answer

Log in to each account and view CloudWatch metrics individually.

Answer

Use CloudWatch cross-region metrics to aggregate metrics in a single account.

Answer

Configure each account to publish metrics to an S3 bucket and use Athena to query.

Question 9

A company runs a production web application on EC2 instances behind an ALB. The operations team receives an alert that the application is returning HTTP 503 errors. Which THREE steps should be taken to diagnose the issue?

Accepted Answer

Check the ALB's HealthyHostCount metric in CloudWatch.. The ALB's HealthyHostCount metric in CloudWatch shows the number of healthy targets registered to the target group. A value of zero or a persistent drop indicates that all EC2 instances are failing health checks, which directly causes HTTP 503 errors because the ALB has no healthy targets to forward traffic to. This metric is the first place to check when diagnosing 503 errors, as it pinpoints whether the issue is with target health rather than network connectivity or load.

Answer

Review VPC Flow Logs to identify if traffic is reaching the ALB.

Question 10

A company runs a critical workload on Amazon RDS for PostgreSQL with Multi-AZ. The operations team notices that during a recent failover test, the DNS record updated in about 60 seconds. However, the application experienced a 2-minute downtime because some connections were not re-established quickly. What should the team do to reduce downtime during failover?

Accepted Answer

Configure the application's connection string to use the RDS read-replica endpoint with a retry mechanism.. Option C is correct because configuring the application's connection string to use the RDS read-replica endpoint with a retry mechanism allows the application to quickly fail over to the read replica during a Multi-AZ failover. The read-replica endpoint remains constant and does not rely on DNS propagation, reducing downtime from DNS TTL delays. Combined with a retry mechanism, this ensures connections are re-established immediately after the failover completes, rather than waiting for the DNS record to update.

Answer

Enable automated backups with a short retention period.

Answer

Increase the TTL of the RDS DNS record to 300 seconds.

Answer

Place a Network Load Balancer in front of the RDS instance.

Question 11

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

Accepted Answer

Review CloudWatch metrics for the instance and the ALB target group. Reviewing CloudWatch metrics for the instance and the ALB target group is the correct first step because it provides immediate visibility into the root cause of intermittent connectivity issues. Metrics such as TargetResponseTime, RequestCount, and HealthyHostCount can reveal whether the problem is due to high latency, request failures, or the instance being marked unhealthy by the ALB health checks. This data-driven approach avoids unnecessary changes and aligns with the AWS Well-Architected Framework's principle of observability.

Answer

Modify the security group to allow all traffic temporarily

Answer

Terminate the instance and let Auto Scaling launch a new one

Answer

Attach an additional Elastic Network Interface (ENI) to the instance

Question 12

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

Accepted Answer

The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint. The error 'Unable to retrieve patch baseline' indicates that the EC2 instances cannot communicate with the AWS Systems Manager service to fetch the patch baseline configuration. Since the instances are in a private subnet with a VPC endpoint for SSM, the most likely cause is that the VPC endpoint's security group does not allow HTTPS outbound traffic (port 443) to the endpoint itself. Without this outbound rule, the SSM Agent on the instance cannot establish the TLS connection required to retrieve the patch baseline from the SSM API.

Answer

The CodeDeploy agent on the instances is outdated

Answer

The instances are not registered as managed instances with the SSM ManagedInstance role

Answer

The instances do not have an IAM instance profile attached

Question 13

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

Accepted Answer

Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.. AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Answer

Examine the S3 server access logs for the bucket.

Answer

Review the configuration timeline in AWS Config for the S3 bucket.

Answer

Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.

Question 14

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

Accepted Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume. Option A is correct because taking a snapshot of the unencrypted volume with encryption enabled creates an encrypted snapshot. From that snapshot, you can create a new encrypted EBS volume. Detaching the original volume and attaching the new encrypted volume to the same EC2 instance achieves encryption with minimal downtime—only the brief period required for the detach/attach operations. This approach does not require copying the snapshot, which would add unnecessary time.

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 15

Solutions Architect needs to automate the patching of Amazon EC2 instances running Amazon Linux 2. The instances are in an Auto Scaling group and must be patched without downtime. Which approach is BEST?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window and update the Auto Scaling group launch configuration to use a patched AMI for new instances.. Option C is correct because AWS Systems Manager Patch Manager automates patching of existing EC2 instances without downtime by using a maintenance window to schedule patch installation, and updating the Auto Scaling group launch configuration ensures new instances launched by the group use a patched AMI, maintaining consistency. This approach avoids terminating all instances at once (which would cause downtime) and leverages AWS-native automation for ongoing compliance.

Answer

Use Amazon Inspector to scan for vulnerabilities and automatically apply patches.

Answer

Terminate all instances and let the Auto Scaling group launch new instances from a patched AMI.

Answer

Create a custom AMI with latest patches and update the Auto Scaling group manually during a maintenance window.

Question 16

A DevOps engineer needs to automatically restart a specific service on an EC2 instance whenever the service crashes. The instance is running Amazon Linux 2. Which approach is the MOST operationally efficient?

Accepted Answer

Configure the service as a systemd unit with Restart=on-failure. Option C is correct because systemd, the default init system on Amazon Linux 2, provides a built-in `Restart=` directive that can be set to `on-failure`. This instructs systemd to automatically restart the service unit when it exits with a non-zero exit code or is terminated by a signal, without requiring any external monitoring or additional infrastructure. This is the most operationally efficient approach as it leverages the native service manager functionality with zero external dependencies.

Answer

Set up a CloudWatch alarm that triggers an SSM Run Command to restart the service

Answer

Write a cron job that checks the service status every minute and restarts it if needed

Answer

Use an AWS Lambda function that polls the service status and calls the EC2 reboot API

Question 17

A company is designing a disaster recovery strategy for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires RPO of 15 minutes and RTO of 1 hour. Which TWO approaches meet these requirements?

Accepted Answer

Use EBS Snapshots taken every 15 minutes and copy them to the DR region. Option A is correct because EBS Snapshots can be taken as frequently as every 15 minutes, and copying them to a DR region ensures that the most recent snapshot is available for recovery. When a disaster occurs, you can create a new EBS volume from the latest snapshot in the DR region, attach it to an EC2 instance, and achieve an RPO of 15 minutes and an RTO of under 1 hour (assuming the instance is pre-provisioned or launched quickly). This approach directly satisfies the stated recovery objectives without relying on instance-level operations.

Answer

Use AWS Backup with a backup plan that takes cross-region backups every 15 minutes

Answer

Use Amazon Machine Images (AMIs) backed by EBS snapshots, taken hourly

Answer

Use EBS Multi-Attach volumes to allow the DR instance to access the same volumes

Question 18

A company runs a production application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. The operations team notices that during a recent deployment, a small percentage of instances failed health checks and were replaced, causing a brief increase in error rates. What is the MOST effective way to reduce deployment-related errors?

Accepted Answer

Configure the Auto Scaling group with a warm-up time in the instance refresh settings.. Option C is correct because configuring a warm-up time in the Auto Scaling group's instance refresh settings ensures that newly launched instances are fully initialized and pass health checks before they start receiving traffic. This prevents brief error spikes during deployments by allowing instances to stabilize before being marked as healthy and added to the ALB target group.

Answer

Use a lifecycle hook to delay instance registration until a script completes.

Answer

Increase the health check interval on the ALB to reduce rapid replacements.

Answer

Increase the desired capacity of the Auto Scaling group to absorb failures.

Question 19

A company runs a web application on Amazon ECS with Fargate launch type. The application's memory utilization spikes periodically, causing tasks to be killed. The operations team wants to automatically scale the service based on memory usage. Which THREE steps are necessary to implement this?

Accepted Answer

Create an Application Auto Scaling target tracking scaling policy based on memory utilization.. Option B is correct because Application Auto Scaling with a target tracking scaling policy allows the ECS service to automatically adjust its desired count based on a CloudWatch metric, such as memory utilization. This ensures the service scales out when memory usage spikes and scales in when it drops, preventing tasks from being killed due to OOM (out-of-memory) errors.

Answer

Attach an EC2 Auto Scaling group to the ECS service to handle capacity.

Answer

Configure step scaling policies to add multiple tasks at once.

Question 20

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

Accepted Answer

The reserved concurrency is set too low; increase the reserved concurrency for the function.. Option D is correct because Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Answer

The SQS visibility timeout is too short; increase it.

Answer

The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

Answer

The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.