PAS-C01 Practice Test 32 — 15 Questions

Question 1

A company is running SAP Business Suite on AWS and wants to improve the disaster recovery posture by replicating data to another AWS Region. The solution must have a recovery time objective (RTO) of less than 15 minutes and a recovery point objective (RPO) of less than 5 minutes. Which approach should they take?

Accepted Answer

Configure SAP HANA system replication with synchronous mode.. Option D is correct because SAP HANA system replication with synchronous mode provides near-zero RPO and automatic failover in minutes. Option A is wrong because EBS snapshots have higher RPO (scheduled). Option B is wrong because cross-Region replication of S3 is slower. Option C is wrong because Database Migration Service is for migrations, not real-time replication.

Answer

Use AWS Database Migration Service for continuous replication.

Answer

Use Amazon S3 cross-Region replication for transaction logs.

Answer

Use AWS Backup to create cross-Region EBS snapshots every 5 minutes.

Question 2

A company runs its SAP S/4HANA system on AWS using a multi-node HANA scale-out configuration. After a recent OS update, the application layer cannot connect to the HANA database. The HANA database processes are running, but the SAP application servers report 'communication failure' errors. Initial checks show that the security group rules allow traffic on the required ports. What is the MOST likely cause of the issue?

Accepted Answer

The OS update has reset the iptables firewall rules, blocking internal HANA ports.. Option D is correct because after OS updates, the firewall (iptables) rules may be reset or changed, blocking HANA internal communication even if security groups are correct. Option A (incorrect SAP license) would cause license errors, not communication failure. Option B (incorrect DNS resolution) is possible but less likely if hostnames are in /etc/hosts. Option C (NTP synchronization) would affect time, not connectivity.

Answer

The DNS resolution is misconfigured after the OS update, causing hostname lookup failures.

Answer

The NTP synchronization is off, causing time drift and authentication errors.

Answer

The SAP system is not correctly licensed for the new OS version.

Question 3

An SAP administrator created the IAM policy shown in the exhibit. When trying to terminate an EC2 instance with ID i-abc123 in us-west-2, the action fails. What is the reason?

Accepted Answer

The ec2:TerminateInstances action is restricted to instances in us-east-1 only.. Option B is correct because the TerminateInstances action is restricted to a specific resource ARN that includes the region us-east-1 and account 123456789012. The instance i-abc123 in us-west-2 does not match that ARN, so the action is denied. Option A is incorrect because StartInstances and StopInstances are allowed on all resources. Option C is incorrect because the condition key is not used. Option D is incorrect because the policy does not have a Deny effect.

Answer

There is an implicit Deny for all actions not explicitly allowed.

Answer

The policy is missing a condition key to allow termination in us-west-2.

Answer

The ec2:StartInstances and ec2:StopInstances actions are not granted for the specific instance.

Question 4

An SAP administrator attaches this IAM policy to a user. Which action will the user be allowed to perform on an EC2 instance with the tag 'Environment: Production'?

Accepted Answer

Reboot the instance. Option A is correct because the policy allows StartInstances, StopInstances, and RebootInstances on instances with the tag Environment=Production. TerminateInstances is denied. B and C are denied. D is allowed but not listed in the options; however, only reboot is correct among the given.

Answer

Start the instance

Answer

Terminate the instance

Answer

Modify the instance type

Question 5

A company migrates its SAP HANA database to an EC2 instance with 1 TB of memory. The system is used for both OLTP and OLAP workloads. The performance team notices that memory utilization is high but the CPU is underutilized. Which configuration change would best improve overall system throughput?

Accepted Answer

Enable HANA Large Pages to reduce TLB misses and improve memory access. Option C is correct because enabling HANA Large Pages improves memory management and CPU efficiency for large workloads. Option A is incorrect because increasing swap would degrade performance. Option B is incorrect because disabling HANA compression increases memory usage. Option D is incorrect because using smaller instances would not help.

Answer

Use a smaller instance type with higher CPU to memory ratio

Answer

Increase the swap space on the instance store volumes

Answer

Disable HANA compression to reduce CPU overhead

Question 6

An SAP administrator needs to ensure that Amazon EBS snapshots of SAP HANA data volumes are crash-consistent. The HANA database is on a single EC2 instance with multiple EBS volumes. What is the correct approach?

Accepted Answer

Use AWS Backup with application-consistent snapshots using pre- and post-scripts.. Option D is correct because the AWS Backup service can create application-consistent snapshots using pre- and post-scripts to quiesce the filesystem and database. Option A (Take snapshots individually) may result in inconsistent data if writes occur between snapshots. Option B (Stop the instance) causes downtime. Option C (Use RAID 0) does not guarantee consistency across volumes.

Answer

Configure the volumes as a RAID 0 array and take a snapshot of the array.

Answer

Take snapshots of each volume individually while the instance is running.

Answer

Stop the EC2 instance, take snapshots of all volumes, then start the instance.

Question 7

A company running SAP on AWS needs to back up their SAP HANA database daily with point-in-time recovery. Which service should they use to achieve this with minimal operational overhead?

Accepted Answer

AWS Backup with the SAP HANA backup plan.. Option C is correct because AWS Backup supports SAP HANA with automated backups and point-in-time recovery. Option A is wrong because snapshots alone do not provide point-in-time recovery. Option B is wrong because S3 is object storage, not a backup service. Option D is wrong because RDS does not support SAP HANA.

Answer

Amazon RDS automated backups.

Answer

Amazon EBS snapshots via a script.

Answer

Amazon S3 with lifecycle policies.

Question 8

An SAP system administrator notices that an SAP S/4HANA system on AWS is experiencing high network latency between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. What is the most effective way to reduce latency?

Accepted Answer

Launch both instances in the same placement group and enable EBS optimization.. Option D is correct because using an EBS-optimized instance with dedicated network bandwidth and placement groups reduces latency and improves throughput. Option A is wrong because adding more ENIs increases complexity without guaranteed latency reduction. Option B is wrong because VPC peering is for cross-VPC communication, not within the same VPC. Option C is wrong because AWS Global Accelerator is for global traffic, not intra-VPC.

Answer

Set up VPC peering between the two subnets.

Answer

Deploy AWS Global Accelerator to optimize the traffic path.

Answer

Add multiple Elastic Network Interfaces (ENIs) to the instances.

Question 9

The above IAM policy is attached to a role named CrossAccountBackupRole in account 123456789012. What does this policy enable?

Accepted Answer

The SAPAdminRole can assume the CrossAccountBackupRole.. Option D is correct. This is a trust policy that allows the SAPAdminRole to assume the CrossAccountBackupRole. Option A is wrong because it's not a permissions policy for S3. Option B is wrong because it allows cross-account access, not blocking. Option C is wrong because it does not grant direct S3 access; only allows sts:AssumeRole.

Answer

The SAPAdminRole directly receives permissions to access S3.

Answer

The CrossAccountBackupRole can be assumed by any IAM user.

Answer

The SAPAdminRole can list S3 buckets in account 123456789012.

Question 10

A company is migrating its SAP landscape to AWS and wants to ensure that all SAP systems can communicate with each other using private IP addresses only. The systems are deployed in multiple VPCs. Which AWS solution should be used to enable private connectivity between these VPCs?

Accepted Answer

VPC Peering.. Option B is correct because VPC Peering allows direct private IP connectivity between VPCs. Option A (VPN) is used for on-premises to VPC. Option C (Direct Connect) is for dedicated connection to on-premises. Option D (VPC Endpoint) is for accessing AWS services privately.

Answer

VPC Endpoints.

Answer

AWS Site-to-Site VPN.

Answer

AWS Direct Connect.

Question 11

A company is migrating its SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS/ERS) instance. The solution must support automatic failover in case of an instance failure. Which AWS service should be used to manage the floating IP address required for the SAP high availability setup?

Accepted Answer

Amazon Route 53. Amazon Route 53 with health checks and failover routing can be used to manage a DNS-based floating IP. Option B is correct. Elastic IP addresses are static public IPs but do not automatically reassign on instance failure without custom scripting. AWS Global Accelerator provides static IP addresses but is designed for traffic optimization, not SAP HA failover. Amazon CloudFront is a CDN service.

Answer

Elastic IP address

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 12

Which TWO of the following are best practices for securing an SAP system on AWS? (Choose two.)

Accepted Answer

Use security groups to restrict inbound traffic to SAP application ports. Security best practices include using security groups to control traffic (A) and encrypting data in transit using TLS (D). Setting inbound rules to 0.0.0.0/0 (B) is insecure. Storing credentials in plaintext (C) is bad practice. Disabling CloudTrail (E) removes auditing.

Answer

Store database credentials in plaintext in application configuration files

Answer

Disable AWS CloudTrail to reduce logs

Answer

Allow all inbound traffic from 0.0.0.0/0 for easy access

Question 13

An administrator runs the AWS CLI command shown and receives the output. The administrator wants to retrieve the private IP address of the ASCS instance using CloudFormation stack outputs. What is the most efficient way to get this IP address?

Accepted Answer

Modify the CloudFormation template to add the private IP as an output.. Option B is correct because CloudFormation stack outputs can be passed as parameter values or referenced in other stacks. The ASCS instance ID is available, but the private IP is not directly in outputs. However, the question asks for 'most efficient way to get this IP address' using CloudFormation. Option A is incorrect because the output does not include IP. Option C is incorrect because it's a different approach (EC2 API). Option D is incorrect because Systems Manager can get IP but is not using CloudFormation.

Answer

Check the CloudFormation stack events for the private IP.

Answer

Use the AWS CLI to describe the EC2 instance using the instance ID.

Answer

Use AWS Systems Manager to find the IP from the instance ID.

Question 14

An SAP customer is using AWS Direct Connect to connect their on-premises network to AWS. They have multiple SAP systems in different VPCs. The network team wants to centralize connectivity and simplify routing. Which AWS service should they use to connect all VPCs to the on-premises network?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway. Option B is correct because AWS Transit Gateway simplifies connectivity between multiple VPCs and on-premises networks via Direct Connect. Option A is incorrect because VPC Peering does not support transitive routing. Option C is incorrect because VPN is not centralized. Option D is incorrect because PrivateLink is for service access, not routing.

Answer

Use a VPN connection from each VPC to the on-premises network

Answer

Use VPC Peering between each VPC and the Direct Connect VIF

Answer

Use AWS PrivateLink to connect services across VPCs

Question 15

A company is designing a network architecture for SAP S/4HANA on AWS. The architecture must support high availability by distributing application servers across two Availability Zones. Which AWS service can provide automatic failover for the SAP central services (ASCS) instance?

Accepted Answer

Amazon Route 53 with DNS failover routing. Option B is correct because Amazon Route 53 can route traffic to a health-checked endpoint and failover to a secondary ASCS in another AZ. Option A (ELB) operates at layer 4/7 but does not handle SAP-specific ASCS failover. Option C (CloudFront) is a CDN. Option D (Direct Connect) is a dedicated network connection.

Answer

AWS Direct Connect

Answer

Application Load Balancer (ALB)

Answer

Amazon CloudFront