PAS-C01 Practice Test 1 — 25 Questions

Question 1

A company runs SAP S/4HANA on AWS. The environment includes an SAP HANA database on an EC2 instance with multiple EBS volumes for data, log, and backup. The backup strategy uses AWS Backup to create daily snapshots of all EBS volumes. During a disaster recovery test, the team discovers that the snapshots are not crash-consistent and the database cannot be restored to a consistent state. The backup window is set to 2 AM daily. What should the team do to ensure crash-consistent backups?

Accepted Answer

Configure AWS Backup to create multi-volume crash-consistent snapshots for the instance.. Option A is correct. AWS Backup supports creating multi-volume crash-consistent snapshots, which ensures that all EBS volumes are snapshotted at the same point in time. This provides crash consistency for the SAP HANA database. Option B is incorrect because while SAP HANA backup to S3 is a valid backup method, the question specifically asks about ensuring crash-consistent EBS snapshots. Option C is incorrect because taking individual snapshots sequentially does not guarantee cross-volume consistency. Option D is incorrect because stopping the instance causes unnecessary downtime; crash-consistent snapshots can be achieved without stopping the instance.

Answer

Use SAP HANA backup to S3 instead of EBS snapshots for database backups.

Answer

Take individual EBS snapshots of each volume sequentially within the backup window.

Answer

Stop the EC2 instance before the backup window and start it after the snapshots complete.

Question 2

A company runs SAP S/4HANA on AWS with a High Availability (HA) cluster spanning two Availability Zones (us-east-1a and us-east-1b). The cluster uses an Amazon FSx for NetApp ONTAP file system for the global transport directory. Recently, the cluster experienced a split-brain situation, leading to data corruption. The administrator wants to prevent this from recurring. The current setup uses a single FSx file system mounted on both cluster nodes. What should the administrator do to prevent split-brain?

Accepted Answer

Configure a STONITH (Shoot The Other Node In The Head) mechanism using AWS Lambda. Option C is correct because STONITH (Shoot The Other Node In The Head) is a fencing mechanism that ensures a failed node is forcefully isolated or powered off before the other node takes over, preventing split-brain scenarios in High Availability clusters. Option A is incorrect because adding a third node increases complexity without addressing the root cause of split-brain. Option B is incorrect because increasing memory does not affect cluster communication or fencing. Option D is incorrect because cross-region replication is for disaster recovery, not for preventing split-brain.

Answer

Add a third cluster node in a third Availability Zone

Answer

Increase the memory on both EC2 instances

Answer

Set up cross-region replication for the FSx file system

Question 3

A company is planning to migrate its SAP landscape to AWS. The landscape includes development, quality assurance, and production systems. The company wants to minimize costs by reusing resources across environments. Which AWS feature should be used to enforce resource tagging and compliance?

Accepted Answer

AWS Service Catalog with tag options.. Option D is correct because AWS Service Catalog allows organizations to create and manage a catalog of approved IT services, and with tag options, it can enforce tagging and compliance policies. Option A is incorrect because AWS CloudFormation templates can include tags but do not enforce tagging policies across environments; they are for provisioning infrastructure. Option B is incorrect because AWS Resource Access Manager is used to share resources across accounts, not to enforce tagging or compliance. Option C is incorrect because AWS Config rules can monitor and enforce tagging compliance, but they are reactive rather than proactive governance; Service Catalog provides a more comprehensive solution for enforcing tagging during provisioning.

Answer

AWS CloudFormation templates with required tags.

Answer

AWS Resource Access Manager to share resources.

Answer

AWS Config rules to enforce tagging.

Question 4

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.. Option C is correct because if the SSM Agent is not running or cannot communicate with the AWS Systems Manager service, Patch Manager cannot execute the patching commands. The agent must be in a healthy state and have network connectivity (e.g., via VPC endpoints or internet gateway) to receive the patch baseline and report status. Option D is correct because the AWS-RunPatchBashelline SSM document execution history in Run Command provides detailed logs and error messages for each instance, allowing the team to identify why the patching failed, such as missing dependencies or timeout issues.

Answer

Assign the patch baseline to the instance IDs directly.

Answer

Ensure that the instances have the appropriate IAM role that allows them to be patched.

Answer

Configure a Maintenance Window for the patching operation.

Question 5

A company is migrating a legacy on-premises application to AWS. The application uses a MySQL database with a complex stored procedure that runs every hour and takes approximately 10 minutes to complete. The company wants to minimize downtime during migration. Which TWO approaches should the company use to migrate the database?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication from the source MySQL database to an Amazon RDS for MySQL instance.. Option B is correct because AWS DMS with ongoing replication allows continuous synchronization from the source MySQL database to Amazon RDS for MySQL, minimizing downtime during migration. The complex stored procedure that runs hourly and takes 10 minutes is handled seamlessly as DMS captures ongoing changes, enabling a controlled cutover with minimal disruption.

Answer

Use AWS DMS with a full load only, without ongoing replication, and schedule a cutover window.

Answer

Take a full database dump using mysqldump and import it into an Amazon RDS for MySQL instance during a planned maintenance window.

Answer

Create an Amazon RDS for MySQL read replica from the on-premises database.

Question 6

A company is migrating a large SAP ERP system to AWS using SAP HANA. They want to minimize downtime and ensure consistency. Which three approaches should they combine? (Choose THREE.)

Accepted Answer

Use AWS Snowball Edge for the initial data transfer. The correct combination involves Snowball Edge for the initial large data transfer (A), DMS with ongoing change data capture (D), and SAP HANA system replication for zero-downtime cutover (E). Snowball Edge handles the initial bulk load efficiently. DMS captures ongoing changes during migration. SAP HANA system replication provides continuous data synchronization for a seamless switch. Option B (DataSync) is redundant as DMS already handles ongoing replication. Option C (SMS) is designed for server-level migration, not for SAP HANA data. Thus, A, D, and E are the three approaches to combine.

Answer

Use AWS DataSync for ongoing replication

Answer

Use AWS Server Migration Service (SMS) for server replication

Question 7

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic across multiple EC2 instances. The operations team notices that some instances are marked as unhealthy even though the application is running correctly. Which TWO actions could resolve this issue?

Accepted Answer

Increase the healthy threshold count.. Option A is correct because increasing the healthy threshold count makes the load balancer require more consecutive successful health checks before marking an instance as healthy, preventing flapping. Option B is wrong because associating an Elastic IP address does not affect health check status; it only provides a static public IP. Option C is wrong because changing the health check protocol to TCP would not resolve application-level health issues; ALB supports HTTP/HTTPS health checks which are more appropriate for web applications. Option D is correct because changing the health check path to a simpler endpoint (e.g., a static page) reduces the chance of false failures caused by complex application logic. Option E is wrong because decreasing the health check interval increases the frequency of checks, which could cause unnecessary load and does not prevent false failures.

Answer

Associate an Elastic IP address with each instance.

Answer

Change the health check protocol to TCP.

Answer

Decrease the health check interval.

Question 8

A company is migrating its SAP ERP system running on Oracle Database to SAP HANA on AWS. The current on-premises environment has a 5 TB Oracle database with high transaction volume. The migration must be completed within a 4-hour downtime window. The target environment on AWS uses an SAP-certified instance with 1 TB of RAM. The company has a 1 Gbps AWS Direct Connect connection. The migration team is considering using SAP DMO with SUM. However, during a test run, the database export took 6 hours, exceeding the downtime window. What should the migration team do to meet the 4-hour downtime window?

Accepted Answer

Use the SAP HANA Database Migration Option (DMO) with the 'load and move' method. Option B is correct because using the SAP HANA Database Migration Option (DMO) with the 'load and move' method allows the initial data load to be performed during the preparation phase before the downtime window, and only a delta transfer (incremental data) during the actual downtime. This significantly reduces the downtime required compared to the standard DMO method that does the full export and import during downtime. Option A is wrong because performing a system copy to Oracle on AWS first does not directly migrate to SAP HANA and adds unnecessary steps and time. Option C is wrong because upgrading to a larger EC2 instance may improve processing speed but does not address the bottleneck of the 1 Gbps network bandwidth; the export time is limited by network speed. Option D is wrong because AWS Snowball Edge introduces additional time for shipping and data transfer, which would likely exceed the 4-hour window, and it is not optimized for the delta sync required for such a short downtime.

Answer

Perform a system copy to an Oracle database on AWS first, then migrate to HANA

Answer

Upgrade to a larger EC2 instance type with more CPU and memory for the HANA database

Answer

Use AWS Snowball Edge to transfer the initial data and then perform a delta sync

Question 9

An SAP administrator is migrating an on-premises SAP system to AWS using this IAM policy. When attempting to launch a new EC2 instance from an AMI stored in the S3 bucket, the launch fails. What is the likely cause?

Accepted Answer

The IAM policy does not include ec2:RunInstances.. The launch fails because the IAM policy does not include the ec2:RunInstances permission, which is required to launch new EC2 instances. Option A is incorrect because the ability to stop or start instances is not relevant to launching new instances. Option C is incorrect because the failure is due to the IAM policy, not the S3 bucket policy; the IAM policy may allow s3:GetObject but that does not overcome the lack of ec2:RunInstances. Option D is incorrect because describing instances is not a prerequisite for launching.

Answer

The policy does not allow stopping or starting instances.

Answer

The S3 bucket policy does not allow reading the AMI object.

Answer

The policy does not allow describing EC2 instances.

Question 10

An SAP administrator receives an alert that the SAP application server is not responding. The administrator checks the EC2 console and sees that the instance state is 'running' but the status checks have failed. Which step should be taken first to restore the SAP application?

Accepted Answer

Use the EC2 console to stop and start the instance, which will move it to new underlying hardware.. When status checks fail, the instance may have underlying hardware issues. Stopping and starting the instance (Option B) moves it to new hardware, which can resolve hardware-related failures and restore the SAP application. Option A is incorrect because terminating the instance loses the existing configuration and EBS volumes (unless termination protection is disabled and volumes are set to survive). Option C is incorrect because rebooting only restarts the OS; it does not change the underlying hardware, so hardware issues persist. Option D is incorrect because creating a new instance and attaching existing volumes is more time-consuming and complex; the simpler stop/start action should be attempted first.

Answer

Terminate the instance and launch a new one using the same AMI.

Answer

Reboot the EC2 instance from the AWS Management Console.

Answer

Create a new EC2 instance from the latest AMI and attach the existing EBS volumes.

Question 11

A company is migrating a large SAP HANA system to AWS. The SAP system has strict latency requirements for storage and requires high IOPS. Which storage solution should be used for the SAP HANA data volume?

Accepted Answer

Amazon EBS io2 Block Express volumes. SAP HANA on AWS requires high-performance storage with high IOPS and sub-millisecond latency. Amazon EBS io2 Block Express volumes provide up to 256K IOPS and sub-millisecond latency, making them the appropriate choice for the SAP HANA data volume. Option A (Amazon S3) is object storage, not block storage, and is unsuitable for database volumes. Option C (Amazon EFS) is file storage, also not block storage. Option D (Amazon EBS gp3 volumes) is general purpose SSD but does not match the performance of io2 Block Express for HANA workloads.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon EBS gp3 volumes

Question 12

A company is planning to migrate an SAP HANA database to AWS. Which THREE factors should the company consider when selecting an EC2 instance type for the SAP HANA database?

Accepted Answer

The instance must be EBS-optimized. For SAP HANA on AWS, EC2 instance types must be memory-optimized (e.g., r5, r6i, x1e) and listed in the SAP Certified Instance Types for SAP HANA. Additionally, instances must be EBS-optimized to provide dedicated bandwidth to EBS volumes. Burstable performance (option A) is not suitable for SAP HANA's consistent performance requirements. While the Nitro System (option C) is recommended, it is not a strict requirement.

Answer

The instance type must support burstable performance

Answer

The instance must be based on the AWS Nitro System

Question 13

A company manages a multi-account AWS environment using AWS Organizations. The operations team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket. What is the MOST efficient way to enforce this configuration?

Accepted Answer

Deploy an AWS CloudFormation StackSet with a template that enables CloudTrail and configures the S3 bucket in every account and region.. Option B is correct because AWS CloudFormation StackSets allow you to deploy a CloudTrail configuration template across multiple accounts and regions in a single, automated operation. This approach ensures consistent enforcement of the policy without manual intervention, leveraging the centralized management capabilities of AWS Organizations.

Answer

Configure CloudTrail in the management account with an S3 bucket policy that grants access to all member accounts.

Answer

Create a custom script using AWS CLI to enable CloudTrail in each account and region.

Answer

Use AWS Service Catalog to publish a CloudTrail product and require each account to launch it.

Question 14

A company is running SAP HANA on an r5.8xlarge instance. They want to scale up to meet increased memory requirements. Which instance family would be the MOST suitable for a scale-up scenario?

Accepted Answer

x1e.32xlarge. The x1e.32xlarge instance is part of the X1e family, which is specifically designed for high-memory workloads like SAP HANA. With 3,904 GiB of memory, it provides the largest memory capacity among AWS instances, making it the most suitable for scaling up SAP HANA to meet increased memory requirements. SAP HANA is an in-memory database, so scaling up requires instances with high memory-to-vCPU ratios, which the X1e family delivers.

Answer

r5.24xlarge

Answer

i3.16xlarge

Answer

c5.18xlarge

Question 15

Which TWO of the following are best practices for securing SAP workloads on AWS?

Accepted Answer

Use IAM roles to grant EC2 instances access to AWS services.. IAM roles allow EC2 instances to securely access AWS services (e.g., S3, DynamoDB) without embedding long-term credentials. By attaching an IAM role to an EC2 instance, the instance can obtain temporary credentials via the instance metadata service, which is a best practice for securing SAP workloads on AWS.

Answer

Disable encryption in transit between application and database tiers.

Answer

Allow SSH access from the internet for administration.

Answer

Store SAP backup files in a public S3 bucket for easy access.

Question 16

Which THREE of the following are valid considerations when designing an SAP HANA backup strategy on AWS?

Accepted Answer

Use EBS snapshots for backing up HANA data volumes.. Option A is correct because EBS snapshots provide a consistent, point-in-time backup of HANA data volumes when the database is in backup mode (e.g., using hdbsql to create a snapshot). This method is supported by SAP and AWS, and it allows for fast recovery by restoring the entire volume without needing to replay transaction logs from a separate backup.

Answer

Back up HANA data directly to Amazon S3 using standard tools.

Answer

Replicate backups to another AWS Region using S3 Cross-Region Replication.

Question 17

A company is running SAP on AWS and needs to design a disaster recovery (DR) solution with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. The primary region is us-east-1 and the DR region is us-west-2. The SAP application uses an SAP HANA database with a size of 2 TB. Which combination of AWS services should be used to meet the DR requirements most cost-effectively?

Accepted Answer

Configure HANA System Replication (HSR) across regions and use a standby HANA instance in us-west-2 with a smaller instance size.. Option D is correct because HANA System Replication (HSR) is the native SAP HANA replication technology that can achieve an RPO of 15 minutes or less by asynchronously replicating data across regions. By using a smaller standby instance in us-west-2, the solution meets the RTO of 4 hours (since the standby can be scaled up or promoted quickly) while minimizing ongoing DR costs. This approach is purpose-built for SAP HANA and avoids the overhead of third-party tools or backup-based restores.

Answer

Use AWS Database Migration Service (DMS) with continuous replication from the primary HANA database to a target in us-west-2.

Answer

Use AWS Backup with continuous backups and cross-region copy to achieve RPO of 15 minutes.

Answer

Use AWS Backup to take hourly backups of the HANA database and restore in us-west-2 during a disaster.

Question 18

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are also in private subnets. The security group for the RDS instance allows inbound traffic on port 3306 from the security group attached to the ECS tasks. However, the application cannot connect to the database. Which solution should the company implement to resolve this issue?

Accepted Answer

Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306. Option B is correct because when using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

Answer

Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway

Answer

Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity

Answer

Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID

Question 19

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

Accepted Answer

Replatform the application by migrating the Oracle database to Amazon RDS for Oracle. Option D is correct because the company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Answer

Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

Answer

Store the data in Amazon S3 and use Athena for querying

Answer

Refactor the application to use Amazon DynamoDB as the database

Question 20

A company runs a stateful web application on EC2 instances in an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The application maintains session state in memory on each instance. Users report that they are frequently logged out and lose their session data during scaling events. What should the company do to resolve this issue?

Accepted Answer

Modify the application to store session state in an Amazon ElastiCache cluster. Option C is correct because storing session state externally in ElastiCache decouples session data from individual EC2 instances. This ensures that when instances are terminated or added during scaling events, users retain their session state regardless of which instance serves their request. ElastiCache provides a low-latency, in-memory cache that is ideal for session persistence in stateful web applications.

Answer

Change the scaling policy to a simple scaling policy instead of dynamic scaling

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer

Answer

Increase the cooldown period for the Auto Scaling group