PAS-C01 Practice Test 40 — 15 Questions

Question 1

An SAP Basis administrator is troubleshooting a performance issue on an SAP NetWeaver application server running on Amazon EC2. The administrator notices that the CPU utilization is low but the application response times are high. The system is using an Amazon EBS gp2 volume. Which configuration change is most likely to improve performance?

Accepted Answer

Increase the IOPS of the EBS gp2 volume or switch to io1.. Option D is correct: If CPU is low but response times high, the bottleneck is likely disk I/O. Increasing the IOPS of the gp2 volume (by increasing volume size or switching to io1/io2) improves throughput. Option A is wrong: More vCPUs won't help if CPU is not saturated. Option B is wrong: Larger instance might not fix disk I/O. Option C is wrong: Instance store is ephemeral and not suitable for persistent data.

Answer

Change the EBS volume to instance store.

Answer

Move the EC2 instance to a larger instance family.

Answer

Increase the number of vCPUs on the EC2 instance.

Question 2

An SAP system on AWS uses a Multi-AZ DB instance for its database. The operations team notices that during a recent Availability Zone outage, the database failover did not occur automatically. What is the MOST likely cause?

Accepted Answer

The secondary DB instance is in the same Availability Zone as the primary.. Option A is correct because Multi-AZ failover requires a primary DB instance in a different AZ; if both are in the same AZ, failover will not happen during an AZ outage. Option B is wrong because read replicas are for read scaling, not failover. Option C is wrong because synchronous replication is used for Multi-AZ. Option D is wrong because Multi-AZ supports automatic failover.

Answer

The database is configured with asynchronous replication.

Answer

The Multi-AZ option is not supported for this database engine.

Answer

The database is configured as a read replica.

Question 3

Which TWO AWS services can be used to monitor SAP system availability and send notifications when a system goes down? (Choose two.)

Accepted Answer

Amazon CloudWatch Events. Options B and D are correct. Option B: CloudWatch alarms can monitor health checks and metrics. Option D: CloudWatch Events can trigger notifications on state changes. Option A is wrong because Config tracks configuration, not availability. Option C is wrong because Trusted Advisor provides best practices, not monitoring. Option E is wrong because S3 is storage, not monitoring.

Answer

AWS Trusted Advisor

Answer

Amazon S3 event notifications

Answer

AWS Config

Question 4

Which TWO AWS services can be used to monitor SAP system performance and send alerts? (Choose two.)

Accepted Answer

Amazon CloudWatch. Option A and Option D are correct. Amazon CloudWatch can collect metrics and send alarms. AWS Lambda can be used to process metrics and send custom alerts. Option B is wrong because Amazon Inspector is for security assessment. Option C is wrong because AWS Config is for configuration compliance. Option E is wrong because AWS Trusted Advisor provides best practice checks, not real-time monitoring.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 5

An SAP administrator is trying to set up an AWS CLI script that queries EC2 instance metadata. The script runs on an EC2 instance with an IAM role attached. The IAM role has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the error?

Accepted Answer

The instance does not have an IAM instance profile associated, or the profile name does not match the role name.. Option D is correct because the error message shows the principal is 'SAP', which suggests the instance profile name is 'SAP', but the policy is attached to the role, and the instance profile must have the same name as the role or be correctly associated. Option A is wrong because the policy allows all resources. Option B is wrong because the error is about authorization, not region mismatch. Option C is wrong because the error shows the action is ec2:DescribeInstances.

Answer

The IAM policy does not specify a resource ARN.

Answer

The IAM role does not have the ec2:DescribeInstances action allowed.

Answer

The AWS CLI is not configured with the correct region.

Question 6

An SAP administrator creates this IAM policy for an EC2 instance role used by SAP HANA Backint to back up to S3. The backups are failing with access denied errors for S3 operations. What is the most likely cause?

Accepted Answer

The policy does not include kms:Encrypt action.. Option D is correct: The S3 bucket is encrypted with SSE-KMS, and the policy allows kms:Decrypt and kms:GenerateDataKey, but Backint may also need kms:Encrypt to write encrypted objects. The error suggests missing permission for encryption. Option A is wrong because GetObject and PutObject are allowed. Option B is wrong because the actions are on the bucket. Option C is wrong because the policy explicitly allows KMS actions.

Answer

The policy does not allow s3:ListBucket action.

Answer

The policy uses a wildcard in the resource ARN for the bucket.

Answer

The policy does not include kms:ReEncrypt action.

Question 7

Refer to the exhibit. An administrator runs the AWS CLI command shown and receives the output. The instance is running, but the SAP application on the instance is not accessible. Which additional AWS CLI command should the administrator run to troubleshoot the network connectivity?

Accepted Answer

aws ec2 describe-instances --instance-ids i-0abcd1234efgh5678 --query 'Reservations[0].Instances[0].NetworkInterfaces'. Option C is correct because the describe-instances command with the query for NetworkInterfaces can provide the public IP address, security groups, and subnet information, which are crucial for network troubleshooting. Option A is wrong because describe-network-interfaces provides similar info but without instance context. Option B is wrong because describe-security-groups alone doesn't show which groups are attached. Option D is wrong because describe-subnets doesn't show instance-level network details.

Answer

aws ec2 describe-subnets

Answer

aws ec2 describe-network-interfaces

Answer

aws ec2 describe-security-groups

Question 8

The exhibit shows an IAM policy for an SAP backup process that uploads backups to S3. An administrator wants to ensure that all uploads are encrypted using SSE-S3. What does this policy enforce?

Accepted Answer

Any PutObject request that does not include the encryption header will be denied.. Option C is correct: The condition requires that the PutObject request includes the x-amz-server-side-encryption header with value AES256. If not included, the request is denied. Option A is wrong: The policy does not enforce encryption at rest automatically; it requires the client to specify it. Option B is wrong: It doesn't require KMS. Option D is wrong: The policy does not require client-side encryption.

Answer

The backup process must encrypt the files before uploading them.

Answer

The backup process must use AWS KMS to encrypt the objects.

Answer

The bucket automatically encrypts objects with SSE-S3 even if the request does not specify it.

Question 9

An SAP administrator needs to ensure that all changes to an SAP system's AWS resources are tracked and that alerts are sent when SSH access to EC2 instances is modified. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls and can trigger alerts via CloudWatch Events. Option A is wrong because Config tracks resource configuration changes but not API calls. Option C is wrong because CloudWatch monitors performance, not API calls. Option D is wrong because Trusted Advisor provides best-practice checks, not change tracking.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 10

A company is migrating an SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which architecture should be used to meet this requirement?

Accepted Answer

Use a cluster of EC2 instances across two Availability Zones with shared storage and a cluster manager.. Option B is correct because SAP ASCS can be set up in a cluster across multiple Availability Zones using shared storage (e.g., Amazon EFS or FSx) and a cluster manager like Pacemaker. Option A is wrong because a single EC2 instance does not provide high availability. Option C is wrong because an Auto Scaling group is for horizontal scaling of stateless applications, not for SAP ASCS. Option D is wrong because placing both nodes in the same AZ does not protect against AZ failure.

Answer

Deploy the ASCS on a single large EC2 instance with a Multi-Attach EBS volume.

Answer

Use an Auto Scaling group with a launch configuration for ASCS.

Answer

Deploy two EC2 instances in the same Availability Zone with a replicated file system.

Question 11

Which TWO AWS services can be used to store SAP backup data? (Choose two.)

Accepted Answer

Amazon S3. Options A and D are correct. Amazon S3 is an object storage service commonly used for backups. Amazon S3 Glacier is a low-cost archive storage for long-term backups. Option B is wrong because Amazon EBS is block storage attached to EC2, not a backup target. Option C is wrong because Amazon RDS is a managed database service, not storage for SAP backups. Option E is wrong because Amazon DynamoDB is a NoSQL database.

Answer

Amazon RDS

Answer

Amazon DynamoDB

Answer

Amazon EBS

Question 12

An SAP system running on AWS is experiencing high CPU utilization on the database server. The database is SAP HANA running on an r5.8xlarge instance. Which metric in Amazon CloudWatch would best indicate whether the CPU is being consumed by the HANA process or by other OS processes?

Accepted Answer

Custom metrics collected by the CloudWatch agent for the hdbindexserver process. Option D is correct because CloudWatch Agent can collect per-process CPU metrics. Option A is wrong because CPUUtilization is aggregate. Option B is wrong because CPUCreditUsage is for burstable instances. Option C is wrong because the HANA metric is not a standard CloudWatch metric.

Answer

CPUUtilization metric from the EC2 instance

Answer

HANA CPU metric from SAP HANA CloudWatch integration

Answer

CPUCreditUsage metric

Question 13

Refer to the exhibit. A CloudFormation template is used to launch an EC2 instance for SAP. The instance launches but the root volume is only 50 GB. The SAP installation requires at least 100 GB for the root volume. How should the template be modified?

Accepted Answer

Change VolumeSize from 50 to 100 in the BlockDeviceMapping.. Option A is correct because increasing the VolumeSize to 100 in the BlockDeviceMapping will allocate a 100 GB root volume. Option B is wrong because modifying the template after launch doesn't change the running instance. Option C is wrong because changing InstanceType does not affect volume size. Option D is wrong because changing ImageId changes the AMI, not the volume size.

Answer

Change the InstanceType to a larger instance.

Answer

Modify the running instance's root volume size using the AWS Management Console.

Answer

Change the ImageId to an AMI with a larger root volume.

Question 14

A company runs SAP on AWS and uses a shared file system for SAP transport files. The system must support concurrent access from multiple SAP application servers and provide strong consistency. The transport files are typically small (less than 1 MB) and are frequently read and written. Which file storage solution should be used?

Accepted Answer

Amazon EFS. Option A is correct: Amazon EFS provides a shared NFS file system with strong consistency and is suitable for concurrent access. Option B is wrong: Amazon S3 is object storage, not a file system. Option C is wrong: Amazon FSx for Windows File Server supports SMB, not NFS typically used by SAP on Linux. Option D is wrong: Instance store is ephemeral and not shared.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3

Answer

Amazon EC2 instance store

Question 15

An SAP system running on AWS is experiencing high latency for database writes. The database is running on an RDS instance with General Purpose (gp2) storage. What change will PROVIDE the most immediate performance improvement?

Accepted Answer

Change the storage type to Provisioned IOPS (io1 or io2).. Option A is correct because switching to Provisioned IOPS (io1/io2) provides consistent low latency for write-heavy workloads. Option B is wrong because adding read replicas helps read scaling, not write latency. Option C is wrong because increasing storage size may improve gp2 baseline performance but not as effectively as io1. Option D is wrong because Multi-AZ provides high availability, not performance.

Answer

Add a read replica to offload read traffic.

Answer

Increase the allocated storage size to increase baseline IOPS.

Answer

Enable Multi-AZ deployment.