PAS-C01 Mock Exam 72 — 25 Questions

Question 1

A company runs a web application on Amazon ECS with Fargate launch type. The application's memory utilization spikes periodically, causing tasks to be killed. The operations team wants to automatically scale the service based on memory usage. Which TWO steps are necessary to implement this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Application Auto Scaling target tracking scaling policy based on memory utilization.. Options B and E are necessary. B: Application Auto Scaling with a target tracking scaling policy automatically adjusts the desired task count to maintain a target memory utilization, preventing OOM kills. E: The ECS service must publish custom CloudWatch metrics for memory utilization because Fargate does not publish memory metrics by default; enabling this makes the metric available for the scaling policy. Option D is not necessary because target tracking scaling policies use the metric directly without requiring a separate CloudWatch alarm.

Answer

Attach an EC2 Auto Scaling group to the ECS service to handle capacity.

Answer

Configure step scaling policies to add multiple tasks at once.

Answer

Create a CloudWatch alarm that triggers the scaling policy when memory exceeds a threshold.

Question 2

An operations team is planning a disaster recovery (DR) strategy for an SAP system on AWS. The system includes SAP HANA database and application servers. The DR site must have a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which THREE components are essential for this DR strategy? (Choose THREE.)

Accepted Answer

AWS CloudFormation templates to provision the DR infrastructure. Correct answers are A, C, and E. CloudFormation templates (A) automate infrastructure provisioning, helping meet the 2-hour RTO. S3 Cross-Region Replication for SAP backup files (C) ensures backups are available in the DR region, supporting RPO. Cross-Region replication of EBS snapshots for SAP HANA data volumes (E) enables frequent snapshots (e.g., every 15 minutes) to meet the RPO. B is wrong because Multi-AZ is for high availability within a region, not cross-region DR. D is wrong because Route 53 health checks and failover routing are important for traffic management but are not essential components for achieving the specified RTO/RPO; they support failover but do not directly provide data replication or infrastructure provisioning.

Answer

Multi-AZ deployment of the SAP application servers

Answer

Amazon Route 53 health checks and failover routing

Question 3

A company runs its SAP landscape on AWS and uses an Application Load Balancer (ALB) to distribute traffic to multiple web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the most likely cause?

Accepted Answer

The target group health checks are failing, causing the ALB to mark instances as unhealthy.. 503 errors from an ALB typically indicate that the target instances are unhealthy or the ALB cannot route traffic to them, often due to failed health checks. Option A is wrong because security groups blocking traffic would cause 504 or timeout errors, not 503. Option B is wrong because an expired SSL certificate on the ALB would cause 502 errors (bad gateway), not 503. Option C is wrong because CloudFront is not in the path; the question describes an ALB distributing traffic directly to web dispatchers, so CloudFront misconfiguration is irrelevant.

Answer

The security groups for the ALB are blocking incoming traffic.

Answer

The SSL certificate on the ALB has expired.

Answer

The CloudFront distribution in front of the ALB is misconfigured.

Question 4

A company is designing an SAP S/4HANA deployment on AWS. They want to ensure high availability for the central services (ASCS and ERS) across two Availability Zones. Which TWO of the following are required components for a typical SAP high availability setup on AWS? (Choose TWO.)

Accepted Answer

AWS Network Load Balancer to route traffic to the ASCS and ERS instances.. The AWS Network Load Balancer (NLB) is required to distribute traffic to the ASCS and ERS instances across two Availability Zones. It uses health checks to detect failures and reroute traffic to the healthy instance, ensuring that the SAP central services remain available even if one AZ fails. The NLB operates at Layer 4, preserving the source IP and supporting the necessary SAP protocols like the Message Server and Enqueue Replication.

Answer

Amazon RDS Multi-AZ deployment for the SAP HANA database.

Answer

AWS Transit Gateway to connect the two Availability Zones.

Answer

AWS Global Accelerator to provide static anycast IP addresses.

Question 5

A company is migrating its SAP environment to AWS. The operations team needs to ensure that all changes to the SAP infrastructure are tracked and that unauthorized changes are detected. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config records configuration changes and enables compliance monitoring, making it the right choice for tracking changes and detecting unauthorized changes. CloudTrail records API calls, not configuration state. GuardDuty is for threat detection. Trusted Advisor provides best practice checks.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 6

Which TWO of the following are best practices for monitoring SAP on AWS? (Choose 2)

Accepted Answer

Set up Amazon CloudWatch alarms for HANA database metrics. Options A and B are correct. A: Amazon CloudWatch alarms for HANA database metrics enable proactive detection of performance issues, such as high memory or CPU usage, which is critical for SAP systems. B: SAP EarlyWatch Alert (EWA) provides periodic health checks and recommendations, making it a standard best practice for monitoring. Option C is incorrect because disabling detailed monitoring reduces visibility into EC2 instance performance, harming monitoring capabilities. Option D is incorrect because manual log reviews are not scalable or timely for production systems. Option E is incorrect because EBS snapshots are for backup and disaster recovery, not real-time monitoring.

Answer

Disable detailed monitoring on EC2 instances to reduce costs

Answer

Manually review system logs weekly

Answer

Take daily EBS snapshots of the HANA data volume

Question 7

A company is running SAP HANA on EC2 instances with EBS volumes. They need to ensure data durability and backup. Which THREE actions should be taken?

Accepted Answer

Enable SAP HANA System Replication to a secondary instance.. SAP HANA System Replication provides synchronous or asynchronous data replication to a secondary EC2 instance, ensuring high availability and data durability by maintaining a real-time copy of the HANA database. This is a native SAP feature that protects against instance failure and supports automatic failover, which is critical for production HANA workloads.

Answer

Disable automated backups to reduce costs.

Answer

Use instance store volumes for HANA data.

Question 8

A company runs SAP on AWS and uses AWS Backup to back up the SAP HANA database. The backup job fails with an error indicating insufficient IAM permissions. What is the most likely missing permission?

Accepted Answer

kms:Decrypt. AWS Backup requires permissions to decrypt the KMS key used to encrypt the SAP HANA database or its backup target. If the IAM role assigned to AWS Backup lacks the `kms:Decrypt` action for the specific KMS key, the backup job fails with an insufficient IAM permissions error. This is because AWS Backup must read the encrypted data before transferring it to the backup vault.

Answer

ec2:DescribeInstances

Answer

rds:CreateDBSnapshot

Answer

s3:PutObject

Question 9

An AWS administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The instance type is r5.2xlarge. Which CloudWatch metric should the administrator use to track the CPU usage of the instance?

Accepted Answer

CPUUtilization. (CPUUtilization). CPUUtilization is a standard CloudWatch metric for EC2 instances that measures the percentage of allocated EC2 compute units that are currently in use. It is suitable for monitoring CPU usage of an EC2 instance running SAP NetWeaver. Option A (MemoryUtilization) is incorrect because memory utilization is not a default CloudWatch metric; it requires a custom agent. Option C (NetworkIn) measures network traffic, not CPU. Option D (DiskReadOps) measures disk I/O operations.

Answer

MemoryUtilization

Answer

NetworkIn

Answer

DiskReadOps

Question 10

An SAP administrator is troubleshooting a failed backup of an SAP HANA database running on an EC2 instance. The backup is configured to use AWS Backup with a backup vault. The error log shows: 'AccessDenied: User: arn:aws:sts::123456789012:assumed-role/AWSBackupRole/backup-job is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/abcd1234-...' Which IAM policy modification is required to resolve this issue?

Accepted Answer

Add kms:Decrypt permission to the backup role on the KMS key.. The error indicates that the backup role is missing the kms:Decrypt permission on the KMS key used to encrypt the backup vault. This permission is necessary to decrypt the data during the backup process. Option A is incorrect because cloudhsm:Decrypt is unrelated to KMS keys. Option C is incorrect because kms:CreateGrant is used to create grants for cross-account access, not for decryption. Option D is incorrect because kms:Encrypt is used for encryption, not decryption.

Answer

Add cloudhsm:Decrypt permission to the backup role.

Answer

Add kms:CreateGrant permission to the backup role.

Answer

Add kms:Encrypt permission to the backup role.

Question 11

An SAP administrator needs to review API calls made by a user who accidentally deleted an S3 bucket used for SAP backups. Which AWS service provides a record of these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion events. When a user accidentally deletes an S3 bucket, CloudTrail captures the event details such as the user identity, source IP, and timestamp, enabling the SAP administrator to audit the action. This is essential for security analysis and operational troubleshooting in the context of SAP backups.

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 12

Which TWO actions can be taken to improve the resilience of an SAP HANA database running on AWS? (Choose two.)

Accepted Answer

Use EBS snapshots for automated backup.. EBS snapshots provide a reliable, automated backup mechanism for SAP HANA data volumes, enabling point-in-time recovery and disaster recovery without requiring additional SAP HANA-specific replication. These snapshots are stored in Amazon S3 and can be used to restore the database to a consistent state, improving resilience against data corruption or accidental deletion.

Answer

Deploy the application in a single Availability Zone.

Answer

Increase the CPU capacity of the database server.

Answer

Enable cross-region replication of the database.

Question 13

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which TWO actions should they take?

Accepted Answer

Set up SAP HANA System Replication to another AWS region.. To achieve an RPO of 15 minutes and RTO of 2 hours, the company should use SAP HANA System Replication to replicate data to another AWS region (Option A), which provides near-real-time replication meeting the RPO. Additionally, using AWS CloudFormation to automate infrastructure deployment in the DR region (Option C) enables rapid provisioning of the DR environment, meeting the RTO. Option B (Pilot Light with EC2 standby) may not meet the RTO if manual steps are required. Option D (AWS Backup with 15-minute schedules) is not suitable for SAP HANA databases and may not meet RTO. Option E (EBS snapshots every 15 minutes) is not feasible due to performance impact and recovery time.

Answer

Implement a Pilot Light strategy using EC2 instances in standby.

Answer

Use AWS Backup to schedule backups every 15 minutes.

Answer

Take EBS snapshots every 15 minutes.

Question 14

An SAP administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The administrator wants to receive an alert when CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (Option D) are the correct choice because they can monitor Amazon CloudWatch metrics, such as EC2 CPU utilization, and trigger actions (e.g., SNS notifications) when a specified threshold (e.g., 90% for 5 consecutive minutes) is breached. Option A (AWS CloudTrail) is incorrect because it logs API calls for auditing, not performance metrics. Option B (AWS Config) tracks resource configuration changes, not real-time metrics. Option C (Amazon VPC Flow Logs) captures network traffic metadata, not CPU utilization.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 15

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and be accessible only within the VPC. Which TWO steps should the solutions architect take to meet these requirements? (Choose TWO.)

Accepted Answer

Use an internal Application Load Balancer to distribute traffic between services.. An internal Application Load Balancer (ALB) operates within a VPC and does not expose a public endpoint, ensuring that traffic between microservices remains private. It distributes incoming requests to Fargate tasks based on defined rules, enabling secure, internal communication without internet access.

Answer

Attach an Internet Gateway to the VPC and configure route tables for the private subnets.

Answer

Place the Fargate tasks in public subnets to allow them to communicate with each other through the internet gateway.

Answer

Use AWS Cloud Map for service discovery and register a public DNS name for each service.

Question 16

A company runs SAP on AWS using an SAP HANA multi-node cluster. The operations team needs to apply an OS-level security patch that requires a reboot. How can they minimize downtime?

Accepted Answer

Use HANA scale-out to move services to other nodes, then reboot each node sequentially.. In a HANA multi-node cluster, you can leverage HANA's scale-out capabilities to move services (e.g., using HANA system replication or failover) to other nodes, then reboot each node sequentially. This minimizes downtime as the database remains available through the other nodes. Option A is incorrect because AWS Systems Manager Run Command can apply the patch, but if a reboot is required, it will still need a reboot, causing downtime. Option B is incorrect because rebooting all nodes simultaneously will cause complete downtime. Option D is incorrect because creating a new EC2 instance and updating DNS introduces complexity, potential connectivity issues, and is not a standard approach for HANA clusters; it also does not leverage HANA's built-in high availability features.

Answer

Use AWS Systems Manager Run Command to apply the patch without reboot.

Answer

Reboot all nodes simultaneously during the maintenance window.

Answer

Create a new EC2 instance with the patch applied, then update DNS to point to the new instance.

Question 17

A company runs SAP HANA on AWS and wants to implement a backup strategy using AWS Backint agent for SAP HANA. Which storage service is best suited for storing the backup files when using Backint?

Accepted Answer

Amazon S3. AWS Backint agent for SAP HANA is designed to stream backups directly to Amazon S3, making S3 the optimal storage service for backup files. Option B (Amazon EFS) is a file storage service not intended for Backint backups. Option A (Amazon S3 Glacier) is a cold archival storage, not suited for frequent backups. Option D (Amazon EBS) provides block storage for EC2 instances, not the target for Backint.

Answer

Amazon S3 Glacier

Answer

Amazon EFS

Answer

Amazon EBS

Question 18

A company runs SAP ERP on AWS using a single Availability Zone. The system includes an SAP HANA database on an EC2 instance with 2 TB of memory. The operations team plans to perform a major version upgrade of the SAP HANA database, which requires approximately 4 hours of downtime. The company's SLA allows a maximum of 2 hours of downtime. The team decides to use a blue/green deployment strategy by creating a new HANA instance in a different Availability Zone and replicating data using HANA System Replication (HSR). After setting up replication, they perform a failover to the new instance. However, the failover takes 3 hours due to the large amount of data that needs to be synchronized. What should the team do to meet the 2-hour downtime requirement?

Accepted Answer

Use HANA System Replication with initial snapshot by taking a backup of the source, restoring on the target, and then setting up replication.. Using initial snapshot with HSR reduces the initial sync time significantly because it avoids copying all data over the network. Instead, the snapshot is restored on the target and then replication catches up. Option A is wrong because increasing bandwidth may help but not enough for 2 TB of memory; the initial sync will still take hours. Option B is wrong because multi-AZ for RDS is for RDS databases, not for self-managed HANA on EC2. Option D is wrong because scaling up the source does not help; the issue is data transfer time.

Answer

Scale up the source HANA instance to a larger instance type to speed up replication.

Answer

Increase the network bandwidth between the two Availability Zones to 10 Gbps.

Answer

Use Amazon RDS for SAP HANA instead of self-managed EC2.

Question 19

An SAP administrator attaches this IAM policy to a user. The user is unable to start an EC2 instance with ID i-0abcdef1234567890. What is the most likely cause?

Accepted Answer

The IAM policy is applied to a user who is working in a different AWS region than the one specified in the resource ARN.. The IAM policy likely includes a resource ARN that specifies a region (e.g., us-east-1). IAM policies with resource ARNs that include a region only apply to resources in that region. If the user is attempting to start the EC2 instance in a different region (e.g., eu-west-1), the policy does not grant permission, even though it includes ec2:StartInstances. Option B correctly identifies this region mismatch as the most likely cause. Options A, C, and D are incorrect because the policy does include the necessary actions for starting an instance.

Answer

The IAM policy does not include the ec2:RebootInstances action.

Answer

The IAM policy does not include the ec2:DescribeInstances action.

Answer

The IAM policy does not include the ec2:StartInstances action.

Question 20

Which TWO actions should be taken to ensure high availability for an SAP NetWeaver system on AWS? (Choose TWO.)

Accepted Answer

Assign Elastic IP addresses to the instances for failover. To ensure high availability for an SAP NetWeaver system on AWS, two key actions are: A) Assign Elastic IP addresses to the instances for failover, which allows rapid IP remapping to a standby instance in case of failure; and E) Use Amazon RDS Multi-AZ for the database, which provides automatic failover to a standby replica in a different Availability Zone. Option B (placing instances in a single AZ) reduces availability. Option C (using Spot Instances) risks interruption and is not suitable for production SAP systems. Option D (deploying ASCS in an Auto Scaling group) is not recommended because ASCS is stateful and cannot scale horizontally.

Answer

Place all EC2 instances in a single Availability Zone

Answer

Use Amazon EC2 Spot Instances for cost savings

Answer

Deploy the ASCS instance in an Auto Scaling group