PAS-C01 Practice Exam 63 — 20 Questions

Question 1

A company has an SAP HANA database running on a r5.8xlarge EC2 instance with 3.5 TB of data. They want to back up the database to Amazon S3 using Backint. What is the most cost-effective and performant backup strategy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use multiple parallel Backint streams to a single S3 bucket with S3 Standard storage.. Backint is the native SAP HANA backup integration that sends backup data directly to Amazon S3. Using multiple parallel Backint streams maximizes throughput by leveraging S3's high request rate limits, and S3 Standard storage provides the low-latency access needed for frequent backups and restores without incurring retrieval costs. This combination is both cost-effective and performant for a 3.5 TB database.

Answer

Use EBS snapshots and copy them to S3.

Answer

Use multiple parallel Backint streams to multiple S3 buckets with S3 Glacier storage.

Answer

Use a single Backint stream to one S3 bucket with S3 Standard storage.

Question 2

A company has an SAP HANA database running on a r5.8xlarge EC2 instance with 3.5 TB of data. They want to back up the database to Amazon S3 using Backint. What is the most cost-effective and performant backup strategy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an additional gp2 volume and use it for temporary data.. Attaching an additional gp2 volume and moving temporary data to it offloads I/O from the primary HANA data volume, effectively increasing the total IOPS available to the database without changing the size of the original volume. This reduces the I/O bottleneck and improves performance.

Option A (EBS optimization) improves network bandwidth but does not increase the volume's IOPS.

Option B (st1) is throughput-optimized and unsuitable for low-latency database workloads like SAP HANA.

Option C (increasing volume size) directly violates the requirement of not changing the volume size.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Change the volume type to st1 (throughput optimized).

Answer

Modify the volume to increase its size to 1,000 GB.

Question 3

A company runs SAP HANA on AWS using an m5.24xlarge instance. The storage is configured with multiple EBS io1 volumes striped with LVM. Recently, the database performance has degraded. CloudWatch shows that the EBS write latency averages 5 ms, and the queue depth is consistently below 1. What is the most likely cause of the performance degradation?

Accepted Answer

The LVM stripe width is misconfigured causing uneven I/O distribution. With EBS write latency averaging 5 ms and queue depth consistently below 1, the storage subsystem is not saturated; the bottleneck is likely an uneven distribution of I/O across the LVM striped volumes. A misconfigured stripe width (e.g., too small or not aligned with the SAP HANA page size of 16 KB) can cause certain volumes to handle disproportionate write traffic, leading to localized latency spikes and overall performance degradation even when aggregate metrics appear acceptable.

Answer

The EBS-optimized instance feature is not enabled

Answer

The EBS volume type should be changed to gp3

Answer

The EBS write latency is too high and requires a larger instance

Question 4

A company is designing a highly available SAP NetWeaver system on AWS. They plan to use a two-node ASCS/ERS cluster with SUSE Linux Enterprise Server (SLES). Which AWS service is required to manage the virtual IP address for the cluster?

Accepted Answer

Amazon Route 53. Amazon Route 53 is required to manage the virtual IP address for the two-node ASCS/ERS cluster by using DNS failover. In a SLES-based SAP NetWeaver cluster on AWS, the cluster software (e.g., Pacemaker) updates a Route 53 DNS record with the private IP address of the active node, enabling clients to connect via a hostname that resolves to the current primary node. This DNS-based approach replaces traditional virtual IP (VIP) floating, which is not natively supported in AWS VPC due to the lack of gratuitous ARP or multicast.

Answer

AWS VPC Peering

Answer

Amazon EBS

Answer

Elastic Load Balancing

Question 5

An SAP administrator needs to ensure that Amazon EBS snapshots of SAP HANA data volumes are crash-consistent. The HANA database is on a single EC2 instance with multiple EBS volumes. What is the correct approach?

Accepted Answer

Use AWS Backup with application-consistent snapshots using pre- and post-scripts.. AWS Backup with application-consistent snapshots uses pre- and post-scripts to quiesce the SAP HANA database, ensuring that all EBS volumes are captured in a crash-consistent state. This approach coordinates the snapshot process across multiple volumes without stopping the EC2 instance, maintaining data integrity for SAP HANA's data volumes.

Answer

Configure the volumes as a RAID 0 array and take a snapshot of the array.

Answer

Take snapshots of each volume individually while the instance is running.

Answer

Stop the EC2 instance, take snapshots of all volumes, then start the instance.

Question 6

An SAP system on AWS has an SAP Central Services (ASCS) instance running on an EC2 instance. The solution must ensure high availability for the ASCS in case of an EC2 failure. The ASCS uses a shared file system for the /sapmnt and /usr/sap/trans directories. Which architecture meets the high availability requirement with the least administrative overhead?

Accepted Answer

Use Amazon EFS for /sapmnt and /usr/sap/trans, and configure a Pacemaker cluster across two Availability Zones. Amazon EFS provides a fully managed, highly available, and durable NFS file system that can be mounted concurrently across multiple EC2 instances in different Availability Zones. By using EFS for /sapmnt and /usr/sap/trans, and configuring a Pacemaker cluster across two AZs, you achieve automatic failover for the ASCS instance without the administrative overhead of managing a separate NFS server or replicating snapshots.

Answer

Deploy a second ASCS instance in another AZ and use an EC2 instance running NFS server with an EBS volume

Answer

Use an Amazon EBS volume attached to the ASCS instance and replicate it to another Availability Zone using EBS Snapshots

Answer

Use Amazon S3 and mount it using s3fs-fuse for the shared file system

Question 7

A retail company is migrating its SAP ERP system to AWS. The system includes an SAP HANA database (1 TB) and an SAP NetWeaver application server. The migration strategy is to use AWS Database Migration Service (DMS) for the database and then manually install the application server on an EC2 instance. The network connection is AWS Direct Connect with 1 Gbps bandwidth. During the migration, the DMS task for the database completes successfully, but the application server installation fails because the SAP installation media is not accessible. The installation media is stored on an on-premises file server. The EC2 instance for the application server is in a private subnet with no direct internet access. The administrator has created a VPC endpoint for S3 to access the media, but the media is not in S3. Which step should the administrator take to make the installation media available?

Accepted Answer

Add a route in the VPC route table to direct traffic to the on-premises network via Direct Connect.. The installation media resides on an on-premises file server. The EC2 instance is in a private subnet connected via Direct Connect. To access the on-premises network, the administrator must add a route in the VPC route table that directs traffic for the on-premises IP range to the Direct Connect virtual interface (VIF). Option A involves an unnecessary copy to S3. Option C introduces internet exposure. Option D is for caching on-premises data to S3 but does not resolve routing.

Answer

Copy the installation media to an S3 bucket and use the VPC endpoint to access it.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Answer

Use AWS Storage Gateway to cache the media in S3.

Question 8

A company runs SAP S/4HANA on AWS with a single-instance deployment. The database is hosted on an r5.8xlarge instance with 5000 provisioned IOPS EBS volumes. Recently, the system experienced a performance degradation during peak hours. CloudWatch metrics show that the EBS volume read latency is consistently above 10 ms, and the queue length is frequently peaking at 20. The instance is in the same Availability Zone as the EBS volumes. What should the administrator do to resolve the performance issue?

Accepted Answer

Increase the provisioned IOPS on the EBS volumes to 10000.. The CloudWatch metrics show high read latency (>10 ms) and a queue length peaking at 20, which indicates that the EBS volume is throttling due to insufficient IOPS for the workload. Increasing provisioned IOPS from 5000 to 10000 directly addresses the bottleneck by allowing more I/O operations per second, reducing queue depth and latency. Since the instance and volumes are in the same Availability Zone, network latency is not a factor, and instance store volumes are ephemeral and unsuitable for persistent SAP HANA data.

Answer

Move the instance to a different Availability Zone to reduce network latency.

Answer

Move the database to an instance with instance store volumes for better performance.

Answer

Migrate the EBS volumes to gp3 volume type with baseline performance.

Question 9

An SAP administrator is planning a Disaster Recovery (DR) strategy for SAP HANA on AWS. The DR site is in a different AWS Region. Which AWS service can replicate SAP HANA data to the DR region with low Recovery Point Objective (RPO)?

Accepted Answer

SAP HANA System Replication with log shipping. SAP HANA System Replication with log shipping is the correct choice because it provides near-synchronous or synchronous replication of HANA data and transaction logs to a secondary system in another AWS Region, enabling a Recovery Point Objective (RPO) of seconds or even zero data loss. This native HANA feature is optimized for SAP workloads and integrates directly with HANA's persistence layer, making it the most suitable DR method for low RPO requirements.

Answer

Amazon EBS snapshots copied to the DR region

Answer

AWS Database Migration Service (DMS) with ongoing replication

Answer

Amazon S3 cross-region replication

Question 10

A company is migrating an SAP Business Suite system to AWS. The system has a large database and requires high network throughput between the application and database tiers. Which Amazon EC2 placement group strategy should be used?

Accepted Answer

Cluster placement group. A cluster placement group is the correct choice because it provides low-latency, high-throughput networking by placing all instances in a single Availability Zone within the same logical rack. For SAP Business Suite with a large database, the application and database tiers require high network throughput (e.g., up to 100 Gbps for supported instance types) and minimal latency, which a cluster placement group delivers by ensuring all instances are in close physical proximity. In contrast, a spread placement group distributes instances across distinct hardware to reduce risk of simultaneous failure but does not optimize network performance. A partition placement group spreads instances across logical partitions to isolate failures but also lacks the high-bandwidth, low-latency benefits of a cluster group. Using no placement group may result in instances being placed on separate racks, increasing network latency and reducing throughput.

Answer

Spread placement group

Answer

Partition placement group

Answer

No placement group

Question 11

A company wants to automate the installation of SAP software on AWS. Which AWS service is most appropriate for orchestrating the deployment of SAP systems?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the most appropriate service for orchestrating the deployment of SAP systems because it allows you to define the entire infrastructure as code using templates, enabling automated, repeatable, and consistent provisioning of SAP landscapes. It supports custom resources and nested stacks, which are essential for managing the complex dependencies and multi-tier architecture typical of SAP deployments on AWS.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 12

A company uses SAP BusinessObjects (BO) on AWS. The BO servers run on EC2 instances in a private subnet. Users access the BI Launch Pad through an Application Load Balancer (ALB) in a public subnet. The company recently received a security audit finding that the ALB is accessible from the internet on port 443, but the security group allows inbound traffic from 0.0.0.0/0. The audit requires that only the company's corporate IP range (203.0.113.0/24) should be allowed. Additionally, the company wants to reduce the attack surface by blocking traffic from other IPs. What should the company do to meet the security requirement?

Accepted Answer

Modify the security group attached to the ALB to allow only inbound traffic from 203.0.113.0/24 on port 443.. The correct answer because modifying the security group attached to the ALB to restrict inbound traffic on port 443 to only the corporate IP range (203.0.113.0/24) is the most direct and effective way to meet the requirement. Security groups are stateful and can enforce IP-based restrictions. Option A is not the best choice because AWS WAF is not necessary for simple IP allowlisting; it's more suited for complex rules like rate limiting or SQL injection prevention. Option C is incorrect because while a network ACL can also restrict traffic, it is stateless and requires separate inbound and outbound rules, and it applies to the subnet rather than the ALB directly, which is less granular. Option D is unnecessary because moving the ALB to a private subnet would block all internet traffic, preventing even corporate users from accessing BI Launch Pad without additional VPN setup, which is more complex than needed.

Answer

Deploy AWS WAF on the ALB and create a rule to allow only the corporate IP range.

Answer

Replace the security group with a network ACL on the ALB subnet to allow only the corporate IP range.

Answer

Move the ALB to a private subnet and use a VPN for user access.

Question 13

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

Accepted Answer

Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.. AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Answer

Examine the S3 server access logs for the bucket.

Answer

Review the configuration timeline in AWS Config for the S3 bucket.

Answer

Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.

Question 14

A company manages a multi-account AWS environment using AWS Organizations. The operations team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket. What is the MOST efficient way to enforce this configuration?

Accepted Answer

Deploy an AWS CloudFormation StackSet with a template that enables CloudTrail and configures the S3 bucket in every account and region.. AWS CloudFormation StackSets allow you to deploy a CloudTrail configuration template across multiple accounts and regions in a single, automated operation. This approach ensures consistent enforcement of the policy without manual intervention, leveraging the centralized management capabilities of AWS Organizations.

Answer

Configure CloudTrail in the management account with an S3 bucket policy that grants access to all member accounts.

Answer

Create a custom script using AWS CLI to enable CloudTrail in each account and region.

Answer

Use AWS Service Catalog to publish a CloudTrail product and require each account to launch it.

Question 15

An SAP environment on AWS uses Amazon FSx for NetApp ONTAP for shared storage. The system is experiencing high write latency. The storage administrator suspects the volume is not optimized for SAP workloads. Which configuration change would most likely reduce write latency?

Accepted Answer

Enable tiering policy to allow all data to be served from the SSD tier.. Enabling the tiering policy to allow all data to be served from the SSD tier ensures that all volume data resides on the high-performance SSD storage pool of the FSx for ONTAP file system. This eliminates read/write latency caused by accessing data from the capacity pool (Amazon S3), which has higher latency. For SAP workloads that require consistent low-latency I/O, keeping all data on the SSD tier is critical to reduce write latency.

Answer

Enable data compression on the volume.

Answer

Enable the capacity pool tiering to auto-tier cold data to Amazon S3.

Answer

Increase the size of the volume.

Question 16

A company is running SAP HANA in a multi-node scale-out configuration on AWS. The cluster uses AWS Placement Groups with the 'cluster' placement strategy. The system is experiencing network latency between nodes. Which change should the company make to reduce latency?

Accepted Answer

Enable Enhanced Networking (ENA) on all instances in the cluster.. Enabling Enhanced Networking (ENA) on all instances reduces network latency and jitter by offloading network processing to dedicated hardware on the Elastic Network Adapter. For SAP HANA scale-out clusters requiring low-latency inter-node communication, ENA provides higher packet-per-second performance and lower latency compared to the default Xen-net driver, directly addressing the latency issue in the cluster placement group.

Answer

Change the placement group to 'spread' to reduce interference.

Answer

Use larger instance sizes to increase network bandwidth.

Answer

Use EBS-optimized instances to improve storage performance.

Question 17

A company is running SAP Business Suite on AWS and needs to back up the SAP HANA database daily. Which AWS service can be used to automate HANA backups to Amazon S3?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that natively supports SAP HANA databases running on Amazon EC2. It automates the creation, retention, and deletion of HANA backups directly to Amazon S3 using the Backint agent, eliminating the need for custom scripts or manual intervention.

Answer

AWS Storage Gateway

Answer

Amazon EBS snapshots

Answer

AWS DataSync

Question 18

A company is running SAP on AWS and needs to back up the SAP HANA database daily. The database is 1 TB in size and the backup must be completed within 2 hours. The backup will be stored in Amazon S3. Which approach provides the fastest backup time while minimizing cost?

Accepted Answer

Use the SAP HANA Backint agent to stream backups directly to S3. The SAP HANA Backint agent is the native, certified integration for SAP HANA backups to Amazon S3. It streams backup data directly to S3 via the Backint API, eliminating intermediate storage and minimizing data transfer overhead. This approach achieves the fastest backup time because it avoids the latency of writing to instance store, EBS, or EFS before reaching S3, and it incurs only S3 storage costs without additional compute or storage fees.

Answer

Copy the backup files to an EC2 instance store, then upload to S3

Answer

Take EBS snapshots of the volume

Answer

Mount an Amazon EFS file system and write backups to it

Question 19

A company is planning to migrate its SAP environment to AWS. They have multiple SAP systems that are interconnected. Which migration approach is recommended to minimize dependency issues?

Accepted Answer

Migrate systems in logical groups that have dependencies on each other. When migrating interconnected SAP systems, the recommended approach is to migrate them in logical groups based on dependencies. This ensures that dependent systems are moved together, minimizing issues with integrations, interfaces, and data consistency. Option A is incorrect because ignoring technical dependencies can lead to broken integrations. Option C is incorrect because migrating by size may break dependencies across systems. Option D is incorrect because a big bang migration of all systems simultaneously is highly risky and complex.

Answer

Migrate systems based on business process priority, ignoring technical dependencies

Answer

Migrate systems individually based on size, starting with the smallest

Answer

Migrate all systems at the same time in a big bang approach

Question 20

An SAP administrator notices that the SAP application server is failing health checks in the Elastic Load Balancer (ELB) target group. The application server runs on an EC2 instance behind an Application Load Balancer. The health check path is /sap/public/ping. What is the most likely cause of the failure?

Accepted Answer

The SAP application (e.g., disp+work) is not running on the instance. If the SAP application (disp+work) is not running, it cannot respond to the health check, causing the ELB to mark it unhealthy. Option A is incorrect because SAProuter does not block health check requests; it routes connections to the SAP system. Option B is incorrect because the health check path is correctly configured as /sap/public/ping, which is the standard SAP health check endpoint. Option C is incorrect because security groups not allowing inbound traffic from ELB would cause connection timeout, not a health check failure on a specific path.

Answer

SAProuter is blocking the health check requests

Answer

The health check path is incorrectly configured in the target group

Answer

The EC2 instance security group does not allow inbound traffic from the ELB