PAS-C01 Practice Exam 54 — 20 Questions

Question 1

An SAP HANA database running on an EC2 instance with EBS volumes experiences high write latency. The instance type is r5.4xlarge. The EBS volumes are gp2. Which change is MOST likely to reduce write latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the EBS volumes to io2 with provisioned IOPS.. gp2 volumes tie IOPS to volume size (3 IOPS/GB baseline, burst to 3000), so an r5.4xlarge with modest gp2 volumes cannot deliver the sustained write IOPS SAP HANA requires. io2 volumes provide provisioned IOPS independent of capacity, with sub-millisecond latency and 99.9% durability, directly addressing the write-latency bottleneck. Since HANA's redo log writes are latency-sensitive, moving to io2 with high provisioned IOPS is the most direct fix.

Answer

Move the database files to Amazon EFS.

Answer

Add a read replica for the database.

Answer

Change the instance type to a compute-optimized instance.

Question 2

A company is designing a disaster recovery (DR) strategy for its SAP environment on AWS. The primary region is us-east-1 and the DR region is us-west-2. The SAP application and database must be recoverable within 4 hours (RTO) and with a maximum data loss of 15 minutes (RPO). The database is SAP HANA. Which combination of services meets these requirements?

Accepted Answer

Configure HANA System Replication (HSR) between the primary and DR regions, with a standby EC2 instance in us-west-2.. HANA System Replication (HSR) with log shipping provides near real-time data replication to the DR region, achieving an RPO of 15 minutes or less. The standby EC2 instance in us-west-2 can be promoted to primary within 4 hours (RTO) by performing a takeover. Option A is incorrect because EBS snapshots are typically taken every few hours and cross-region copy time adds latency, making it difficult to meet a 15-minute RPO. Option B is incorrect because Amazon S3 cross-region replication for HANA backups is asynchronous and may not ensure consistent log backups every 15 minutes, also requiring manual restore steps that exceed the RTO. Option D is incorrect because AWS DMS does not support SAP HANA as a target for ongoing replication; RDS for SAP HANA is not a supported service, and DMS is designed for homogeneous database migrations, not SAP HANA replication.

Answer

Use Amazon EBS snapshots replicated across regions, restoring in the DR region with a CloudFormation template.

Answer

Back up the HANA database to Amazon S3 and copy the backup to the DR region using cross-region replication.

Answer

Use AWS Database Migration Service (DMS) with ongoing replication to an RDS for SAP HANA instance in the DR region.

Question 3

A company runs SAP BusinessObjects on AWS and needs to scale the application tier based on CPU utilization. Which AWS service should be used to automatically add or remove EC2 instances?

Accepted Answer

AWS Auto Scaling. AWS Auto Scaling can automatically adjust the number of EC2 instances based on CloudWatch alarms for CPU utilization. AWS Elastic Load Balancing distributes traffic but does not scale instances. AWS Lambda is for serverless, not EC2 scaling. AWS CloudFormation is for infrastructure provisioning, not auto-scaling.

Answer

AWS Elastic Load Balancing

Answer

AWS Lambda

Answer

AWS CloudFormation

Question 4

A company is migrating a large SAP ERP system to AWS. The source system runs on IBM Db2. The target is SAP HANA on AWS. Which tool should be used for schema conversion?

Accepted Answer

AWS Schema Conversion Tool (AWS SCT). AWS Schema Conversion Tool (AWS SCT) is designed to convert database schemas from one database engine to another, such as from IBM Db2 to SAP HANA. It assesses the source schema, identifies incompatibilities, and generates a conversion plan. AWS SCT is the recommended tool for heterogeneous migrations where the source and target database engines are different.

Answer

AWS Database Migration Service (AWS DMS)

Answer

SAP HANA Studio

Answer

SAP DMO

Question 5

A company is running SAP HANA on AWS and wants to encrypt the EBS volumes at rest. They also need to manage the encryption keys themselves. Which solution should they use?

Accepted Answer

Use AWS KMS with a customer managed key (CMK). AWS KMS with a customer managed key (CMK) allows the company to have full control over the encryption keys used for EBS volume encryption, including key rotation, access policies, and disabling or deleting the key. This meets the requirement to manage the encryption keys themselves while still leveraging AWS KMS for key management and auditing.

Answer

Enable EBS encryption with the default AWS managed KMS key

Answer

Use AWS CloudHSM to store keys

Answer

Use AWS Systems Manager Parameter Store

Question 6

An SAP system uses an Application Load Balancer (ALB) to distribute traffic to web servers. The ALB is configured with a health check that fails, causing the web servers to be marked as unhealthy. What is a possible reason for the health check failure?

Accepted Answer

The web server is not configured to respond to the health check path. The ALB health check sends HTTP/HTTPS requests to a specific path (default '/') on each target. If the web server is not configured to respond with a 200 OK status to that path, the health check fails and the target is marked unhealthy. This is the most common application-level cause of health check failures, as the ALB relies on the target's response to determine health.

Answer

The instance is in a private subnet

Answer

The instance type is not supported by the ALB

Answer

The security group for the ALB does not allow outbound traffic

Question 7

A company runs SAP on AWS and needs to ensure that all changes to the SAP system's underlying infrastructure are recorded and auditable. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing. CloudWatch Logs is for log monitoring. Config tracks resource configuration changes. Trusted Advisor provides best-practice checks. CloudTrail is the primary service for API activity auditing.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 8

A company runs a production SAP HANA database on AWS using an EC2 instance with EBS volumes. The database is experiencing high latency during peak hours. The operations team needs to identify the root cause. Which steps should the team take to diagnose the issue?

Accepted Answer

Monitor the EBS volume queue length and latency using Amazon CloudWatch metrics.. Amazon CloudWatch provides metrics such as EBS volume queue length (depth) and average latency, which are key indicators of I/O bottlenecks. High queue depth with corresponding latency spikes suggests that the EBS volume is overwhelmed and needs adjustment (e.g., switching to Provisioned IOPS). Option A is incorrect because migrating to Provisioned IOPS without diagnosing the root cause may not solve the issue and increases cost unnecessarily. Option C is incorrect because moving SAP HANA to Amazon RDS for SAP is not a direct solution for latency and introduces migration complexity. Option D is incorrect because increasing instance size without analyzing I/O patterns may not address the bottleneck and can also increase costs.

Answer

Migrate the EBS volumes to Provisioned IOPS SSD (io1) immediately.

Answer

Move the SAP HANA database to Amazon RDS for SAP.

Answer

Increase the instance size to improve performance.

Question 9

A company is migrating an SAP NetWeaver system to AWS. The system uses SAProuter for secure network communication. What is the recommended approach to preserve the SAProuter functionality during the migration?

Accepted Answer

Deploy SAProuter on an EC2 instance with an Elastic IP address. Deploying SAProuter on an EC2 instance with an Elastic IP address preserves the existing SAProuter configuration and ensures a stable endpoint that can be referenced in firewall rules and SAP routing tables. Option B (AWS NAT Gateway) is incorrect because a NAT Gateway is used for outbound internet traffic from private subnets and does not provide a persistent inbound endpoint for SAProuter connections. Option C (AWS Site-to-Site VPN) is incorrect because while a VPN provides secure connectivity between on-premises and AWS, it does not replace the need for SAProuter, which operates at the application layer. Option D (Application Load Balancer) is incorrect because an ALB is designed for HTTP/HTTPS traffic and cannot handle the proprietary protocol used by SAProuter.

Answer

Use an AWS NAT Gateway to route traffic

Answer

Establish an AWS Site-to-Site VPN connection

Answer

Use an AWS Application Load Balancer

Question 10

A company is migrating a large SAP ERP system to AWS. Which TWO AWS services are essential for high availability and disaster recovery? (Choose two.)

Accepted Answer

AWS Elastic Disaster Recovery (DRS). AWS Elastic Disaster Recovery (DRS) (option D) is correct because it provides block-level, continuous replication of on-premises or cloud SAP ERP servers into a low-cost staging area in AWS, enabling rapid recovery with minimal RPO/RTO during a disaster. Amazon Route 53 (option E) is correct because it delivers DNS-based high availability and failover, using health checks and routing policies such as failover or latency-based routing to redirect SAP clients to a healthy region or Availability Zone. Together they address the DR and HA requirements of a large SAP ERP migration. Amazon CloudWatch (A) is a monitoring and observability service, not a DR or HA mechanism, though it can trigger alarms. AWS Database Migration Service (B) is for migrating databases, not for ongoing high availability or disaster recovery. Amazon S3 (C) is object storage used for backups and data durability, but by itself it does not provide the automated server replication and DNS failover needed for SAP ERP HA/DR.

Answer

Amazon CloudWatch

Answer

AWS Database Migration Service

Answer

Amazon S3

Question 11

A company runs SAP Business Suite on AWS. The database size is 2 TB. They need to restore the database to a point-in-time from the last 24 hours. Which AWS service should be used to achieve this with minimal impact on production performance?

Accepted Answer

Configure SAP HANA Backup & Recovery using Backint agent to Amazon S3.. SAP HANA Backup & Recovery using the Backint agent to Amazon S3 is the native, AWS-integrated method for performing point-in-time recovery (PITR) of SAP HANA databases. Backint offloads backup and restore operations directly to S3, bypassing the EC2 instance's I/O stack, which minimizes performance impact on production workloads. This approach supports incremental and log backups, enabling precise PITR within the last 24 hours without requiring full-volume snapshots.

Answer

Use AWS Backup with a backup plan for the EC2 instance.

Answer

Use Amazon EBS snapshots of the database volume.

Answer

Use AWS Database Migration Service (DMS) for continuous replication.

Question 12

An administrator is troubleshooting an SAP system where the application server cannot connect to the database server. Both servers are in the same VPC but different subnets. Security groups allow traffic on the database port. What is the next step to diagnose the issue?

Accepted Answer

Check the Network ACLs for both subnets to ensure inbound/outbound rules allow the database port. Network ACLs (NACLs) are stateless, meaning they require explicit inbound and outbound rules for traffic to flow in both directions. Even if security groups allow the database port, a missing or misconfigured NACL rule on either subnet can silently drop traffic. Since the servers are in different subnets, checking NACLs is the next logical step after confirming security groups are correct.

Answer

Check the DB Subnet Group configuration

Answer

Verify route tables for the subnets

Answer

Review VPC Flow Logs for rejected traffic

Question 13

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.. Option C is correct because Patch Manager relies on the SSM Agent being installed, running, and able to reach the Systems Manager endpoints; if the agent is stopped, outdated, or blocked by networking/proxy issues, the instance cannot receive or execute the patch command and will report 'Failed'. Option D is correct because the AWS-RunPatchBaseline document is the SSM document that Patch Manager invokes, and its per-instance output in Run Command history contains the actual error details (for example, baseline resolution failures, missing permissions, or patch installation errors) needed to diagnose why patching failed. Option A is not appropriate because patch baselines are associated through patch groups or by default, not by directly assigning baselines to individual instance IDs, and doing so would not address the reported failure. Option B is not the best troubleshooting step here because the instances already have the SSM Agent and are appearing in Patch Manager, which indicates the required IAM role for Systems Manager is generally present; the failure is more likely execution- or communication-related. Option E is not correct because a Maintenance Window is a scheduling mechanism, not a fix for instances that already ran a patching operation and reported 'Failed'.

Answer

Assign the patch baseline to the instance IDs directly.

Answer

Ensure that the instances have the appropriate IAM role that allows them to be patched.

Answer

Configure a Maintenance Window for the patching operation.

Question 14

Which TWO AWS services can be used to monitor SAP system availability and send notifications when a system goes down? (Choose two.)

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now Amazon EventBridge) is correct because it can detect state changes in AWS resources and SAP systems, match them against rules, and route them to targets such as Amazon SNS or Lambda to send notifications when a system goes down. Amazon CloudWatch Alarms is also correct because it evaluates metrics or custom SAP health metrics against thresholds and, when the alarm state changes to ALARM, triggers actions like SNS notifications to alert on system unavailability. AWS Trusted Advisor is not correct because it provides best-practice checks and recommendations, not real-time SAP availability monitoring or down-state notifications. Amazon S3 event notifications are not correct because they only emit events for object-level operations in S3 buckets, not SAP system availability. AWS Config is not correct because it tracks resource configuration changes and compliance over time, not live SAP availability or down alerts.

Answer

AWS Trusted Advisor

Answer

Amazon S3 event notifications

Answer

AWS Config

Question 15

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The DR region must have the SAP application stack ready but the database can be replayed from backups. Which TWO actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Set up a cross-region read replica for the Aurora PostgreSQL database.. Option C is correct because a cross-region read replica of Aurora PostgreSQL continuously replicates changes to the DR region, giving an RPO of typically under a minute (well within 15 minutes) and allowing the replica to be promoted to a writable primary in minutes, satisfying the 2-hour RTO. Option E is correct because pre-provisioning the EC2 instances with the SAP application stack already installed and configured in the DR region means the application tier is ready to start immediately, avoiding the hours of build/install time that would otherwise break the 2-hour RTO. Option A is not appropriate because a single-region Multi-AZ deployment only protects against an Availability Zone failure, not a full region outage, so it cannot serve as a cross-region DR strategy. Option B does not belong because replicating application log files to S3 does not restore the database or application tier and does not by itself meet the RPO/RTO targets. Option D is not suitable because daily snapshots yield an RPO of up to 24 hours, far exceeding the required 15-minute RPO.

Answer

Use a single-region Multi-AZ deployment for the database.

Answer

Use S3 cross-region replication for the application log files.

Answer

Take daily snapshots of the database and copy them to the DR region.

Question 16

Refer to the exhibit. An administrator has run a query to check the backup status of an SAP HANA database. The output shows that the backup on January 17 failed. What is the most appropriate next step?

Accepted Answer

Investigate the backup logs for the failed backup to identify the cause.. A failed HANA backup should never be blindly retried or ignored — the correct first step is to examine the backup log to determine the root cause (e.g., insufficient disk space, locked files, network interruption, or service outage). Only after understanding the failure can the administrator decide whether to retry, adjust configuration, or escalate. This diagnostic-first approach is standard SAP HANA DBA practice.

Answer

Restore the database from the last successful backup to ensure data integrity.

Answer

Immediately restart the failed backup from the catalog.

Answer

Ignore the failure because subsequent backups are successful.

Question 17

An organization is migrating an SAP system from on-premises to AWS. The SAP system uses a shared file system (NFS) for transport directories. The company wants a fully managed NFS solution on AWS. Which service should they use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS is a fully managed NFS file system that supports the NFSv4.1 and NFSv4.0 protocols, making it the ideal choice for SAP transport directories that require a shared POSIX-compliant file system. It provides high availability, automatic scaling, and eliminates the need to manage underlying storage infrastructure, directly matching the requirement for a fully managed NFS solution on AWS.

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3

Question 18

Which TWO options are valid methods to back up an SAP HANA database on AWS? (Choose 2)

Accepted Answer

Use SAP HANA Backint with AWS Backup. Option B is correct because SAP HANA Backint is the native SAP HANA backup API that integrates with external backup tools, and AWS Backup supports SAP HANA via the Backint interface on AWS, allowing full, differential, and log backups to be managed centrally. Option E is correct because application-consistent EBS snapshots of the HANA data and log volumes can be created using pre- and post-snapshot scripts (for example, suspending I/O or putting HANA in a consistent state) to ensure the snapshot is recoverable. Option A is not valid because Amazon RDS does not support SAP HANA as an engine, so RDS automated backups cannot back up a HANA database. Option C is not valid because AWS DMS is a data migration and replication service, not a backup mechanism for SAP HANA. Option D is not valid because simply copying HANA data files to Amazon S3 with the AWS CLI does not produce a supported, consistent HANA backup and cannot be restored through HANA's backup and recovery tools.

Answer

Use Amazon RDS automated backups

Answer

Use AWS Database Migration Service (DMS)

Answer

Copy HANA data files to Amazon S3 using AWS CLI

Question 19

An SAP landscape on AWS includes several instances in a VPC. The administrator needs to ensure that SAProuter can connect to the SAP system from the internet securely. Which networking component should be used?

Accepted Answer

AWS VPN connection to the customer's network. An AWS VPN connection establishes an encrypted tunnel over the internet between the customer's on-premises network and the VPC, allowing SAProuter to connect securely to the SAP system without exposing any instance to the public internet. This aligns with the requirement for secure, authenticated connectivity from the internet while maintaining network isolation.

Answer

AWS Direct Connect with a public VIF

Answer

Internet Gateway with a public IP on the SAProuter instance

Answer

AWS CloudFront with a security group

Question 20

An SAP system is deployed across multiple Availability Zones using an Application Load Balancer (ALB). The Operations team notices that during a failover test, the ALB is sending traffic to unhealthy instances. Which configuration change would ensure the ALB stops sending traffic to unhealthy targets?

Accepted Answer

Configure a health check with appropriate thresholds and interval.. Configuring a health check with appropriate thresholds and interval ensures the ALB can accurately determine the health of targets and stop routing traffic to unhealthy instances. Option A is incorrect because sticky sessions (session affinity) do not affect health checking; they only maintain session persistence. Option C is incorrect because increasing the deregistration delay only extends the time for connection draining, not health detection. Option D is incorrect because cross-zone load balancing distributes traffic across Availability Zones but does not influence health checks or unhealthy target routing.

Answer

Enable sticky sessions (session affinity).

Answer

Increase the deregistration delay value.

Answer

Enable cross-zone load balancing.