PAS-C01 Practice Questions 1 — 50 Questions

Question 1

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.. Option C is correct because if the SSM Agent is not running or cannot communicate with the AWS Systems Manager service, Patch Manager cannot execute the patching commands. The agent must be in a healthy state and have network connectivity (e.g., via VPC endpoints or internet gateway) to receive the patch baseline and report status. Option D is correct because the AWS-RunPatchBashelline SSM document execution history in Run Command provides detailed logs and error messages for each instance, allowing the team to identify why the patching failed, such as missing dependencies or timeout issues.

Answer

Assign the patch baseline to the instance IDs directly.

Answer

Ensure that the instances have the appropriate IAM role that allows them to be patched.

Answer

Configure a Maintenance Window for the patching operation.

Question 2

A company is migrating a legacy on-premises application to AWS. The application uses a MySQL database with a complex stored procedure that runs every hour and takes approximately 10 minutes to complete. The company wants to minimize downtime during migration. Which TWO approaches should the company use to migrate the database?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication from the source MySQL database to an Amazon RDS for MySQL instance.. Option B is correct because AWS DMS with ongoing replication allows continuous synchronization from the source MySQL database to Amazon RDS for MySQL, minimizing downtime during migration. The complex stored procedure that runs hourly and takes 10 minutes is handled seamlessly as DMS captures ongoing changes, enabling a controlled cutover with minimal disruption.

Answer

Use AWS DMS with a full load only, without ongoing replication, and schedule a cutover window.

Answer

Take a full database dump using mysqldump and import it into an Amazon RDS for MySQL instance during a planned maintenance window.

Answer

Create an Amazon RDS for MySQL read replica from the on-premises database.

Question 3

A company manages a multi-account AWS environment using AWS Organizations. The operations team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket. What is the MOST efficient way to enforce this configuration?

Accepted Answer

Deploy an AWS CloudFormation StackSet with a template that enables CloudTrail and configures the S3 bucket in every account and region.. Option B is correct because AWS CloudFormation StackSets allow you to deploy a CloudTrail configuration template across multiple accounts and regions in a single, automated operation. This approach ensures consistent enforcement of the policy without manual intervention, leveraging the centralized management capabilities of AWS Organizations.

Answer

Configure CloudTrail in the management account with an S3 bucket policy that grants access to all member accounts.

Answer

Create a custom script using AWS CLI to enable CloudTrail in each account and region.

Answer

Use AWS Service Catalog to publish a CloudTrail product and require each account to launch it.

Question 4

A company is running SAP HANA on an r5.8xlarge instance. They want to scale up to meet increased memory requirements. Which instance family would be the MOST suitable for a scale-up scenario?

Accepted Answer

x1e.32xlarge. The x1e.32xlarge instance is part of the X1e family, which is specifically designed for high-memory workloads like SAP HANA. With 3,904 GiB of memory, it provides the largest memory capacity among AWS instances, making it the most suitable for scaling up SAP HANA to meet increased memory requirements. SAP HANA is an in-memory database, so scaling up requires instances with high memory-to-vCPU ratios, which the X1e family delivers.

Answer

r5.24xlarge

Answer

i3.16xlarge

Answer

c5.18xlarge

Question 5

Which TWO of the following are best practices for securing SAP workloads on AWS?

Accepted Answer

Use IAM roles to grant EC2 instances access to AWS services.. IAM roles allow EC2 instances to securely access AWS services (e.g., S3, DynamoDB) without embedding long-term credentials. By attaching an IAM role to an EC2 instance, the instance can obtain temporary credentials via the instance metadata service, which is a best practice for securing SAP workloads on AWS.

Answer

Disable encryption in transit between application and database tiers.

Answer

Allow SSH access from the internet for administration.

Answer

Store SAP backup files in a public S3 bucket for easy access.

Question 6

Which THREE of the following are valid considerations when designing an SAP HANA backup strategy on AWS?

Accepted Answer

Use EBS snapshots for backing up HANA data volumes.. Option A is correct because EBS snapshots provide a consistent, point-in-time backup of HANA data volumes when the database is in backup mode (e.g., using hdbsql to create a snapshot). This method is supported by SAP and AWS, and it allows for fast recovery by restoring the entire volume without needing to replay transaction logs from a separate backup.

Answer

Back up HANA data directly to Amazon S3 using standard tools.

Answer

Replicate backups to another AWS Region using S3 Cross-Region Replication.

Question 7

A company is running SAP on AWS and needs to design a disaster recovery (DR) solution with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. The primary region is us-east-1 and the DR region is us-west-2. The SAP application uses an SAP HANA database with a size of 2 TB. Which combination of AWS services should be used to meet the DR requirements most cost-effectively?

Accepted Answer

Configure HANA System Replication (HSR) across regions and use a standby HANA instance in us-west-2 with a smaller instance size.. Option D is correct because HANA System Replication (HSR) is the native SAP HANA replication technology that can achieve an RPO of 15 minutes or less by asynchronously replicating data across regions. By using a smaller standby instance in us-west-2, the solution meets the RTO of 4 hours (since the standby can be scaled up or promoted quickly) while minimizing ongoing DR costs. This approach is purpose-built for SAP HANA and avoids the overhead of third-party tools or backup-based restores.

Answer

Use AWS Database Migration Service (DMS) with continuous replication from the primary HANA database to a target in us-west-2.

Answer

Use AWS Backup with continuous backups and cross-region copy to achieve RPO of 15 minutes.

Answer

Use AWS Backup to take hourly backups of the HANA database and restore in us-west-2 during a disaster.

Question 8

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are also in private subnets. The security group for the RDS instance allows inbound traffic on port 3306 from the security group attached to the ECS tasks. However, the application cannot connect to the database. Which solution should the company implement to resolve this issue?

Accepted Answer

Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306. Option B is correct because when using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

Answer

Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway

Answer

Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity

Answer

Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID

Question 9

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

Accepted Answer

Replatform the application by migrating the Oracle database to Amazon RDS for Oracle. Option D is correct because the company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Answer

Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

Answer

Store the data in Amazon S3 and use Athena for querying

Answer

Refactor the application to use Amazon DynamoDB as the database

Question 10

A company runs a stateful web application on EC2 instances in an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The application maintains session state in memory on each instance. Users report that they are frequently logged out and lose their session data during scaling events. What should the company do to resolve this issue?

Accepted Answer

Modify the application to store session state in an Amazon ElastiCache cluster. Option C is correct because storing session state externally in ElastiCache decouples session data from individual EC2 instances. This ensures that when instances are terminated or added during scaling events, users retain their session state regardless of which instance serves their request. ElastiCache provides a low-latency, in-memory cache that is ideal for session persistence in stateful web applications.

Answer

Change the scaling policy to a simple scaling policy instead of dynamic scaling

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer

Answer

Increase the cooldown period for the Auto Scaling group

Question 11

A company is migrating a 10 TB SQL Server database to Amazon RDS for SQL Server using AWS DMS. The migration is taking longer than expected. Which TWO actions can improve the migration speed? (Choose two.)

Accepted Answer

Enable parallel loading by splitting tables into multiple tasks. Option B is correct because splitting tables into multiple DMS tasks enables parallel loading, which significantly reduces migration time by processing multiple tables concurrently. Option D is correct because increasing the DMS replication instance size provides more CPU and memory resources, allowing the instance to handle larger data volumes and higher throughput more efficiently.

Answer

Use a single DMS task with full LOB mode

Answer

Use S3 multipart upload for the data

Answer

Disable transaction logging on the source

Question 12

A company is migrating a legacy .NET application to AWS. The application uses Windows Authentication and relies on Active Directory for user authentication. The company wants to minimize changes to the application code. Which AWS service should be used to integrate Active Directory with the migrated application?

Accepted Answer

AWS Directory Service for Microsoft Active Directory. AWS Directory Service for Microsoft Active Directory is the correct choice because it provides a fully managed Microsoft Active Directory in the AWS cloud, which natively supports Windows Authentication and Kerberos-based authentication without requiring any code changes. This service allows the migrated .NET application to seamlessly integrate with the existing on-premises Active Directory through a trust relationship or by extending the directory directly into AWS, preserving the application's authentication logic.

Answer

Amazon Cognito

Answer

AD Connector

Answer

Simple AD

Question 13

A company is migrating a web application from an on-premises data center to AWS. The application uses a MySQL database that is 500 GB in size. The company wants to minimize downtime during the migration. Which approach should the company use?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication. AWS Database Migration Service (DMS) with ongoing replication (change data capture, CDC) allows you to perform a live migration with minimal downtime. You can start a full load of the 500 GB MySQL database while the source remains operational, then enable CDC to replicate ongoing changes until you cut over to the target RDS instance, reducing the downtime window to seconds.

Answer

Use an RDS read replica and promote it

Answer

Stop the database, take a mysqldump, and restore to RDS

Answer

Use AWS Schema Conversion Tool (SCT) to migrate the schema and data

Question 14

A company is migrating a multi-tier application to AWS. The application includes a load balancer, web servers, and an Oracle database. The migration plan includes using AWS DMS for the database. During the initial full load, the DMS task fails with an error indicating insufficient memory. The source database is on an EC2 instance with 4 GB RAM. What should the migration team do to resolve this issue?

Accepted Answer

Increase the size of the DMS replication instance. Option C is correct because the error 'insufficient memory' during the initial full load in AWS DMS typically indicates that the replication instance does not have enough memory to handle the data volume or LOB processing. Increasing the size of the DMS replication instance provides more memory for caching, transformation, and LOB handling, directly resolving the resource constraint without altering the source database or task structure.

Answer

Disable LOB support in the DMS task

Answer

Split the migration into multiple smaller tasks

Answer

Increase the memory of the source EC2 instance

Question 15

A company is planning to migrate a critical application to AWS using the 7 Rs migration strategy. The application is currently running on a large VMware VM. Which THREE strategies are appropriate for this migration? (Choose three.)

Accepted Answer

Rehost: Use AWS VM Import/Export to migrate the VM to EC2. Rehost (A) is appropriate because AWS VM Import/Export allows you to migrate VMware VMs directly to Amazon EC2 as AMIs, enabling a lift-and-shift migration with minimal changes. This is a core 7 Rs strategy for moving existing virtualized workloads to AWS.

Answer

Retire: Decommission the application as it is no longer needed

Answer

Retain: Keep the application on-premises

Question 16

A company is migrating a critical application to AWS using a lift-and-shift strategy. The application has a legacy licensing model tied to specific hardware IDs. The company has already migrated the application to an Amazon EC2 instance but the license validation fails because the hardware ID changed. What is the MOST cost-effective and least disruptive solution?

Accepted Answer

Use AWS License Manager to create a hardware-based license token that matches the original hardware ID.. Option D is correct because AWS License Manager can create a hardware-based license token that binds the license to a specific hardware ID, allowing the application to validate against the original hardware ID even after migration to EC2. This is the most cost-effective and least disruptive solution as it avoids modifying the application code or reverting the migration, and it leverages AWS-native licensing management without requiring dedicated hardware.

Answer

Revert the migration and keep the application on-premises with a VPN connection to AWS for other services.

Answer

Provision a Dedicated Host and associate the instance with it to control hardware IDs.

Answer

Modify the application's license file to accept the new hardware ID.

Question 17

A company is migrating a web application to AWS and wants to use a blue/green deployment strategy to minimize downtime. Which AWS service should be used to route traffic between the blue and green environments?

Accepted Answer

Amazon Route 53. Amazon Route 53 is correct because it supports weighted DNS routing, which allows you to shift traffic gradually between blue and green environments by adjusting the weight values for DNS records. This enables a blue/green deployment strategy with minimal downtime, as Route 53 can route a percentage of traffic to the new environment while keeping the old environment active for rollback.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Application Load Balancer (ALB)

Question 18

An organization is migrating a large data lake (500 TB) from on-premises HDFS to Amazon S3. The migration must be completed within 3 weeks. The network bandwidth between on-premises and AWS is 1 Gbps. What is the MOST efficient migration approach?

Accepted Answer

Use multiple AWS Snowball Edge devices to transfer the data in parallel.. Given the 500 TB data volume and a 3-week deadline, the 1 Gbps network bandwidth yields a theoretical maximum transfer of only ~340 TB in 3 weeks (1 Gbps * 21 days * 86400 seconds / 8 bits per byte), which is insufficient. AWS Snowball Edge devices provide a petabyte-scale, offline data transfer solution that bypasses network constraints entirely, allowing parallel transfers to meet the timeline. This is the most efficient approach because it avoids network bottlenecks and leverages physical shipping for massive datasets.

Answer

Use AWS DataSync over the existing internet connection.

Answer

Order a dedicated AWS Direct Connect circuit at 10 Gbps and use AWS DataSync.

Answer

Use Amazon S3 Transfer Acceleration to speed up the transfer over the internet.

Question 19

A company is migrating a multi-tier application to AWS and wants to ensure high availability. The application has a web tier, application tier, and database tier. The database is currently running on a single on-premises server. Which migration strategy minimizes downtime and provides the HIGHEST availability for the database tier?

Accepted Answer

Use AWS DMS to migrate the database to Amazon RDS Multi-AZ deployment.. Option C is correct because AWS DMS can perform a live migration with minimal downtime by continuously replicating changes from the source database to the target Amazon RDS Multi-AZ deployment. Multi-AZ provides automatic failover to a standby replica in a different Availability Zone, ensuring the highest availability for the database tier. This combination minimizes downtime during migration and provides built-in high availability post-migration.

Answer

Use AWS Database Migration Service (DMS) to migrate to Amazon RDS in a single-AZ deployment, then manually take snapshots.

Answer

Migrate the database to a single large Amazon EC2 instance using AWS Application Migration Service.

Answer

Migrate to Amazon RDS with Multi-AZ deployment and use DMS for initial load.

Question 20

A company is migrating a legacy application to AWS. The application currently uses Oracle Database and the company wants to migrate to Amazon Aurora PostgreSQL with minimal downtime. Which TWO steps should be taken to achieve this? (Choose TWO)

Accepted Answer

Use the AWS Schema Conversion Tool (SCT) to convert the Oracle schema to PostgreSQL.. Option A is correct because the AWS Schema Conversion Tool (SCT) can automatically convert Oracle database schemas (including stored procedures, views, and data types) to a PostgreSQL-compatible format, which is essential when migrating to Amazon Aurora PostgreSQL. Option D is correct because AWS DMS with ongoing replication (change data capture) allows you to keep the source Oracle database and target Aurora PostgreSQL synchronized with minimal downtime, enabling a near-zero-downtime migration by capturing and applying incremental changes.

Answer

Rehost the Oracle database on an Amazon EC2 instance to minimize changes.

Answer

Configure Amazon Aurora PostgreSQL with Multi-AZ for high availability.

Answer

Export Oracle database as dump files and import into Aurora PostgreSQL using native tools.