PAS-C01 Practice Exam 59 — 20 Questions

Question 1

A company runs its SAP ERP system on AWS with an Oracle database on an EC2 instance. The system is used by thousands of users globally. Recently, the database has been experiencing slow query performance, especially during end-of-month processing. The administrator notices that the database instance is an r5.8xlarge with 32 vCPUs and 256 GB of memory, running on a single EBS io1 volume with 20,000 IOPS for the data files. The administrator has already optimized the SQL queries and increased the SGA size. However, performance remains poor. The Amazon CloudWatch metrics show that the EBS volume's Average Queue Length is consistently above 10 and the read latency spikes to over 100 ms during peak times. The CPU utilization is around 70%. Which action should the administrator take to resolve the I/O bottleneck?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create multiple EBS io1 volumes and stripe them using RAID 0 at the OS level.. Striping multiple EBS io1 volumes using RAID 0 at the OS level increases I/O parallelism, distributing the workload across multiple volumes and reducing the average queue length and latency. Option A is incorrect because gp3 volumes may not provide sufficient IOPS for this demanding workload, and a single volume still creates a bottleneck. Option C is incorrect because increasing IOPS on a single volume may not resolve the queue length issue if the volume is already at its throughput limit. Option D is incorrect because upgrading the instance does not directly improve EBS performance; the bottleneck is at the storage layer.

Answer

Change the volume type to gp3 and increase the baseline IOPS.

Answer

Increase the IOPS of the existing io1 volume to 40,000.

Answer

Upgrade the EC2 instance to an r5.12xlarge with more network bandwidth.

Question 2

A company is running SAP on AWS and wants to automate the installation of SAP applications using infrastructure as code. Which AWS service should be used to define the infrastructure?

Accepted Answer

AWS CloudFormation. AWS CloudFormation allows defining infrastructure as code. Option A is wrong because OpsWorks is for Chef/Puppet. Option B is wrong because CodeDeploy is for application deployment, not infrastructure. Option C is wrong because Elastic Beanstalk is for web applications, not infrastructure.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 3

An organization is deploying a large SAP HANA system on AWS. They need to ensure that the EBS volumes for the /hana/data and /hana/log directories are configured with optimal performance and resilience. Which configuration should they use?

Accepted Answer

Use io2 Block Express volumes with /hana/data on a RAID 0 set and /hana/log on a RAID 1 set. SAP HANA requires high IOPS and low latency for /hana/data, which benefits from RAID 0 striping across multiple io2 Block Express volumes to maximize throughput and capacity. For /hana/log, RAID 1 mirroring provides the necessary resilience to protect against volume failure while maintaining the write performance critical for transaction log durability. io2 Block Express volumes offer up to 256,000 IOPS and 4,000 MB/s throughput per volume, making them ideal for this high-performance workload.

Answer

Use io2 Block Express volumes with /hana/data on a RAID 1 set and /hana/log on a RAID 0 set

Answer

Use a single large gp3 EBS volume for both /hana/data and /hana/log

Answer

Use io2 Block Express volumes with /hana/data on one volume and /hana/log on another, no RAID

Question 4

Refer to the exhibit. An IAM policy is attached to an IAM user. Which EC2 instance can the user terminate?

Accepted Answer

None, because the Deny statement overrides the Allow for that instance. The explicit Deny for all instances (*) overrides the Allow for the specific instance i-1234567890abcdef0, as Deny always wins. Option A is incorrect because the Deny applies to all instances, including i-1234567890abcdef0. Option B is incorrect because the Deny covers all instances, regardless of tags. Option D is incorrect because the Deny explicitly denies access to all instances.

Answer

Only instance i-1234567890abcdef0

Answer

Any instance with tag 'Environment:Production'

Answer

Any instance in the account

Question 5

An SAP system on AWS uses a custom AMI for its application servers. The operations team needs to update the AMI to include a new security patch. What is the MOST efficient way to update all existing instances without downtime?

Accepted Answer

Create a new AMI version, update the Auto Scaling group's launch template, and perform a rolling update.. Creating a new AMI version, updating the Auto Scaling group's launch template, and performing a rolling update ensures zero downtime by gradually replacing instances with the patched AMI. This is the most efficient method for updating all existing instances without downtime. Option B is wrong because stopping all instances causes downtime. Option C is wrong because Patch Manager patches live instances, but the requirement is to update the AMI for future instances, not just patch running ones. Option D is wrong because manually launching instances is inefficient and not automated.

Answer

Stop all instances, apply the patch, create a new AMI, and start instances.

Answer

Use AWS Systems Manager Patch Manager to apply the patch to all running instances.

Answer

Create a new AMI, launch new instances manually, and terminate old ones.

Question 6

A company is migrating an SAP HANA system from on-premises to AWS. The database size is 3 TB, and the network bandwidth to AWS is 1 Gbps. The migration window is limited to 48 hours. What is the most efficient migration strategy?

Accepted Answer

Use AWS Snowball Edge to transfer the HANA backup. The 3 TB database size and 1 Gbps bandwidth would require approximately 7 hours for data transfer alone, but the 48-hour migration window includes backup, transfer, and restore time. AWS Snowball Edge provides a petabyte-scale physical data transport solution that bypasses network constraints entirely, making it the most efficient strategy for transferring a 3 TB HANA backup within the limited window. Snowball Edge supports direct integration with SAP HANA backup workflows via NFS or S3-compatible endpoints, ensuring minimal migration time.

Answer

Set up an AWS Direct Connect connection and use HANA backup and restore

Answer

Use AWS Database Migration Service (DMS) for continuous replication

Answer

Upload the HANA backup to Amazon S3 using multipart upload

Question 7

An SAP system administrator is configuring an SAP HANA database on an EC2 instance with multiple EBS volumes. The administrator wants to ensure that the data volumes are mirrored to protect against volume failure. Which RAID configuration should the administrator use for the HANA data volumes?

Accepted Answer

RAID 10. RAID 10 (striping + mirroring) is recommended for SAP HANA data volumes on AWS because it provides both high performance through striping and redundancy through mirroring, protecting against EBS volume failure. RAID 0 offers no fault tolerance. RAID 5 and RAID 6 introduce significant write penalties due to parity calculations, which can degrade HANA performance.

Answer

RAID 5

Answer

RAID 0

Answer

RAID 6

Question 8

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Answer

Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

Answer

AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

Answer

AWS Snowball Edge to ship the data physically, then import to RDS.

Question 9

An SAP administrator uses an IAM role attached to an EC2 instance to perform backups. The backup script fails when trying to write to an S3 bucket and create EBS snapshots. What is the most likely cause?

Accepted Answer

The trust policy does not include the EC2 service principal.. The most likely cause is that the trust policy of the IAM role does not include the EC2 service principal (ec2.amazonaws.com). Without this, the EC2 instance cannot assume the role, causing all AWS API calls from the backup script to fail, including writing to S3 and creating EBS snapshots. Options A and C only affect specific actions, and D incorrectly includes s3:ListBucket as a requirement.

Answer

The S3 bucket policy denies all writes from this role.

Answer

The role does not have permission to create snapshots due to an explicit deny.

Answer

The policy lacks 's3:ListBucket' and 'ec2:CreateSnapshot' requires volume ARN.

Question 10

An architect is designing a storage solution for an SAP Business Warehouse (BW) system on AWS. The system requires high throughput for data extraction and transformation. The existing on-premises system uses SAN storage with 10,000 IOPS. Which Amazon EBS volume type should the architect choose to meet or exceed this performance at the lowest cost?

Accepted Answer

gp3 with 10,000 IOPS and 500 MB/s throughput. Amazon EBS gp3 volumes can provision up to 16,000 IOPS and 1,000 MB/s throughput independently, making them suitable for SAP BW workloads requiring 10,000 IOPS. gp3 offers a lower cost than io1 because it includes a baseline performance (3,000 IOPS and 125 MB/s) and only charges for additional provisioned IOPS and throughput, whereas io1 charges for every provisioned IOPS. This makes gp3 the most cost-effective choice to meet or exceed the required 10,000 IOPS and 500 MB/s throughput.

Answer

sc1 with 10,000 IOPS

Answer

io1 with 10,000 Provisioned IOPS

Answer

st1 with 10,000 IOPS

Question 11

A company is planning a migration of their SAP ERP system to AWS. They want to use SAP HANA as the database. The current on-premises database size is 2 TB. The migration must have minimal downtime. Which combination of AWS services and methods should be used to achieve a near-zero downtime migration?

Accepted Answer

Use AWS DMS with a SAP HANA source and target, configuring ongoing replication to minimize downtime. AWS DMS with a SAP HANA source and target, configuring ongoing replication, is correct because it supports near-zero downtime migration by continuously replicating changes from the on-premises HANA database to the target HANA database on AWS until cutover. DMS uses log-based change data capture (CDC) to capture ongoing transactions, allowing the source to remain operational during the bulk load and then switch with minimal interruption.

Answer

Use AWS Database Migration Service (DMS) with an SAP HANA source and S3 as target

Answer

Use SAP HANA System Replication (HSR) to replicate data to an EC2 instance in AWS

Answer

Use AWS Backup to perform a continuous backup of the on-premises HANA database and restore to AWS

Question 12

A company runs SAP HANA on AWS with a multi-AZ deployment using HANA System Replication (HSR). The primary site is in us-east-1a and the secondary in us-east-1b. Each site has an ASCS and PAS. The HANA database uses a virtual IP address managed by a Route 53 health check with a failover routing policy. During a recent AZ failure in us-east-1a, the automatic failover to the secondary site took over 15 minutes. The recovery time objective (RTO) is 5 minutes. Analysis shows that the Route 53 health check failed but the failover did not trigger quickly because the DNS TTL was set to 300 seconds. What changes should be made to meet the RTO?

Accepted Answer

Reduce the DNS TTL to 60 seconds and use a weighted routing policy with health checks.. Reducing the DNS TTL to 60 seconds ensures that DNS resolvers cache the failover record for a shorter duration, allowing the Route 53 failover routing policy to propagate the new IP address more quickly after a health check failure. Combined with a weighted routing policy and health checks, this enables failover within the 5-minute RTO by minimizing DNS propagation delay, which was the bottleneck at 300 seconds.

Answer

Increase the DNS TTL to 600 seconds to ensure stability.

Answer

Replace Route 53 with an Application Load Balancer for the virtual IP.

Answer

Remove the health check and use a simple routing policy with a low TTL.

Question 13

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.. The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Answer

The S3 bucket has versioning enabled, which requires additional permissions.

Answer

The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.

Answer

The bucket policy does not grant the s3:PutObject permission to the IAM role.

Question 14

A company is running SAP on AWS and needs to migrate a large on-premises SAP HANA database to AWS with minimal downtime. Which approach is most suitable?

Accepted Answer

Set up SAP HANA System Replication between the on-premises system and an EC2 instance running HANA in AWS.. SAP HANA System Replication (HSR) is the native, low-latency replication mechanism designed for HANA databases, enabling near-continuous data synchronization between an on-premises system and an EC2 instance. This approach supports a controlled takeover with minimal downtime, as it replicates transactions in real time using log shipping or synchronous replication, making it the most suitable for large databases requiring minimal interruption.

Answer

Export the HANA database to a file, upload to S3, and import into a new HANA instance on EC2.

Answer

Use AWS Server Migration Service (SMS) to replicate the entire on-premises server to AWS.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to an Amazon RDS for SAP HANA instance.

Question 15

An SAP administrator notices that the SAP application server is unable to establish an RFC connection to the SAP HANA database. The database is running on an EC2 instance in the same VPC. Security groups and NACLs allow all traffic. What is the most likely cause?

Accepted Answer

The application server is configured to connect to the wrong port number.. The SAP HANA database listens on a specific TCP port, typically 3<instance_number>13 (e.g., 30013 for instance 00). If the application server is configured with a different port number, it cannot establish an RFC connection. Option C is correct because a port mismatch is a common misconfiguration. Option A (overlapping CIDR) would cause routing issues at the network layer, but since security groups and NACLs allow all traffic, this is less likely. Option B (UDP protocol) is incorrect because RFC connections use TCP, not UDP. Option D (reboot) would be temporary and the connection would resume after the database restarts.

Answer

The VPC has overlapping CIDR blocks with the on-premises network.

Answer

The application server uses TCP instead of the required UDP protocol.

Answer

The HANA database instance was rebooted for maintenance.

Question 16

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application uses Auto Scaling and a MySQL RDS Multi-AZ DB instance. Users report intermittent connection timeouts, and CloudWatch metrics show CPUUtilization spikes to 90% on the DB instance. The application queries are read-heavy with occasional writes. What is the MOST cost-effective design change to improve performance?

Accepted Answer

Add an RDS read replica in the same region and configure the application to route read queries to the replica.. The most cost-effective design change because adding an RDS read replica offloads read-heavy queries from the primary DB instance, reducing CPU utilization without requiring a larger instance. Since the workload is read-heavy with occasional writes, a read replica handles SELECT traffic while the Multi-AZ primary manages writes, improving performance at a lower cost than scaling up.

Answer

Implement ElastiCache Redis cluster to cache query results and reduce DB load.

Answer

Enable RDS Performance Insights and create a CloudWatch alarm to reboot the DB instance on high CPU.

Answer

Switch the DB instance to a larger instance type to handle the load.

Question 17

A company is migrating an SAP ERP system to AWS. The SAP system uses a central instance (CI) and dialog instances. The migration must minimize downtime. Which AWS service should be used to replicate the application servers in near real-time?

Accepted Answer

AWS Elastic Disaster Recovery (AWS DRS). AWS Elastic Disaster Recovery (DRS) provides continuous replication of block-level data, enabling near real-time replication of application servers. Option A (AWS Backup) is for scheduled backups, not real-time replication. Option B (AWS DataSync) is for one-time data transfers. Option D (Amazon S3 replication) is for S3 objects.

Answer

Amazon S3 Replication

Answer

AWS DataSync

Answer

AWS Backup

Question 18

Which TWO AWS services can be used to monitor SAP HANA database performance in real time? (Select TWO.)

Accepted Answer

AWS Systems Manager. AWS Systems Manager is correct because it provides the capability to run SAP-specific commands and scripts on EC2 instances via Run Command or State Manager, enabling real-time monitoring of SAP HANA database performance metrics such as memory usage, CPU load, and SQL query execution. It integrates with SAP HANA's built-in monitoring tools (e.g., SAP HANA Studio or SAP HANA Cockpit) to collect and report performance data without requiring additional agents. Amazon CloudWatch is also correct because it can collect and track metrics from SAP HANA by using the CloudWatch agent or custom metrics, allowing real-time monitoring of key performance indicators like CPU utilization, memory consumption, and disk I/O. CloudWatch integrates with SAP HANA via the SAP HANA CloudWatch connector or custom scripts, providing dashboards and alarms for proactive monitoring.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 19

An SAP system administrator is troubleshooting an issue where the SAP HANA database is using more memory than expected on an Amazon EC2 instance. The instance type is an x1e.32xlarge with 3,904 GB of RAM. The HANA global.ini file includes the parameter 'memorymanager = global'. The administrator suspects that the HANA memory limit is not set correctly. What should the administrator check to confirm the memory limit?

Accepted Answer

Run the SQL statement 'SELECT * FROM M_SERVICE_MEMORY' and compare with 'SELECT VALUE FROM M_INIFILE WHERE KEY='global_allocation_limit'.'. When `memorymanager = global` is set in HANA, the effective memory limit is determined by the `global_allocation_limit` parameter in the `global.ini` file, not by the OS-level memory. Running `SELECT * FROM M_SERVICE_MEMORY` shows actual per-service memory usage, while `SELECT VALUE FROM M_INIFILE WHERE KEY='global_allocation_limit'` retrieves the configured limit. Comparing these two values directly confirms whether the memory limit is set correctly and if HANA is respecting it.

Answer

Review Amazon CloudWatch metrics for HANA memory usage.

Answer

Check the output of 'free -g' command on the EC2 instance.

Answer

Check the 'global_allocation_limit' parameter in the global.ini file.

Question 20

Which AWS service should be used to capture and analyze operating system-level metrics from an EC2 instance running SAP, such as memory utilization and disk I/O, and to set alarms based on thresholds?

Accepted Answer

Amazon CloudWatch with the CloudWatch Agent. Amazon CloudWatch with the CloudWatch Agent is the correct choice because the CloudWatch Agent can collect custom operating system-level metrics (such as memory utilization and disk I/O) from EC2 instances, including those running SAP. The agent sends these metrics to CloudWatch, where you can set alarms based on thresholds. AWS Config, Trusted Advisor, and Inspector do not provide OS-level metric collection or alarm capabilities.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector