PAS-C01 Practice Test 26 — 15 Questions

Question 1

An SAP system on AWS is experiencing performance degradation. The operations team suspects a network bottleneck. Which THREE metrics should they analyze in CloudWatch to diagnose the issue? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NetworkOut. NetworkOut (A) is correct because it measures the bytes leaving the EC2 instance, which directly reveals outbound bandwidth saturation or a bottleneck on the egress path affecting SAP application traffic. NetworkIn (D) is correct because it tracks bytes received by the instance, showing whether inbound traffic volume or a saturated receive path is degrading SAP performance. NetworkPacketsIn (B) is correct because packet-level ingress metrics expose issues such as packet storms, high PPS load, or dropped/retransmitted traffic that byte-level counters can mask. CPUUtilization (C) is not a network metric and would only indicate compute contention, while DiskReadOps (E) reflects EBS storage read activity, so neither belongs in a network-bottleneck diagnosis.

Answer

CPUUtilization

Answer

DiskReadOps

Question 2

A company is planning to migrate its SAP environment to AWS. They have multiple SAP systems that are interconnected. Which migration approach is recommended to minimize dependency issues?

Accepted Answer

Migrate systems in logical groups that have dependencies on each other. Migrating SAP systems in logical groups that share dependencies minimizes issues because interdependent systems (e.g., ECC, BW, PI/PO) must be migrated together to maintain integration and data consistency. This approach ensures that cross-system interfaces, RFC connections, and batch jobs continue to function without disruption. It also allows for coordinated testing and cutover, reducing the risk of broken dependencies.

Answer

Migrate systems based on business process priority, ignoring technical dependencies

Answer

Migrate systems individually based on size, starting with the smallest

Answer

Migrate all systems at the same time in a big bang approach

Question 3

A company is planning to migrate its SAP workloads to AWS. Which THREE AWS services are commonly used to set up a secure network connectivity between on-premises and AWS? (Choose THREE.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (A) is correct because it acts as a central hub that connects on-premises networks (via VPN or Direct Connect attachments) to multiple VPCs, simplifying and securing hybrid SAP connectivity at scale. AWS Site-to-Site VPN (B) is correct because it establishes an encrypted IPsec tunnel over the internet between the on-premises customer gateway and an AWS virtual private gateway or Transit Gateway, providing secure hybrid connectivity. AWS Direct Connect (C) is correct because it provides a dedicated, private physical network connection from on-premises to AWS, offering consistent low-latency, high-bandwidth connectivity often required for latency-sensitive SAP workloads. VPC Peering (D) is not correct here because it only connects VPCs to each other within AWS and does not provide on-premises-to-AWS connectivity. AWS Client VPN (E) is not correct because it is a managed remote-access VPN for individual users/endpoints, not for site-to-site connectivity between a corporate data center and AWS.

Answer

VPC Peering

Answer

AWS Client VPN

Question 4

An organization uses AWS Systems Manager to run automation documents on their SAP EC2 instances. Recently, some automation runbooks have failed because the EC2 instances did not have the required SSM Agent version. The operations team wants to ensure all existing and future instances automatically have the latest SSM Agent. Which solution meets this requirement?

Accepted Answer

Create an AWS Systems Manager State Manager association that runs the AWS-UpdateSSMAgent document on the instances.. AWS Systems Manager State Manager can enforce a desired state configuration on EC2 instances. By creating an association that runs the `AWS-UpdateSSMAgent` document on a schedule, State Manager ensures that both existing and future instances (when configured with the appropriate instance profile and tags) automatically update to the latest SSM Agent version, regardless of the instance's lifecycle.

Answer

Use an automation document to update the SSM Agent and schedule it via a cron job on each instance.

Answer

Enable the 'Auto-update SSM Agent' option in the EC2 launch settings for all instances.

Answer

Configure AWS Systems Manager Patch Manager to update the SSM Agent.

Question 5

Which THREE of the following are valid options for high availability of SAP HANA on AWS? (Choose THREE.)

Accepted Answer

Storage replication using NetApp Cloud Volumes ONTAP.. Option A is correct because NetApp Cloud Volumes ONTAP provides block-level storage replication (SnapMirror) that can be used to maintain a synchronized copy of SAP HANA data and enable recovery or takeover on AWS, making it a valid HA approach. Option B is correct because HANA System Replication (HSR) combined with automatic failover using an AWS Elastic IP or Route 53 DNS failover is a recognized high-availability pattern on AWS, where the overlay IP or DNS record is moved to the secondary node. Option E is correct because HANA System Replication with manual failover is also a valid HA configuration; HSR itself provides the replication, and failover can be triggered manually (e.g., via hdbnsutil -sr_takeover) rather than automatically. Option C is not correct in this context because asynchronous replication to a secondary region is a disaster-recovery (DR) strategy, not a high-availability option within a region. Option D is not correct because Amazon RDS Multi-AZ is a managed relational database service for engines like MySQL, PostgreSQL, SQL Server, and Oracle, and it does not support SAP HANA.

Answer

SAP HANA replication to a secondary region with asynchronous replication.

Answer

Amazon RDS Multi-AZ for HANA.

Question 6

Which THREE actions should be taken to ensure a secure and compliant SAP environment on AWS? (Choose 3)

Accepted Answer

Restrict IAM permissions to only necessary actions. Option B is correct because applying least-privilege IAM policies ensures SAP administrators and services only receive the specific AWS API permissions they need, reducing the blast radius of compromised credentials and supporting compliance controls such as segregation of duties. Option C is correct because security groups act as stateful virtual firewalls at the ENI level, allowing you to restrict inbound and outbound traffic to only the required SAP ports and trusted sources, such as SAP GUI (3200/3300), SAP HANA (30013/30015), and RFC (3300), which is essential for a secure SAP landscape. Option D is correct because enabling encryption on EBS volumes and RDS instances protects SAP data at rest using AWS KMS-managed keys, satisfying compliance requirements like GDPR, HIPAA, and PCI DSS that mandate encryption of sensitive data. Option A is not appropriate because placing SAP servers in a public subnet exposes them directly to the internet and increases the attack surface; SAP systems should reside in private subnets behind load balancers or bastion hosts. Option E is not appropriate because storing application logs in Amazon S3 with public read access would expose potentially sensitive SAP data to anyone, violating confidentiality and compliance requirements; logs should be stored in private, encrypted buckets with restricted access.

Answer

Place all SAP servers in a public subnet for easy access

Answer

Store all application logs in Amazon S3 with public read access

Question 7

Which AWS service can be used to monitor the performance of SAP HANA databases running on EC2 instances?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the primary AWS service for monitoring the performance of SAP HANA databases on EC2. It can collect custom metrics such as CPU utilization, memory usage, disk I/O, and SAP HANA-specific metrics (e.g., row store memory, column store memory) via the CloudWatch agent or monitoring scripts. The other listed services (Inspector, RDS Performance Insights, X-Ray, Config) are not designed for or capable of directly monitoring self-managed SAP HANA database performance on EC2.

Answer

Amazon Inspector

Answer

Amazon RDS Performance Insights

Answer

AWS X-Ray

Answer

AWS Config

Question 8

A company runs SAP ERP on AWS with a Sybase ASE database. The database is on an EC2 instance with a single 500 GB gp2 EBS volume. The volume shows 100% credit balance consumption frequently, causing I/O throttling. What should the company do to resolve the throttling?

Accepted Answer

Migrate the volume to gp3 with appropriate IOPS and throughput settings.. The gp2 volume's credit balance is fully consumed because the workload's sustained I/O demand exceeds the baseline performance of 500 GB gp2 (1,500 IOPS). Migrating to gp3 (option B) eliminates the credit-bucket model entirely, providing a baseline of 3,000 IOPS and 125 MiB/s throughput regardless of volume size, with the ability to provision higher IOPS and throughput independently without relying on burst credits.

Answer

Increase the gp2 volume size to 1,000 GB to gain more I/O credits.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Move the database to Amazon RDS for Sybase ASE.

Question 9

A company is migrating an SAP Business Suite system to AWS. The current on-premises system uses Oracle Database with Automatic Storage Management (ASM). The target database on AWS will be SAP HANA. Which migration strategy minimizes data conversion efforts?

Accepted Answer

Use the SAP HANA Database Migration Option (DMO) with SUM. The SAP HANA Database Migration Option (DMO) with SUM is the correct choice because it is specifically designed for migrating to SAP HANA, handling both data and schema conversion automatically, minimizing manual effort. Option A is incorrect because although AWS DMS supports SAP HANA as a target, it is not the optimal tool for SAP system migration due to the lack of integrated SAP-specific schema and data conversion capabilities. Option B is incorrect because SAP Landscape Transformation (SLT) is primarily for real-time data replication and does not provide the same level of integrated conversion. Option D is incorrect because export/import requires significant manual data conversion and transformation, increasing effort and risk.

Answer

Use AWS Database Migration Service (DMS) with Oracle as source and HANA as target

Answer

Use SAP Landscape Transformation (SLT) for real-time data replication

Answer

Perform an export/import of the Oracle database and import into HANA

Question 10

Which THREE steps should be taken to monitor the performance of an SAP HANA database on AWS? (Choose 3).

Accepted Answer

Install the CloudWatch agent on the EC2 instance to collect memory and disk metrics.. Option A is correct because installing the CloudWatch agent on the EC2 instance enables the collection of guest-level OS metrics such as memory utilization and disk usage, which are not available by default from the hypervisor and are essential for monitoring SAP HANA performance. Option D is correct because SAP HANA is heavily I/O dependent, and monitoring EBS volume queue length and IOPS via CloudWatch helps detect storage bottlenecks that directly affect HANA throughput and response times. Option E is correct because configuring CloudWatch alarms on SAP HANA metrics such as CPU and memory usage provides proactive notification when thresholds are breached, allowing timely remediation before performance degrades. Option B is not appropriate because AWS Direct Connect is a dedicated network connectivity service, not a monitoring tool for network latency, and it is unrelated to HANA performance monitoring. Option C is not appropriate because AWS CloudTrail records AWS API activity for auditing and governance, not database-level performance metrics of SAP HANA.

Answer

Set up AWS Direct Connect to monitor network latency.

Answer

Enable AWS CloudTrail to track all API calls to the HANA database.

Question 11

An SAP administrator is designing a backup strategy for an SAP HANA database on AWS. They want to use the Backint interface with Amazon S3. Which THREE components are required? (Choose three.)

Accepted Answer

IAM role with permissions to write to the S3 bucket. Option B is correct because the AWS Backint Agent running on the SAP HANA instance must authenticate to AWS and requires an IAM role (or credentials) granting s3:PutObject and related permissions to write backup data into the target bucket. Option C is correct because the AWS Backint Agent for SAP HANA is the software component that implements SAP's Backint API, translating HANA backup and recovery calls into Amazon S3 API operations. Option E is correct because the backups themselves are stored as objects in an S3 bucket, which is the destination the Backint Agent writes to and reads from during recovery. Option A is not required because the backup catalog is maintained by SAP HANA itself (in the database and its own storage), not on dedicated EBS volumes for this S3-based Backint design. Option D is not required because S3 Transfer Acceleration is an optional performance feature for speeding up uploads over long distances, not a prerequisite for using Backint with Amazon S3.

Answer

EBS volumes for the backup catalog

Answer

S3 Transfer Acceleration enabled

Question 12

Which THREE steps should be taken when recovering an SAP system from an EBS snapshot? (Choose 3.)

Accepted Answer

Attach the new volume to the EC2 instance. Option E is correct because recovery from an EBS snapshot requires first creating a new EBS volume from that snapshot, since a snapshot itself cannot be directly attached or mounted. Option A is correct because the newly created EBS volume must be attached to the EC2 instance (using the appropriate device name, e.g., /dev/xvdf or /dev/sdf) so the instance can access the recovered data. Option C is correct because after attachment, the volume must be mounted on the appropriate mount point (e.g., /usr/sap or /oracle) so the SAP system can use the restored file systems. Option B is not needed because the existing EC2 instance is typically retained and reused during snapshot recovery rather than terminated. Option D is not relevant because S3 bucket reconfiguration is unrelated to restoring an SAP system from an EBS snapshot.

Answer

Terminate the existing EC2 instance

Answer

Reconfigure the S3 bucket for backup storage

Question 13

A company is designing a new SAP S/4HANA workload on AWS. Which storage service should be used for the SAP HANA data volume to meet the required throughput and latency for production systems?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the correct choice for SAP HANA data volumes because they provide sub-millisecond latency and up to 256,000 IOPS per volume with 99.999% durability, meeting the strict throughput and latency requirements of SAP HANA production systems. SAP specifically certifies io2 Block Express for SAP HANA data volumes on AWS, ensuring consistent performance for mission-critical workloads.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon EBS gp3 volumes

Question 14

A company is running SAP HANA on an r5.8xlarge instance. They want to scale up to meet increased memory requirements. Which instance family would be the MOST suitable for a scale-up scenario?

Accepted Answer

x1e.32xlarge. The x1e.32xlarge instance is part of the X1e family, which is specifically designed for high-memory workloads like SAP HANA. With 3,904 GiB of memory, it provides the largest memory capacity among AWS instances, making it the most suitable for scaling up SAP HANA to meet increased memory requirements. SAP HANA is an in-memory database, so scaling up requires instances with high memory-to-vCPU ratios, which the X1e family delivers.

Answer

r5.24xlarge

Answer

i3.16xlarge

Answer

c5.18xlarge

Question 15

A company is running SAP on AWS and wants to automate the installation of SAP applications using infrastructure as code. Which AWS service should be used to define the infrastructure?

Accepted Answer

AWS CloudFormation. AWS CloudFormation allows defining infrastructure as code. Option A is wrong because OpsWorks is for Chef/Puppet. Option B is wrong because CodeDeploy is for application deployment, not infrastructure. Option C is wrong because Elastic Beanstalk is for web applications, not infrastructure.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk