PAS-C01 Practice Exam 56 — 20 Questions

Question 1

Which THREE factors should be considered when selecting an AWS Region for a migration to minimize latency for users in Europe? (Choose three.)

Accepted Answer

Data residency and compliance requirements. Data residency and compliance requirements (Option A) are critical when selecting an AWS Region for a migration to minimize latency for users in Europe because many European countries have strict data sovereignty laws (e.g., GDPR) that mandate personal data remain within the EU/EEA. Choosing a Region outside Europe would violate these regulations, regardless of latency benefits, and could result in legal penalties. Therefore, compliance directly influences which Regions are permissible, making it a primary factor in Region selection.

Answer

Number of Availability Zones in the Region

Answer

Cost of data transfer between Regions

Question 2

An SAP HANA database administrator needs to restore a database from a backup stored in Amazon S3. The backup was taken using SAP HANA Backint. Which AWS service should be used to retrieve the backup files from S3?

Accepted Answer

SAP HANA Backint agent. SAP HANA Backint is the native SAP interface for integrating with third-party backup tools. When a backup is taken using Backint, the backup files are stored in Amazon S3 via the Backint agent for SAP HANA on AWS. To restore from these backups, the same Backint agent must be used because it understands the proprietary metadata and file format that Backint writes to S3, and it handles the direct S3 API calls required to retrieve the files. Other methods like the S3 console or AWS CLI cannot interpret Backint-specific metadata or restore the database correctly.

Answer

Amazon S3 console

Answer

AWS CLI

Answer

AWS Backup

Question 3

Which TWO AWS services can be used to monitor the performance of SAP NetWeaver application servers? (Choose two.)

Accepted Answer

AWS Systems Manager. AWS Systems Manager is correct because it provides the Agent-based infrastructure management capabilities needed to monitor SAP NetWeaver application servers. Specifically, Systems Manager Inventory can collect OS-level metrics like CPU, memory, and disk usage from EC2 instances running SAP, and its Run Command or State Manager can execute custom scripts to gather SAP-specific performance data (e.g., from ST03 or ST06 transactions) without requiring direct SSH access.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 4

A company is designing a disaster recovery (DR) strategy for its SAP environment on AWS. The primary site is in us-east-1 and the DR site in us-west-2. The SAP HANA database is 3 TB and uses HANA System Replication (HSR) in async mode. The RPO requirement is 15 minutes. What is the most cost-effective way to meet the RPO?

Accepted Answer

Configure HANA System Replication in asynchronous mode over AWS Direct Connect.. HANA System Replication (HSR) in asynchronous mode over AWS Direct Connect provides a low-latency, reliable network path that can achieve an RPO of 15 minutes without the performance penalty of synchronous replication. Asynchronous replication sends committed transactions to the DR site without waiting for acknowledgment, which is suitable for the 3 TB HANA database and meets the RPO requirement cost-effectively by avoiding the need for expensive, high-bandwidth dedicated connections or frequent full backups.

Answer

Take full database backups to Amazon S3 every 15 minutes.

Answer

Use EBS snapshots every 5 minutes to replicate data to DR region.

Answer

Use HANA System Replication in synchronous mode to ensure zero data loss.

Question 5

Refer to the exhibit. An SAP administrator has created this IAM policy for a backup user. The user can list and download backups but cannot delete them. However, the user is unable to list the objects in the bucket. What is the most likely cause?

Accepted Answer

There is an additional bucket policy that denies s3:ListBucket to this user.. The IAM policy shown grants s3:ListBucket permission on the bucket, so the user should be able to list objects. However, the user cannot list objects, indicating an additional bucket policy explicitly denies s3:ListBucket for this user. Bucket policies override IAM permissions when a Deny is present. Option A is incorrect because the policy does include s3:ListBucket. Option C is incorrect because s3:GetObjectVersion is not required to list objects. Option D is incorrect because the Deny statement only affects s3:DeleteObject, not s3:ListBucket.

Answer

The IAM policy does not include s3:ListBucket for the bucket.

Answer

The user needs s3:GetObjectVersion permission to list objects.

Answer

The Deny statement also denies s3:ListBucket because of the wildcard resource.

Question 6

A company is running SAP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. They have set up a cluster using Amazon Route 53 with health checks. During a failover test, the ASCS instance fails but the DNS record does not update immediately. What is the most likely cause?

Accepted Answer

The TTL on the DNS record is set too high. The TTL (Time to Live) on the DNS record determines how long clients cache the DNS response. If the TTL is set too high, clients continue to use the old (failed) IP address even after Route 53 updates the record based on the health check. This delays failover. Options B and C are incorrect because health checks and routing policies do affect failover, but the immediate cause of the delay is the TTL. Option D is incorrect because Route 53 record sets are updatable.

Answer

The health check is not configured to check the ASCS service port

Answer

The Route 53 record is using simple routing instead of failover

Answer

The Route 53 record set is not updatable

Question 7

An SAP administrator notices that the SAP application server is experiencing high memory utilization. The system uses a cluster of EC2 instances. What is the most cost-effective solution to automatically add an additional application server when memory exceeds 80%?

Accepted Answer

Configure an Auto Scaling group with a scaling policy based on a custom CloudWatch metric for memory utilization.. Auto Scaling groups can use custom CloudWatch metrics (e.g., memory utilization) via the CloudWatch Agent to trigger scaling actions. This automates adding instances when memory exceeds 80% without manual intervention. Option B is incorrect because it only sends an email for manual action, which is not automatic nor cost-effective. Option C is incorrect because it scales based on CPU, not memory, so it does not address the memory issue. Option D is incorrect because Elastic Beanstalk is a PaaS service that abstracts infrastructure, but it does not provide a simple way to scale based on memory utilization, and it is not specifically designed for SAP application server clusters.

Answer

Create a CloudWatch alarm that sends an email to the administrator to manually launch a new instance.

Answer

Use an Auto Scaling group with a scaling policy based on CPU utilization.

Answer

Use AWS Elastic Beanstalk to deploy the application server.

Question 8

Refer to the exhibit. A migration engineer is setting up an IAM policy for an AWS DMS task that will replicate data from an on-premises SAP ASE database to Amazon RDS for SAP ASE. The engineer wants to ensure the DMS task can be created and started. What is missing from this policy?

Accepted Answer

Permissions to create DMS endpoints (dms:CreateEndpoint). Creating endpoints is a prerequisite for running a DMS task, and the provided policy does not include 'dms:CreateEndpoint'. Option B is incorrect because the policy does not include 'dms:DescribeReplicationInstances', but that is not required to create or start the task; the issue is missing endpoint creation permissions. Option C is incorrect because the policy does include 'dms:StartReplicationTask', so starting the task is allowed once endpoints exist. Option D is incorrect because the policy does not reference KMS actions, and encryption via KMS would require additional permissions, but that is not the immediate missing piece for creating and starting the task.

Answer

Permissions to describe DMS replication instances

Answer

Permissions to start and stop replication tasks

Answer

Permissions to use AWS Key Management Service (KMS) for encryption

Question 9

An SAP Basis administrator notices that the SAP application server logs show repeated connection timeouts to the database. The database is running on an RDS for SAP HANA instance. The application server and database are in the same VPC but different subnets. The security groups allow inbound traffic from the application server's security group on port 3xx17. Network ACLs allow both inbound and outbound traffic on ephemeral ports. Despite this, connections fail intermittently. What is the most likely cause?

Accepted Answer

The security group for the RDS instance does not allow inbound traffic on the HANA internal communication port (e.g., 3xx18).. SAP HANA uses multiple ports for internal communication. While port 3xx17 (SQL) is allowed, the missing inbound rule for the HANA internal communication port (e.g., 3xx18) causes intermittent connection timeouts. Option A is incorrect because RDS DNS names are stable and do not change intermittently. Option B is incorrect because network ACLs are stateless, but the problem states both inbound and outbound are allowed on ephemeral ports, so return traffic is not blocked. Option D is incorrect because route tables within a VPC use local routes for database traffic, and NAT gateways do not affect intra-VPC traffic.

Answer

The RDS instance's DNS name resolves to a different IP address intermittently.

Answer

The network ACL is stateful and blocking return traffic.

Answer

The application server's subnet has a route table that points to a NAT gateway instead of the database subnet.

Question 10

An SAP administrator is troubleshooting a failed backup of SAP HANA to Amazon S3. The backup is initiated by an SAP HANA BACKUP command using the S3 backint agent. The error log shows 'HTTP 403 Forbidden' when the agent tries to upload to the S3 bucket. The bucket policy allows s3:PutObject from the VPC endpoint. What is the most likely cause?

Accepted Answer

The VPC endpoint policy for S3 does not grant the required actions to the IAM role.. The HTTP 403 Forbidden error indicates that the request was received but denied. Since the bucket policy allows s3:PutObject from the VPC endpoint, the issue is likely that the VPC endpoint policy itself does not grant the required actions to the IAM role. VPC endpoint policies act as a separate layer that can override bucket policies. Option D is correct. Option A is wrong because the bucket exists. Option B is wrong because cross-region access would not cause a 403. Option C is wrong because SSE-KMS would cause a 400 error, not 403.

Answer

The S3 bucket does not exist.

Answer

The S3 bucket is not in the same AWS Region as the EC2 instance.

Answer

The S3 bucket uses server-side encryption with AWS KMS (SSE-KMS) and the IAM role lacks kms:GenerateDataKey.

Question 11

Which THREE of the following are valid considerations for designing SAP workloads on AWS to achieve high availability within a single AWS Region? (Choose three.)

Accepted Answer

Use a cluster with a shared file system (e.g., Amazon EFS or FSx) for SAP ASCS. SAP ASCS (ABAP Central Services) requires a shared file system for the global transport directory and instance profiles to enable failover between cluster nodes. Amazon EFS or FSx for NetApp ONTAP provide the necessary NFS-based shared storage that supports the SAP enqueue replication and message server services during a failover event.

Answer

Use AWS Network Load Balancer (NLB) for SAP Enqueue Replication 2 (ENSA2)

Answer

Use HANA scale-out with HSR across two nodes for high availability

Question 12

Which TWO services can be used to centrally manage and enforce backup policies for SAP systems on AWS? (Choose TWO.)

Accepted Answer

Amazon Data Lifecycle Manager. Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. For SAP systems, you can use DLM to enforce backup policies for the underlying EBS volumes (e.g., /usr/sap, /sapmnt, data volumes) by scheduling snapshots and applying retention rules. AWS Backup provides a centralized, policy-based backup service that supports SAP HANA databases (via Backint integration) and EC2 instances, enabling you to define backup plans, assign resources, and enforce compliance across your SAP landscape.

Answer

AWS CloudFormation

Answer

AWS Config

Answer

Amazon S3

Question 13

A company runs SAP on AWS and needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail logs all API calls made to AWS services, providing an audit trail. Amazon CloudWatch Logs can then be used to store, monitor, and analyze these logs. Together, they satisfy the auditing requirement. Option A (Amazon S3) can store logs but does not log API calls itself. Option B (VPC Flow Logs) captures network traffic, not API calls. Option D (AWS Config) records resource configuration changes, not API calls. Therefore, the correct combination is CloudTrail and CloudWatch Logs.

Answer

Amazon S3

Answer

VPC Flow Logs

Answer

AWS Config

Question 14

A company is migrating an SAP ERP system to AWS and wants to use SAP HANA as the database. The current on-premises database is 4 TB. Which EC2 instance type is optimized for SAP HANA workloads and provides sufficient memory?

Accepted Answer

x1e.32xlarge. The x1e.32xlarge instance is specifically optimized for SAP HANA workloads, offering 3,904 GiB of memory, which is sufficient for a 4 TB SAP HANA database when considering the 1:5 memory-to-data ratio required by SAP (4 TB data requires approximately 800 GB memory, but the x1e.32xlarge provides ample headroom for growth and workload peaks). It also supports SAP HANA certified instance types and provides high network and EBS throughput essential for HANA's performance demands.

Answer

r5.24xlarge

Answer

m5.24xlarge

Answer

c5.18xlarge

Question 15

Which TWO configurations are mandatory for an SAP HANA system replication setup on AWS? (Choose TWO.)

Accepted Answer

A virtual IP (VIP) address for the HANA system. SAP HANA system replication requires a virtual IP (VIP) address to enable automatic failover and client reconnection. The VIP is managed by a cluster manager (e.g., Pacemaker with AWS Route53 or Elastic IP) and moves between primary and secondary instances during a takeover, ensuring clients can always reach the active HANA instance without manual reconfiguration. Option C is also correct because a dedicated replication network between primary and secondary is mandatory to ensure reliable and low-latency replication traffic, separate from the client-facing network. This dedicated network is required for optimal performance and to avoid contention with other traffic.

Answer

An Application Load Balancer in front of the HANA instances

Answer

Encryption of data in transit using SSL

Answer

A separate VPC for the secondary instance

Question 16

A company is migrating an SAP S/4HANA system to AWS. The migration strategy involves using SAP HANA System Replication (HSR) to replicate the source HANA database to an EC2 instance running HANA. During the final cutover, the replication link breaks and the target database becomes inconsistent. What should the migration team do to recover?

Accepted Answer

Perform a full HSR initial snapshot from the source to the target. When the HSR link breaks and the target becomes inconsistent during cutover, the only reliable recovery method is to perform a full HSR initial snapshot from the source. This completely reinitializes the target database, ensuring consistency. Option A (restart HSR with a delta snapshot) is incorrect because it requires a consistent state to apply changes incrementally, which does not exist. Option C (restore from AWS Backup) is incorrect as it may not reflect the latest data and could cause data loss. Option D (use AWS DMS) is incorrect because AWS DMS does not fully support HANA-to-HANA replication for SAP workloads.

Answer

Restart HSR with a delta snapshot from the source

Answer

Restore the target database from an AWS Backup

Answer

Use AWS DMS to replicate remaining changes

Question 17

A company is migrating its SAP NetWeaver system to AWS and wants to implement a high-availability architecture for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which TWO of the following are required components in a recommended AWS HA setup for ASCS and ERS?

Accepted Answer

A shared file system (e.g., Amazon EFS) to store the SAP transport directory and global profile.. In an SAP NetWeaver high-availability architecture on AWS, a shared file system such as Amazon EFS is required to store the SAP transport directory and global profile. This ensures that both the ASCS and ERS instances can access consistent configuration and transport files, which is essential for failover and cluster operations. Without a shared file system, the instances would have divergent configurations, breaking the HA setup.

Answer

An Application Load Balancer to distribute traffic between ASCS and ERS instances.

Answer

A read replica of the SAP HANA database to offload application traffic.

Answer

A secondary Windows Server Failover Cluster in a different Availability Zone.

Question 18

An SAP administrator created the IAM policy shown above to control access to an S3 bucket used for SAP HANA backups. The policy is attached to an IAM role used by an EC2 instance. The instance fails to upload backups. What is the cause?

Accepted Answer

The 'aws:SecureTransport' condition in the Deny statement is incorrectly using 'BoolIfExists' instead of 'Bool'.. The policy uses 'BoolIfExists' for the 'aws:SecureTransport' condition in the Deny statement. 'BoolIfExists' evaluates the condition as true if the condition key exists and matches the specified value, OR if the key does not exist at all. This can cause unintended denials when the 'aws:SecureTransport' key is absent from the request context (e.g., certain internal AWS service calls). Using 'Bool' instead ensures the condition is evaluated only when the key is present, preventing false denials. This mismatch between the intended behavior (deny only when explicitly false) and the actual behavior (deny also when key is missing) is the root cause of the backup upload failure.

Answer

The policy does not allow encryption (SSE-S3) which is required for backups.

Answer

The VPC endpoint ID in the policy does not match the actual endpoint.

Answer

The Deny statement overrides the Allow statement for all actions.

Question 19

An operations team needs to monitor the disk space usage of SAP application servers running on EC2. Which combination of AWS services should they use?

Accepted Answer

Amazon CloudWatch agent and Amazon CloudWatch alarms. Amazon CloudWatch agent is required to collect custom metrics like disk space usage from EC2 instances, as the standard CloudWatch metrics only cover CPU, memory, network, and disk I/O. By installing the agent and configuring it to report disk space metrics, you can then set CloudWatch alarms to trigger notifications when thresholds are breached, enabling proactive monitoring of SAP application servers.

Answer

Amazon CloudWatch and AWS CloudTrail

Answer

AWS Lambda and Amazon DynamoDB

Answer

Amazon S3 and Amazon SNS

Question 20

A company is migrating their SAP Business Suite on SAP HANA to AWS. They need to transfer the data securely and efficiently. The source environment is in a different country with limited network bandwidth. The total data size is 100 TB. What is the most efficient migration approach?

Accepted Answer

Use AWS Snowball Edge for the initial data load, then AWS DMS for ongoing replication. For a 100 TB migration with limited network bandwidth, an offline transfer using AWS Snowball Edge is most efficient for the initial data load. After loading the data into AWS, AWS DMS can handle ongoing replication for any changes. This approach avoids the time and bandwidth constraints of network-based transfers. Option A (Direct Connect + DMS) would still require significant network time for the full load. Option C (VPN + DMS) is also network-bound and slow. Option D (DataSync over internet) is not efficient for 100 TB.

Answer

Establish an AWS Direct Connect connection and use AWS DMS for full load and replication

Answer

Use a VPN connection and AWS DMS for both full load and continuous replication

Answer

Use AWS DataSync over the internet to transfer data and then switch to DMS