PAS-C01 Practice Test 41 — 15 Questions

Question 1

During an SAP system refresh, the operations team needs to restore an SAP HANA database from an S3 backup to a new EC2 instance. The backup was created using SAP HANA Backint. Which AWS service is required to read the backup from S3?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SAP HANA Backint agent for Amazon S3. SAP HANA Backint is an SAP-defined API, and AWS provides a Backint agent that runs on the HANA host and reads/writes backups directly to and from Amazon S3. To restore from an S3 backup, the Backint agent for Amazon S3 must be installed and configured on the target EC2 instance.

Answer

Amazon EBS snapshots

Answer

AWS Backup

Answer

AWS Storage Gateway

Question 2

An SAP Basis administrator needs to apply an OS-level security patch to a fleet of SAP EC2 instances running Red Hat Enterprise Linux. The instances are part of an Auto Scaling group. Which approach is the MOST efficient and minimizes downtime?

Accepted Answer

Create a new AMI with the patch applied, update the launch template, and perform a rolling update via Auto Scaling.. The most efficient, lowest-downtime approach is to bake the patch into a new AMI, update the launch template, and perform a rolling update via Auto Scaling. This uses immutable infrastructure: new instances launch with the patch already applied, and Auto Scaling replaces old instances gradually (respecting min/max/desired and health checks), so capacity is maintained throughout and rollback is as simple as reverting the launch template version.

Answer

Create a custom AMI and manually terminate each instance to launch new ones.

Answer

Stop all instances, apply the patch using a script, and restart them.

Answer

Use AWS Systems Manager Patch Manager to apply the patch to all instances simultaneously.

Question 3

An SAP system on AWS is experiencing high latency between the application and database tiers. Both tiers are in the same VPC but in different Availability Zones. What is the most effective way to reduce latency?

Accepted Answer

Move both tiers into the same Availability Zone.. The most effective way to reduce latency between application and database tiers in the same VPC but different Availability Zones is to move both tiers into the same Availability Zone. Network latency between AZs is typically 1-2 milliseconds, but for latency-sensitive SAP workloads, even this small delay can impact performance. Co-locating the tiers in the same AZ eliminates cross-AZ network hops, providing the lowest possible latency.

Answer

Add an Application Load Balancer between tiers.

Answer

Increase the bandwidth of the EC2 instances.

Answer

Enable AWS Direct Connect.

Question 4

A company is migrating its SAP HANA database to AWS. The migration requires minimal downtime and data consistency. Which THREE steps should the company take to achieve this?

Accepted Answer

Use AWS DMS with change data capture (CDC) for ongoing replication.. To achieve minimal downtime and data consistency when migrating an SAP HANA database to AWS, the company should: Use AWS DMS with change data capture (CDC) for ongoing replication (B), create the target HANA database and schema in advance (C), and perform a full load of the data using AWS DMS before enabling CDC (D). A full backup and restore (A) would cause downtime, and disabling logging (E) is incorrect as it would compromise data consistency and recovery.

Answer

Take a full backup of the source database and restore it on the target.

Answer

Disable all logging on the source database to reduce overhead.

Question 5

Refer to the exhibit. An Application Load Balancer is configured to route traffic to an Auto Scaling group of web servers. The health check for the target group is failing. The web servers are healthy and running, but the health check endpoint is returning a 503 status code because the application cannot connect to the database. The database is an Amazon RDS instance in the same VPC. Which action should the solutions architect take to resolve the health check failure?

Accepted Answer

Change the health check endpoint to a static page that does not require database connectivity.. The health check endpoint should validate the web server's ability to serve traffic, not the database's availability. By changing the health check to a static page (e.g., /health.html) that does not depend on database connectivity, the load balancer will correctly assess the web server's health independently. This decouples the health check from the database, preventing cascading failures where a database outage causes all web servers to be marked unhealthy and removed from the target group.

Answer

Restart the web server instances to reset the database connection.

Answer

Modify the application's health check endpoint to return a 200 OK status even when the database is unavailable.

Answer

Increase the health check interval to allow more time for the database to respond.

Question 6

A company is migrating an SAP system from on-premises to AWS. The migration involves rehosting SAP HANA on EC2. Which of the following is the best practice for sizing the EC2 instance?

Accepted Answer

Use an EC2 instance that is listed in the SAP Certified and Supported SAP HANA Hardware Directory.. For SAP HANA on AWS, the EC2 instance type must be certified by SAP and listed in the SAP Certified and Supported SAP HANA Hardware Directory. This ensures the instance meets SAP's performance, memory, and reliability requirements for production HANA workloads. Using a non-certified instance, even with sufficient memory, violates SAP support agreements and may lead to performance or stability issues.

Answer

Use a memory-optimized EC2 instance with the required memory.

Answer

Use a general-purpose EC2 instance with sufficient vCPUs and memory.

Answer

Use a compute-optimized EC2 instance to ensure high CPU performance.

Question 7

Which TWO AWS services can be used to provide shared storage for SAP systems running on multiple EC2 instances?

Accepted Answer

Amazon FSx for NetApp ONTAP. Amazon FSx for NetApp ONTAP provides a fully managed, shared file system with NFS and SMB support, offering features like deduplication and snapshots ideal for SAP clustered deployments. Amazon EFS also provides a shared NFSv4.1 file system accessible from multiple EC2 instances concurrently, making it suitable for SAP workloads that require shared storage. Both services enable shared storage for SAP systems running on multiple instances, while EC2 Instance Store is ephemeral, S3 is object storage, and EBS volumes are single-instance attached.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EBS

Question 8

A company is running an SAP HANA database on an Amazon EC2 instance with 4 TB of memory. The database is used for real-time analytics and requires the highest possible I/O performance. The company wants to use Amazon EBS volumes for storage. Which EBS volume type and configuration should be used to achieve the lowest latency and highest throughput?

Accepted Answer

Provisioned IOPS SSD (io2 Block Express) volumes with multiple volumes in a RAID 0 configuration.. For a large SAP HANA database requiring the highest I/O performance, Provisioned IOPS SSD (io2 Block Express) volumes are the correct choice. They offer the lowest latency and highest throughput, and when combined in a RAID 0 configuration, they can deliver the aggregated IOPS and throughput needed for real-time analytics. Other EBS volume types do not provide the necessary performance characteristics for this workload.

Answer

Cold HDD (sc1) volumes with Amazon EBS Multi-Attach enabled.

Answer

Throughput Optimized HDD (st1) volumes with multiple volumes in a RAID 0 configuration.

Answer

General Purpose SSD (gp3) volumes with provisioned IOPS and throughput.

Question 9

A company is migrating a legacy application to AWS. The application currently uses Oracle Database and the company wants to migrate to Amazon Aurora PostgreSQL with minimal downtime. Which TWO steps should be taken to achieve this? (Choose TWO)

Accepted Answer

Use the AWS Schema Conversion Tool (SCT) to convert the Oracle schema to PostgreSQL.. The AWS Schema Conversion Tool (SCT) can automatically convert Oracle database schemas (including stored procedures, views, and data types) to a PostgreSQL-compatible format, which is essential when migrating to Amazon Aurora PostgreSQL. Option D is correct because AWS DMS with ongoing replication (change data capture) allows you to keep the source Oracle database and target Aurora PostgreSQL synchronized with minimal downtime, enabling a near-zero-downtime migration by capturing and applying incremental changes.

Answer

Rehost the Oracle database on an Amazon EC2 instance to minimize changes.

Answer

Configure Amazon Aurora PostgreSQL with Multi-AZ for high availability.

Answer

Export Oracle database as dump files and import into Aurora PostgreSQL using native tools.

Question 10

Refer to the exhibit. A CloudFormation template is used to migrate a web server to AWS. The template launches an EC2 instance but does not install the web server. What is the best way to automate the installation?

Accepted Answer

Add a UserData property to the EC2 instance resource.. The EC2 UserData property in a CloudFormation template lets you pass a script that runs automatically on first boot, so the web server installation happens as part of instance launch. This keeps the automation inside the template and requires no external orchestration.

Answer

Create a CloudWatch Events rule to trigger a Lambda function after instance launch.

Answer

Use AWS Systems Manager Run Command to install the web server.

Answer

Use AWS CodeDeploy to deploy the web server after the instance is created.

Question 11

An SAP system administrator is troubleshooting a performance issue on an SAP ERP Central Component (ECC) system running on AWS. The system uses an Oracle database on an EC2 instance with EBS volumes. Users report that some transactions are slow, especially during month-end closing. The administrator checks CloudWatch metrics and notices that the EBS volume read latency is high (average 20 ms) and the queue depth is consistently 0. The volume type is gp2 with 3000 IOPS. The administrator suspects the volume is not meeting the IOPS demand. What should the administrator do to resolve this issue?

Accepted Answer

Increase the EBS volume size to increase the baseline IOPS. Increasing the EBS volume size raises the baseline IOPS for a gp2 volume, since gp2 performance scales at 3 IOPS per GiB up to 16,000 IOPS, so a larger volume directly addresses the IOPS shortfall causing the high read latency. The consistently zero queue depth combined with 20 ms latency indicates the volume is hitting its IOPS ceiling rather than being throttled by throughput or instance limits. Option A (gp2 to gp3) does not by itself increase IOPS unless provisioned IOPS are explicitly configured above the 3,000 baseline, so it does not guarantee a fix. Option C addresses throughput (MB/s), not IOPS, and gp2 throughput is tied to IOPS anyway, so it would not resolve the latency. Option D (EBS optimization) only affects instance-level bandwidth and is already enabled by default on most modern instance types, so it does not raise the volume's IOPS limit.

Answer

Switch the volume type from gp2 to gp3

Answer

Increase the volume throughput to 250 MB/s

Answer

Enable EBS optimization on the EC2 instance

Question 12

An SAP system is deployed on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers must be encrypted in transit. Which action should be taken to meet this requirement?

Accepted Answer

Configure SSL/TLS certificates on the database and application servers. Encryption in transit between the SAP application and database tiers requires cryptographic protection at the protocol layer, which is achieved by configuring SSL/TLS certificates on both the application and database servers. This ensures that data exchanged between these tiers is encrypted end-to-end regardless of the underlying network path. Network-level controls alone cannot provide encryption; they only control reachability.

Answer

Attach an Internet Gateway to the VPC

Answer

Restrict security group rules to only allow traffic from the application tier

Answer

Create a VPC Peering connection between the subnets

Answer

Use network ACLs to allow only database traffic

Question 13

An SAP system administrator needs to automate the creation of an SAP HANA database backup and copy it to another AWS Region for disaster recovery. The backup is stored in an Amazon S3 bucket. Which AWS service should be used to replicate the backup to another Region?

Accepted Answer

S3 Cross-Region Replication (CRR). S3 Cross-Region Replication (CRR) is the correct service because it automatically replicates objects from a source S3 bucket in one AWS Region to a destination bucket in another Region, meeting the requirement to copy the SAP HANA database backup to a different Region for disaster recovery. CRR operates asynchronously and can be configured with the appropriate IAM role to replicate existing and new objects, ensuring the backup is continuously available in the DR Region.

Answer

S3 Lifecycle Policies

Answer

S3 Batch Operations

Answer

S3 Transfer Acceleration

Question 14

A company is planning to migrate its SAP environment to AWS. The SAP landscape includes development, test, and production systems. The company wants to ensure data security and compliance. Which THREE AWS services should the company use to achieve this?

Accepted Answer

AWS Key Management Service (KMS) for encryption of EBS volumes and S3 buckets.. AWS KMS enables encryption of EBS volumes and S3 buckets, ensuring data at rest is secure. Option B is correct because IAM provides user and role management to enforce least privilege access. Option D is correct because CloudTrail records API activity for auditing and compliance. Option C is wrong because Direct Connect is a network connectivity service, not a security service. Option E is wrong because Elastic Load Balancing is for traffic distribution, not security.

Answer

AWS Direct Connect for dedicated network connection.

Answer

Elastic Load Balancing for distributing traffic.

Question 15

Refer to the exhibit. An SAP administrator created this IAM policy for an SAP application user that performs database backups to Amazon S3. The user reports that backup jobs fail with an access denied error. What is the most likely cause?

Accepted Answer

The policy is missing s3:ListBucket permission on the bucket.. The error occurs because the IAM policy grants s3:PutObject and s3:DeleteObject on the bucket and its objects, but it does not include s3:ListBucket permission. When an SAP application performs a backup to S3, the AWS SDK or CLI often first lists the bucket to verify its existence or check for existing objects before writing. Without s3:ListBucket, the list operation fails, causing the access denied error even though the write permission is present.

Answer

The policy has a syntax error and is invalid.

Answer

The policy does not allow s3:PutObject for the bucket.

Answer

The Deny statement blocks all DeleteObject requests.