PAS-C01 Practice Test 42 — 15 Questions

Question 1

A company runs SAP on AWS and needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (option E) is the service that records every API call made to AWS services, capturing the identity of the caller, the time, source IP, request parameters, and response, which is exactly what is needed for auditing API activity. Amazon CloudWatch Logs (option C) is used together with CloudTrail because CloudTrail can deliver its event logs to a CloudWatch Logs log group, enabling centralized storage, monitoring, metric filters, and alerting on those API events. Amazon S3 (option A) can store CloudTrail logs, but by itself it does not capture or log API calls, so it is not one of the two required services. VPC Flow Logs (option B) only capture IP traffic metadata for network interfaces in a VPC and do not record AWS API calls. AWS Config (option D) tracks resource configuration changes and compliance, not the full set of API calls made to AWS services.

Answer

Amazon S3

Answer

VPC Flow Logs

Answer

AWS Config

Question 2

A company is migrating its SAP ERP system to AWS and needs to minimize network latency between the SAP application servers and the database. Which architecture is recommended?

Accepted Answer

Place both the application and database servers in the same Availability Zone. Placing both the SAP application servers and the database in the same Availability Zone minimizes network latency because traffic stays within a single AZ's low-latency network fabric and avoids cross-AZ hops. AWS SAP guidance recommends keeping tightly coupled application and database tiers co-located in one AZ for performance, with cross-AZ or cross-region standby for resilience.

Answer

Place the application servers in one AZ and the database in a different AZ

Answer

Place the application servers in one region and the database in another region

Answer

Keep the database on-premises and move only the application servers to AWS

Question 3

An SAP HANA database is running on an EC2 instance with a gp3 EBS volume. The database workload requires high IOPS and throughput. The current configuration shows 16,000 IOPS and 1,000 MB/s throughput. Which change could improve performance?

Accepted Answer

Increase the EC2 instance size.. Increasing the EC2 instance size can provide additional EBS bandwidth, which may remove a bottleneck if the current instance's bandwidth is insufficient to fully utilize the gp3 volume's maximum IOPS (16,000) and throughput (1,000 MB/s). Options B, C, and D are incorrect: increasing volume size does not directly improve gp3 performance since IOPS and throughput are independent of size; changing to gp2 would likely reduce performance due to burst limitations; and gp3 volumes have a maximum of 16,000 IOPS, so increasing to 20,000 is not possible.

Answer

Increase the volume size to 1,000 GB.

Answer

Change the volume type to gp2.

Answer

Increase the volume's IOPS to 20,000.

Question 4

Which TWO of the following are recommended practices for securing SAP workloads on AWS? (Choose TWO.)

Accepted Answer

Use security groups to restrict inbound traffic to only required ports and IP ranges.. Option A is correct because security groups act as stateful virtual firewalls at the instance/ENI level, and restricting inbound rules to only the specific ports SAP requires (for example 3200-3299 for SAP dispatcher, 3300 for the gateway, or 443/8443 for web services) and to trusted CIDR ranges minimizes the attack surface. Option E is correct because enabling EBS encryption protects SAP HANA data at rest, including data volumes, log volumes, and backups, using AWS KMS-managed keys, which is a recommended practice for sensitive in-memory database workloads. Option B is not recommended because the AWS root account should be locked away with MFA and never used for daily administration; instead, use IAM users/roles with least privilege. Option C is wrong because assigning public IPs exposes SAP instances directly to the internet; access should go through bastion hosts, VPN, or AWS Direct Connect. Option D is wrong because placing SAP application servers in a public subnet increases exposure; they belong in private subnets behind NAT gateways or load balancers.

Answer

Use the AWS root account for daily administration of SAP systems.

Answer

Assign public IP addresses to SAP instances for direct internet access.

Answer

Place SAP application servers in a public subnet for ease of access.

Question 5

A company is planning to migrate its SAP landscape to AWS. The environment includes SAP HANA databases for production and non-production. Which AWS service can be used to automate the provisioning of the SAP HANA infrastructure? (Select TWO.)

Accepted Answer

AWS CloudFormation. AWS CloudFormation (Option A) is correct because it allows you to define SAP HANA infrastructure as code using templates, automating the provisioning of EC2 instances, storage, networking, and security groups required for SAP HANA. This aligns with SAP's deployment best practices on AWS, enabling repeatable and consistent infrastructure setup for both production and non-production environments. AWS Service Catalog (Option D) is also correct because it enables organizations to create and manage a catalog of IT services, including pre-approved SAP HANA infrastructure products. Service Catalog integrates with CloudFormation to provision standardized environments, allowing administrators to control which resources (like SAP HANA instances) can be deployed by end users, thus automating and governing the provisioning process.

Answer

Amazon Macie

Answer

AWS OpsWorks

Answer

AWS CodePipeline

Question 6

A company is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The database is 5 TB and the migration must be completed within a 2-hour downtime window. Which AWS service should be used to perform the initial full load and then replicate ongoing changes?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can perform a full load and then continuously replicate changes. Option A (AWS Snowball Edge) is for large data transfer but does not support ongoing replication. Option C (AWS Application Migration Service) is for server migration. Option D (AWS DataSync) is for file transfers.

Answer

AWS Snowball Edge

Answer

AWS Application Migration Service (MGN)

Answer

AWS DataSync

Question 7

An SAP administrator is troubleshooting a performance issue with SAP HANA. The database is running on an EC2 instance with EBS volumes. Which TWO metrics should be monitored to identify disk I/O bottlenecks? (Choose 2.)

Accepted Answer

VolumeReadBytes. Options C (VolumeReadBytes) and D (VolumeWriteBytes) are correct because these are Amazon CloudWatch EBS metrics that directly quantify the volume of data read from and written to the EBS volumes, so sustained high or spiking values reveal the disk I/O load driving an SAP HANA bottleneck. Together they show the read/write throughput demand placed on the underlying EBS storage, which is exactly what an administrator needs to correlate with HANA's I/O performance. Option A (VolumeIdleTime) measures idle seconds and is not marked correct here, and while it can hint at utilization, it does not express the read/write byte volume used to pinpoint I/O bottlenecks. Option B (NetworkIn) reflects inbound network traffic, which is unrelated to EBS disk I/O. Option E (CPUUtilization) measures processor usage and, although relevant to overall instance performance, does not identify disk I/O bottlenecks.

Answer

VolumeIdleTime

Answer

NetworkIn

Answer

CPUUtilization

Question 8

A company is designing a multi-tier SAP architecture on AWS. They want to separate the SAP application tier and database tier into different subnets for security. Which AWS networking component should they use to connect the tiers?

Accepted Answer

VPC peering connection. The tiers are placed in different subnets within the same VPC. Subnets in the same VPC can communicate using the VPC's local route, so no additional networking component is required. None of the listed options is correct; VPC peering, Direct Connect, Site-to-Site VPN, and Transit Gateway are for connecting separate VPCs or on-premises networks.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Question 9

An SAP system administrator is troubleshooting a failed HANA database backup to Amazon S3. The backup job returns an error: 'Access Denied'. Which TWO actions should the administrator take to resolve the issue?

Accepted Answer

Review the S3 bucket policy for any deny statements that may block the backup.. Option A is correct because an explicit Deny in the S3 bucket policy always overrides any Allow granted elsewhere, so a deny statement blocking the backup principal or actions like s3:PutObject would produce exactly the 'Access Denied' error seen in the failed HANA backup. Option C is correct because the EC2 instance running SAP HANA must obtain S3 permissions through its attached IAM role (or instance profile); if that role lacks the required s3:PutObject/s3:ListBucket permissions or is missing entirely, the backup job will fail with 'Access Denied'. Option B is not relevant because S3 Transfer Acceleration only improves upload performance via edge locations and does not grant or fix permissions. Option D is not the cause because a disabled or misconfigured KMS key typically yields a KMS-related error such as 'Access Denied' only when encryption permissions are missing, but the question's generic permission failure is addressed by policy and IAM role checks, and enabling a KMS key is not a standard fix. Option E is not applicable because a VPC endpoint affects network routing to S3, not authorization, so it would not resolve an 'Access Denied' error.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Verify that the S3 bucket's KMS key is enabled.

Answer

Set up a VPC endpoint for S3.

Question 10

A company is running SAP HANA on AWS and needs to ensure that the system can be restored to a specific point in time within the last 24 hours with minimal data loss. The database is 2 TB in size. Which backup strategy meets these requirements with the lowest cost?

Accepted Answer

Use AWS Backup with a daily backup and a 24-hour retention policy, enabling point-in-time recovery.. AWS Backup for SAP HANA provides continuous backup with log backups every 5 minutes, enabling point-in-time recovery to any second within the retention period. This meets the requirement of restoring to a specific point in time with minimal data loss. For a 2 TB database, the cost of AWS Backup with a 24-hour retention is lower than hourly EBS snapshots, because EBS snapshots are charged per GB stored and hourly snapshots would incur higher costs even with incremental savings. Hourly EBS snapshots (Option D) only allow recovery to the nearest hour, introducing up to 60 minutes of potential data loss, which does not satisfy the 'minimal data loss' requirement.

Answer

Configure S3 Transfer Acceleration for faster backup uploads.

Answer

Use a script to copy HANA backup files to S3 every 15 minutes.

Answer

Take hourly EBS snapshots of all HANA volumes and retain them for 24 hours.

Question 11

A company is running SAP ERP on AWS using an SAP-certified AMI. The system uses a single EC2 instance for both the application and database. The operations team needs to implement a disaster recovery (DR) solution with a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 1 hour. The DR site must be in a different AWS Region. Currently, the system uses EBS snapshots for backup. What should the team do to meet the RTO and RPO requirements?

Accepted Answer

Schedule hourly EBS snapshots and copy them to the DR region using AWS Backup.. Option D is correct because scheduling hourly EBS snapshots satisfies the 1-hour RPO, and copying those snapshots to the DR Region with AWS Backup provides cross-Region recovery capability that can restore the SAP-certified AMI/EC2 instance within the 2-hour RTO. AWS Backup supports cross-Region snapshot copies and centralized backup policies, making it the appropriate managed solution for this single-instance SAP ERP workload. Option A is incorrect because a read replica applies to databases such as RDS/Aurora, not a self-managed SAP system on a single EC2 instance with EBS. Option B is incorrect because S3 Cross-Region Replication replicates S3 objects, not EBS snapshots, so it does not directly provide restorable EBS volumes in the DR Region. Option C is not the best fit here because CloudEndure Disaster Recovery (now part of AWS Elastic Disaster Recovery) is a continuous block-level replication service, which exceeds the stated 1-hour RPO requirement and adds unnecessary complexity for a snapshot-based backup strategy.

Answer

Set up a read replica in the DR region and promote it during failover.

Answer

Configure Amazon S3 Cross-Region Replication for the EBS snapshots.

Answer

Use AWS CloudEndure Disaster Recovery to replicate the entire server to the DR region.

Question 12

An SAP system administrator needs to ensure that an EC2 instance running SAP can access an S3 bucket containing installation media. The instance is in a private subnet without internet access. What is the recommended way to provide access to S3?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 provides private connectivity from the VPC to S3 without requiring an internet gateway, NAT device, VPN, or Direct Connect. It works by adding a prefix list route to the route table that directs S3 traffic through the gateway endpoint, keeping traffic on the AWS private network. This is the recommended, cost-effective solution for private subnet instances needing S3 access.

Answer

Set up a VPN connection to S3.

Answer

Set up a NAT Gateway in the public subnet.

Answer

Use AWS Direct Connect to connect to S3.

Question 13

An SAP system is running on AWS and needs to be accessible over the internet securely. Which AWS service should be used to provide secure remote access for administrators?

Accepted Answer

Use AWS Systems Manager Session Manager. AWS Systems Manager Session Manager provides secure, auditable, browser-based or CLI-based remote access to EC2 instances without opening inbound ports, managing SSH keys, or using bastion hosts. It leverages the AWS SSM Agent and IAM policies to authenticate and authorize administrators, making it the most secure and operationally efficient option for SAP system administration on AWS.

Answer

Set up an AWS Site-to-Site VPN connection from the corporate network

Answer

Use Amazon WorkSpaces to provide a virtual desktop for administrators

Answer

Configure the EC2 instance in a public subnet with SSH access from the internet

Question 14

A company is deploying SAP S/4HANA on AWS and needs to ensure that the system can be recovered within 4 hours in case of a disaster in the primary region. The secondary region is in a different AWS region. Which approach should be used to meet the recovery time objective (RTO)?

Accepted Answer

Configure SAP HANA system replication to a secondary region with a pre-provisioned standby instance. Replicating SAP HANA to a standby instance in another region using HANA system replication with pre-provisioned infrastructure allows fast failover. Cross-region EBS snapshots take time to restore. Backup and restore from S3 may be slower. Pilot light with application-level replication is not sufficient for HANA.

Answer

Use cross-region EBS snapshots and restore them in the secondary region

Answer

Back up SAP HANA to Amazon S3 and restore in the secondary region

Answer

Set up a pilot light environment using application-level replication

Question 15

A company is migrating an SAP HANA database to AWS. Which TWO of the following are valid options for running SAP HANA on AWS? (Choose 2)

Accepted Answer

Amazon EC2 instances with Amazon EBS storage. SAP HANA can run on EC2 instances with EBS or on AWS HANA Large Instances. RDS for SAP HANA is not available. Lightsail is not suitable for HANA. Fargate is for containers.

Answer

Amazon RDS for SAP HANA

Answer

AWS Lambda

Answer

AWS Fargate