PAS-C01 Practice Exam 4 — 20 Questions

Question 1

An SAP administrator notices that the SAP HANA database is running on an EC2 instance with a single EBS volume for /hana/data and /hana/log. The system is experiencing high latency during write operations. What is the most cost-effective design change to improve performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate EBS volumes for /hana/data and /hana/log, attaching them to the instance. SAP HANA requires separate EBS volumes for /hana/data and /hana/log to avoid I/O contention. When both directories share a single volume, write operations to the log (sequential) and data (random) compete for the same queue depth and bandwidth, causing high latency. Separating them allows each workload to use dedicated IOPS and throughput, which is the most cost-effective fix without upgrading to premium volume types.

Answer

Use an Instance Store volume for /hana/data

Answer

Modify the EBS volume to use Provisioned IOPS (io2) with higher IOPS

Answer

Increase the size of the existing EBS volume to gain more throughput

Question 2

An SAP administrator needs to configure high availability for SAP NetWeaver AS ABAP. They plan to use AWS services. Which combination of services is required?

Accepted Answer

Amazon EFS and Pacemaker on EC2. SAP NetWeaver AS ABAP high availability on AWS requires shared storage for the /sapmnt and /usr/sap/trans directories, which Amazon EFS provides via NFSv4, and a cluster manager like Pacemaker on EC2 to orchestrate failover between the primary and secondary application servers. This combination ensures that the SAP central services (ASCS and ERS) can fail over seamlessly in the event of an instance or availability zone failure.

Answer

AWS Global Accelerator and Auto Scaling

Answer

Elastic Load Balancing and Amazon Route 53

Answer

Amazon EBS Multi-Attach volumes

Question 3

An SAP application is experiencing high latency when writing to an Amazon EBS volume. The volume is a gp2 type attached to an m5.4xlarge instance. Which change would improve write performance?

Accepted Answer

Change the volume type to io2 and provision sufficient IOPS.. The gp2 volume's baseline performance of 3 IOPS per GiB (max 16,000 IOPS) is insufficient for the SAP application's write-intensive workload, causing high latency. Changing to io2 with provisioned IOPS ensures consistent, high-performance writes by decoupling IOPS from volume size, directly addressing the latency issue.

Answer

Increase the size of the gp2 volume to 1 TB.

Answer

Change the volume type to st1.

Answer

Enable EBS optimization on the EC2 instance.

Question 4

A company runs SAP on AWS and needs to ensure that the SAP application logs are centrally collected and analyzed for security incidents. Which AWS service should be used to collect and store the logs from EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can collect and store application logs from EC2 instances using the unified CloudWatch agent. It provides centralized log management and can be used for security incident analysis. Option A (Amazon Kinesis Data Firehose) is for streaming data to destinations like S3 or Redshift, not primarily for log collection from instances. Option B (AWS CloudTrail) records API activity, not application logs. Option C (Amazon S3) can store logs but does not directly collect them from EC2 instances without additional services like CloudWatch Logs or Kinesis. Therefore, Amazon CloudWatch Logs is the correct service for collecting and storing SAP application logs from EC2 instances.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3

Question 5

An SAP administrator wants to monitor the CPU utilization of SAP application servers using Amazon CloudWatch. What is the minimum configuration required?

Accepted Answer

Install and configure the AWS CloudWatch Agent on each SAP application server.. The AWS CloudWatch Agent must be installed and configured on each SAP application server to collect custom metrics like CPU utilization at the granularity and frequency required for SAP monitoring. CloudWatch by default only provides basic EC2 metrics (every 5 minutes) and cannot capture OS-level or application-level CPU utilization without the agent. The agent sends metrics via the CloudWatch PutMetricData API, enabling detailed monitoring of SAP-specific performance counters.

Answer

Set up an AWS Lambda function to query EC2 metrics from the CloudWatch API.

Answer

Configure SAP Solution Manager to export metrics to CloudWatch.

Answer

Enable EC2 detailed monitoring from the AWS Management Console.

Question 6

An SAP system on AWS is using an Oracle database. The company wants to implement automated backups to Amazon S3. Which AWS service should be used to orchestrate the backup process?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, policy-driven backup solution that can orchestrate backups for SAP workloads running on Amazon EC2 with Oracle databases. It integrates directly with Amazon S3 for storing backup data and supports custom backup scripts via the AWS Backup API or AWS Lambda, enabling automated, scheduled backups without manual intervention.

Answer

Amazon RDS for Oracle

Answer

Amazon S3 Lifecycle policies

Answer

AWS Database Migration Service (DMS)

Question 7

A company is running a mission-critical SAP S/4HANA system on AWS in the us-east-1 region. The system uses a two-tier architecture with the SAP application server and HANA database on the same EC2 instance. The instance type is an r5.24xlarge with 12 x 2 TB gp3 EBS volumes striped using LVM. The HANA data volume is 10 TB. The company has a disaster recovery (DR) requirement with an RPO of 15 minutes and an RTO of 4 hours. The DR site must be in us-west-2. The company currently takes daily EBS snapshots of the data volume and copies them to us-west-2. However, they are not meeting the RPO. The operations team is considering implementing SAP HANA System Replication (HSR) asynchronously to the DR region. However, network latency between us-east-1 and us-west-2 averages 60 ms. The SAP HANA database has a heavy write workload, with average log writes of 500 MB/sec. The team is concerned that the replication may fall behind and cause data loss. What should the team do to meet the DR requirements while minimizing data loss?

Accepted Answer

Implement HSR asynchronously and also enable HANA log backups to an S3 bucket in us-west-2.. Combining asynchronous HANA System Replication (HSR) with HANA log backups to an S3 bucket in us-west-2 provides a dual-layer protection strategy. Asynchronous HSR will replicate log changes in near real-time, but given the 60 ms latency and 500 MB/sec write workload, it may fall behind; the log backups act as a safety net to capture any log data that hasn't been replicated yet, allowing recovery with minimal data loss while still meeting the 15-minute RPO.

Answer

Switch to synchronous replication to ensure zero data loss.

Answer

Increase the HANA log buffer size to reduce the frequency of log flushes, so that less data is sent over the network.

Answer

Use HSR with multiple replicas in us-west-2 to improve replication speed.

Question 8

An SAP HANA database is running on an r5.8xlarge instance. The administrator notices high swap usage and suspects memory pressure. Which AWS metric should be monitored to confirm memory utilization?

Accepted Answer

CWAgent namespace metrics. The CWAgent namespace metrics are correct because the CloudWatch agent, when installed on the EC2 instance, can capture detailed OS-level memory utilization metrics (such as `mem_used_percent` and `mem_available_percent`) that are not available in the default EC2 or EBS namespaces. This allows the administrator to directly confirm memory pressure causing high swap usage on the SAP HANA database.

Answer

AWS/Lambda namespace metrics

Answer

EC2 namespace metrics

Answer

EBS namespace metrics

Question 9

An SAP system on AWS is using an SAP HANA database. The database administrator wants to monitor memory usage and receive alerts when memory consumption exceeds 90%. Which THREE services can be used together to achieve this?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is correct because it provides a fully managed pub/sub messaging service that can deliver alerts (e.g., via email, SMS, or HTTP endpoints) when triggered by an Amazon CloudWatch Alarm. In this scenario, once the CloudWatch Alarm detects that memory usage exceeds 90%, it publishes to an SNS topic, which then sends the notification to the database administrator. This enables real-time alerting without requiring custom polling or additional infrastructure.

Answer

AWS Config

Answer

Amazon Inspector

Question 10

A company is migrating a legacy three-tier web application to AWS. The application uses a MySQL database and stores session data in the database. The company wants to minimize database load and improve scalability. Which TWO actions should the company take to achieve these goals?

Accepted Answer

Use Amazon ElastiCache to store session data instead of the database.. Storing session data in the database creates unnecessary write load and latency. Amazon ElastiCache (Memcached or Redis) provides an in-memory key-value store that is ideal for transient session data, reducing database load and improving application scalability by offloading session management from the persistent MySQL layer.

Answer

Configure Amazon RDS Multi-AZ for high availability.

Answer

Use Auto Scaling for the web server tier to handle variable traffic.

Answer

Use Amazon RDS read replicas to offload read traffic from the primary database.

Question 11

An SAP administrator is configuring high availability for SAP HANA using HANA system replication (HSR) across multiple Availability Zones. The administrator must ensure that the replication traffic is encrypted and uses the most efficient network path. Which TWO configurations meet these requirements? (Choose TWO.)

Accepted Answer

Enable SAP HANA system replication with TLS/SSL encryption.. SAP HANA system replication (HSR) supports TLS/SSL encryption natively, which encrypts the replication traffic between the primary and secondary HANA instances. This ensures data confidentiality and integrity without requiring additional network infrastructure, and it uses the most efficient network path because the replication occurs directly over the existing network between the Availability Zones.

Answer

Store replication data in Amazon S3 and have the secondary instance pull it.

Answer

Use AWS Direct Connect to connect the Availability Zones.

Answer

Configure a VPN connection between the Availability Zones.

Question 12

A company is migrating a legacy .NET application to AWS. The application uses Windows Authentication and relies on Active Directory for user authentication. The company wants to minimize changes to the application code. Which AWS service should be used to integrate Active Directory with the migrated application?

Accepted Answer

AWS Directory Service for Microsoft Active Directory. AWS Directory Service for Microsoft Active Directory is the correct choice because it provides a fully managed Microsoft Active Directory in the AWS cloud, which natively supports Windows Authentication and Kerberos-based authentication without requiring any code changes. This service allows the migrated .NET application to seamlessly integrate with the existing on-premises Active Directory through a trust relationship or by extending the directory directly into AWS, preserving the application's authentication logic.

Answer

Amazon Cognito

Answer

AD Connector

Answer

Simple AD

Question 13

An IAM policy is attached to a user who manages SAP HANA volumes. The policy is shown in the exhibit. What is the effect of this policy?

Accepted Answer

The user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume.. The first statement allows ec2:AttachVolume and ec2:DetachVolume only if the volume has tag Environment=production. The second statement denies ec2:DeleteVolume for all volumes. Therefore, the user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume. Option A is incorrect because attach/detach are allowed only with the condition. Option B is incorrect because delete is denied for all volumes. Option D is incorrect because the allow statement is conditional on the specific tag value, not just the production environment.

Answer

The user can attach and detach any volume regardless of tags.

Answer

The user can delete any volume.

Answer

The user can attach and detach any volume in the production environment.

Question 14

An SAP workload on AWS uses an Auto Scaling group for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS) instances. The instances are launched with a custom AMI that includes the SAP software. During a recent failover test, the ASCS instance failed to start after being terminated and re-launched by the Auto Scaling group. The error log indicates that the ASCS instance cannot find the quorum device. What is the most likely cause of this issue?

Accepted Answer

The quorum device (EBS volume) was not re-attached or was not available in the same Availability Zone as the new ASCS instance.. In an SAP on AWS high-availability setup, the ASCS and ERS instances rely on a shared quorum device (typically an EBS volume or an Amazon EFS file system) to maintain cluster state and prevent split-brain scenarios. When the Auto Scaling group terminates and re-launches the ASCS instance, the new instance must have the quorum device attached and be in the same Availability Zone as the EBS volume (since EBS volumes are AZ-specific). If the quorum device is not re-attached or is in a different AZ, the SAP cluster cannot find it, causing the ASCS instance to fail to start.

Answer

The instance type of the new ASCS instance is different from the original, causing incompatibility with the SAP kernel.

Answer

The ASCS instance does not have a public IP address, preventing communication with the quorum device.

Answer

The Security Group associated with the ASCS instance does not allow inbound traffic on the quorum port.

Question 15

A company is running SAP S/4HANA on AWS. The application team reports that batch jobs are failing intermittently with database connection timeouts. The SAP system uses a single Availability Zone deployment. Which design change should the architect recommend to improve database availability?

Accepted Answer

Configure SAP HANA System Replication across two Availability Zones. SAP HANA System Replication (HSR) across two Availability Zones provides synchronous or asynchronous data replication at the database level, ensuring that if the primary HANA instance fails, the secondary can take over with minimal downtime. This directly addresses the intermittent database connection timeouts by eliminating the single point of failure in a single-AZ deployment, as the application can failover to the replica without manual intervention.

Answer

Use Amazon EBS Multi-Attach to attach the same volume to multiple EC2 instances

Answer

Implement an Amazon RDS for SAP HANA read replica

Answer

Scale up the SAP HANA instance to a larger instance type

Question 16

A company is running SAP NetWeaver on AWS. The system uses an SAP HANA database. The operations team needs to monitor the database performance and receive alerts when specific metrics exceed thresholds. Which AWS service should be used to collect and analyze SAP HANA metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can collect, monitor, and analyze SAP HANA database metrics using the AWS CloudWatch Agent or the SAP HANA CloudWatch integration. By configuring custom metrics or using the SAP HANA monitoring views, operations teams can set CloudWatch Alarms to trigger notifications when specific thresholds are exceeded, enabling proactive performance management.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 17

An SAP Basis administrator needs to apply security patches to the operating system of SAP EC2 instances. The administrator wants to use AWS Systems Manager Patch Manager. Which THREE steps are required to set up patching? (Choose THREE.)

Accepted Answer

Create a patch baseline in AWS Systems Manager.. To set up patching with AWS Systems Manager Patch Manager, you need three steps: Create a patch baseline (A) to define which patches to apply. Install the SSM Agent on each EC2 instance (C) to allow Systems Manager to communicate with the instances. Associate the instances with a maintenance window (E) to schedule when patching occurs. Options B and D are not required: Lambda is not needed because Patch Manager handles the patching process, and CloudWatch Logs are not mandatory for patching operations.

Answer

Create an AWS Lambda function to invoke the patching process.

Answer

Configure Amazon CloudWatch Logs to store patch logs.

Question 18

A company is migrating an SAP BusinessObjects environment to AWS. The migration must ensure that the legacy reporting system remains accessible during the transition. Which AWS service can help facilitate this by allowing the company to redirect traffic gradually?

Accepted Answer

Amazon Route53 with weighted routing policies. Amazon Route53 with weighted routing policies can gradually shift traffic from on-premises to AWS by assigning weights to DNS records. Option A (Amazon CloudFront) is a content delivery network, not for traffic shifting. Option B (Elastic Load Balancer) distributes traffic within AWS, not for gradual migration. Option C (AWS Global Accelerator) improves performance but does not provide weighted routing. Option D (Amazon Route53 with weighted routing policies) is correct because it allows incremental traffic redirection during migration.

Answer

Amazon CloudFront

Answer

Elastic Load Balancer (ELB)

Answer

AWS Global Accelerator

Question 19

A company is migrating an SAP ERP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS). The company plans to use a shared file system for the SAP transport directory. Which TWO AWS services can be used to provide a highly available shared file system for this purpose?

Accepted Answer

Amazon FSx for NetApp ONTAP. Options D (Amazon FSx for NetApp ONTAP) and E (Amazon EFS) are correct because they provide NFS-based shared file systems that support the required protocols for SAP transport directory and can be configured for high availability. Option A (Amazon EBS Multi-Attach) is block storage, not a shared file system, and does not support concurrent read/write operations required for SAP. Option B (Amazon S3) is object storage, not POSIX-compliant. Option C (Amazon FSx for Windows File Server) uses SMB protocol, not NFS, which is required by SAP.

Answer

Amazon EBS Multi-Attach

Answer

Amazon S3

Answer

Amazon FSx for Windows File Server

Question 20

A company is planning to migrate its SAP NetWeaver system from on-premises to AWS. The system uses an SAP HANA database. The company wants to use the SAP System Migration (sum) tool. Which THREE prerequisites must be met before starting the migration?

Accepted Answer

The target SAP HANA database must be installed and running.. For an SAP System Migration (SUM) to AWS with HANA, the target HANA database must be installed and running (A), the target system must have the SAP kernel and required libraries (B), and source and target must be on the same OS (D) to ensure compatibility. HTTP proxy (C) is not a prerequisite; communication between source and target does not require a proxy. The source system does not need to be fully shut down before starting; SUM can be run with the source system running (E).

Answer

An HTTP proxy must be configured for communication between source and target.

Answer

The source SAP system must be fully shut down before starting the migration.