PAS-C01 Practice Questions 2 — 50 Questions

Question 1

A company is migrating an SAP ERP system to AWS. They have multiple SAP systems (DEV, QAS, PRD) and want to automate the deployment of identical environments. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it lets the company define the entire SAP landscape (DEV, QAS, PRD) as code in templates, so identical, repeatable environments can be provisioned automatically and consistently. It supports infrastructure-as-code with parameters, mappings, and nested stacks, which is ideal for deploying multiple SAP systems with the same architecture. AWS OpsWorks is a configuration-management service (Chef/Puppet) and does not provide the same declarative template-based environment provisioning. AWS Elastic Beanstalk targets application deployment for web apps, not full SAP infrastructure stacks, and AWS CodeDeploy only automates application code deployments to instances, not environment creation.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 2

A company is migrating SAP ECC to AWS and needs to ensure low-latency connectivity between the SAP application and database servers. Which AWS service is most appropriate to achieve this?

Accepted Answer

Placement groups for the application and database instances.. Placement groups, specifically cluster placement groups, provide low-latency, high-throughput network connectivity by placing instances in a single Availability Zone within a low-latency, 10 Gbps network. This is ideal for SAP ECC where the application and database servers require consistent, sub-millisecond latency for optimal performance.

Answer

VPC peering between the application and database subnets.

Answer

AWS Direct Connect to connect the application and database servers.

Answer

AWS Transit Gateway to connect the application and database subnets.

Question 3

An SAP administrator runs the AWS CLI command shown in the exhibit to check the status of a production HANA instance. The output shows the instance is running in us-east-1a. However, the SAP application team reports that the HANA database is not responding. What should the administrator check next to diagnose the issue?

Accepted Answer

The HANA database service is not running on the instance. The AWS CLI command only checks the EC2 instance state (e.g., 'running'), not the status of the HANA database service itself. Even if the instance is running, the HANA database service (hdbnameserver, hdbindexserver, etc.) may have crashed, failed to start, or been stopped. The administrator should SSH into the instance and run commands like 'systemctl status hdbindexserver' or 'sapcontrol -nr <instance_number> -function GetProcessList' to verify the HANA service status.

Answer

The EBS volumes are detached from the instance

Answer

The instance state is 'running' so no issue with the instance

Answer

The security group does not allow inbound traffic to the database port

Question 4

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver and set an alarm when it exceeds 90% for 5 minutes. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides detailed monitoring of EC2 instances, including CPU utilization metrics, and allows you to set CloudWatch Alarms that trigger when a metric exceeds a specified threshold (e.g., 90%) for a given number of consecutive evaluation periods (e.g., 5 minutes). This is the native AWS service designed for performance monitoring and alerting.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 5

A company is migrating its SAP landscape to AWS. The SAP systems consist of multiple instances (development, quality, production) running on different EC2 instances. The company wants to automate the provisioning of these instances using infrastructure as code. Which AWS service should be used to define and provision the SAP infrastructure in a repeatable manner?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire SAP infrastructure—including EC2 instances, VPCs, security groups, and storage—as code using a JSON or YAML template. This enables repeatable, version-controlled provisioning of development, quality, and production environments, which is essential for an SAP migration requiring consistent and automated deployments.

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 6

An SAP system on AWS needs to be highly available across two Availability Zones. The application tier runs on EC2 instances behind an Application Load Balancer. The database tier uses an RDS Multi-AZ deployment. What additional step is REQUIRED to ensure complete high availability for the application tier?

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. For the application tier to be highly available across two Availability Zones, EC2 instances must be distributed across at least two AZs so that if one AZ fails, the Application Load Balancer can route traffic to instances in the other AZ. Option B directly addresses this requirement. Without instances in multiple AZs, the application tier remains a single point of failure, even if the ALB and RDS Multi-AZ are configured correctly.

Answer

Use a larger EC2 instance type.

Answer

Enable EBS Multi-Attach for the root volumes.

Answer

Configure an Auto Scaling group with a dynamic scaling policy.

Question 7

A company runs SAP on AWS and uses AWS Transit Gateway to connect multiple VPCs. They notice that inter-VPC traffic is being dropped. What is a likely cause?

Accepted Answer

Missing routes in the VPC route tables pointing to the Transit Gateway.. AWS Transit Gateway requires explicit routes in each VPC's route table pointing to the Transit Gateway attachment ID for traffic to be forwarded between VPCs. Without these routes, the VPCs have no path to reach the Transit Gateway, causing inter-VPC traffic to be dropped at the VPC router level.

Answer

Security groups not allowing return traffic.

Answer

Transit Gateway does not support transitive routing.

Answer

Network ACLs blocking traffic.

Question 8

Refer to the exhibit. A CloudFormation template is used to launch an EC2 instance for SAP. The instance launches but the root volume is only 50 GB. The SAP installation requires at least 100 GB for the root volume. How should the template be modified?

Accepted Answer

Change VolumeSize from 50 to 100 in the BlockDeviceMapping.. The CloudFormation template explicitly defines the root volume size in the BlockDeviceMapping property. By changing VolumeSize from 50 to 100, the template will provision a new EC2 instance with a 100 GB root volume, meeting the SAP installation requirement. The BlockDeviceMapping overrides the default root volume size from the AMI, so this is the precise way to control volume size at launch.

Answer

Change the InstanceType to a larger instance.

Answer

Modify the running instance's root volume size using the AWS Management Console.

Answer

Change the ImageId to an AMI with a larger root volume.

Question 9

An SAP administrator needs to provide temporary, time-limited access to an S3 bucket containing SAP backup files for an external auditor. The auditor should be able to download files from the bucket. Which method provides the most secure way to grant access?

Accepted Answer

Generate a presigned URL for each file the auditor needs to download.. Presigned URLs grant temporary, time-limited access to specific S3 objects without requiring the auditor to have AWS credentials or any permanent permissions. The SAP administrator can generate a presigned URL for each backup file, set an expiration time, and share the URL with the auditor, who can then download the file using standard HTTP GET requests. This approach follows the principle of least privilege and ensures access is revoked automatically after the URL expires.

Answer

Create an IAM user with read-only access to the bucket and share the credentials with the auditor.

Answer

Provide the auditor with the root user credentials of the AWS account.

Answer

Make the bucket publicly readable and share the bucket URL.

Question 10

A company runs SAP NetWeaver on AWS and wants to improve the operational resilience of its SAP application servers. The application servers are behind an Application Load Balancer (ALB) and run on Amazon EC2 instances in an Auto Scaling group. The operations team needs to ensure that unhealthy application servers are automatically replaced and that the replacement instances are correctly registered with the ALB. Which TWO configurations should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Configure the Auto Scaling group to use the ALB target group's health check as the health check type.. To automatically replace unhealthy SAP application servers and ensure replacements are registered with the ALB, the Auto Scaling group must use the ALB target group's health checks and have the target group attached. These two configurations together provide end-to-end health monitoring and automatic registration, eliminating manual intervention and ensuring high availability.

Answer

Configure a scheduled scaling policy to replace all instances every night, and use the ALB to drain connections before termination.

Answer

Create a lifecycle hook that sends a notification to an Amazon SNS topic when an instance is terminating, and use a Lambda function to deregister the instance from the target group.

Answer

Enable Elastic Load Balancing health checks on the EC2 instances and configure the Auto Scaling group to use EC2 status checks as the health check type.

Question 11

An SAP basis team manages a production S/4HANA system on AWS. They must be able to detect whether any AWS resource in the account deviates from the approved configuration baseline (e.g., an EC2 instance type change or an S3 bucket policy modification). The security team wants a managed service that continuously evaluates these resources and reports compliance. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config is the only service listed that continuously records resource configurations and evaluates them against rules representing the approved baseline. It can detect changes such as an EC2 instance type modification or an S3 bucket policy update and flag them as noncompliant. The other services either provide recommendations, scan for vulnerabilities, or log API activity, but none perform ongoing configuration compliance evaluation against a custom baseline.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 12

A company is migrating its SAP ERP system to AWS and needs to choose a storage option for the SAP HANA database. Which AWS storage service is most suitable for SAP HANA data volumes?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the most suitable for SAP HANA data volumes because they provide the highest level of performance, durability, and consistency required for SAP HANA's demanding I/O workloads. io2 Block Express volumes offer up to 256,000 IOPS per volume and sub-millisecond latency, meeting SAP's certification requirements for production SAP HANA deployments on AWS. This storage type ensures the low-latency, high-throughput, and consistent performance that SAP HANA's in-memory database requires for its data and log volumes.

Answer

Amazon S3

Answer

Amazon EBS gp3 volumes

Answer

Amazon EFS

Question 13

A company is migrating an SAP HANA system from on-premises to AWS. The HANA system uses a large amount of memory (2 TB). Which EC2 instance type is most suitable for this workload?

Accepted Answer

x2iedn.32xlarge. (x2iedn.32xlarge) is correct because it is a memory-optimized instance with up to 4 TB of memory, making it suitable for SAP HANA workloads requiring 2 TB of memory. Option B (c5n.18xlarge) is wrong because c5n instances are compute-optimized and have less memory. Option C (m5n.24xlarge) is wrong because m5n instances are general-purpose and cannot support 2 TB of memory. Option D (r5.24xlarge) is wrong because r5 instances have a maximum memory of 768 GB.

Answer

c5n.18xlarge

Answer

m5n.24xlarge

Answer

r5.24xlarge

Question 14

A company runs SAP S/4HANA on AWS with a multi-tier landscape (DEV, QAS, PRD). The PRD system uses a clustered setup with two application servers behind an Application Load Balancer. The database is a single-node HANA on an r5.24xlarge instance. The administrator receives an alert that the PRD application is slow. CloudWatch metrics show high CPU utilization on the two application servers (average 95%) and high DB connection count. The ALB shows increased request latency. The database CPU is at 60%. The administrator suspects a SQL query performance issue. What should be the first step to identify the root cause?

Accepted Answer

Enable detailed SQL trace in HANA to identify high-resource queries.. The symptoms (high CPU on app servers, high DB connections, increased ALB latency, DB CPU at 60%) strongly suggest a SQL query performance bottleneck, not a capacity issue. Enabling detailed SQL trace in HANA (option B) is the most direct first step to identify the specific high-resource queries causing the slowdown, as it captures execution plans, wait times, and resource consumption per query. This aligns with SAP's recommended troubleshooting methodology for HANA performance issues.

Answer

Configure CloudWatch Logs to capture HANA trace logs and analyze them.

Answer

Add two more application servers to distribute the load.

Answer

Increase the size of the HANA database instance to reduce CPU pressure.

Question 15

An SAP system on AWS is running on a single Availability Zone. The operations team wants to improve high availability. Which THREE actions should they take?

Accepted Answer

Use an Application Load Balancer to distribute traffic across AZs.. Option A is correct because an Application Load Balancer operates at the regional level and can distribute incoming traffic across targets in multiple Availability Zones, removing the single-AZ bottleneck and enabling failover if one AZ becomes unavailable. Option D is correct because placing SAP application servers in an Auto Scaling group spanning multiple AZs ensures the application tier can survive an AZ outage and automatically replace unhealthy instances. Option E is correct because the SAP database is the critical stateful component, and a Multi-AZ deployment (for example, RDS Multi-AZ or a database-level HA cluster with synchronous replication) provides automatic failover to a standby in another AZ. Option B is incorrect because EBS Multi-Attach only allows a volume to be attached to multiple Nitro instances within the same Availability Zone, not across AZs. Option C is incorrect because Elastic IP addresses provide static public addressing and instance-level remapping, but they do not by themselves create cross-AZ high availability or replicate data.

Answer

Use EBS Multi-Attach to share volumes across AZs.

Answer

Assign Elastic IP addresses to instances for failover.

Question 16

A company runs a critical SAP application on AWS. The operations team needs to monitor the system for performance issues and receive alerts when CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this monitoring and alerting?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch can monitor CPU utilization and trigger alarms when a threshold is breached. CloudTrail is for API auditing, Config is for compliance, and AWS Health provides service health notifications.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Health

Question 17

A company is planning to run SAP BusinessObjects (BOBJ) on AWS. The application servers require consistent low-latency access to a shared file system for storing reports and configuration files. Which AWS storage solution is BEST suited for this requirement?

Accepted Answer

Amazon Elastic File System (Amazon EFS).. Amazon EFS provides a fully managed, scalable, and shared file system that can be accessed concurrently by multiple EC2 instances via the NFSv4.1 protocol. For SAP BusinessObjects application servers requiring consistent low-latency access to shared reports and configuration files, EFS delivers the necessary POSIX permissions, strong consistency, and automatic scaling without provisioning overhead, making it the ideal choice.

Answer

Amazon Elastic Block Store (Amazon EBS) with a multi-attach enabled volume.

Answer

Amazon Simple Storage Service (Amazon S3).

Answer

Amazon FSx for Windows File Server.

Question 18

A company is designing a disaster recovery (DR) strategy for SAP on AWS. The primary region is us-east-1 and the DR region is us-west-2. The SAP HANA database is 2 TB. The recovery point objective (RPO) is 15 minutes and the recovery time objective (RTO) is 4 hours. Which solution meets these requirements most cost-effectively?

Accepted Answer

HANA System Replication in asynchronous mode. HANA System Replication in asynchronous mode meets the RPO of 15 minutes and RTO of 4 hours for a 2 TB database while being more cost-effective than synchronous replication, which would introduce latency and require high-bandwidth, low-latency links. Asynchronous replication allows the secondary system to lag slightly behind the primary, which is acceptable for a 15-minute RPO, and avoids the performance impact on the primary system that synchronous mode would impose over a long-distance link.

Answer

HANA System Replication in synchronous mode

Answer

Log shipping to an S3 bucket in DR region

Answer

EBS snapshot replication to DR region using AWS Backup

Question 19

An SAP administrator is deploying an SAP ASCS instance using CloudFormation. The deployment fails because the instance cannot be reached from other SAP components. Based on the exhibit, what is the most likely cause?

Accepted Answer

The security group does not allow inbound traffic on the required SAP ports.. The SAP ASCS instance must be reachable by other SAP components (e.g., PAS, AAS) on specific ports for services like the SAP Message Server (port 36xx/TCP) and SAP Enqueue Server (port 32xx/TCP). The exhibit shows the security group lacks inbound rules for these ports, so traffic from other components is blocked, causing the deployment to fail. Without proper inbound access, the ASCS instance cannot participate in the SAP system's communication, leading to the unreachability error.

Answer

The instance type m5.large is not certified for SAP ASCS.

Answer

The instance lacks an IAM role to join the SAP domain.

Answer

The root volume is too small and uses gp2, which is not supported for SAP.

Question 20

A company is migrating an SAP system to AWS and wants to use AWS Systems Manager for patching. The SAP application server is running Windows. What is a prerequisite for Systems Manager to manage the instance?

Accepted Answer

Install the AWS Systems Manager Agent (SSM Agent) on the instance. AWS Systems Manager requires the SSM Agent to be installed and running on managed instances to perform patching and other management operations. The SSM Agent processes Systems Manager requests, executes run commands, and reports instance state back to the Systems Manager service. Without the agent, the instance cannot communicate with the Systems Manager endpoint or receive patching instructions.

Answer

Install the Amazon CloudWatch agent on the instance

Answer

Enable AWS Config on the instance

Answer

Assign a public IP address to the instance