PAS-C01 Practice Test 24 — 15 Questions

Question 1

Which THREE security best practices should be implemented for SAP systems on AWS? (Choose three.)

Accepted Answer

Use security groups to restrict inbound and outbound traffic to SAP systems.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. For SAP systems, this is critical to restrict access to only necessary ports (e.g., 3200 for SAP Application Server, 36xx for SAProuter, 443 for HTTPS) and trusted IP ranges, reducing the attack surface. Unlike network ACLs, security groups are stateful, meaning return traffic is automatically allowed, simplifying rule management for SAP communication flows.

Answer

Disable SSH key pair access and use only password authentication.

Answer

Deploy all SAP systems in a single VPC for simplified management.

Question 2

An SAP application on EC2 is experiencing high CPU utilization. The instance is part of an Auto Scaling group. The CPU metric shows spikes every hour. Which scaling policy should be used to preemptively scale out before the spike?

Accepted Answer

Scheduled scaling policy to add capacity just before the spike. The CPU spikes are predictable (every hour), making a scheduled scaling policy the ideal choice to preemptively add capacity just before the spike occurs. Scheduled scaling allows you to define a specific time to increase the desired capacity of the Auto Scaling group, ensuring resources are available before the load increases, rather than reacting after the spike has started.

Answer

Simple scaling policy based on CPU > 80%

Answer

Step scaling policy with multiple thresholds

Answer

Target tracking scaling policy with CPU target 75%

Question 3

A company is migrating its on-premises SAP landscape to AWS. The SAP system uses Oracle Database. The migration must minimize downtime. Which AWS service should be used for the database migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication from Oracle to a target database (e.g., Amazon RDS for Oracle or Amazon Aurora) with minimal downtime. DMS can perform a full load followed by continuous change data capture (CDC) using Oracle LogMiner or binary reader to keep the source and target synchronized until cutover.

Answer

AWS Snowball Edge

Answer

AWS CloudEndure Migration

Answer

Amazon S3 Transfer Acceleration

Question 4

Which THREE of the following are requirements for running SAP HANA in an AWS multi-zone HA cluster? (Choose three.)

Accepted Answer

At least two EC2 instances in different Availability Zones per node type.. SAP HANA in a multi-zone HA cluster requires at least two EC2 instances per node type (e.g., worker, standby) deployed in different Availability Zones to ensure high availability. This architecture allows automatic failover between zones, maintaining SAP HANA system replication and cluster quorum in the event of an AZ failure.

Answer

Use of an Elastic Load Balancer to distribute traffic to the HANA nodes.

Answer

All nodes must use instance store volumes for the HANA data.

Question 5

A company is deploying SAP NetWeaver on AWS and needs to set up high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The company uses a shared file system for the transport directory. Which components are essential for the HA setup? (Choose TWO.)

Accepted Answer

An internal Application Load Balancer (ALB) to distribute traffic to the ASCS instance.. An internal Application Load Balancer (ALB) is essential because it provides a virtual IP address and health checks for the SAP ASCS instance. In a multi-AZ HA setup, the ALB routes client traffic to the active ASCS instance and automatically fails over to the standby instance if the primary fails, ensuring continuous access to SAP Central Services.

Answer

Amazon S3 as the transport directory.

Answer

Both ASCS and ERS instances must run on the same EC2 instance.

Answer

Amazon RDS Multi-AZ for the SAP database.

Question 6

A company is migrating an SAP NetWeaver system from on-premises to AWS. They plan to use the same SAP SID and keep the same hostname. The migration will be performed using SAP Software Provisioning Manager (SWPM) with the option 'System Rename' set to 'No'. What must be configured in the AWS environment to ensure the system functions correctly?

Accepted Answer

Ensure the same private IP address is assigned to the Amazon EC2 instance. The system uses the same hostname and SAP SID. To avoid reconfiguration, the Amazon EC2 instance must have the same private IP address as the on-premises hostname resolves to, or the hostname must be resolvable via DNS or /etc/hosts. Option B is incorrect because updating DNS records to point to a new public IP is unnecessary when the same private IP is used. Option C is incorrect because the same SAP SID is allowed and does not need to be changed. Option D is incorrect because assigning a different private IP would require updating hostname resolution, which defeats the purpose of keeping the same hostname.

Answer

Update the DNS records to point to the new public IP

Answer

Change the SAP SID to a new value

Answer

Assign a different private IP address to avoid conflicts

Question 7

A company runs SAP BusinessObjects on AWS and needs to scale the application tier based on CPU utilization. Which AWS service should be used to automatically add or remove EC2 instances?

Accepted Answer

AWS Auto Scaling. AWS Auto Scaling can automatically adjust the number of EC2 instances based on CloudWatch alarms for CPU utilization. AWS Elastic Load Balancing distributes traffic but does not scale instances. AWS Lambda is for serverless, not EC2 scaling. AWS CloudFormation is for infrastructure provisioning, not auto-scaling.

Answer

AWS Elastic Load Balancing

Answer

AWS Lambda

Answer

AWS CloudFormation

Question 8

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL Multi-AZ DB instance. The security team requires that all traffic between the ALB and EC2 instances is encrypted, and that the EC2 instances can only be accessed by the ALB. Which TWO steps should be taken to meet these requirements? (Choose TWO.)

Accepted Answer

In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.. Referencing the ALB's security group in the inbound rule of the EC2 security group ensures that only traffic originating from the ALB is allowed, meeting the requirement that EC2 instances can only be accessed by the ALB. Option D is correct because configuring the target group to use HTTPS protocol ensures that traffic between the ALB and EC2 instances is encrypted using TLS, satisfying the encryption requirement.

Answer

In the EC2 security group, allow inbound HTTPS traffic from 0.0.0.0/0.

Answer

Enable encryption at rest on the EC2 instances using EBS encryption.

Answer

Configure the ALB with an HTTPS listener and upload the SSL/TLS certificate.

Question 9

A company is planning to migrate its SAP ERP system from an on-premises data center to AWS. The system uses SAP HANA as the database. The current on-premises HANA database size is 1 TB. The company wants to minimize downtime during the migration. The network connection between on-premises and AWS has a bandwidth of 1 Gbps. The company has already set up a Direct Connect connection. They plan to use SAP HANA system replication to replicate the database to an EC2 instance in AWS. However, the initial data transfer will take too long due to the large dataset. What should they do to reduce the initial replication time?

Accepted Answer

Use AWS Snowball Edge to physically transfer the initial HANA backup.. Using AWS Snowball Edge to physically transfer the initial HANA backup is much faster than transferring over the network, even with Direct Connect. Option A is wrong because ordering an additional Direct Connect circuit is costly and does not address the time limitation of the 1 Gbps link. Option B is wrong because enabling compression on HANA system replication may help but is still constrained by the available bandwidth. Option C is wrong because setting up a VPN over the internet is typically slower and less reliable than the existing Direct Connect connection.

Answer

Order an additional Direct Connect circuit to increase bandwidth.

Answer

Enable compression on the HANA system replication.

Answer

Set up a VPN connection over the internet for faster transfer.

Question 10

An SAP system administrator needs to ensure high availability for an SAP HANA database using AWS services. What is the recommended architecture?

Accepted Answer

Deploy SAP HANA on EC2 instances in a cluster across multiple Availability Zones with synchronous replication. SAP HANA can be deployed as a multi-node cluster using EC2 instances in different Availability Zones with synchronous replication and automatic failover using cluster software like Pacemaker. RDS does not support SAP HANA. A single EC2 instance in one AZ is not highly available. Multi-AZ RDS is for other databases, not SAP HANA.

Answer

Use Amazon RDS for SAP HANA with Multi-AZ deployment

Answer

Use Amazon RDS Multi-AZ for SAP HANA database

Answer

Deploy a single EC2 instance in one Availability Zone and take daily snapshots

Question 11

Which TWO AWS services can be used to monitor the health and performance of an SAP HANA database on AWS?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (option B) can monitor OS-level metrics and custom metrics from SAP HANA via the CloudWatch agent or API. SAP HANA monitoring tools like HANA cockpit (option D) provide built-in health and performance monitoring. AWS Trusted Advisor (option A) offers best-practice recommendations, not real-time monitoring. AWS Config (option C) tracks resource configuration changes. VPC Flow Logs (option E) capture network traffic metadata.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

VPC Flow Logs

Question 12

A company is running SAP HANA on an EC2 instance with multiple EBS volumes for data and log. The instance is experiencing high write latency on the log volume. The administrator notices that the log volume is a gp2 EBS volume with 1,000 GB size and 3,000 IOPS baseline. The average write IOPS to the log volume is 4,000, with peaks up to 5,500. Which action should the administrator take to resolve the latency?

Accepted Answer

Replace the gp2 volume with an io2 Block Express volume provisioned at 6,000 IOPS.. The gp2 volume's baseline IOPS is 3,000, but the log volume requires an average of 4,000 write IOPS with peaks up to 5,500, which exceeds the burst balance, causing latency. Replacing with an io2 Block Express volume provisioned at 6,000 IOPS provides consistent high IOPS and low latency, ideal for SAP HANA log volumes. Option B is incorrect because st1 volumes are throughput-optimized, not IOPS-optimized, and would not address the IOPS bottleneck. Option C is incorrect because striping additional gp2 volumes adds complexity and still relies on burst performance, which may not sustain the required IOPS. Option D is incorrect because while increasing gp2 size to 2,000 GB doubles baseline IOPS to 6,000, gp2 still uses a burst model; if the burst balance is depleted, latency can occur. io2 Block Express provides provisioned, consistent performance without bursting.

Answer

Change the volume type to st1 (throughput optimized) to improve throughput.

Answer

Add a second log volume and stripe them using LVM.

Answer

Increase the gp2 volume size to 2,000 GB to double the baseline IOPS.

Question 13

An SAP system administrator is setting up monitoring for SAP NetWeaver on AWS. They want to send custom SAP application metrics to CloudWatch for alerting. What is the most efficient way to achieve this?

Accepted Answer

Install the Amazon CloudWatch Agent on the EC2 instance and configure it to collect SAP metrics. The CloudWatch Agent can collect custom metrics from the OS and applications, including SAP, and publish them to CloudWatch. AWS Lambda can be used but requires custom code and more overhead. SAP Solution Manager does not natively integrate with CloudWatch. AWS Systems Manager is for management, not custom metric publishing.

Answer

Use SAP Solution Manager to export metrics to CloudWatch via API

Answer

Use AWS Lambda to periodically query SAP and push metrics to CloudWatch

Answer

Configure AWS Systems Manager to collect SAP metrics

Question 14

A company is troubleshooting an issue where SAP users cannot log in to the SAP GUI. The SAP application server is running on an EC2 instance behind an Application Load Balancer (ALB). The ALB is configured to use the HTTPS listener on port 443. Which configuration is most likely causing the issue?

Accepted Answer

The ALB is terminating HTTPS connections, but the SAP application server expects unencrypted DIAG protocol.. SAP GUI uses the DIAG protocol over TCP port 3200, not HTTPS. The ALB terminates HTTPS connections, but the backend SAP application server expects unencrypted DIAG traffic, so the protocol mismatch prevents successful login. Option A is incorrect because health checks affect target availability, not user authentication. Option B is incorrect because port 3300 is not the standard DIAG port (3200 is), and security group rules are not the primary cause. Option D is incorrect because stickiness settings influence session persistence but do not block initial login when protocol mismatch exists.

Answer

The ALB's target group is not configured with health checks.

Answer

The security group for the ALB does not allow inbound traffic on port 3300.

Answer

The ALB's stickiness settings are misconfigured, causing session persistence issues.

Question 15

A company is deploying SAP S/4HANA on AWS and needs to choose the storage for the HANA data volume. Which EBS volume type provides the highest consistent IOPS for this workload?

Accepted Answer

EBS io2 Block Express. EBS io2 Block Express is designed for mission-critical applications like SAP HANA, offering the highest consistent IOPS of any EBS volume type, with up to 256,000 IOPS. Option B (gp3) provides baseline performance but lower maximum IOPS than io2 Block Express. Option C (io1) is an older provisioned IOPS type with lower maximum IOPS (up to 64,000) compared to io2 Block Express. Option D (st1) is throughput-optimized and not suitable for high IOPS workloads.

Answer

EBS gp3

Answer

EBS io1

Answer

EBS st1