PAS-C01 Practice Test 40 — 15 Questions

Question 1

A company runs SAP HANA on AWS and needs to perform a system copy from production to a test environment. The test environment is in a different AWS account. Which AWS service can be used to securely share the HANA backup files stored in Amazon S3 across accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 bucket policy. To securely share HANA backup files stored in Amazon S3 across AWS accounts, you can use an S3 bucket policy. The bucket policy can grant cross-account access to the specific IAM principals in the test account, allowing them to read the backup objects. This is the standard method for cross-account S3 access.

Answer

VPC Peering

Answer

S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 2

Drag and drop the steps to migrate an on-premises SAP system to AWS using AWS Application Migration Service (MGN) into the correct order.

Accepted Answer

Install AWS Replication Agent, then Configure replication settings, then Launch test instances and validate, then Perform cutover, then Perform post-migration steps.. MGN migration involves installing agent, configuring replication, testing, cutover, and post-migration steps.

Answer

Install AWS Replication Agent, then Launch test instances and validate, then Configure replication settings, then Perform cutover, then Perform post-migration steps.

Answer

Configure replication settings, then Install AWS Replication Agent, then Launch test instances and validate, then Perform cutover, then Perform post-migration steps.

Answer

Install AWS Replication Agent, then Configure replication settings, then Perform cutover, then Launch test instances and validate, then Perform post-migration steps.

Question 3

An SAP administrator needs to apply an OS-level security patch to all EC2 instances in an SAP landscape. The administrator wants to automate this process and track compliance. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is purpose-built for automating OS-level patch application across EC2 instances (and on-premises/hybrid nodes) at scale. It uses patch baselines, maintenance windows, and compliance reporting to both automate patching and track which instances are compliant. This directly satisfies the administrator's dual requirement of automation and compliance tracking for an SAP landscape.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 4

An SAP on AWS environment uses a shared file system via Amazon EFS for SAP transport files. The EFS file system is mounted on multiple EC2 instances. Users report that file operations are slow during peak hours. Which action should be taken to improve performance?

Accepted Answer

Enable EFS Provisioned Throughput mode and increase throughput. Amazon EFS performance is governed by its throughput mode; if the file system is in Bursting mode and credits are exhausted during peak hours, performance degrades. Switching to Provisioned Throughput mode and specifying a higher throughput level decouples performance from the amount of data stored and provides consistent, high throughput for the SAP transport file workload.

Answer

Migrate to Amazon EBS with Multi-Attach enabled

Answer

Move the transport files to Amazon S3 and use S3FS

Answer

Increase the number of EC2 instances to distribute the load

Question 5

An SAP system on AWS is experiencing intermittent network connectivity issues between the application servers and the database server. Both are in the same VPC but different subnets. The security groups allow all traffic between them. What should the administrator check next?

Accepted Answer

Network ACL rules for the subnets. The administrator should check Network ACL rules for the subnets. Network ACLs are stateless and can block traffic even if security groups allow it. Since both instances are in the same VPC but different subnets, each subnet has its own NACL. If the NACLs are not configured to allow the necessary traffic (both inbound and outbound), connectivity issues can occur. This is the next logical check after security groups.

Answer

VPC Flow Logs to analyze dropped packets

Answer

Route tables to ensure proper routing

Answer

Security group rules for outbound traffic

Question 6

An SAP administrator needs to set up a fault-tolerant architecture for SAP NetWeaver on AWS. The architecture must survive an entire Availability Zone failure. Which configuration is the most appropriate?

Accepted Answer

Use an Auto Scaling group to launch SAP application servers across multiple AZs behind an Application Load Balancer.. Deploying SAP application servers across multiple Availability Zones (AZs) behind an Application Load Balancer (ALB) provides fault tolerance at the AZ level. The ALB distributes traffic to healthy instances in different AZs, ensuring that if one AZ fails, the remaining AZs continue to serve requests without interruption. This architecture aligns with SAP's recommended high-availability pattern for the ABAP stateless application tier.

Answer

Deploy all SAP application servers in one Availability Zone and use Amazon EBS snapshots for backup.

Answer

Deploy SAP application servers across multiple AZs but without a load balancer.

Answer

Use a single large EC2 instance for all SAP components.

Question 7

An SAP system on AWS is experiencing performance degradation. The CloudWatch metrics show that the EBS volumes used for the HANA data files have an average queue length of 10 and average latency of 50 ms. What is the most likely cause?

Accepted Answer

The EBS volume's provisioned IOPS are insufficient for the workload.. An average EBS queue length of 10 and average latency of 50 ms indicate that the volume is saturated with I/O requests. The queue length persistently exceeds the recommended threshold (typically <1 for optimal performance), and latency spikes above the 1–10 ms range for gp3 or io2 volumes. This directly points to insufficient provisioned IOPS for the SAP HANA workload, causing requests to queue up and wait for service.

Answer

EBS encryption is causing additional overhead.

Answer

EBS snapshots are being taken too frequently.

Answer

EBS optimization is not enabled on the instance.

Question 8

A company runs an SAP HANA database on an AWS EC2 instance. The database experiences high latency during peak hours. The operations team suspects network bottlenecks. Which AWS service should be used to analyze network traffic patterns and identify the source of latency?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information going to and from network interfaces in a VPC. By analyzing flow logs, you can identify traffic patterns, detect anomalies, and pinpoint sources of network latency, such as dropped packets or high traffic volumes between specific instances. This makes it the appropriate service for analyzing network traffic patterns.

Answer

AWS X-Ray

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 9

A company is migrating a legacy SAP ERP system to AWS. The system uses a custom kernel and has strict latency requirements. The SAP application servers must be placed in the same AWS region as the database. Which migration strategy should be used?

Accepted Answer

Rehost. Rehost (lift-and-shift) moves the SAP ERP system to AWS with minimal changes, preserving the custom kernel and existing application architecture while placing app servers and database in the same region to meet latency requirements. This is the fastest migration strategy and is appropriate when the goal is to migrate without re-architecting. Replatform, refactor, and repurchase all involve changes that would risk the custom kernel and add time.

Answer

Replatform

Answer

Refactor

Answer

Repurchase

Question 10

An SAP administrator needs to patch the operating system of SAP application servers that are part of an Auto Scaling group. What is the best practice to ensure that instances are updated without downtime?

Accepted Answer

Create a new launch configuration with an updated AMI and perform a rolling update using the Auto Scaling group.. The best practice for patching instances in an Auto Scaling group without downtime is to create a new launch configuration (or launch template) with an updated AMI and perform a rolling update. This replaces instances gradually, maintaining availability. The rolling update ensures that a minimum number of instances remain in service while others are replaced.

Answer

Update the AMI used by the Auto Scaling group launch configuration and manually terminate all running instances.

Answer

Update the AMI and stop the Auto Scaling group, then start it again.

Answer

Install patches on each running instance using AWS Systems Manager Patch Manager.

Question 11

Refer to the exhibit. An administrator is creating an IAM policy for a user who will manage SAP application servers during migration. The policy currently allows starting and stopping EC2 instances. What additional permission is required to allow the user to terminate instances?

Accepted Answer

ec2:TerminateInstances. ec2:TerminateInstances. In AWS IAM, each EC2 API action maps to a specific permission, and terminating an instance is controlled by the ec2:TerminateInstances action. Since the policy already allows starting and stopping instances (ec2:StartInstances and ec2:StopInstances), adding ec2:TerminateInstances is the only way to grant the user the ability to permanently delete instances. This is essential for managing SAP application servers during migration, where decommissioning old instances is a common task.

Answer

ec2:ModifyInstanceAttribute

Answer

ec2:RebootInstances

Answer

ec2:DeleteInstances

Question 12

A company wants to use AWS Systems Manager to automate patching of SAP application servers. What is a prerequisite for Systems Manager to manage these EC2 instances?

Accepted Answer

Install the SSM Agent on the EC2 instances.. AWS Systems Manager requires the SSM Agent to be installed and running on EC2 instances to enable communication with the Systems Manager service for patching and other management tasks. Without the agent, Systems Manager cannot send commands, initiate patching workflows, or gather inventory data from the instances. The SSM Agent is pre-installed on many Amazon Linux and Windows AMIs but must be manually installed on custom or imported images.

Answer

Enable SSH access to the instances.

Answer

Assign a separate IAM role to each instance.

Answer

Ensure the instances have public IP addresses.

Question 13

An SAP administrator needs to perform an OS-level patching of the underlying EC2 instances hosting an SAP HANA database in a production environment. The HANA database is configured with system replication across two Availability Zones. What is the best practice to minimize downtime?

Accepted Answer

Fail over to the secondary HANA instance, apply patches to the primary, then fail back.. With HANA system replication across two AZs, the best practice for OS patching is to perform a planned takeover to the secondary site, patch the now-secondary (original primary) instance, then take over back to the original primary. This keeps the database available throughout, minimizing downtime to only the brief takeover windows.

Answer

Stop the EC2 instance, apply patches, and start.

Answer

Take a snapshot of the volume, patch the OS, and restore if needed.

Answer

Stop the HANA database, apply patches, and restart.

Question 14

Which TWO AWS services can be used to automate the patching of SAP EC2 instances? (Choose two.)

Accepted Answer

AWS Systems Manager Maintenance Windows. AWS Systems Manager Patch Manager (option B) is the service that actually scans for and installs missing OS patches on EC2 instances, using patch baselines and the SSM Agent, so it directly automates SAP EC2 instance patching. AWS Systems Manager Maintenance Windows (option A) provides the scheduling mechanism that runs those patching tasks during defined time windows, which is how you automate patch execution at scale. Together they form the standard AWS-native automation pattern for patching EC2 instances. Amazon Inspector (C) only assesses and reports vulnerabilities; it does not install patches. AWS CloudFormation (D) provisions infrastructure as code but does not perform OS patch installation. AWS CodeDeploy (E) deploys application revisions, not operating system patches.

Answer

Amazon Inspector

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 15

A company runs SAP ERP on AWS using a single Availability Zone. The system includes an SAP HANA database on an EC2 instance with 2 TB of memory. The operations team plans to perform a major version upgrade of the SAP HANA database, which requires approximately 4 hours of downtime. The company's SLA allows a maximum of 2 hours of downtime. The team decides to use a blue/green deployment strategy by creating a new HANA instance in a different Availability Zone and replicating data using HANA System Replication (HSR). After setting up replication, they perform a failover to the new instance. However, the failover takes 3 hours due to the large amount of data that needs to be synchronized. What should the team do to meet the 2-hour downtime requirement?

Accepted Answer

Use HANA System Replication with initial snapshot by taking a backup of the source, restoring on the target, and then setting up replication.. The 3-hour failover is caused by HSR having to synchronize the full 2 TB dataset over the network during initial setup. Pre-seeding the target with a backup/restore of the source database means HSR only needs to replicate the delta (changed data since the backup), drastically reducing the time needed to bring the target in sync. This lets the actual cutover fit within the 2-hour SLA.

Answer

Scale up the source HANA instance to a larger instance type to speed up replication.

Answer

Increase the network bandwidth between the two Availability Zones to 10 Gbps.

Answer

Use Amazon RDS for SAP HANA instead of self-managed EC2.