PAS-C01 Practice Test 49 — 15 Questions

Question 1

A company runs an SAP HANA system on AWS. The system uses a three-node cluster with HANA System Replication (HSR) in a scale-out configuration. The cluster spans three Availability Zones. Which architecture ensures the highest availability for the SAP HANA database?

Accepted Answer

Use a cluster of nodes across three Availability Zones with HANA System Replication and automatic failover.. Option B is correct: for HSR scale-out, a multi-AZ cluster with automatic failover provides high availability. Option A is incorrect because a single AZ is a single point of failure. Option C is incorrect because HSR active/active is not supported for scale-out. Option D is incorrect because Multi-AZ is for RDS, not HANA on EC2.

Answer

Configure HANA System Replication in active/active mode across all nodes.

Answer

Use Amazon RDS for SAP HANA with Multi-AZ deployment.

Answer

Deploy all nodes in a single Availability Zone with synchronous replication.

Question 2

An SAP administrator notices that the SAP application server is unable to establish an RFC connection to the SAP HANA database. The database is running on an EC2 instance in the same VPC. Security groups and NACLs allow all traffic. What is the most likely cause?

Accepted Answer

The application server is configured to connect to the wrong port number.. Option B is correct because the HANA database listens on port 3[instance number]13. If the application server is configured with the default HANA port (e.g., 30015), it would fail. Option A (instance reboot) would not cause permanent failure. Option C (wrong protocol) is less likely. Option D (subnet CIDR overlap) would cause connectivity issues at a different layer.

Answer

The VPC has overlapping CIDR blocks with the on-premises network.

Answer

The application server uses TCP instead of the required UDP protocol.

Answer

The HANA database instance was rebooted for maintenance.

Question 3

A company is deploying SAP S/4HANA on AWS and needs to choose the storage for the HANA data volume. Which EBS volume type provides the highest consistent IOPS for this workload?

Accepted Answer

EBS io2 Block Express. Option A is correct because io2 Block Express provides the highest IOPS of the listed types. Option B (io1) is older. Option C (st1) is throughput-optimized. Option D (gp3) offers baseline performance but lower max IOPS.

Answer

EBS gp3

Answer

EBS io1

Answer

EBS st1

Question 4

Refer to the exhibit. An SAP administrator is reviewing the EBS volume configuration for a SAP HANA /hana/data volume. The volume is 500 GB gp2 with DeleteOnTermination set to false. The instance is in us-east-1a. Which action should the administrator take to improve performance for SAP HANA?

Accepted Answer

Modify the volume to gp3 and provision 5000 IOPS.. SAP HANA requires a minimum of 5000 IOPS for /hana/data. The gp2 volume provides 1500 IOPS (3 IOPS per GB). The administrator should either increase the volume size to at least 1667 GB to get 5000 IOPS, or change to gp3 with provisioned IOPS of 5000 or more. The best practice for SAP HANA is to use multiple volumes in RAID 0, but the question asks about improving performance for this volume. Changing to gp3 with higher IOPS is a direct improvement.

Answer

Take a snapshot and create a new volume in us-east-1b.

Answer

Enable encryption on the volume.

Answer

Set DeleteOnTermination to true.

Question 5

A company is running SAP ERP on AWS with an Oracle database. The database is hosted on an EC2 instance with multiple EBS volumes. The company wants to encrypt the database at rest using AWS KMS. What is the correct procedure to enable encryption for the existing Oracle database without downtime?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with AWS KMS as the key store. Enabling EBS encryption on a running instance requires creating an encrypted snapshot, restoring a new encrypted volume, and attaching it; this involves downtime. Oracle TDE can be enabled online with minimal impact. AWS KMS does not provide database-level encryption natively; it is used for EBS encryption. Changing to RDS Custom requires migration.

Answer

Enable EBS encryption on the existing volumes by modifying the volume attribute

Answer

Migrate the database to Amazon RDS Custom for Oracle with encryption enabled

Answer

Use AWS KMS to encrypt the EBS volumes by creating a new encrypted volume and attaching it

Question 6

Refer to the exhibit. An SAP administrator has the IAM policy shown. The administrator needs to attach an EBS volume to an EC2 instance that is tagged with SAPSystem=DEV. Will the administrator be able to perform the attach operation?

Accepted Answer

No, because the condition requires the tag SAPSystem=PRD. The policy allows AttachVolume and DetachVolume actions, but only when the volume or instance resource has the tag SAPSystem=PRD. Since the instance is tagged DEV, the condition is not met, and the operation will be denied.

Answer

No, because the policy does not allow attaching volumes

Answer

Yes, because the policy allows the actions

Answer

Yes, because the resource is not restricted

Question 7

A company is running SAP HANA on AWS and wants to encrypt the EBS volumes at rest. The company requires key rotation and audit logging of key usage. Which solution should be used?

Accepted Answer

Use EBS encryption with AWS KMS. Amazon EBS encryption with AWS KMS provides key management, rotation, and audit logging. S3 server-side encryption does not apply to EBS. AWS CloudHSM is for hardware-based key management but does not provide automatic key rotation. AWS Certificate Manager is for SSL/TLS certificates.

Answer

Use AWS Certificate Manager

Answer

Use AWS CloudHSM to manage keys

Answer

Use S3 server-side encryption

Question 8

An SAP system administrator is troubleshooting an issue where an application cannot connect to an SAP HANA database running on an EC2 instance. The security group for the HANA instance allows inbound traffic on port 39013 (SQL) from the application server's security group. The network ACLs for the subnet allow all traffic. What could be the cause of the connectivity issue?

Accepted Answer

The network ACL for the HANA instance's subnet is missing an outbound rule to allow return traffic on ephemeral ports.. Option C is correct: The network ACL is stateless and must allow both inbound and outbound traffic; the outbound rule for ephemeral ports may be missing. Option A is incorrect because the security group allows the port. Option B is incorrect because the NACL allows all inbound traffic. Option D is incorrect because the security group allows the application server's security group.

Answer

The security group for the HANA instance does not allow inbound traffic on port 39013 from the application server's IP address.

Answer

The network ACL for the application server's subnet does not allow outbound traffic on port 39013.

Answer

The security group for the application server does not allow outbound traffic on port 39013.

Question 9

An SAP administrator created the IAM policy shown above to control access to an S3 bucket used for SAP HANA backups. The policy is attached to an IAM role used by an EC2 instance. The instance fails to upload backups. What is the cause?

Accepted Answer

The 'aws:SecureTransport' condition in the Deny statement is incorrectly using 'BoolIfExists' instead of 'Bool'.. Option D is correct because the Deny statement for 'aws:SecureTransport': 'false' will deny requests that are not using HTTPS. However, the condition 'BoolIfExists' evaluates to true if the key exists and is false, or if the key does not exist. If the request comes from an EC2 instance, the condition might not be met as expected. Option A (wrong VPC endpoint) is not relevant. Option B (explicit deny) is not the issue. Option C (lack of encryption) is not enforced by the policy.

Answer

The policy does not allow encryption (SSE-S3) which is required for backups.

Answer

The VPC endpoint ID in the policy does not match the actual endpoint.

Answer

The Deny statement overrides the Allow statement for all actions.

Question 10

Refer to the exhibit. An SAP system administrator checks disk usage on an SAP HANA instance. The /hana/log volume is at 80% usage. What is the recommended course of action to prevent issues?

Accepted Answer

Increase the size of the EBS volume for /hana/log and extend the filesystem.. SAP HANA requires that the log volume have sufficient free space to avoid transaction log overflow. The best practice is to increase the size of the log volume. Deleting logs manually is risky, and moving data volumes is not appropriate. The recommended action is to increase the EBS volume size and extend the filesystem.

Answer

Take a snapshot of the instance and terminate it.

Answer

Delete old backup files from /hana/log.

Answer

Move some data from /hana/log to /hana/data.

Question 11

An SAP Basis administrator is planning to migrate an SAP NetWeaver system from on-premises to AWS. The system uses a proprietary storage backend for the transport directory. Which AWS storage options are suitable for the SAP transport directory to provide shared access across multiple EC2 instances? (Choose TWO.)

Accepted Answer

Amazon FSx for Lustre. Amazon EFS provides a shared file system accessible from multiple Linux instances. Amazon FSx for Lustre is a high-performance file system for HPC and can be used for SAP transport directories if performance is critical. S3 is object storage, not a file system. EBS can only be attached to one instance at a time (except multi-attach which is limited). Instance store is ephemeral.

Answer

EC2 instance store

Answer

Amazon EBS with multi-attach

Answer

Amazon S3

Question 12

An SAP system on AWS is using a Multi-AZ deployment for high availability. The SAP Central Services (ASCS) and Enqueue Replication Server (ERS) are running on separate EC2 instances. During a failover test, the ASCS instance fails, but the ERS does not take over. What is the most likely cause?

Accepted Answer

The floating IP address is not configured to move to the ERS instance. SAP Enqueue Replication requires a floating IP address (using AWS Elastic IP or Route 53) that moves from ASCS to ERS during failover. If the floating IP is not properly configured, the ERS cannot take over. DNS resolution is not the primary method. Health checks are not the issue. Instance type is irrelevant.

Answer

The ERS instance does not have the required security group rules

Answer

The DNS TTL is set too high

Answer

The ERS instance is in a different subnet

Question 13

An SAP system uses an Application Load Balancer (ALB) to distribute traffic to web servers. The ALB is configured with a health check that fails, causing the web servers to be marked as unhealthy. What is a possible reason for the health check failure?

Accepted Answer

The web server is not configured to respond to the health check path. A common health check failure is when the health check path (e.g., /health) returns a non-200 status code. The security group allowing traffic from the ALB is required. Instance type does not affect health check. The subnet is not a direct cause.

Answer

The instance is in a private subnet

Answer

The instance type is not supported by the ALB

Answer

The security group for the ALB does not allow outbound traffic

Question 14

A company is designing a disaster recovery (DR) strategy for its SAP HANA database on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO actions are required to enable HANA System Replication (HSR) across AWS Regions? (Choose 2)

Accepted Answer

Set up a VPN or Direct Connect connection between the Regions for secure, low-latency communication.. Options B and D are correct. B: HSR requires low-latency network connectivity. D: For cross-region HSR, the log shipping must be asynchronous to avoid performance impact. A is incorrect because EBS snapshots are not used for HSR. C is incorrect because HSR does not use S3. E is incorrect because HSR is a database-level replication, not an application-level load balancer.

Answer

Enable cross-Region replication of EBS snapshots.

Answer

Use S3 Cross-Region Replication to copy HANA data files.

Answer

Deploy an Application Load Balancer in front of the HANA instances in both Regions.

Question 15

A company is migrating its SAP landscape to AWS. They have a mix of production and non-production systems. The SAP systems use a shared storage architecture for transport directories. Which AWS storage solution should be used for the SAP transport directory to provide low-latency access across multiple EC2 instances in the same region?

Accepted Answer

Amazon EFS. Amazon EFS provides a scalable, shared file system accessible from multiple EC2 instances with low latency, ideal for SAP transport directories. Amazon S3 is object storage, not a file system. Amazon FSx for Windows File Server is for Windows workloads. Amazon EBS volumes can only be attached to one instance at a time (except for multi-attach, which has limitations).

Answer

Amazon EBS with multi-attach

Answer

Amazon S3 with S3FS

Answer

Amazon FSx for Windows File Server