PAS-C01 Practice Test 21 — 15 Questions

Question 1

An SAP administrator needs to set up a fault-tolerant architecture for SAP NetWeaver on AWS. The architecture must survive an entire Availability Zone failure. Which configuration is the most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Auto Scaling group to launch SAP application servers across multiple AZs behind an Application Load Balancer.. Deploying SAP application servers across multiple Availability Zones (AZs) behind an Application Load Balancer (ALB) provides fault tolerance at the AZ level. The ALB distributes traffic to healthy instances in different AZs, ensuring that if one AZ fails, the remaining AZs continue to serve requests without interruption. This architecture aligns with SAP's recommended high-availability pattern for the ABAP stateless application tier.

Answer

Deploy all SAP application servers in one Availability Zone and use Amazon EBS snapshots for backup.

Answer

Deploy SAP application servers across multiple AZs but without a load balancer.

Answer

Use a single large EC2 instance for all SAP components.

Question 2

A company is designing a backup strategy for SAP HANA on AWS. The HANA database is 2 TB in size. The company requires daily full backups and hourly incremental backups. Which AWS service should be used to store the backups cost-effectively with high durability?

Accepted Answer

Amazon S3 with lifecycle policies to transition to Glacier.. Amazon S3 with lifecycle policies to transition to Glacier is correct because S3 provides 99.999999999% durability and cost-effective storage for SAP HANA backups. Lifecycle policies automatically move older backups to lower-cost tiers like Glacier, reducing costs while meeting the 2 TB database's daily full and hourly incremental backup requirements.

Answer

Amazon EBS Snapshots stored in Amazon S3.

Answer

AWS Storage Gateway with volume gateway.

Answer

Amazon EFS for shared backup storage.

Question 3

An SAP system on AWS is experiencing performance degradation. The CloudWatch metrics show that the EBS volumes used for the HANA data files have an average queue length of 10 and average latency of 50 ms. What is the most likely cause?

Accepted Answer

The EBS volume's provisioned IOPS are insufficient for the workload.. An average EBS queue length of 10 and average latency of 50 ms indicate that the volume is saturated with I/O requests. The queue length persistently exceeds the recommended threshold (typically <1 for optimal performance), and latency spikes above the 1–10 ms range for gp3 or io2 volumes. This directly points to insufficient provisioned IOPS for the SAP HANA workload, causing requests to queue up and wait for service.

Answer

EBS encryption is causing additional overhead.

Answer

EBS snapshots are being taken too frequently.

Answer

EBS optimization is not enabled on the instance.

Question 4

A company is using AWS Systems Manager to manage their SAP environment. They want to ensure that only specific users can run automation documents on production SAP instances. Which IAM policy action should be used to control access to executing automation documents?

Accepted Answer

ssm:StartAutomationExecution. The correct action is ssm:StartAutomationExecution because AWS Systems Manager Automation requires this specific permission to initiate an automation workflow. The question asks about controlling access to executing automation documents, and StartAutomationExecution is the IAM action that governs the ability to start an automation execution on a target resource, such as a production SAP instance.

Answer

ssm:SendCommand

Answer

ssm:GetParameter

Answer

ssm:ListDocuments

Question 5

A company is running SAP ERP on AWS. The SAP application servers are in private subnets, and the database is in a separate private subnet. The company needs to allow the application servers to communicate with the database. Which AWS networking component should be configured to allow this traffic?

Accepted Answer

Security Group rules allowing traffic between the security groups.. Security groups act as a virtual firewall for instances, and you can reference another security group as a source in inbound rules. This allows the application servers' security group to be specified as the source for the database security group's inbound rule, enabling traffic between the subnets without exposing the database to the entire subnet. This is the most secure and AWS-recommended method for controlling traffic between instances within the same VPC.

Answer

VPC Peering connection between subnets.

Answer

Internet Gateway

Answer

Network ACL with inbound rules for the database subnet.

Question 6

A company is running SAP HANA on AWS. The HANA database is deployed on an r5.8xlarge instance. The company notices high CPU utilization on the instance during peak loads. The SAP team confirms that the HANA workload requires more CPU capacity. What is the most cost-effective way to increase CPU capacity without changing the instance family?

Accepted Answer

Resize the instance to a larger instance type in the r5 family.. Resizing the instance to a larger type within the r5 family (e.g., r5.12xlarge or r5.16xlarge) directly increases vCPU and memory capacity without changing the instance family, which is the most cost-effective approach for a single-node SAP HANA deployment. This avoids the complexity, licensing costs, and network latency of scale-out configurations while meeting the CPU demand.

Answer

Add more EBS volumes with higher IOPS to offload CPU.

Answer

Launch additional r5.8xlarge instances and configure HANA scale-out.

Answer

Configure Auto Scaling to add instances during peak load.

Question 7

A company migrates its SAP HANA database to an EC2 instance with 1 TB of memory. The system is used for both OLTP and OLAP workloads. The performance team notices that memory utilization is high but the CPU is underutilized. Which configuration change would best improve overall system throughput?

Accepted Answer

Enable HANA Large Pages to reduce TLB misses and improve memory access. HANA Large Pages (also known as huge pages) reduce the number of Translation Lookaside Buffer (TLB) misses by mapping large contiguous memory regions with fewer page table entries. In a 1 TB memory system, the default 4 KB page size causes excessive TLB pressure, especially under OLAP workloads with large data scans. Enabling large pages improves memory access efficiency, allowing the CPU to spend less time on page walks and more time on actual processing, thereby improving overall throughput without requiring a hardware change.

Answer

Use a smaller instance type with higher CPU to memory ratio

Answer

Increase the swap space on the instance store volumes

Answer

Disable HANA compression to reduce CPU overhead

Question 8

Which TWO of the following are valid strategies to improve the availability of an SAP HANA database on AWS?

Accepted Answer

Implement automatic failover using SAP HANA System Replication.. SAP HANA System Replication (HSR) provides synchronous or asynchronous replication of the HANA database to a secondary system. Automatic failover can be configured using HSR with tools like Pacemaker or AWS-specific scripts, ensuring high availability by switching to the standby instance if the primary fails. This is a native SAP HANA feature that does not rely on external services.

Answer

Use Amazon RDS for HANA with Multi-AZ deployment.

Answer

Take daily snapshots of the HANA data volume.

Answer

Use a larger EC2 instance type for the HANA server.

Question 9

An SAP system on AWS uses a shared file system (e.g., /sapmnt) that must be accessible from multiple EC2 instances. Which storage solution provides the highest availability and scalability?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, NFS-based shared file system that is accessible from multiple EC2 instances across Availability Zones, offering high availability and automatic scalability. For SAP /sapmnt, EFS supports the required POSIX permissions and concurrent access patterns without single points of failure, unlike block storage or gateway solutions.

Answer

Amazon S3 with S3 File Gateway

Answer

AWS Storage Gateway file gateway

Answer

Amazon EBS with multi-attach enabled

Question 10

Which TWO AWS services can be used to create a private, low-latency network connection between an on-premises data center and an SAP environment on AWS? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet to deliver consistent low latency and high bandwidth, which is critical for SAP workloads. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, offering a private connection that can supplement Direct Connect as a backup or for lower-cost scenarios, though it introduces internet variability. Both services establish private connectivity between on-premises and AWS, meeting the requirements for low-latency SAP environments.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 11

During an SAP system migration to AWS, the team needs to ensure that the SAP application can automatically restart if the EC2 instance fails. Which combination of AWS services should they use?

Accepted Answer

Amazon EC2 Auto Scaling and Amazon CloudWatch. Amazon EC2 Auto Scaling can automatically replace a failed EC2 instance by launching a new one, while Amazon CloudWatch can monitor instance health and trigger the Auto Scaling recovery process. Together, they ensure the SAP application restarts on a healthy instance without manual intervention, meeting the high-availability requirement for SAP workloads.

Answer

AWS Elastic Beanstalk and Amazon RDS

Answer

AWS Lambda and Amazon SQS

Answer

Amazon Route 53 and Elastic Load Balancing

Question 12

The exhibit shows the output of the describe-replication-tasks command. The task status is 'failed'. Which action should be taken to troubleshoot the failure?

Accepted Answer

Review the CloudWatch logs for the replication instance and task.. The first step is to check the CloudWatch logs for DMS to find detailed error messages. Option A is wrong because restarting without investigation may lead to the same error. Option B is wrong because modifying table mappings may not be the issue. Option C is wrong because creating a new task without understanding the failure is inefficient.

Answer

Restart the replication task with a different migration type.

Answer

Modify the table mappings to exclude all tables.

Answer

Create a new replication task with the same settings.

Question 13

A company is designing a network architecture for SAP S/4HANA on AWS. The architecture must support high availability by distributing application servers across two Availability Zones. Which AWS service can provide automatic failover for the SAP central services (ASCS) instance?

Accepted Answer

Amazon Route 53 with DNS failover routing. Amazon Route 53 with DNS failover routing is correct because SAP ASCS (ABAP SAP Central Services) requires a virtual hostname that clients use to connect. Route 53 can monitor the health of the ASCS instance in the primary Availability Zone and automatically update DNS resolution to point to the standby ASCS instance in the secondary Availability Zone when a failure is detected. This provides the automatic failover needed for SAP central services without requiring a shared IP address across zones.

Answer

AWS Direct Connect

Answer

Application Load Balancer (ALB)

Answer

Amazon CloudFront

Question 14

A company is migrating its SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS/ERS) instance. The solution must support automatic failover in case of an instance failure. Which AWS service should be used to manage the floating IP address required for the SAP high availability setup?

Accepted Answer

Amazon Route 53. Amazon Route 53 can be configured with health checks and DNS failover to manage the floating IP address required for SAP Central Services (ASCS/ERS) high availability. When the primary ASCS instance fails, Route 53 automatically updates DNS resolution to point to the secondary instance's IP address, enabling automatic failover without requiring a static floating IP.

Answer

Elastic IP address

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 15

An SAP system running on AWS is experiencing intermittent network connectivity issues between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. The network ACLs and security groups are properly configured. What is the most likely cause and solution?

Accepted Answer

The route tables are not correctly configured for cross-AZ traffic; verify and update route tables. The most likely cause is that the route tables in the subnets do not have routes for the destination CIDR of the other Availability Zone (AZ). By default, each subnet in a VPC is associated with a route table, and for traffic to flow between subnets in different AZs, the route tables must include a local route for the VPC CIDR. If the route tables are misconfigured (e.g., missing the local route or pointing to an incorrect target), cross-AZ traffic will fail, causing intermittent connectivity issues between the application and database servers.

Answer

The security groups are stateful and blocking return traffic; use network ACLs instead

Answer

Use AWS Transit Gateway to connect the subnets in different AZs

Answer

The network ACLs are blocking traffic between Availability Zones; update the NACLs