PAS-C01 Mock Exam 74 — 25 Questions

Question 1

A company is running SAP Business Suite on AWS. The system includes a central services (ASCS) instance, a primary application server (PAS), and a database server running SAP HANA. The company recently experienced an outage when the EC2 instance hosting the ASCS instance failed due to a hardware issue. The system was down for 4 hours while the IT team manually recovered the ASCS instance from an AMI. The company wants to implement a highly available ASCS instance with automatic failover and a Recovery Time Objective (RTO) of less than 15 minutes. The system is currently running in a single Availability Zone. What should the company do to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a second ASCS instance in a different Availability Zone, set up SAP enqueue replication, and use a virtual IP address with Route 53 health checks for failover.. Deploying a second ASCS instance in a different Availability Zone with SAP enqueue replication and a virtual IP address managed by Route 53 health checks provides automatic failover with an RTO under 15 minutes. This setup ensures that if the primary ASCS instance fails, the standby instance takes over quickly, maintaining enqueue state and minimizing downtime. Option A is wrong because an Application Load Balancer is not designed for SAP ASCS failover; it would not handle enqueue replication or virtual hostname. Option B is wrong because an Auto Scaling group with lifecycle hooks does not provide application-level clustering or enqueue state replication. Option D is wrong because CloudWatch EC2 Auto Recovery only restarts the instance in the same Availability Zone and does not address enqueue replication or cross-AZ failover, resulting in an RTO longer than 15 minutes.

Answer

Place the ASCS instance behind an Application Load Balancer and configure health checks.

Answer

Configure an Auto Scaling group for the ASCS instance with a minimum of 1 and maximum of 2, and use a lifecycle hook to attach an Elastic IP.

Answer

Enable CloudWatch EC2 Auto Recovery on the ASCS instance and configure it to start a new instance in a different AZ.

Question 2

A company is migrating its SAP ERP system to AWS and needs to retain the same SAP system ID (SID) and hostnames. The migration must be completed with minimal downtime. Which AWS service or feature supports this requirement?

Accepted Answer

SAP Software Update Manager (SUM) with Database Migration Option (DMO). SAP Software Update Manager (SUM) with Database Migration Option (DMO). SUM with DMO is an SAP tool specifically designed for system migrations, including cross-platform migrations like on-premises to AWS. It preserves the SAP system ID (SID) and hostnames by performing a homogeneous or heterogeneous migration while keeping the application configuration intact. It supports minimal downtime through near-zero downtime techniques.

Option B (AWS CloudEndure Migration, now AWS Application Migration Service) is a general-purpose migration service that replicates entire servers at the block level. While it can preserve hostnames and SIDs if configured, it is not SAP-aware and does not optimize for SAP system consistency or offer the same integration as SUM with DMO. It may require additional steps to ensure SAP-specific components are migrated correctly.

Option C (AWS Application Migration Service with custom scripts) similarly lacks SAP-specific tools and would rely on manual scripting to preserve SID and hostnames, increasing complexity and risk.

Option D (AWS Database Migration Service) is for database-level migration only and does not migrate the SAP application layer, so it cannot preserve the SID or hostnames of the entire SAP system.

Answer

AWS CloudEndure Migration (now AWS Application Migration Service)

Answer

AWS Application Migration Service (MGN) with custom scripts

Answer

AWS Database Migration Service (DMS)

Question 3

A company is migrating its SAP Business Suite system from on-premises to AWS. The system uses a Sybase ASE database. The migration team has limited Sybase expertise. They want to minimize the operational overhead after migration. Which database migration approach should they choose?

Accepted Answer

Use SAP Software Update Manager (SUM) with Database Migration Option (DMO) to migrate the system to SAP HANA on EC2.. Migrating from Sybase ASE to SAP HANA is a strategic move that reduces operational overhead because HANA is a modern in-memory database with better performance and simpler management. SAP Software Update Manager (SUM) with Database Migration Option (DMO) is the official SAP tool to perform this migration while also upgrading the SAP system. This approach minimizes manual effort and leverages SAP expertise. Option A is incorrect because AWS Application Migration Service (MGN) would replicate the entire Sybase server, keeping Sybase and not reducing overhead. Option C is incorrect because AWS DataSync is designed for file-based transfers, not database replication. Option D is incorrect because AWS DMS does not support Sybase as a target database, and Amazon RDS does not support Sybase; Sybase on AWS would require self-managed EC2, increasing overhead.

Answer

Use AWS MGN to replicate the entire Sybase server to EC2, then perform a system upgrade to SAP HANA.

Answer

Use AWS DataSync to copy the Sybase data files to EBS and attach to an EC2 instance running Sybase.

Answer

Use AWS DMS to migrate the Sybase database to Amazon RDS for Sybase.

Question 4

Your company runs SAP Business Suite on AWS. The system has a three-tier architecture with a web dispatcher, application servers, and a HANA database. The operations team has been receiving alerts about high CPU usage on the application servers during peak hours. The application servers are currently running on m5.large instances. You need to ensure consistent performance without over-provisioning. What is the most cost-effective solution?

Accepted Answer

Configure Auto Scaling with a step scaling policy based on CPU utilization. Configuring Auto Scaling with a step scaling policy based on CPU utilization automatically adds or removes application servers in response to demand. This ensures consistent performance during peak hours without permanently over-provisioning resources, making it the most cost-effective solution. Option D is correct.

Answer

Add more application servers manually during peak hours

Answer

Upgrade all application servers to m5.xlarge instances

Answer

Use reserved instances to lower cost but keep existing instances

Question 5

Which TWO statements are true regarding Amazon EBS volume types for SAP HANA data volumes?

Accepted Answer

io2 Block Express volumes provide up to 256,000 IOPS. Io2 Block Express volumes are designed for SAP HANA data volumes, offering up to 256,000 IOPS and 4,000 MB/s throughput per volume, which meets the high-performance requirements for SAP HANA. Option C is correct because gp3 volumes can be provisioned with up to 16,000 IOPS and 1,000 MB/s throughput, making them a cost-effective alternative for smaller SAP HANA workloads or non-production environments.

Answer

io1 volumes are the recommended choice for SAP HANA

Answer

st1 volumes are suitable for SAP HANA log volumes

Answer

sc1 volumes are cost-effective for SAP HANA data volumes

Question 6

An organization is migrating an SAP BusinessObjects system to AWS. The system uses a Sybase ASE database. They need to minimize downtime. Which migration strategy is most appropriate?

Accepted Answer

Use SAP Landscape Reorganization (LaMa) to automate the migration.. The best approach is to use SAP Landscape Reorganization (LaMa) which supports Sybase ASE and can automate the migration with minimal downtime. DMS does not support Sybase ASE as a source. HSR is for SAP HANA, not Sybase. Export/import is manual and leads to longer downtime.

Answer

Use AWS Database Migration Service (DMS) with ongoing replication.

Answer

Perform an export/import of the database to AWS.

Answer

Set up HANA System Replication (HSR) to the AWS target.

Question 7

Which TWO of the following AWS services can be used to create and manage SAP system backups in an automated manner?

Accepted Answer

AWS Backup. AWS Backup is a fully managed backup service that can automate and centrally manage backups across AWS services, including EC2 instances and RDS databases used for SAP. Option C is correct because AWS Systems Manager can automate backup tasks through its Automation capabilities, including creating snapshots and managing backup schedules for SAP systems. Option B is wrong because AWS CloudTrail is an auditing service that records API activity, not a backup service. Option D is wrong because AWS Lambda is a compute service that can run custom code but is not a dedicated backup management service. Option E is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not for backup management.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

AWS CloudFormation

Question 8

An operations team uses this IAM policy for a role assumed by SAP administrators. An administrator tries to stop a production SAP HANA instance in the us-west-2 region but receives an access denied error. What is the cause?

Accepted Answer

The Deny statement with a condition on aws:RequestedRegion prevents actions outside us-east-1.. The Deny statement includes a condition using aws:RequestedRegion that blocks any action unless the request is made in us-east-1. Since the administrator's request is in us-west-2, the condition fails and the Deny applies, causing the access denied error. Option A is incorrect because the Allow statement's resource ARN is for us-east-1, but the Deny overrides the Allow; the resource region is not the primary issue. Option B is incorrect because even if the instance has the tag, the Deny still overrides. Option C is incorrect because the Deny does not require a tag; it checks the region.

Answer

The Allow statement's resource ARN specifies us-east-1, but the instance is in us-west-2.

Answer

The Allow statement only permits stopping instances with the tag Environment=production, and the instance does not have that tag.

Answer

The Deny statement requires the resource to have a specific tag, which is missing.

Question 9

The following IAM trust policy is attached to a role named CrossAccountBackupRole in account 123456789012:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/SAPAdminRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

What does this policy enable?

Accepted Answer

The SAPAdminRole can assume the CrossAccountBackupRole.. The trust policy explicitly allows the IAM role SAPAdminRole (in account 111111111111) to perform sts:AssumeRole on the CrossAccountBackupRole. This enables SAPAdminRole to assume CrossAccountBackupRole and inherit its permissions. The policy does not grant direct S3 access; that would require a separate permissions policy attached to CrossAccountBackupRole.

Answer

The SAPAdminRole directly receives permissions to access S3.

Answer

The CrossAccountBackupRole can be assumed by any IAM user.

Answer

The SAPAdminRole can list S3 buckets in account 123456789012.

Question 10

A company runs SAP HANA in a multi-node scale-out configuration on AWS. The system is experiencing network bottlenecks that impact performance. Which AWS services or features can be used to monitor and analyze network performance between the HANA nodes? (Choose THREE.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata to analyze network connections between HANA nodes. Amazon CloudWatch provides network metrics such as throughput and errors. AWS X-Ray helps trace application requests across nodes, which can identify performance bottlenecks including network latency. AWS Trusted Advisor offers best practice recommendations but not detailed network analysis. Amazon Inspector is for security assessment. Therefore, the three services that can be used to monitor and analyze network performance are VPC Flow Logs, CloudWatch, and X-Ray.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 11

A company is migrating a SAP database to Amazon RDS. The IAM policy shown in the exhibit is attached to a user. Which action is allowed by this policy?

Accepted Answer

Modify the production SAP RDS instance.. The policy allows all RDS actions (rds:*) on all resources, with an explicit deny for DeleteDBInstance on the prod-sap-db resource. This means the user can perform any RDS operation except deleting the specific production SAP RDS instance. Therefore, the user is allowed to modify the production SAP RDS instance (ModifyDBInstance), making Option B the correct answer. Creating a new RDS instance (CreateDBInstance) is generally allowed, but it is not the action directly related to the production instance in this scenario. Option C is denied explicitly. Option D is incorrect because the policy allows write operations.

Answer

Create a new RDS instance.

Answer

Delete the production SAP RDS instance.

Answer

Only read RDS instances.

Question 12

A company is migrating an SAP ERP system to AWS and needs to connect on-premises users to the SAP application securely. The SAP application is deployed in a VPC private subnet. Which service should be used to provide secure access for remote users?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed service that allows remote users to securely connect to AWS resources using OpenVPN-based VPN clients. Since the SAP application is in a private subnet, remote users need individual encrypted tunnels to access it, which Client VPN provides by authenticating users and routing traffic through a VPC endpoint.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 13

An SAP administrator created an IAM policy to allow an EC2 instance to upload backups to an S3 bucket. The policy is shown in the exhibit. However, the backup job fails with an access denied error. What is the most likely cause?

Accepted Answer

The policy requires server-side encryption with KMS, but the backup job does not include the required encryption header. The IAM policy includes the `s3:x-amz-server-side-encryption` condition key set to `aws:kms`, which enforces server-side encryption with KMS (SSE-KMS) for all `s3:PutObject` requests. If the backup job does not include the `x-amz-server-side-encryption: aws:kms` header in its PUT request, S3 will deny the request with an access denied error, even if the IAM role has the necessary permissions.

Answer

The KMS key policy does not grant the EC2 instance permission to use the key

Answer

The resource ARN is incorrect because it does not include the bucket name correctly

Answer

The IAM role does not have permission to call s3:PutObject

Question 14

A company runs SAP Business Suite on AWS with a large SAP HANA database. They observe high memory utilization and need to scale up. Which instance type should they choose to provide the highest memory capacity for SAP HANA?

Accepted Answer

u-12tb1.112xlarge. The u-12tb1.112xlarge is the correct choice because it is part of AWS's bare metal 'u' instance family, specifically designed for large in-memory databases like SAP HANA, offering up to 12 TB of RAM. This instance type provides the highest memory capacity among AWS instances, making it suitable for scaling up SAP HANA when high memory utilization is observed.

Answer

r5.24xlarge

Answer

x1e.32xlarge

Answer

m5.24xlarge

Question 15

A company runs a critical SAP HANA database on an m5.24xlarge EC2 instance. The database has high transaction volume and requires low latency storage. The current setup uses EBS gp2 volumes with 10,000 IOPS. During peak hours, the database performance degrades due to IOPS burst balance depletion. Which storage solution should the company use to maintain consistent performance?

Accepted Answer

Provision EBS io2 Block Express volumes with 10,000 provisioned IOPS.. EBS io2 Block Express volumes provide consistent, low-latency performance with provisioned IOPS, making them the recommended choice for SAP HANA workloads. Option A is wrong because although gp3 volumes can provision 10,000 IOPS and would eliminate burst balance depletion, io2 Block Express is specifically designed for high-performance databases like SAP HANA, offering higher durability and consistent low-latency performance. Option B is wrong because Instance Store is ephemeral and data is lost if the instance stops. Option D is wrong because EFS is a file system, not suitable for block-level database storage.

Answer

Migrate to EBS gp3 volumes with provisioned IOPS of 10,000.

Answer

Use EC2 Instance Store (NVMe SSD) for the database data and logs.

Answer

Move the database to Amazon EFS with provisioned throughput.

Question 16

A company is migrating an SAP S/4HANA system to AWS. The system requires high availability for the database and application layers. Which THREE components should the company configure to achieve high availability for SAP S/4HANA on AWS?

Accepted Answer

Pacemaker cluster for SAP Central Services. To achieve high availability for SAP S/4HANA on AWS, three components are required. A Pacemaker cluster (option A) manages SAP Central Services (ASCS and ERS) by automating failover. Multi-AZ deployment for SAP HANA (option B) ensures database high availability by replicating across Availability Zones. Amazon EFS (option D) provides a shared file system for the SAP transport directory, essential for consistent failover. Option C (Single Availability Zone) lacks redundancy, and option E (AWS Transit Gateway) is a networking component unrelated to high availability.

Answer

Single Availability Zone deployment

Answer

AWS Transit Gateway

Question 17

During an SAP migration, the migration team needs to ensure that all SAP system IDs (SIDs) are unique across the AWS environment. Which AWS service can be used to centrally manage and enforce this uniqueness?

Accepted Answer

AWS Service Catalog. AWS Service Catalog can define product portfolios with constraints, including preventing duplicate SIDs. Option B is wrong because AWS Config audits resources but doesn't enforce uniqueness. Option C is wrong because AWS Resource Access Manager shares resources, not manages SIDs. Option D is wrong because AWS CloudTrail logs API calls.

Answer

AWS Config

Answer

AWS Resource Access Manager

Answer

AWS CloudTrail

Question 18

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.

Question 19

During a SAP migration to AWS, the team needs to ensure that the SAP license is compliant. Which of the following is a requirement for running SAP production systems on AWS?

Accepted Answer

The EC2 instance must be SAP-certified and the number of SAPS must be licensed.. AWS requires that for running SAP production systems, the EC2 instance must be SAP-certified (listed in the SAP Certified and Supported Hardware Directory) and the customer must have licensed the appropriate number of SAP Application Performance Standard (SAPS) units for the instance type. This ensures the infrastructure meets SAP's performance and support requirements, and that the license covers the compute capacity used.

Answer

The company must use AWS Enterprise Support.

Answer

The company must notify SAP of the migration to AWS.

Answer

The company must use a specific AWS region.

Question 20

A company runs SAP S/4HANA on AWS with a production system in us-east-1 and a disaster recovery (DR) system in us-west-2. The DR system is a standby HANA system using HANA System Replication (HSR) with asynchronous replication. The primary system has a memory of 2 TB and uses x1e.16xlarge instances. The DR system uses identical instance types. Recently, the network latency between the primary and DR sites increased from 50 ms to 150 ms due to a change in the network path. The SAP Basis team notices that the replication lag has increased significantly, and the DR system is now behind by several minutes. The RPO requirement is 30 seconds. The team must resolve the issue without changing the DR site location or the bandwidth. Which action should the team take to meet the RPO?

Accepted Answer

Configure HSR to use delta_datashipping instead of log shipping.. HANA System Replication (HSR) can be configured to use delta_datashipping, which sends only the changed data blocks rather than full redo logs. This reduces the amount of data transferred per replication cycle, making it more resilient to increased network latency. With 150 ms latency, log shipping may fail to meet the 30-second RPO, but delta_datashipping can keep the DR system within the required lag by minimizing per-message payload size.

Answer

Increase the AWS Direct Connect bandwidth between the two regions.

Answer

Use Amazon S3 cross-region replication for the HANA log backups.

Answer

Change HSR to synchronous replication mode.