PAS-C01 Practice Exam 52 — 20 Questions

Question 1

Which TWO of the following are required when integrating SAP HANA with AWS Direct Connect for hybrid connectivity?

Accepted Answer

A Virtual Private Gateway attached to the VPC.. Option B is correct because a Virtual Private Gateway (VGW) must be attached to the target VPC to serve as the AWS-side anchor for the private virtual interface that carries Direct Connect traffic into the VPC. Option D is correct because AWS Direct Connect uses BGP for dynamic route exchange, so BGP peering must be established between the customer's on-premises router and the AWS router (over the private or transit virtual interface) for the SAP HANA subnets to be reachable. Option A is wrong because a public virtual interface is used to reach AWS public services (e.g., S3 endpoints) over public IP space, not to access resources inside a VPC, which requires a private virtual interface. Option C is wrong because a Direct Connect Gateway is only needed when connecting to VPCs in multiple regions or to multiple VPCs via a transit gateway, not for a basic single-VPC hybrid integration. Option E is wrong because a VPN tunnel is an alternative or backup IPsec-over-internet connection, not a requirement for Direct Connect, which is a dedicated private layer-2/layer-3 link.

Answer

A Public Virtual Interface to access the VPC.

Answer

A Direct Connect Gateway for the connection.

Answer

A VPN tunnel between on-premises and AWS.

Question 2

A company is migrating a large Oracle database to Amazon RDS for Oracle. They want to minimize downtime during the migration. Which AWS service should they use to replicate data in real time?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is purpose-built for continuous, real-time replication between source and target databases, including Oracle-to-RDS-for-Oracle. It supports ongoing change data capture (CDC) so the target stays in sync until cutover, minimizing downtime. This is the standard AWS answer for 'replicate data in real time during migration.'

Answer

AWS Server Migration Service (SMS)

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS DataSync

Question 3

An SAP system administrator is setting up monitoring for SAP NetWeaver on AWS. They want to send custom SAP application metrics to CloudWatch for alerting. What is the most efficient way to achieve this?

Accepted Answer

Install the Amazon CloudWatch Agent on the EC2 instance and configure it to collect SAP metrics. The CloudWatch Agent can collect custom metrics from the OS and applications, including SAP, and publish them to CloudWatch. AWS Lambda can be used but requires custom code and more overhead. SAP Solution Manager does not natively integrate with CloudWatch. AWS Systems Manager is for management, not custom metric publishing.

Answer

Use SAP Solution Manager to export metrics to CloudWatch via API

Answer

Use AWS Lambda to periodically query SAP and push metrics to CloudWatch

Answer

Configure AWS Systems Manager to collect SAP metrics

Question 4

A company is migrating an SAP BusinessObjects system to AWS. The system includes a Central Management Server (CMS) and several processing servers. The CMS uses a SQL Server database. The company wants to use a managed database service on AWS to reduce operational overhead. The database size is 100 GB and is expected to grow 10% annually. The company requires automatic failover to a secondary Availability Zone with minimal downtime. Which AWS database service should the company use for the CMS database?

Accepted Answer

Amazon RDS for SQL Server with Multi-AZ deployment. Amazon RDS for SQL Server with Multi-AZ deployment provides a managed SQL Server database with automatic failover to a standby in another Availability Zone, meeting the requirements for minimal downtime and reduced operational overhead. The 100 GB size and 10% annual growth are well within RDS limits.

Answer

Amazon EC2 with SQL Server installed

Answer

Amazon Aurora SQL Server

Answer

Amazon DynamoDB

Question 5

A company is planning to migrate an SAP BusinessObjects environment to AWS. They need to ensure high availability for the Web Application Server tier. Which AWS service should they use to distribute traffic across multiple instances?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) operates at Layer 7 and is the correct choice for distributing HTTP/HTTPS traffic across multiple SAP BusinessObjects Web Application Server instances. ALB supports path-based and host-based routing, health checks at the HTTP level, and sticky sessions, all of which are needed for web application tiers. This makes it the standard AWS service for high availability of web application servers.

Answer

AWS Global Accelerator

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 6

A company wants to automate the installation of SAP software on AWS. Which AWS service is most appropriate for orchestrating the deployment of SAP systems?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the most appropriate service for orchestrating the deployment of SAP systems because it allows you to define the entire infrastructure as code using templates, enabling automated, repeatable, and consistent provisioning of SAP landscapes. It supports custom resources and nested stacks, which are essential for managing the complex dependencies and multi-tier architecture typical of SAP deployments on AWS.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 7

A solutions architect is designing a disaster recovery plan for a critical application that runs on Amazon RDS for PostgreSQL. The application requires a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which RDS deployment option meets these requirements?

Accepted Answer

A Multi-AZ deployment with synchronous replication.. Amazon RDS Multi-AZ deployments with synchronous replication provide automatic failover to a standby instance in a different Availability Zone, ensuring data is committed to both primary and standby before acknowledging a write. This achieves an RPO of effectively zero (less than 5 seconds) and an RTO typically under 1 minute, meeting the stated requirements.

Answer

A single-AZ deployment with cross-Region automated backups.

Answer

A single-AZ deployment with a standby instance manually promoted.

Answer

A Multi-AZ deployment with a Read Replica in a different Region.

Question 8

An SAP administrator runs the commands above to inspect the volumes attached to an EC2 instance that hosts an SAP HANA database. The database log files are stored on /dev/sdf. What is a potential issue with this configuration?

Accepted Answer

The log volume uses gp3, which may not provide enough IOPS for HANA log writes.. SAP HANA log volumes require sustained high IOPS and low write latency because every transaction commit is written to the log before being acknowledged. gp3 volumes start at a baseline of 3,000 IOPS and only reach higher IOPS if provisioned separately, which is typically insufficient for production HANA log writes. SAP-certified HANA log volumes generally require io2 Block Express or provisioned-IOPS gp3 with sufficient IOPS, making gp3 with default settings a real performance risk.

Answer

The log volume is attached as /dev/sdf, which is not a standard device name for HANA.

Answer

The root volume will be deleted on termination, causing data loss.

Answer

The log volume is not encrypted.

Question 9

Which TWO AWS services can be used to automate the deployment of SAP infrastructure during migration? (Choose 2.)

Accepted Answer

AWS Service Catalog. AWS Service Catalog (B) is correct because it lets organizations create and govern pre-approved, standardized product portfolios — including SAP infrastructure templates — so migration teams can provision compliant SAP environments on demand with a single, repeatable action. AWS CloudFormation (C) is correct because it is the native infrastructure-as-code service that automates the deployment of SAP infrastructure by defining EC2 instances, EBS volumes, VPC networking, security groups, and SAP-specific parameters in templates that can be versioned and re-deployed consistently. Together these services directly automate SAP infrastructure provisioning during a migration. AWS OpsWorks (A) is a configuration-management service built around Chef/Puppet stacks and is not the primary tool for automating SAP infrastructure deployment; AWS Elastic Beanstalk (D) targets application deployment for web apps, not SAP infrastructure; and AWS CodePipeline (E) is a CI/CD orchestration service that coordinates build and release stages but does not itself deploy SAP infrastructure.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Question 10

A company wants to ensure that their SAP HANA database backups are stored securely and can be retained for 7 years for compliance. Which AWS service should they use to archive the backups?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage class designed for long-term retention of data that is accessed infrequently, with a default retrieval time of 12 hours. This meets the 7-year compliance requirement for SAP HANA backups while minimizing storage costs, as the backups are unlikely to be accessed frequently after the initial retention period.

Answer

Amazon EBS Snapshots

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Standard

Question 11

A company runs SAP on AWS using an SAP HANA database on an R5.8xlarge EC2 instance. The SAP application generates alerts about high disk I/O latency. Which AWS service should the administrator use to identify the root cause?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it collects and monitors metrics such as disk I/O latency, CPU, and network performance for EC2 instances. The administrator can use CloudWatch metrics and alarms to identify the root cause of high disk I/O latency on the SAP HANA instance. CloudWatch provides the granular, time-series data needed for performance troubleshooting.

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Answer

AWS Config

Question 12

A company runs SAP NetWeaver on AWS and needs to ensure that the SAP application server instances are evenly distributed across two Availability Zones. Which AWS service should be used to distribute traffic?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as SAP application servers, in different Availability Zones. By registering SAP instances in two AZs and enabling cross-zone load balancing, the ALB ensures even distribution of traffic across both zones, which is critical for high availability and balanced resource utilization in SAP NetWeaver deployments.

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Answer

Amazon Route 53 weighted routing

Question 13

A company is deploying SAP on AWS and needs to ensure high availability for the SAP application servers. Which TWO strategies can be used to achieve this? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with an Application Load Balancer. Option C is correct because an Auto Scaling group with an Application Load Balancer provides high availability for SAP application servers by automatically replacing failed instances and distributing incoming traffic across healthy targets in multiple subnets. Option E is correct because deploying application servers across multiple Availability Zones protects against a single AZ failure, which is a fundamental AWS high-availability design practice for SAP application tiers. Option A is incorrect because Amazon RDS Multi-AZ applies to the database tier, not the SAP application server tier. Option B is incorrect because a single large EC2 instance with an Elastic IP is a single point of failure and does not provide high availability. Option D is incorrect because standard EBS volumes cannot be attached to multiple EC2 instances simultaneously; only specific multi-attach-capable EBS volumes support that, and it is not a valid SAP application high-availability strategy.

Answer

Use Amazon RDS Multi-AZ for the application tier

Answer

Use a single large EC2 instance with an Elastic IP

Answer

Attach the same EBS volume to multiple instances

Question 14

An SAP application on AWS needs to access an S3 bucket containing sensitive data. Which IAM policy element should be used to enforce encryption in transit?

Accepted Answer

"Condition": {"Bool": {"aws:SecureTransport": "true"}}. The `aws:SecureTransport` condition key in an IAM policy enforces that all requests to the S3 bucket must be made over HTTPS (TLS), ensuring encryption in transit. For an SAP application handling sensitive data, this prevents data exposure during transmission over the network. The `Bool` condition evaluates to `true` only when the request uses SSL/TLS.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "AES256"}}

Answer

"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}

Answer

"Condition": {"IpAddress": {"aws:SourceIp": "10.0.0.0/8"}}

Question 15

An SAP administrator needs to back up the SAP HANA database daily with a retention period of 30 days. The backups must be stored in a cost-effective manner and be instantly accessible for recovery. Which AWS service should be used?

Accepted Answer

Amazon S3 Standard. Amazon S3 Standard is the correct choice because it provides low-latency, millisecond access to backup data while remaining cost-effective for a 30-day retention window. SAP HANA backups written to S3 Standard can be restored instantly via AWS Backint Agent or native HANA commands, satisfying the 'instantly accessible' requirement. S3 Standard's durability (11 nines) and lifecycle flexibility make it ideal for short-term operational backups.

Answer

Amazon S3 Glacier

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon EBS Snapshots

Question 16

Which TWO are best practices for securing SAP on AWS?

Accepted Answer

Use security groups to control traffic between SAP components.. Option C is correct because security groups act as stateful virtual firewalls at the ENI level, allowing you to restrict inbound and outbound traffic to only the specific ports and protocols SAP components require (for example, SAP dispatcher ports 3200-3299, SAProuter 3299, HANA 30013-30015), which enforces least-privilege network segmentation between the application, database, and central services tiers. Option E is correct because attaching an IAM role to an EC2 instance delivers temporary, automatically rotated credentials via the instance metadata service (IMDS), eliminating the need to embed long-lived access keys in SAP profiles or configuration files when the system accesses services such as S3, EBS, or CloudWatch. Option A is not a best practice because the default VPC uses permissive default networking and lacks the controlled subnet, route table, and NACL design expected for production SAP landscapes. Option B is not a best practice because public IP addresses expose SAP instances directly to the internet, increasing attack surface; administrative access should instead go through a bastion host, VPN, or AWS Systems Manager Session Manager. Option D is not a best practice because SSH key pairs only authenticate a user at the OS level and provide no network-layer filtering, so disabling security groups would leave all ports reachable.

Answer

Place all SAP systems in the default VPC.

Answer

Attach public IP addresses to all SAP EC2 instances for easy management.

Answer

Disable security groups and rely on SSH key pairs only.

Question 17

Which TWO steps are required to set up automated backups for an SAP HANA database running on EC2?

Accepted Answer

Install and configure the SAP HANA Backint agent for Amazon S3. Option B is correct because SAP HANA's native backup framework integrates with external storage through the Backint API, and AWS provides the SAP HANA Backint agent for Amazon S3, which must be installed and configured on the EC2 instance so HANA can write backups directly to S3. Option D is correct because the Backint agent requires a target Amazon S3 bucket to store the backup files, so that bucket must be created (and referenced in the agent's configuration) before automated backups can run. Option A is not required because EBS snapshots capture volumes at the block level and are not the mechanism HANA uses for database-consistent automated backups via Backint. Option C is not required because a lifecycle policy only manages storage-class transitions of objects already in S3 and is an optional cost optimization, not a setup step for automated backups. Option E is not required because HANA Studio is an administration client and does not provide an 'enable automatic backups' switch; scheduling is done via HANA's backup configuration (e.g., DBA Cockpit or scripts) combined with the Backint agent.

Answer

Create an Amazon EBS snapshot of the HANA data volumes

Answer

Set up a lifecycle policy to transition backups to Amazon S3 Glacier

Answer

Enable automatic backups in the HANA Studio

Question 18

Which THREE factors should be considered when selecting an EC2 instance type for an SAP HANA production system? (Choose three.)

Accepted Answer

The instance type must have sufficient memory capacity for the HANA database.. Option A is correct because SAP HANA is an in-memory database, so the EC2 instance type must provide enough RAM to hold the working data set plus overhead, and AWS/SAP sizing rules tie instance selection directly to memory capacity. Option B is correct because production HANA systems require sufficient network bandwidth for HANA system replication, backup/restore traffic, and data transfer, so the instance's networking performance is a key selection factor. Option D is correct because SAP only supports HANA on specific SAP-certified AWS instance types, and using a non-certified instance would put the production system outside SAP support. Option C is not required because standard SAP HANA does not depend on GPU acceleration for analytics; GPU-backed instances are not the normal certification criterion for HANA database production workloads. Option E is not correct because vCPU count alone is insufficient and can be misleading: HANA sizing is primarily memory-driven, and a high-vCPU instance with inadequate memory would not be suitable.

Answer

The instance type must have GPU acceleration for HANA analytics.

Answer

The instance type must have a high number of vCPUs regardless of memory.

Question 19

An administrator needs to back up SAP HANA database to S3 with encryption. The backup must be encrypted at rest in S3. Which combination of actions should be taken?

Accepted Answer

Configure S3 bucket with default encryption using SSE-S3 or SSE-KMS. Configuring an S3 bucket with default encryption using SSE-S3 or SSE-KMS ensures that backups written to S3 are automatically encrypted at rest. SSE-S3 uses Amazon-managed keys with AES-256, while SSE-KMS allows you to use AWS KMS customer managed keys (CMKs) for additional control. This meets the requirement for encryption at rest in S3 without requiring additional infrastructure or manual key management.

Answer

Use AWS CloudHSM to generate keys and store them in S3

Answer

Enable S3 Versioning and use S3-managed keys

Answer

Use AWS Backup to back up to S3 with default settings

Question 20

Which TWO actions can be taken to improve the resilience of an SAP HANA database running on AWS? (Choose two.)

Accepted Answer

Use EBS snapshots for automated backup.. Option B (Use EBS snapshots for automated backup) is correct because EBS snapshots provide point-in-time, incremental backups of the HANA data and log volumes stored on EBS, enabling recovery from data corruption, accidental deletion, or volume failure and thus directly improving resilience. Option C (Configure SAP HANA system replication across Availability Zones) is correct because HANA system replication continuously ships redo logs from a primary to a secondary HANA instance in a different AZ, providing high availability and fast failover if the primary AZ or host fails. Option A is wrong because deploying the application in a single Availability Zone concentrates all resources in one failure domain, which reduces rather than improves resilience. Option D is wrong because increasing CPU capacity only scales performance and does not add redundancy or fault tolerance. Option E is wrong because cross-region replication of the database is not a standard, directly supported resilience action for HANA on AWS in this context; cross-region DR would typically rely on mechanisms such as HANA system replication to a remote region combined with EBS snapshot copying, not a simple 'enable cross-region replication' toggle.

Answer

Deploy the application in a single Availability Zone.

Answer

Increase the CPU capacity of the database server.

Answer

Enable cross-region replication of the database.