PAS-C01 Practice Test 5 — 10 Questions

Question 1

An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not include the ec2:CreateTags action.. The IAM policy explicitly grants ec2:StartInstances and ec2:StopInstances actions but does not include ec2:CreateTags. Without the ec2:CreateTags action, the user lacks the required permission to create or modify tags on EC2 instances, even though they can start and stop them.

Answer

The user does not have permission to describe instances.

Answer

The resource ARN is too restrictive.

Answer

There is an implicit deny for all actions not listed.

Question 2

A company is migrating a legacy on-premises Oracle database to Amazon RDS for Oracle. They need to minimize downtime. Which AWS service should they use for ongoing replication during the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) with ongoing replication (change data capture) allows near-zero downtime migration. Option A (AWS Schema Conversion Tool) is wrong because it is a schema conversion tool, not a replication service. Option B (AWS Server Migration Service) is wrong because it is for server migration, not database replication. Option D (AWS DataSync) is wrong because it is for file/object storage, not database replication.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Question 3

A company is experiencing performance issues with their SAP ERP system on AWS. The system is running on an r5.4xlarge EC2 instance with gp2 EBS volumes. The database is SAP HANA. CloudWatch metrics show high write latency on the data volume. Which change would most likely improve performance?

Accepted Answer

Change the volume type to io2 Block Express. SAP HANA is highly sensitive to storage latency, and the high write latency on the data volume indicates that gp2's burst model is insufficient for sustained write workloads. io2 Block Express provides consistent, sub-millisecond latency with provisioned IOPS up to 256,000, which directly addresses the performance bottleneck. This change aligns with AWS best practices for SAP HANA production workloads, which recommend io2 volumes for data and log volumes.

Answer

Increase the size of the gp2 volume to get more baseline IOPS

Answer

Move the database to a t3.large instance

Answer

Enable EBS optimization on the instance

Question 4

A company is setting up a disaster recovery (DR) site for SAP on AWS. They need to replicate the SAP HANA database to another region. Which AWS service is BEST suited for this?

Accepted Answer

SAP HANA System Replication. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for replicating HANA databases asynchronously or synchronously across regions. It replicates at the database level using log shipping and is the only option that maintains full SAP HANA consistency, transaction integrity, and support for takeover in a DR scenario.

Answer

AWS Backup cross-region copy

Answer

AWS Database Migration Service (DMS)

Answer

Amazon S3 Cross-Region Replication

Question 5

An SAP administrator is creating an IAM policy to allow SAP basis users to manage their own SAP EC2 instances. The policy above is intended to allow users to start, stop, and reboot instances tagged with their username. However, users report that they cannot start instances. What is the MOST likely reason?

Accepted Answer

The ec2:StartInstances action does not support resource-level permissions; it requires a separate condition or a wildcard resource.. The ec2:StartInstances action does not support resource-level permissions in IAM policies. This means that even if the policy specifies a condition based on tags, the condition is ignored for StartInstances, and the action will be denied unless the resource element is set to a wildcard ('*'). AWS documentation explicitly states that StartInstances, StopInstances, and RebootInstances require a wildcard resource or a separate condition to allow the action, making option D the correct answer.

Answer

The condition references ${aws:username} which is not available in the context.

Answer

The condition key ec2:ResourceTag/SAPSystem is not valid.

Answer

The actions are not correct for managing instances.

Question 6

Drag and drop the steps to configure an SAP S/4HANA high-availability cluster using AWS Resilience Hub into the correct order.

Accepted Answer

1. Define the application stack in Resilience Hub. 2. Associate a resilience policy and run an assessment. 3. Implement the recommended changes (e.g., configure HA cluster). 4. Validate the configuration with a test and monitor using Resilience Hub.. Resilience Hub helps assess and improve HA by defining stack, assessing policy, implementing changes, testing, and monitoring.

Answer

1. Define the application stack. 2. Implement recommended changes. 3. Associate a resilience policy and run an assessment. 4. Validate and monitor.

Answer

1. Associate a resilience policy and run an assessment. 2. Define the application stack. 3. Implement recommended changes. 4. Validate and monitor.

Answer

1. Define the application stack. 2. Associate a resilience policy and run an assessment. 3. Validate and monitor. 4. Implement recommended changes.

Question 7

A company is running a critical web application on EC2 instances behind an Application Load Balancer. During a recent deployment, a new version of the application was released, and within minutes, the error rate spiked. The operations team rolled back the deployment, but the error rate remained high. The team suspects that the ALB is still routing traffic to unhealthy instances. Which step should the team take to immediately stop routing traffic to the problematic instances?

Accepted Answer

Deregister the instances from the target group.. Deregistering the problematic EC2 instances from the target group immediately stops the Application Load Balancer from routing any new traffic to them. The ALB performs health checks on registered targets, but if an instance is unhealthy, it still remains in the target group and can receive traffic if the health check logic is misconfigured or if the instance is in a 'draining' state. Deregistration forces the ALB to complete any in-flight requests and then remove the instance from the routing table, providing an immediate stop to traffic.

Answer

Modify the ALB listener rules to point to a different target group.

Answer

Modify the health check interval to 5 seconds and the unhealthy threshold to 2.

Answer

Stop the EC2 instances from the AWS Management Console.

Question 8

Which TWO of the following are required for SAP HANA high availability on AWS using HANA System Replication (HSR) with automatic failover? (Select TWO.)

Accepted Answer

An Amazon Route 53 health check that monitors the primary instance and updates a DNS record to the secondary IP on failure.. Amazon Route 53 health checks can monitor the primary HANA instance's availability. On failure, a Route 53 failover routing policy automatically updates the DNS record to point to the secondary instance's private IP, enabling clients to reconnect without manual intervention. This is a key component of HANA System Replication (HSR) with automatic failover on AWS.

Answer

Application Auto Scaling to automatically scale HANA instances.

Answer

An Elastic Load Balancer (ELB) in front of the HANA instances to distribute traffic.

Answer

An Amazon Route 53 alias record pointing to the primary instance's private IP.

Question 9

A company runs its SAP ERP system on AWS. The database is SAP HANA on an EC2 instance. The system is critical and requires a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 2 hours. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) to perform continuous backups to S3.. AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) provides continuous, incremental backups to Amazon S3, achieving an RPO of less than 5 minutes with automated, policy-driven backups. This solution minimizes operational overhead by eliminating manual scripting and infrastructure management, while supporting point-in-time recovery within the required RTO of under 2 hours.

Answer

Use EBS snapshots of the root and data volumes taken every 5 minutes.

Answer

Set up HANA system replication across two EC2 instances in different Availability Zones with manual failover.

Answer

Schedule manual HANA backups to S3 using cron scripts and hdbsql commands.

Question 10

Which THREE actions should be taken to ensure minimal downtime during an SAP system migration to AWS using SAP HSR (HANA System Replication)?

Accepted Answer

Perform a takeover to the target system to finalize migration.. To minimize downtime during an SAP HANA migration to AWS using HSR, it is critical to replicate data in advance. Pre-provisioning the target HANA instance on AWS ensures the infrastructure is ready (C). Configuring HANA System Replication between source and target enables ongoing data synchronization (E). Performing a takeover to the target system finalizes the migration with a quick cutover, minimizing downtime (B). Disabling backups on the source (A) is risky and does not reduce downtime, and manually copying data files (D) is unnecessary because HSR handles the replication.

Answer

Disable backups on the source system to reduce load.

Answer

Manually copy data files to AWS before starting replication.