PAS-C01 Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. An SAP HANA system is running on an EC2 instance with the attached volumes shown. The HANA system requires high IOPS for its data volume. Which volume should be used for the HANA data directory?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vol-1a2b3c4d5e6f78901 (io1). The io1 volume is correct because SAP HANA's data directory demands consistently high IOPS, and io1 (Provisioned IOPS SSD) allows you to provision a specific IOPS level independent of volume size, which is essential for HANA's random read/write workload. gp3, while flexible, has a baseline of 3,000 IOPS and only scales IOPS separately up to 16,000, but for production HANA workloads requiring guaranteed high IOPS, io1 (or io2) is the AWS-recommended choice. Striping both volumes would mix a lower-performance gp3 into the data path, and instance store is ephemeral and not suitable for persistent HANA data.

Answer

Both volumes for striping

Answer

vol-0a1b2c3d4e5f67890 (gp3)

Answer

Neither volume; use instance store

Question 2

An SAP environment on AWS consists of several EC2 instances running SAP NetWeaver and a separate HANA database instance. The system is using an Application Load Balancer (ALB) to distribute traffic to the web dispatchers. Recently, the ALB health checks are failing for one of the web dispatchers, causing it to be taken out of service. You investigate and find that the web dispatcher is running and can be reached directly via its private IP. The health check is configured to check the /sap/public/health endpoint. What is the most likely reason for the health check failure?

Accepted Answer

The web dispatcher is configured to redirect HTTP requests to HTTPS, and the health check is using HTTP.. ALB health checks use the protocol configured on the target group. If the web dispatcher is configured to redirect HTTP to HTTPS (common in SAP NetWeaver setups), an HTTP health check to /sap/public/health receives a 301/302 redirect rather than a 200 OK, which the ALB treats as unhealthy. The fix is to configure the health check to use HTTPS or to allow the health endpoint to respond over HTTP without redirect.

Answer

The security group for the web dispatcher does not allow traffic from the ALB.

Answer

The web dispatcher instance is running out of memory, causing slow responses.

Answer

The web dispatcher has multiple IP addresses and the health check targets the wrong one.

Question 3

A company is deploying SAP S/4HANA on AWS and needs to choose the storage for the HANA data volume. Which EBS volume type provides the highest consistent IOPS for this workload?

Accepted Answer

EBS io2 Block Express. EBS io2 Block Express is designed for mission-critical applications like SAP HANA, offering the highest consistent IOPS of any EBS volume type, with up to 256,000 IOPS. Option B (gp3) provides baseline performance but lower maximum IOPS than io2 Block Express. Option C (io1) is an older provisioned IOPS type with lower maximum IOPS (up to 64,000) compared to io2 Block Express. Option D (st1) is throughput-optimized and not suitable for high IOPS workloads.

Answer

EBS gp3

Answer

EBS io1

Answer

EBS st1

Question 4

Which THREE factors should be considered when choosing an EC2 instance type for an SAP HANA production system? (Choose three.)

Accepted Answer

The instance type must be certified by SAP for HANA.. Option A is correct because SAP HANA production deployments on AWS require an instance type that appears on the SAP HANA Certified and Supported Amazon EC2 Instances list (e.g., the X1, X1e, R4, or High Memory families), since SAP only supports HANA on hardware that has passed its certification and benchmark (SAPS) testing. Option D is correct because HANA is an in-memory database, so the instance must have sufficient RAM to hold the entire database in memory (plus overhead for row/column stores and computation), making memory size the primary sizing factor. Option E is correct because HANA system replication, backup/restore, and client connectivity are network-intensive, so high network bandwidth (and low latency, e.g., via cluster placement groups and ENA) is needed for reliable replication and performance. Option B is not required because HANA data persistence is provided by EBS volumes (or FSx for SAP HANA), not instance store, which is ephemeral and would lose data on stop/termination. Option C is not required because HANA is a CPU/memory-bound in-memory database and does not use GPU acceleration for its core operations.

Answer

The instance type should include instance store volumes for data persistence.

Answer

The instance must include GPU acceleration for HANA operations.

Question 5

A company is running SAP HANA on EC2 instances with EBS volumes. They need to ensure data durability and backup. Which THREE actions should be taken?

Accepted Answer

Enable SAP HANA System Replication to a secondary instance.. SAP HANA System Replication provides synchronous or asynchronous data replication to a secondary EC2 instance, ensuring high availability and data durability by maintaining a real-time copy of the HANA database. This is a native SAP feature that protects against instance failure and supports automatic failover, which is critical for production HANA workloads.

Answer

Disable automated backups to reduce costs.

Answer

Use instance store volumes for HANA data.

Question 6

Refer to the exhibit. An administrator is trying to restore an SAP HANA backup from an S3 bucket but receives an AccessDenied error. The administrator has full EC2 and S3 permissions via an IAM role attached to the EC2 instance. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access from the instance's IAM role. The AccessDenied error persists despite the EC2 instance's IAM role having full EC2 and S3 permissions because an explicit Deny in the S3 bucket policy overrides any Allow granted by the IAM role. In AWS, an explicit Deny always takes precedence over an Allow, so the bucket policy is the most likely cause. The administrator's IAM role permissions are irrelevant if the bucket policy denies access.

Answer

The S3 bucket is in a different region than the EC2 instance

Answer

The backup file is encrypted with SSE-C and the key is not provided

Answer

The administrator used the wrong S3 command syntax

Question 7

A company is running SAP BusinessObjects on AWS. The application is deployed on EC2 instances with an Application Load Balancer. Users are reporting that the application is sometimes unreachable. What is the most likely cause?

Accepted Answer

The target group health checks are failing intermittently on the EC2 instances.. Intermittent unreachability of an application behind an Application Load Balancer (ALB) is most commonly caused by health checks failing on the target EC2 instances. When health checks fail intermittently, the ALB will periodically mark the instances as unhealthy and stop routing traffic to them, causing the application to become unreachable during those windows. This matches the symptom of 'sometimes unreachable' rather than a persistent failure.

Answer

The security group for the instances is not allowing traffic from the load balancer.

Answer

The load balancer is not configured with sticky sessions.

Answer

The Route 53 TTL is too short for DNS resolution.

Question 8

A company runs SAP HANA on AWS and uses AWS Systems Manager to automate patching of the operating system. After a recent patching cycle, the SAP HANA database failed to start. The administrator checked the logs and found that the HANA service was not starting due to a missing library dependency. What should the administrator do to prevent this issue in future patching cycles?

Accepted Answer

Test patches in a non-production environment and create a new AMI after successful validation. Testing patches in a non-production environment and then creating a golden AMI after validation ensures that any missing library dependencies are caught before production patching. This is the standard SAP-on-AWS best practice for change control, aligning with AWS Well-Architected and SAP's own guidance. It prevents the exact failure mode seen here by validating the full patch set against HANA before rollout.

Answer

Use AWS Systems Manager Patch Manager to apply patches but exclude the library in question

Answer

Create a script to reinstall the missing library after patching

Answer

Set up a maintenance window that stops HANA before patching and starts it after

Question 9

A company runs SAP S/4HANA on AWS. The system is deployed in a cluster across two Availability Zones using Pacemaker for high availability. The primary SAP HANA node fails, and the failover to the secondary node is successful. However, after failover, the application servers cannot connect to the database because the database IP address changed. The application servers are configured to use the IP address of the primary node. The company needs a solution that allows the application servers to connect to the active database node without reconfiguration after failover. Which solution should the company implement?

Accepted Answer

Deploy an internal Network Load Balancer (NLB) with a static IP and target the HANA nodes. An internal Network Load Balancer (NLB) provides a static private IP address that the application servers can use as the database endpoint. The NLB targets the HANA nodes, and its health checks automatically route traffic to the active node after failover, so no application reconfiguration is needed. This is the AWS-recommended pattern for SAP HANA high availability.

Answer

Use Amazon Route 53 DNS with a health check to point to the active node's IP

Answer

Associate an Elastic IP address to the active node using a script during failover

Answer

Configure a CNAME record in Route 53 that points to the primary node's DNS name

Question 10

A company is migrating a web application to AWS and wants to improve security. The application uses a classic three-tier architecture. Which TWO security measures should the company implement?

Accepted Answer

Use AWS WAF to protect the web tier. Option D is correct because AWS WAF is a web application firewall that filters and monitors HTTP(S) requests reaching the web tier, protecting against common exploits like SQL injection and cross-site scripting in a three-tier web application. Option E is correct because security groups act as stateful virtual firewalls at the instance/ENI level, and using them to allow only required traffic between the web, application, and database tiers enforces least-privilege segmentation. Option A is incorrect because exposing the database tier directly to the internet removes a critical layer of defense and violates the principle of keeping data stores in private subnets. Option B is incorrect because Amazon S3 Transfer Acceleration only speeds up uploads/downloads to S3 buckets and has no bearing on securing a three-tier application. Option C is incorrect because placing all tiers in public subnets exposes the application and database tiers to the internet, defeating network isolation.

Answer

Allow direct internet access to the database tier

Answer

Use Amazon S3 Transfer Acceleration

Answer

Place all tiers in public subnets

Question 11

An SAP system needs to store audit logs for 7 years to meet compliance requirements. The logs are accessed rarely. Which storage class is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest cost for long-term archival. Option A is incorrect because S3 Standard is for frequently accessed data. Option C is incorrect because S3 One Zone-IA is for infrequent access but not archival. Option D is incorrect because S3 Intelligent-Tiering incurs monitoring costs and is not as cost-effective for rarely accessed logs over 7 years.

Answer

Amazon S3 Standard

Answer

Amazon S3 One Zone-Infrequent Access

Answer

Amazon S3 Intelligent-Tiering

Question 12

An SAP system uses a Network Load Balancer (NLB) to distribute traffic to SAP application servers. The application servers are in private subnets. The operations team notices that the health checks are failing for one of the application servers. The health check is configured to use TCP on port 3200. The application server's security group allows inbound traffic on port 3200 from the NLB's subnet CIDR. The network ACL allows inbound and outbound traffic on ephemeral ports. What is the most likely cause of the health check failure?

Accepted Answer

The SAP application is not listening on port 3200.. The health check is a TCP check on port 3200. The security group allows inbound traffic from the NLB's subnet CIDR, and the network ACL allows ephemeral ports. The most likely cause is that the SAP application is not listening on port 3200. If the application is down or not bound to that port, the TCP handshake will fail, causing the health check to fail. The other options are less likely because the security group and network ACL configurations appear to permit the traffic, and the NLB uses private IP addresses for health checks, not public IPs.

Answer

The security group does not allow inbound traffic from the NLB's private IP addresses.

Answer

The network ACL is blocking the health check traffic.

Answer

The NLB is configured to use the instance's public IP address.

Question 13

An SAP administrator notices that the SAP application server is unable to establish an RFC connection to the SAP HANA database. The database is running on an EC2 instance in the same VPC. Security groups and NACLs allow all traffic. What is the most likely cause?

Accepted Answer

The application server is configured to connect to the wrong port number.. SAP application servers connect to SAP HANA using the SQL port, which by default is 3<instance_number>15 (for example, 30015 for instance 00). If the application server's connection string or profile points to the wrong port, the RFC/SQL connection will fail even though security groups and NACLs permit all traffic. Since the question states network ACLs and security groups allow all traffic and the instances are in the same VPC, the most likely cause is a misconfigured port number in the application server's connection parameters.

Answer

The VPC has overlapping CIDR blocks with the on-premises network.

Answer

The application server uses TCP instead of the required UDP protocol.

Answer

The HANA database instance was rebooted for maintenance.

Question 14

An SAP administrator is setting up a new SAP HANA system on AWS and needs to ensure that the system can recover from an Availability Zone failure. Which strategy should they implement for high availability?

Accepted Answer

Set up HANA System Replication across two Availability Zones. HANA System Replication (HSR) is the native SAP mechanism for achieving high availability across Availability Zones (AZs). By replicating data synchronously or synchronously in-memory to a standby instance in a different AZ, it ensures automatic failover with minimal data loss in the event of an AZ failure. This directly meets the requirement for recovery from an AZ failure without relying on storage-level or database-agnostic approaches.

Answer

Attach multiple Elastic Network Interfaces (ENIs) to the HANA instance

Answer

Configure the HANA database with Amazon RDS Multi-AZ

Answer

Take EBS snapshots every hour and restore in another AZ

Question 15

A company is migrating an SAP ERP system to AWS and needs to connect on-premises users to the SAP application securely. The SAP application is deployed in a VPC private subnet. Which service should be used to provide secure access for remote users?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed service that allows remote users to securely connect to AWS resources using OpenVPN-based VPN clients. Since the SAP application is in a private subnet, remote users need individual encrypted tunnels to access it, which Client VPN provides by authenticating users and routing traffic through a VPC endpoint.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect