PAS-C01 Practice Test 2 — 30 Questions

Question 1

A company is migrating its SAP environment to AWS and wants to use SAP HANA as a Service on AWS (HANA database on AWS). The SAP application tier will run on EC2 instances behind an Application Load Balancer. The company requires high availability for the database with automatic failover in case of an AZ failure. Which architecture should the company implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up HANA System Replication between two EC2 instances in different AZs with automatic failover.. HANA System Replication configured between two EC2 instances in different Availability Zones (AZs) with automatic failover ensures high availability and resilience against an AZ failure. Option A is incorrect because replicating HANA to Amazon S3 is meant for backups and point-in-time recovery, not for real-time automatic failover. Option C is incorrect because synchronous replication within the same AZ does not protect against an AZ failure; it only provides protection against instance or host failure. Option D is incorrect because a single HANA database instance in one AZ, even with regular backups to S3, cannot provide automatic failover if the AZ fails; it would require manual recovery.

Answer

Configure HANA replication to Amazon S3 for point-in-time recovery.

Answer

Use HANA System Replication with a synchronous secondary in the same AZ.

Answer

Deploy a single HANA database on a large EC2 instance in one AZ with regular backups to S3.

Question 2

A company is migrating its SAP ERP system from an on-premises environment to AWS. The database is SAP HANA. The migration must minimize downtime. Which TWO approaches should the company consider?

Accepted Answer

Use AWS DMS with full load and ongoing change data capture (CDC).. AWS DMS with full load and ongoing change data capture (CDC) enables a near-zero-downtime migration by continuously replicating changes from the source SAP HANA database to the target on AWS after the initial full load, allowing the cutover to occur with minimal disruption. Option E is correct because SAP HANA System Replication provides a native, asynchronous or synchronous replication mechanism that can be configured between the on-premises HANA database and an AWS-hosted HANA instance, supporting a controlled switchover with very low downtime.

Answer

Use AWS Database Migration Service (DMS) with full load only.

Answer

Use VM Import/Export to migrate the entire on-premises virtual machine to AWS.

Answer

Use the SAP Software Provisioning Manager (SWPM) to perform a homogeneous system copy over the network.

Question 3

An SAP administrator needs to provide temporary, time-limited access to an S3 bucket containing SAP backup files for an external auditor. The auditor should be able to download files from the bucket. Which method provides the most secure way to grant access?

Accepted Answer

Generate a presigned URL for each file the auditor needs to download.. Presigned URLs grant temporary, time-limited access to specific S3 objects without requiring the auditor to have AWS credentials or any permanent permissions. The SAP administrator can generate a presigned URL for each backup file, set an expiration time, and share the URL with the auditor, who can then download the file using standard HTTP GET requests. This approach follows the principle of least privilege and ensures access is revoked automatically after the URL expires.

Answer

Create an IAM user with read-only access to the bucket and share the credentials with the auditor.

Answer

Provide the auditor with the root user credentials of the AWS account.

Answer

Make the bucket publicly readable and share the bucket URL.

Question 4

An organization uses AWS Systems Manager to run automation documents on their SAP EC2 instances. Recently, some automation runbooks have failed because the EC2 instances did not have the required SSM Agent version. The operations team wants to ensure all existing and future instances automatically have the latest SSM Agent. Which solution meets this requirement?

Accepted Answer

Create an AWS Systems Manager State Manager association that runs the AWS-UpdateSSMAgent document on the instances.. AWS Systems Manager State Manager can enforce a desired state configuration on EC2 instances. By creating an association that runs the `AWS-UpdateSSMAgent` document on a schedule, State Manager ensures that both existing and future instances (when configured with the appropriate instance profile and tags) automatically update to the latest SSM Agent version, regardless of the instance's lifecycle.

Answer

Use an automation document to update the SSM Agent and schedule it via a cron job on each instance.

Answer

Enable the 'Auto-update SSM Agent' option in the EC2 launch settings for all instances.

Answer

Configure AWS Systems Manager Patch Manager to update the SSM Agent.

Question 5

Which THREE of the following are best practices for securing an SAP system on AWS? (Choose THREE.)

Accepted Answer

Enable CloudTrail to log API calls for auditing. AWS CloudTrail records all API calls made to the AWS environment, including those that modify SAP infrastructure (e.g., EC2 instance launches, security group changes). Enabling CloudTrail provides an immutable audit log that is essential for compliance, security incident investigation, and operational troubleshooting in an SAP landscape. This aligns with the AWS shared responsibility model, where customers must log and monitor actions taken on their SAP workloads.

Answer

Use the same security group for all SAP instances

Answer

Store SAP license keys in a public S3 bucket

Question 6

A company wants to migrate its on-premises SAP system to AWS. The system consists of an SAP NetWeaver application server and an SAP HANA database. The database requires ultra-low latency storage. Which AWS storage solution is most suitable for the SAP HANA data volume?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the most suitable storage solution for SAP HANA data volumes because they provide ultra-low latency, high durability, and up to 256,000 IOPS per volume with sub-millisecond latency. This meets the stringent performance requirements of SAP HANA, which demands consistent, low-latency storage for its in-memory database operations. io2 Block Express is certified by SAP for production HANA workloads on AWS.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EFS file system

Question 7

Which TWO of the following are required components for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared? (Choose two.)

Accepted Answer

Amazon EFS file system. Amazon EFS is required for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared because it provides a fully managed, POSIX-compliant NFS file system that can be mounted concurrently across multiple EC2 instances. SAP HANA scale-out nodes require a shared file system for /hana/shared to exchange configuration and log data, and EFS supports the necessary NFSv4 protocol with the required throughput and latency characteristics for this workload.

Answer

EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 8

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance. The EC2 instance has an Elastic IP address of 203.0.113.5 and is running in a VPC with CIDR 10.0.0.0/16. When the application on the instance tries to upload an object to the S3 bucket 'my-bucket', it receives an Access Denied error. What is the MOST likely cause?

Accepted Answer

The condition checks the source IP address, but the EC2 instance uses a private IP address within the VPC when communicating with S3 via a VPC endpoint.. The IAM policy condition likely includes an `aws:SourceIp` condition that allows only the Elastic IP address (203.0.113.5). However, when the EC2 instance communicates with S3 via a VPC endpoint, traffic uses a private IP from the VPC CIDR (10.0.0.0/16) as the source IP, not the Elastic IP. This mismatch causes the condition to evaluate to False, resulting in Access Denied.

Answer

The policy does not allow the s3:PutObject action.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket without the asterisk.

Answer

The policy is missing a Deny statement for other IP addresses.

Question 9

An SAP administrator notices that the SAP HANA database is running out of disk space on the /hana/data volume. The volume is an EBS gp3 volume with 2000 GB size. The administrator wants to increase the size without downtime. Which action should be taken?

Accepted Answer

Use the modify-volume API to increase the size of the existing volume. AWS EBS gp3 volumes support online resizing via the modify-volume API without requiring downtime. The SAP HANA /hana/data volume can be increased in size while the instance remains running, as EBS volumes can be modified dynamically. After the modification, the administrator must extend the file system to recognize the new space, but no volume detachment or data migration is needed.

Answer

Detach the volume, create a snapshot, create a larger volume from the snapshot, and attach it

Answer

Create a new larger volume and copy data using rsync

Answer

Increase the IOPS of the volume to improve performance

Question 10

An SAP administrator is troubleshooting a performance issue on an SAP NetWeaver system running on AWS. The system uses an Oracle database. The CPU utilization of the database server is consistently below 30%, but application response times are slow. Which THREE checks should the administrator perform to identify the bottleneck?

Accepted Answer

Use Amazon CloudWatch metrics to check network throughput and latency between the application and database servers.. High network latency or insufficient throughput between the application and database servers can cause slow response times even when CPU utilization is low. Amazon CloudWatch metrics such as NetworkIn, NetworkOut, and NetworkPacketsIn/Out can reveal congestion or bandwidth saturation, which is a common bottleneck in SAP NetWeaver deployments on AWS.

Answer

Increase the number of CPU cores on the database server.

Answer

Enable Amazon EBS Elastic Volumes to increase volume size dynamically.

Question 11

An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?

Accepted Answer

The policy does not include the ec2:CreateTags action.. The IAM policy explicitly grants ec2:StartInstances and ec2:StopInstances actions but does not include ec2:CreateTags. Without the ec2:CreateTags action, the user lacks the required permission to create or modify tags on EC2 instances, even though they can start and stop them.

Answer

The user does not have permission to describe instances.

Answer

The resource ARN is too restrictive.

Answer

There is an implicit deny for all actions not listed.

Question 12

A company is migrating a legacy on-premises Oracle database to Amazon RDS for Oracle. They need to minimize downtime. Which AWS service should they use for ongoing replication during the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) with ongoing replication (change data capture) allows near-zero downtime migration. Option A (AWS Schema Conversion Tool) is wrong because it is a schema conversion tool, not a replication service. Option B (AWS Server Migration Service) is wrong because it is for server migration, not database replication. Option D (AWS DataSync) is wrong because it is for file/object storage, not database replication.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Question 13

A company is experiencing performance issues with their SAP ERP system on AWS. The system is running on an r5.4xlarge EC2 instance with gp2 EBS volumes. The database is SAP HANA. CloudWatch metrics show high write latency on the data volume. Which change would most likely improve performance?

Accepted Answer

Change the volume type to io2 Block Express. SAP HANA is highly sensitive to storage latency, and the high write latency on the data volume indicates that gp2's burst model is insufficient for sustained write workloads. io2 Block Express provides consistent, sub-millisecond latency with provisioned IOPS up to 256,000, which directly addresses the performance bottleneck. This change aligns with AWS best practices for SAP HANA production workloads, which recommend io2 volumes for data and log volumes.

Answer

Increase the size of the gp2 volume to get more baseline IOPS

Answer

Move the database to a t3.large instance

Answer

Enable EBS optimization on the instance

Question 14

A company is setting up a disaster recovery (DR) site for SAP on AWS. They need to replicate the SAP HANA database to another region. Which AWS service is BEST suited for this?

Accepted Answer

SAP HANA System Replication. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for replicating HANA databases asynchronously or synchronously across regions. It replicates at the database level using log shipping and is the only option that maintains full SAP HANA consistency, transaction integrity, and support for takeover in a DR scenario.

Answer

AWS Backup cross-region copy

Answer

AWS Database Migration Service (DMS)

Answer

Amazon S3 Cross-Region Replication

Question 15

An SAP administrator is creating an IAM policy to allow SAP basis users to manage their own SAP EC2 instances. The policy above is intended to allow users to start, stop, and reboot instances tagged with their username. However, users report that they cannot start instances. What is the MOST likely reason?

Accepted Answer

The ec2:StartInstances action does not support resource-level permissions; it requires a separate condition or a wildcard resource.. The ec2:StartInstances action does not support resource-level permissions in IAM policies. This means that even if the policy specifies a condition based on tags, the condition is ignored for StartInstances, and the action will be denied unless the resource element is set to a wildcard ('*'). AWS documentation explicitly states that StartInstances, StopInstances, and RebootInstances require a wildcard resource or a separate condition to allow the action, making option D the correct answer.

Answer

The condition references ${aws:username} which is not available in the context.

Answer

The condition key ec2:ResourceTag/SAPSystem is not valid.

Answer

The actions are not correct for managing instances.

Question 16

Drag and drop the steps to configure an SAP S/4HANA high-availability cluster using AWS Resilience Hub into the correct order.

Accepted Answer

1. Define the application stack in Resilience Hub. 2. Associate a resilience policy and run an assessment. 3. Implement the recommended changes (e.g., configure HA cluster). 4. Validate the configuration with a test and monitor using Resilience Hub.. Resilience Hub helps assess and improve HA by defining stack, assessing policy, implementing changes, testing, and monitoring.

Answer

1. Define the application stack. 2. Implement recommended changes. 3. Associate a resilience policy and run an assessment. 4. Validate and monitor.

Answer

1. Associate a resilience policy and run an assessment. 2. Define the application stack. 3. Implement recommended changes. 4. Validate and monitor.

Answer

1. Define the application stack. 2. Associate a resilience policy and run an assessment. 3. Validate and monitor. 4. Implement recommended changes.

Question 17

A company is running a critical web application on EC2 instances behind an Application Load Balancer. During a recent deployment, a new version of the application was released, and within minutes, the error rate spiked. The operations team rolled back the deployment, but the error rate remained high. The team suspects that the ALB is still routing traffic to unhealthy instances. Which step should the team take to immediately stop routing traffic to the problematic instances?

Accepted Answer

Deregister the instances from the target group.. Deregistering the problematic EC2 instances from the target group immediately stops the Application Load Balancer from routing any new traffic to them. The ALB performs health checks on registered targets, but if an instance is unhealthy, it still remains in the target group and can receive traffic if the health check logic is misconfigured or if the instance is in a 'draining' state. Deregistration forces the ALB to complete any in-flight requests and then remove the instance from the routing table, providing an immediate stop to traffic.

Answer

Modify the ALB listener rules to point to a different target group.

Answer

Modify the health check interval to 5 seconds and the unhealthy threshold to 2.

Answer

Stop the EC2 instances from the AWS Management Console.

Question 18

Which TWO of the following are required for SAP HANA high availability on AWS using HANA System Replication (HSR) with automatic failover? (Select TWO.)

Accepted Answer

An Amazon Route 53 health check that monitors the primary instance and updates a DNS record to the secondary IP on failure.. Amazon Route 53 health checks can monitor the primary HANA instance's availability. On failure, a Route 53 failover routing policy automatically updates the DNS record to point to the secondary instance's private IP, enabling clients to reconnect without manual intervention. This is a key component of HANA System Replication (HSR) with automatic failover on AWS.

Answer

Application Auto Scaling to automatically scale HANA instances.

Answer

An Elastic Load Balancer (ELB) in front of the HANA instances to distribute traffic.

Answer

An Amazon Route 53 alias record pointing to the primary instance's private IP.

Question 19

A company runs its SAP ERP system on AWS. The database is SAP HANA on an EC2 instance. The system is critical and requires a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 2 hours. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) to perform continuous backups to S3.. AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) provides continuous, incremental backups to Amazon S3, achieving an RPO of less than 5 minutes with automated, policy-driven backups. This solution minimizes operational overhead by eliminating manual scripting and infrastructure management, while supporting point-in-time recovery within the required RTO of under 2 hours.

Answer

Use EBS snapshots of the root and data volumes taken every 5 minutes.

Answer

Set up HANA system replication across two EC2 instances in different Availability Zones with manual failover.

Answer

Schedule manual HANA backups to S3 using cron scripts and hdbsql commands.

Question 20

Which THREE actions should be taken to ensure minimal downtime during an SAP system migration to AWS using SAP HSR (HANA System Replication)?

Accepted Answer

Perform a takeover to the target system to finalize migration.. To minimize downtime during an SAP HANA migration to AWS using HSR, it is critical to replicate data in advance. Pre-provisioning the target HANA instance on AWS ensures the infrastructure is ready (C). Configuring HANA System Replication between source and target enables ongoing data synchronization (E). Performing a takeover to the target system finalizes the migration with a quick cutover, minimizing downtime (B). Disabling backups on the source (A) is risky and does not reduce downtime, and manually copying data files (D) is unnecessary because HSR handles the replication.

Answer

Disable backups on the source system to reduce load.

Answer

Manually copy data files to AWS before starting replication.