PAS-C01 Practice Test 2 — 25 Questions

Question 1

A company is designing a disaster recovery (DR) strategy for SAP S/4HANA on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The SAP HANA database is 2 TB and requires Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 4 hours. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure SAP HANA System Replication (HSR) to an EC2 instance in us-west-2 with log replication in sync mode.. SAP HANA System Replication (HSR) with synchronous log replication meets the RPO of 15 minutes and RTO of 4 hours because it continuously replicates transaction logs to the DR site in us-west-2, ensuring near-zero data loss. In sync mode, the primary waits for the secondary to acknowledge log writes, which keeps the DR database consistent and ready for takeover within minutes, well under the 4-hour RTO. This is the only option that provides continuous, database-level replication with the required recovery objectives.

Answer

Use AWS S3 Cross-Region Replication to copy database backups every 15 minutes.

Answer

Take EBS snapshots of the HANA data volume every hour and copy them to us-west-2.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate changes to a HANA instance in us-west-2.

Question 2

A company is migrating a legacy on-premises application to AWS. The application uses a proprietary database that is not supported by AWS Database Migration Service (DMS). The company needs to minimize downtime and automate the migration as much as possible. Which approach should be used?

Accepted Answer

Use AWS Application Migration Service (MGN) to replicate the entire server, including the database, to AWS.. AWS Application Migration Service (MGN) can replicate entire servers, including the operating system, applications, and the proprietary database, to AWS without requiring database-specific support. This minimizes downtime by using continuous block-level replication and automates the migration by converting the source server into a native AWS instance. Since AWS DMS does not support the proprietary database, MGN provides a viable path for migrating the entire workload as a whole.

Answer

Use AWS Database Migration Service (DMS) with a custom endpoint.

Answer

Export the database as a flat file, upload to Amazon S3, and import into Amazon RDS.

Answer

Use AWS Snowball to transfer database backups, then restore in Amazon RDS.

Question 3

An SAP system on AWS is running on an r5.16xlarge instance. The system is experiencing network throughput bottlenecks. Which step should be taken to improve network performance?

Accepted Answer

Enable Enhanced Networking and install the ENA driver. Enabling Enhanced Networking and installing the Elastic Network Adapter (ENA) driver is the standard method to achieve higher packet-per-second (PPS) performance, lower latency, and increased network bandwidth on supported instance types like r5.16xlarge. Without the ENA driver, the instance uses the older Xen network driver, which cannot utilize the full 25 Gbps network bandwidth available to r5 instances, leading to throughput bottlenecks.

Answer

Move the instance to a placement group

Answer

Attach an Elastic Fabric Adapter

Answer

Change the instance type to c5.18xlarge

Question 4

An SAP administrator needs to back up an SAP HANA database running on an Amazon EC2 instance. The requirement is to perform daily backups to Amazon S3 with minimal cost and impact on database performance. Which backup strategy should be used?

Accepted Answer

Use SAP HANA Backint integration to back up to S3. SAP HANA Backint integration allows direct, streaming backups from the HANA database to Amazon S3, which minimizes performance impact by offloading backup processing to the Backint agent and avoids intermediate storage. This approach is cost-effective as it uses S3's low-cost storage and eliminates the need for additional infrastructure, meeting the requirement for daily backups with minimal cost and database performance impact.

Answer

Use AWS Backup with the SAP HANA plugin

Answer

Create EBS snapshots of the database volumes

Answer

Configure S3 Lifecycle policies to move logs

Question 5

A company is deploying SAP NetWeaver on AWS and needs to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which AWS services can be used to implement a failover cluster for ASCS and ERS? (Select THREE.)

Accepted Answer

Elastic Load Balancing. Elastic Load Balancing (ELB) is correct because it can be used in conjunction with a Network Load Balancer (NLB) to provide a stable endpoint for SAP ASCS and ERS failover. The NLB supports static IP addresses and can be configured with health checks that monitor the SAP service, automatically routing traffic to the healthy node in the cluster. This eliminates the need for a traditional floating IP and integrates with AWS-native failover mechanisms.

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company is migrating its SAP environment to AWS and wants to use SAP HANA as a Service on AWS (HANA database on AWS). The SAP application tier will run on EC2 instances behind an Application Load Balancer. The company requires high availability for the database with automatic failover in case of an AZ failure. Which architecture should the company implement?

Accepted Answer

Set up HANA System Replication between two EC2 instances in different AZs with automatic failover.. HANA System Replication configured between two EC2 instances in different Availability Zones (AZs) with automatic failover ensures high availability and resilience against an AZ failure. Option A is incorrect because replicating HANA to Amazon S3 is meant for backups and point-in-time recovery, not for real-time automatic failover. Option C is incorrect because synchronous replication within the same AZ does not protect against an AZ failure; it only provides protection against instance or host failure. Option D is incorrect because a single HANA database instance in one AZ, even with regular backups to S3, cannot provide automatic failover if the AZ fails; it would require manual recovery.

Answer

Configure HANA replication to Amazon S3 for point-in-time recovery.

Answer

Use HANA System Replication with a synchronous secondary in the same AZ.

Answer

Deploy a single HANA database on a large EC2 instance in one AZ with regular backups to S3.

Question 7

A company is migrating its SAP ERP system from an on-premises environment to AWS. The database is SAP HANA. The migration must minimize downtime. Which TWO approaches should the company consider?

Accepted Answer

Use AWS DMS with full load and ongoing change data capture (CDC).. AWS DMS with full load and ongoing change data capture (CDC) enables a near-zero-downtime migration by continuously replicating changes from the source SAP HANA database to the target on AWS after the initial full load, allowing the cutover to occur with minimal disruption. Option E is correct because SAP HANA System Replication provides a native, asynchronous or synchronous replication mechanism that can be configured between the on-premises HANA database and an AWS-hosted HANA instance, supporting a controlled switchover with very low downtime.

Answer

Use AWS Database Migration Service (DMS) with full load only.

Answer

Use VM Import/Export to migrate the entire on-premises virtual machine to AWS.

Answer

Use the SAP Software Provisioning Manager (SWPM) to perform a homogeneous system copy over the network.

Question 8

An SAP administrator needs to provide temporary, time-limited access to an S3 bucket containing SAP backup files for an external auditor. The auditor should be able to download files from the bucket. Which method provides the most secure way to grant access?

Accepted Answer

Generate a presigned URL for each file the auditor needs to download.. Presigned URLs grant temporary, time-limited access to specific S3 objects without requiring the auditor to have AWS credentials or any permanent permissions. The SAP administrator can generate a presigned URL for each backup file, set an expiration time, and share the URL with the auditor, who can then download the file using standard HTTP GET requests. This approach follows the principle of least privilege and ensures access is revoked automatically after the URL expires.

Answer

Create an IAM user with read-only access to the bucket and share the credentials with the auditor.

Answer

Provide the auditor with the root user credentials of the AWS account.

Answer

Make the bucket publicly readable and share the bucket URL.

Question 9

An organization uses AWS Systems Manager to run automation documents on their SAP EC2 instances. Recently, some automation runbooks have failed because the EC2 instances did not have the required SSM Agent version. The operations team wants to ensure all existing and future instances automatically have the latest SSM Agent. Which solution meets this requirement?

Accepted Answer

Create an AWS Systems Manager State Manager association that runs the AWS-UpdateSSMAgent document on the instances.. AWS Systems Manager State Manager can enforce a desired state configuration on EC2 instances. By creating an association that runs the `AWS-UpdateSSMAgent` document on a schedule, State Manager ensures that both existing and future instances (when configured with the appropriate instance profile and tags) automatically update to the latest SSM Agent version, regardless of the instance's lifecycle.

Answer

Use an automation document to update the SSM Agent and schedule it via a cron job on each instance.

Answer

Enable the 'Auto-update SSM Agent' option in the EC2 launch settings for all instances.

Answer

Configure AWS Systems Manager Patch Manager to update the SSM Agent.

Question 10

Which THREE of the following are best practices for securing an SAP system on AWS? (Choose THREE.)

Accepted Answer

Enable CloudTrail to log API calls for auditing. AWS CloudTrail records all API calls made to the AWS environment, including those that modify SAP infrastructure (e.g., EC2 instance launches, security group changes). Enabling CloudTrail provides an immutable audit log that is essential for compliance, security incident investigation, and operational troubleshooting in an SAP landscape. This aligns with the AWS shared responsibility model, where customers must log and monitor actions taken on their SAP workloads.

Answer

Use the same security group for all SAP instances

Answer

Store SAP license keys in a public S3 bucket

Question 11

A company wants to migrate its on-premises SAP system to AWS. The system consists of an SAP NetWeaver application server and an SAP HANA database. The database requires ultra-low latency storage. Which AWS storage solution is most suitable for the SAP HANA data volume?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the most suitable storage solution for SAP HANA data volumes because they provide ultra-low latency, high durability, and up to 256,000 IOPS per volume with sub-millisecond latency. This meets the stringent performance requirements of SAP HANA, which demands consistent, low-latency storage for its in-memory database operations. io2 Block Express is certified by SAP for production HANA workloads on AWS.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EFS file system

Question 12

Which TWO of the following are required components for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared? (Choose two.)

Accepted Answer

Amazon EFS file system. Amazon EFS is required for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared because it provides a fully managed, POSIX-compliant NFS file system that can be mounted concurrently across multiple EC2 instances. SAP HANA scale-out nodes require a shared file system for /hana/shared to exchange configuration and log data, and EFS supports the necessary NFSv4 protocol with the required throughput and latency characteristics for this workload.

Answer

EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 13

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance. The EC2 instance has an Elastic IP address of 203.0.113.5 and is running in a VPC with CIDR 10.0.0.0/16. When the application on the instance tries to upload an object to the S3 bucket 'my-bucket', it receives an Access Denied error. What is the MOST likely cause?

Accepted Answer

The condition checks the source IP address, but the EC2 instance uses a private IP address within the VPC when communicating with S3 via a VPC endpoint.. The IAM policy condition likely includes an `aws:SourceIp` condition that allows only the Elastic IP address (203.0.113.5). However, when the EC2 instance communicates with S3 via a VPC endpoint, traffic uses a private IP from the VPC CIDR (10.0.0.0/16) as the source IP, not the Elastic IP. This mismatch causes the condition to evaluate to False, resulting in Access Denied.

Answer

The policy does not allow the s3:PutObject action.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket without the asterisk.

Answer

The policy is missing a Deny statement for other IP addresses.

Question 14

An SAP administrator notices that the SAP HANA database is running out of disk space on the /hana/data volume. The volume is an EBS gp3 volume with 2000 GB size. The administrator wants to increase the size without downtime. Which action should be taken?

Accepted Answer

Use the modify-volume API to increase the size of the existing volume. AWS EBS gp3 volumes support online resizing via the modify-volume API without requiring downtime. The SAP HANA /hana/data volume can be increased in size while the instance remains running, as EBS volumes can be modified dynamically. After the modification, the administrator must extend the file system to recognize the new space, but no volume detachment or data migration is needed.

Answer

Detach the volume, create a snapshot, create a larger volume from the snapshot, and attach it

Answer

Create a new larger volume and copy data using rsync

Answer

Increase the IOPS of the volume to improve performance

Question 15

An SAP administrator is troubleshooting a performance issue on an SAP NetWeaver system running on AWS. The system uses an Oracle database. The CPU utilization of the database server is consistently below 30%, but application response times are slow. Which THREE checks should the administrator perform to identify the bottleneck?

Accepted Answer

Use Amazon CloudWatch metrics to check network throughput and latency between the application and database servers.. High network latency or insufficient throughput between the application and database servers can cause slow response times even when CPU utilization is low. Amazon CloudWatch metrics such as NetworkIn, NetworkOut, and NetworkPacketsIn/Out can reveal congestion or bandwidth saturation, which is a common bottleneck in SAP NetWeaver deployments on AWS.

Answer

Increase the number of CPU cores on the database server.

Answer

Enable Amazon EBS Elastic Volumes to increase volume size dynamically.

Question 16

An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?

Accepted Answer

The policy does not include the ec2:CreateTags action.. The IAM policy explicitly grants ec2:StartInstances and ec2:StopInstances actions but does not include ec2:CreateTags. Without the ec2:CreateTags action, the user lacks the required permission to create or modify tags on EC2 instances, even though they can start and stop them.

Answer

The user does not have permission to describe instances.

Answer

The resource ARN is too restrictive.

Answer

There is an implicit deny for all actions not listed.

Question 17

A company is migrating a legacy on-premises Oracle database to Amazon RDS for Oracle. They need to minimize downtime. Which AWS service should they use for ongoing replication during the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) with ongoing replication (change data capture) allows near-zero downtime migration. Option A (AWS Schema Conversion Tool) is wrong because it is a schema conversion tool, not a replication service. Option B (AWS Server Migration Service) is wrong because it is for server migration, not database replication. Option D (AWS DataSync) is wrong because it is for file/object storage, not database replication.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Question 18

A company is experiencing performance issues with their SAP ERP system on AWS. The system is running on an r5.4xlarge EC2 instance with gp2 EBS volumes. The database is SAP HANA. CloudWatch metrics show high write latency on the data volume. Which change would most likely improve performance?

Accepted Answer

Change the volume type to io2 Block Express. SAP HANA is highly sensitive to storage latency, and the high write latency on the data volume indicates that gp2's burst model is insufficient for sustained write workloads. io2 Block Express provides consistent, sub-millisecond latency with provisioned IOPS up to 256,000, which directly addresses the performance bottleneck. This change aligns with AWS best practices for SAP HANA production workloads, which recommend io2 volumes for data and log volumes.

Answer

Increase the size of the gp2 volume to get more baseline IOPS

Answer

Move the database to a t3.large instance

Answer

Enable EBS optimization on the instance

Question 19

A company is setting up a disaster recovery (DR) site for SAP on AWS. They need to replicate the SAP HANA database to another region. Which AWS service is BEST suited for this?

Accepted Answer

SAP HANA System Replication. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for replicating HANA databases asynchronously or synchronously across regions. It replicates at the database level using log shipping and is the only option that maintains full SAP HANA consistency, transaction integrity, and support for takeover in a DR scenario.

Answer

AWS Backup cross-region copy

Answer

AWS Database Migration Service (DMS)

Answer

Amazon S3 Cross-Region Replication

Question 20

An SAP administrator is creating an IAM policy to allow SAP basis users to manage their own SAP EC2 instances. The policy above is intended to allow users to start, stop, and reboot instances tagged with their username. However, users report that they cannot start instances. What is the MOST likely reason?

Accepted Answer

The ec2:StartInstances action does not support resource-level permissions; it requires a separate condition or a wildcard resource.. The ec2:StartInstances action does not support resource-level permissions in IAM policies. This means that even if the policy specifies a condition based on tags, the condition is ignored for StartInstances, and the action will be denied unless the resource element is set to a wildcard ('*'). AWS documentation explicitly states that StartInstances, StopInstances, and RebootInstances require a wildcard resource or a separate condition to allow the action, making option D the correct answer.

Answer

The condition references ${aws:username} which is not available in the context.

Answer

The condition key ec2:ResourceTag/SAPSystem is not valid.

Answer

The actions are not correct for managing instances.