PAS-C01 Mock Exam 77 — 25 Questions

Question 1

A company runs a production SAP HANA database on AWS using an EC2 instance with EBS volumes. The database is experiencing high latency during peak hours. The operations team needs to identify the root cause. Which steps should the team take to diagnose the issue?

Accepted Answer

Monitor the EBS volume queue length and latency using Amazon CloudWatch metrics.. Option C is correct because CloudWatch metrics for EBS volume queue depth and latency can pinpoint the bottleneck. Option A is wrong because increasing instance size without diagnosis may not resolve the issue and could increase cost. Option B is wrong because switching to Provisioned IOPS without understanding the workload may be premature. Option D is wrong because migrating to RDS for SAP HANA is not a standard solution and may not address the specific latency issue.

Answer

Migrate the EBS volumes to Provisioned IOPS SSD (io1) immediately.

Answer

Move the SAP HANA database to Amazon RDS for SAP.

Answer

Increase the instance size to improve performance.

Question 2

An SAP HANA database administrator reviews the above CLI output for a data volume. The database team reports high write latency. What is the most likely performance bottleneck?

Accepted Answer

The volume is provisioned with too many IOPS for its size, exceeding the maximum IOPS/GB ratio.. Option D is correct. The volume is io1 with 10,000 IOPS for a 500 GB volume, exceeding the maximum IOPS/GB ratio of 50:1 for io1 (max 50 IOPS/GB). This can cause throttling and high latency. Option A is wrong because EBS-optimized instances support up to certain bandwidth, but not directly related. Option B is wrong because encryption does not significantly impact performance. Option C is wrong because DeleteOnTermination does not affect performance.

Answer

The volume is attached to an instance that does not support EBS optimization.

Answer

The volume has DeleteOnTermination enabled, which affects write performance.

Answer

The volume is not encrypted, causing performance degradation.

Question 3

Refer to the exhibit. An IAM policy is attached to a role used by an EC2 instance running SAP. The instance is unable to start or stop other EC2 instances. What is the most likely cause?

Accepted Answer

The policy resource ARN specifies a specific region (us-east-1), but the instances are in a different region.. The policy allows `ec2:StartInstances` and `ec2:StopInstances` on all resources (`"Resource": "*"`), so it should work. However, the condition is missing. The issue could be that the policy does not include the `ec2:DescribeInstanceStatus` action needed to check status before starting/stopping. But the question says it cannot start/stop; the policy seems correct. Actually, the most likely cause is that the role does not have permission to pass the instance profile (iam:PassRole) if the instance uses an instance profile, but that is not shown. Alternatively, the policy is missing `ec2:DescribeInstances` which is needed for the AWS CLI to list instances? But it is included. Let's think: The policy allows start/stop on all resources, so it should work. Possibly the issue is that the EC2 instance has an instance profile that the role cannot pass. But the question says the policy is attached to the role; the role is used by the instance. The policy looks correct. However, the exhibit might be missing the `ec2:DescribeInstanceStatus` action, but that is not required for start/stop. I'll choose option C: The policy does not include `ec2:DescribeInstances` for the specific instances? No, it's there. Actually, the correct answer is that the policy does not include `ec2:DescribeInstances` for the instances? It does. Hmm. Let's look at the options: A) The policy does not allow `ec2:StartInstances` on specific instance IDs. B) The policy does not include `ec2:DescribeInstances` for the instances. C) The policy does not include `ec2:RebootInstances`. D) The policy does not allow `s3:GetObject` on the backup bucket. None of these are correct. I need to adjust the exhibit to make the question work. Let me modify the exhibit to include a condition that restricts the resource to only certain instances. For example:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::sap-backup-bucket/*"
    }
  ]
}
```

Then the question: The instance is unable to start or stop instances in another region. Why? Because the resource ARN specifies us-east-1, but the instances are in eu-west-1. That is plausible. I'll use that.

Answer

The policy does not allow `ec2:RebootInstances` which is required to start instances.

Answer

The policy does not include `iam:PassRole` permission.

Answer

The policy does not include `ec2:DescribeInstances` for instances in other regions.

Question 4

An SAP application server repeatedly logs the error above. The database is an Oracle RDS instance. What is the most likely cause of this error?

Accepted Answer

The database connection is not properly established, or the session is in a bad state.. Option A is correct because the error indicates that a SQL statement was not parsed before execution, often due to a connection issue or session state. Option B is wrong because insufficient memory usually causes different errors. Option C is wrong because the application server is not the database. Option D is wrong because network connectivity would cause different errors.

Answer

The SAP application server is misconfigured.

Answer

There is a network connectivity issue between the application server and the database.

Answer

The Oracle database is out of memory.

Question 5

A company runs SAP on AWS and needs to ensure that the SAP application logs are centrally collected and analyzed for security incidents. Which AWS service should be used to collect and store the logs from EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. CloudWatch Logs can collect logs from EC2 instances via the unified CloudWatch agent. Option A is correct. Option B is wrong because S3 can store logs but not collect them directly from instances. Option C is wrong because Kinesis is for streaming data. Option D is wrong because CloudTrail records API activity, not application logs.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3

Question 6

An SAP administrator created the IAM policy shown for a backup script. The script fails when trying to upload a backup to S3. What is the likely cause?

Accepted Answer

The KMS key ARN is malformed; it contains extra characters.. The S3 action is allowed on objects only (arn:aws:s3:::sap-backup-bucket/*) but not on the bucket itself. For PutObject, the resource must be the object ARN, which is correct. However, the policy also requires kms:Decrypt for the KMS key, but the key ARN is wrong (it has extra characters). Option B is correct. Option A is wrong because the action is allowed. Option C is wrong because ec2:Describe* is not needed. Option D is wrong because the bucket policy is not shown.

Answer

The resource for S3 should include the bucket itself (arn:aws:s3:::sap-backup-bucket).

Answer

The ec2:Describe* action is not required and causes a conflict.

Answer

The s3:* action is too broad and is denied by an S3 bucket policy.

Question 7

An SAP Basis administrator needs to apply security patches to the operating system of SAP EC2 instances. The administrator wants to use AWS Systems Manager Patch Manager. Which THREE steps are required to set up patching? (Choose THREE.)

Accepted Answer

Create a patch baseline in AWS Systems Manager.. A, B, and D are correct. Installing SSM Agent on instances is required. Creating a patch baseline defines which patches to apply. Associating the instances with a maintenance window schedules the patching. C is wrong because CloudWatch Logs are not required for patching. E is wrong because Lambda is not needed.

Answer

Create an AWS Lambda function to invoke the patching process.

Answer

Configure Amazon CloudWatch Logs to store patch logs.

Question 8

Which TWO actions should be taken to improve the high availability of a single-instance SAP HANA database running on EC2? (Choose two.)

Accepted Answer

Set up HANA System Replication to a second EC2 instance in a different Availability Zone.. Options B and D are correct. Option B creates a standby instance in another AZ using replication. Option D creates automated snapshots for point-in-time recovery. Option A is wrong because increasing instance size does not improve availability. Option C is wrong because Multi-AZ RDS is for RDS, not EC2-based HANA. Option E is wrong because Amazon FSx does not replace the database.

Answer

Enable Multi-AZ on the RDS instance.

Answer

Move the HANA data files to Amazon FSx for Lustre.

Answer

Increase the instance size to a larger type.

Question 9

A company is using SAP HANA in a multi-node scale-out configuration on AWS. The operations team needs to automate the patching of the operating system on all nodes with minimal downtime. Which approach is most suitable?

Accepted Answer

Use a rolling patching strategy: patch one node at a time after isolating it from the HANA cluster.. Using a rolling patching strategy with Auto Scaling group or custom scripts that patch one node at a time while ensuring the node is temporarily removed from the HANA cluster minimizes downtime. Option A is correct. Option B is wrong because stopping all nodes causes downtime. Option C is wrong because just using AWS Systems Manager Patch Manager patches all at once without coordination. Option D is wrong because replacing instances from an AMI is more complex and may require data reload.

Answer

Stop all HANA nodes, patch the OS on each node, then start them all together.

Answer

Create new EC2 instances from a patched AMI and terminate the old ones.

Answer

Use AWS Systems Manager Patch Manager to apply patches to all nodes simultaneously.

Question 10

A company is deploying SAP S/4HANA on AWS and needs to ensure high availability for the central services (ASCS and ERS). The architecture uses two EC2 instances in different Availability Zones with a shared file system using Amazon EFS for /sapmnt. The SAP system is configured with an enqueue replication server. The operations team needs to automate the failover of the ASCS instance in case of a failure. The team is considering using AWS services for this purpose. Which approach should the team use?

Accepted Answer

Use Amazon Route 53 with health checks and a custom script to update DNS record on failover.. Using AWS Route 53 health checks to monitor the ASCS instance and a custom script to update DNS records on failover provides a simple and effective HA solution. Option D is correct. Option A is wrong because ALB cannot direct traffic to a single SAP instance for ASCS. Option B is wrong because Auto Scaling is for scaling out, not HA for stateful services. Option C is wrong because EC2 Auto Recovery recovers the instance but does not handle failover to another AZ.

Answer

Use an Application Load Balancer with a target group containing both ASCS instances.

Answer

Use an Auto Scaling group with a minimum of 2 instances and a lifecycle hook to handle failover.

Answer

Enable EC2 Auto Recovery to automatically recover the ASCS instance on new hardware.

Question 11

An operations team uses this IAM policy for a role assumed by SAP administrators. An administrator tries to stop a production SAP HANA instance in the us-west-2 region but receives an access denied error. What is the cause?

Accepted Answer

The Deny statement with a condition on aws:RequestedRegion prevents actions outside us-east-1.. Option A is correct. The Deny statement blocks all actions unless the request is made in us-east-1. Since the administrator is in us-west-2, the condition fails and the deny applies. Option B is wrong because the Allow statement explicitly allows stop/start on production instances, but the Deny overrides. Option C is wrong because the policy does not require tags for the Deny. Option D is wrong because the condition checks the requested region, not the resource region.

Answer

The Allow statement's resource ARN specifies us-east-1, but the instance is in us-west-2.

Answer

The Allow statement only permits stopping instances with the tag Environment=production, and the instance does not have that tag.

Answer

The Deny statement requires the resource to have a specific tag, which is missing.

Question 12

A company runs SAP on AWS with a distributed system: an SAP Central Services (ASCS) instance, a primary application server (PAS), and additional dialog instances (DI). All instances are in a single Availability Zone. The company wants to implement high availability for the ASCS instance using a shared filesystem for the /sapmnt directory. The ASCS instance uses a single EBS volume for /sapmnt. The operations team plans to use a Network File System (NFS) solution to share /sapmnt between instances. Which approach should the team use to achieve a highly available shared filesystem?

Accepted Answer

Deploy Amazon EFS and mount it on all instances as /sapmnt.. Option C is correct because using Amazon EFS provides a managed NFS filesystem that is highly available across AZs. Option A is wrong because attaching the same EBS volume to multiple instances is not supported without cluster filesystem. Option B is wrong because instance store is ephemeral. Option D is wrong because FSx for Windows is for Windows, not Linux.

Answer

Use Amazon FSx for Windows File Server to host the /sapmnt share.

Answer

Use an instance store volume on the ASCS instance and share it via NFS.

Answer

Create a secondary EBS volume and attach it to both the ASCS and PAS instances, then use a cluster-aware filesystem like OCFS2.

Question 13

Which TWO actions are recommended to ensure high availability for SAP NetWeaver on AWS? (Choose 2).

Accepted Answer

Use an Application Load Balancer with health checks to distribute traffic.. Placing instances in different Availability Zones (B) and using a load balancer with health checks (C) are best practices for high availability. Option A is wrong because single zone is not HA. Option D is wrong because t2 series are burstable and not recommended for production SAP. Option E is wrong because EBS volumes are already durable; snapshots don't provide HA.

Answer

Use a single Availability Zone to reduce latency.

Answer

Take frequent EBS snapshots to ensure data durability.

Answer

Use t2 instance types to reduce cost.

Question 14

A company runs its SAP landscape on AWS and uses an Application Load Balancer (ALB) to distribute traffic to multiple web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the most likely cause?

Accepted Answer

The target group health checks are failing, causing the ALB to mark instances as unhealthy.. Option C is correct because 503 errors typically indicate that the target instances are unhealthy or the ALB cannot route traffic to them. Option A is wrong because security groups blocking traffic would cause 504 or timeout errors. Option B is wrong because SSL certificate issues cause 502 errors. Option D is wrong because CloudFront is not in the path.

Answer

The security groups for the ALB are blocking incoming traffic.

Answer

The SSL certificate on the ALB has expired.

Answer

The CloudFront distribution in front of the ALB is misconfigured.

Question 15

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The administrator wants to receive an alert when the CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Option B is correct because CloudWatch Alarms can monitor metrics and trigger actions. Option A is wrong because CloudWatch Logs is for log data. Option C is wrong because CloudTrail is for API activity. Option D is wrong because Config is for resource configuration.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 16

A company is running a production SAP HANA database on an AWS EC2 instance with multiple EBS volumes. The operations team notices that the database performance degrades during peak hours. Which AWS service can be used to analyze the disk I/O performance and identify bottlenecks?

Accepted Answer

Amazon CloudWatch. CloudWatch provides metrics for EBS volumes including read/write throughput and IOPS, which can be used to analyze disk I/O performance. Option A is wrong because AWS Config tracks configuration changes, not performance. Option B is wrong because Trusted Advisor provides best-practice checks but not real-time performance analysis. Option C is correct. Option D is wrong because AWS Config is not for performance monitoring.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Config

Question 17

Which THREE steps should be taken to monitor the performance of an SAP HANA database on AWS? (Choose 3).

Accepted Answer

Install the CloudWatch agent on the EC2 instance to collect memory and disk metrics.. Monitoring EBS volume metrics (A), using CloudWatch agent for OS metrics (B), and setting alarms for HANA-specific metrics (E) are key. Option C is wrong because CloudTrail does not monitor performance. Option D is wrong because Direct Connect is for network connectivity.

Answer

Set up AWS Direct Connect to monitor network latency.

Answer

Enable AWS CloudTrail to track all API calls to the HANA database.

Question 18

An SAP system administrator needs to monitor the CPU and memory utilization of SAP EC2 instances. Which TWO AWS services can be used to collect and visualize these metrics? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. A and D are correct. CloudWatch can collect CPU and memory metrics (via agent), and Managed Service for Prometheus can scrape and store metrics. B is wrong because CloudTrail is for API logs. C is wrong because Config is for configuration compliance. E is wrong because Trusted Advisor provides best-practice checks, not granular metrics.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 19

A company runs its SAP HANA database on an EC2 instance in a single Availability Zone. The system is critical and requires high availability. The current setup uses an EBS volume for data storage. During a recent failure simulation, the database took 45 minutes to recover because the EBS volume had to be reattached and the database had to replay logs. The operations team wants to reduce recovery time to less than 15 minutes. Which solution should they implement?

Accepted Answer

Deploy a second EC2 instance in a different Availability Zone and configure SAP HANA system replication.. Option C is correct because using Multi-AZ deployment with synchronous replication ensures that a standby database is ready to take over immediately, reducing recovery time significantly. Option A is wrong because increasing EBS volume size does not reduce recovery time. Option B is wrong because Amazon S3 is not suitable for low-latency database storage. Option D is wrong because manual snapshots take time to restore and do not provide automatic failover.

Answer

Use AWS Backup to create more frequent snapshots.

Answer

Increase the provisioned IOPS of the EBS volume.

Answer

Move the database to Amazon S3 for faster access.

Question 20

A company runs a critical SAP ERP system on AWS. The system consists of a single EC2 instance running SAP NetWeaver with an Oracle database on the same instance. The instance type is r5.4xlarge with 500 GB gp2 EBS volume for the database. The operations team receives a CloudWatch alarm that the EBS volume's 'BurstBalance' metric has dropped to 0%. Consequently, the database performance degrades significantly. The team needs to resolve the issue and prevent recurrence. The SAP system cannot tolerate more than 10 minutes of downtime. The budget is limited. Which action should the team take?

Accepted Answer

Change the EBS volume type from gp2 to gp3 and increase the IOPS and throughput settings as needed.. Switching to gp3 provides baseline performance without burst credits and is cost-effective. Option C is correct. Option A is wrong because increasing to io2 volumes is more expensive and may require downtime if not using elasticity. Option B is wrong because changing to st1 is for throughput-optimized workloads, not suitable for database. Option D is wrong because adding more volumes and striping is complex and may require downtime.

Answer

Migrate the database to an io2 Block Express volume with provisioned IOPS.

Answer

Add additional EBS volumes and configure RAID 0 striping to increase IOPS.

Answer

Increase the volume size to 1000 GB to increase baseline IOPS and burst credits.