PAS-C01 Mock Exam 79 — 25 Questions

Question 1

Which TWO of the following are best practices for securing SAP workloads on AWS?

Accepted Answer

Use IAM roles to grant EC2 instances access to AWS services.. IAM roles allow EC2 instances to securely access AWS services (e.g., S3, DynamoDB) without embedding long-term credentials. By attaching an IAM role to an EC2 instance, the instance can obtain temporary credentials via the instance metadata service, which is a best practice for securing SAP workloads on AWS.

Answer

Disable encryption in transit between application and database tiers.

Answer

Allow SSH access from the internet for administration.

Answer

Store SAP backup files in a public S3 bucket for easy access.

Question 2

A company is designing an SAP S/4HANA deployment on AWS with high availability. They want to use a shared file system for the SAP transport directory. Which AWS service should they use for this shared file system?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, which is exactly what an SAP transport directory requires. The SAP transport directory (e.g., /usr/sap/trans) must be accessible from all SAP application servers in the high-availability cluster, and EFS supports the necessary file locking and consistency semantics for SAP's transport management system (TMS).

Answer

Amazon FSx for Windows File Server

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 3

A company is deploying SAP S/4HANA on AWS and needs to ensure high availability for the database layer. Which TWO actions should the company take?

Accepted Answer

Configure SAP HANA System Replication across two Availability Zones. SAP HANA System Replication (HSR) across two Availability Zones provides synchronous or asynchronous data replication at the database level, ensuring automatic failover and high availability for the HANA database. This is a core requirement for SAP S/4HANA on AWS, as it protects against AZ-level failures and meets SAP's HA architecture guidelines.

Answer

Store HANA backups in Amazon S3 Standard-IA

Answer

Use Amazon EFS as the data volume for HANA

Answer

Enable EC2 Auto Scaling for the HANA instance

Question 4

A company is deploying SAP NetWeaver on AWS and needs to configure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The solution must use AWS native services. Which TWO actions should be taken?

Accepted Answer

Associate an Elastic IP address with the active ASCS instance using a script.. An Elastic IP address can be programmatically reassigned to the standby ASCS instance using a script (e.g., AWS CLI or custom automation) during a failover event. This provides a stable virtual IP address that clients use to connect to the active ASCS, meeting the high availability requirement without relying on a load balancer, which is not suitable for SAP Central Services due to its stateful nature and the need for a fixed IP address.

Answer

Place an Application Load Balancer in front of the ASCS instances.

Answer

Set up AWS Direct Connect for redundant connectivity.

Answer

Deploy AWS Global Accelerator for failover.

Question 5

A company wants to automate the deployment of SAP environments on AWS. Which AWS service should the company use to define the infrastructure as code?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it allows you to define your entire SAP infrastructure—including EC2 instances, VPCs, security groups, and storage—as code using JSON or YAML templates. This enables repeatable, version-controlled, and automated deployments of SAP environments, which is essential for infrastructure as code (IaC) practices.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 6

A company is designing an SAP HANA disaster recovery solution on AWS. The primary system is in us-east-1, and the DR system must be in us-west-2. The RPO is 15 minutes, and RTO is 1 hour. Which TWO approaches meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication from the primary HANA database to a target HANA database in us-west-2.. AWS DMS with ongoing replication can capture and apply changes from the primary SAP HANA database to a target HANA database in us-west-2 with low latency, supporting an RPO of 15 minutes. DMS uses log-based CDC (Change Data Capture) to replicate transactions continuously, making it suitable for near-real-time replication. This approach meets the RTO of 1 hour because the target database can be promoted quickly.

Answer

Take EBS snapshots of HANA data volumes every 15 minutes and copy them to us-west-2.

Answer

Use Amazon S3 Cross-Region Replication to copy HANA backup files to us-west-2.

Answer

Use AWS Application Migration Service (MGN) to replicate the entire HANA server to us-west-2.

Question 7

A company wants to automate the deployment of SAP systems on AWS. Which AWS service is most appropriate for infrastructure as code (IaC) for SAP?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the most appropriate service for infrastructure as code (IaC) for SAP because it allows you to define and provision AWS infrastructure declaratively using templates. This enables repeatable, version-controlled deployments of complex SAP landscapes, including EC2 instances, networking, storage, and security groups, which is critical for SAP's strict architectural requirements.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 8

A company is planning to run SAP S/4HANA on AWS. The architect needs to ensure that the EC2 instances are SAP certified for the specific SAP HANA version. Where should the architect verify the instance certification?

Accepted Answer

SAP Certified and Supported SAP HANA Hardware Directory. The SAP Certified and Supported SAP HANA Hardware Directory is the authoritative source maintained by SAP that lists all certified hardware configurations, including specific AWS EC2 instance types and their supported SAP HANA versions. This directory is the only place where SAP officially validates that an EC2 instance meets the exact hardware and firmware requirements for a given SAP HANA release, ensuring compliance with SAP's certification standards.

Answer

SAP Support Portal

Answer

AWS Management Console under EC2 instance types

Answer

AWS documentation for SAP on AWS

Question 9

Which TWO of the following are required when integrating SAP HANA with AWS Direct Connect for hybrid connectivity?

Accepted Answer

A Virtual Private Gateway attached to the VPC.. A Virtual Private Gateway (VGW) is required to attach the VPC to the Direct Connect connection, enabling private IP traffic between on-premises and the VPC. Without a VGW, the Direct Connect virtual interface cannot terminate within the VPC, making hybrid connectivity impossible for SAP HANA workloads that require low-latency, private network paths.

Answer

A Public Virtual Interface to access the VPC.

Answer

A Direct Connect Gateway for the connection.

Answer

A VPN tunnel between on-premises and AWS.

Question 10

A company is running SAP S/4HANA on AWS and needs to ensure high availability for the database layer. Which AWS service should be used to replicate the database to a standby instance in a different Availability Zone?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) supports ongoing replication from an SAP HANA source database to a standby instance in a different Availability Zone using change data capture (CDC). This allows continuous data synchronization without requiring native SAP HANA replication features, making it suitable for high-availability setups where the database layer must be replicated across AZs.

Answer

EC2 Auto Scaling

Answer

Amazon S3

Answer

Amazon RDS Multi-AZ

Question 11

A company runs SAP Business Warehouse (BW) on AWS. The system uses an SAP HANA database that is also used for other SAP systems. The company wants to set up monitoring to ensure that the HANA database is performing optimally. They have installed the AWS CloudWatch agent on the HANA server to collect operating system metrics. However, they also need to collect HANA-specific metrics such as memory usage and SQL execution times. Which additional step should the company take to collect these metrics?

Accepted Answer

Install and configure the SAP HANA CloudWatch agent on the HANA server.. The AWS-provided SAP HANA CloudWatch agent is specifically designed to collect HANA-specific metrics such as memory usage, SQL execution times, and other database-level performance counters. It connects to the HANA database using the SQLDBC protocol and pushes the metrics directly to CloudWatch, complementing the OS-level metrics collected by the standard CloudWatch agent. This is the only option that directly addresses the requirement to gather HANA-specific metrics without additional custom development.

Answer

Set up SAP Solution Manager to send metrics to CloudWatch via an API.

Answer

Use Amazon CloudWatch Logs to capture HANA trace files and create metric filters.

Answer

Enable AWS CloudTrail to log HANA database API calls.

Question 12

An SAP system administrator is troubleshooting an issue where SAP users cannot log in to the SAP system. The administrator checks the SAP application server logs and finds that the connection to the SAP HANA database is failing with 'connection refused'. Which THREE AWS resources should be investigated to resolve the issue?

Accepted Answer

Network ACLs for the database subnet. Options B, D, and E are correct. Network ACLs for the database subnet must allow inbound and outbound traffic between the application server and database. Security group rules for the database instance must permit traffic from the application server's security group on the database port. Route tables for the application server subnet must have a route to the database subnet. Option A is incorrect because a VPC peering connection is not needed unless the resources are in different VPCs. Option C is incorrect because an Internet Gateway is not required for internal communication within a VPC.

Answer

VPC peering connection

Answer

Internet Gateway

Question 13

A company is planning to migrate their SAP system to AWS. They need to ensure that the SAP application servers and database servers are in the same AWS Region but in different Availability Zones for high availability. The network latency between Availability Zones must be minimal. Which AWS service should be used to connect the instances?

Accepted Answer

Use the default VPC network within the same VPC spanning multiple Availability Zones. A single VPC can span multiple Availability Zones within the same AWS Region, and by default, instances in different AZs within the same VPC communicate over the AWS private network with low latency, typically under 1-2 ms. This meets the requirement for minimal latency between SAP application and database servers while keeping them in the same Region for high availability.

Answer

Set up VPC Peering between the Availability Zones

Answer

Establish an AWS Direct Connect connection

Answer

Use AWS Transit Gateway to connect the subnets

Question 14

An SAP system uses a custom RFC destination to an external SOAP web service. After a recent network change, the RFC call fails with a timeout error. The SAP administrator has verified that the web service is reachable from the SAP application server using ping. What is the MOST likely cause of the timeout?

Accepted Answer

A firewall between the application server and the web service is blocking the required port.. The RFC call uses a specific port (e.g., 443 for HTTPS or 80 for HTTP) to communicate with the SOAP web service. A firewall blocking that port would cause a timeout, as the ping test (ICMP) succeeds but the TCP handshake on the required port fails. The SAP administrator's verification of reachability via ping only confirms ICMP-level connectivity, not application-layer port access.

Answer

The DNS resolution is incorrect for the web service hostname.

Answer

The SAP router configuration is blocking the connection.

Answer

The SSL certificate of the web service has expired.

Question 15

An SAP system running on AWS is experiencing intermittent connectivity issues between the SAP application servers and the database server. Both are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. The issue occurs only during peak hours. Which of the following is the most likely cause?

Accepted Answer

Network ACLs do not have rules to allow ephemeral ports for return traffic.. The intermittent connectivity issue during peak hours points to a resource exhaustion problem. Network ACLs are stateless, meaning they must explicitly allow both inbound and outbound traffic, including ephemeral ports (typically 1024-65535) used for return traffic. If the NACL outbound rules do not allow these ephemeral ports, return traffic from the database server to the application server will be dropped, especially under high load when many connections are established simultaneously.

Answer

Security group outbound rules are blocking return traffic.

Answer

The VPC peering connection is throttling traffic.

Answer

Security group inbound rules are misconfigured.

Question 16

A customer runs SAP HANA on an AWS Multi-AZ deployment with a primary and secondary instance. They want to ensure automatic failover in case of instance failure. What is the recommended approach?

Accepted Answer

Implement SAP HANA System Replication in a multi-AZ configuration with automatic failover using AWS services.. SAP HANA System Replication (HSR) in a multi-AZ configuration, combined with AWS services like Amazon Route 53 health checks and custom scripts for automatic failover, provides the recommended approach for ensuring automatic failover upon instance failure. HSR replicates data synchronously or asynchronously between primary and secondary HANA instances, and when integrated with AWS, you can automate the failover process without manual intervention, meeting the requirement for high availability.

Answer

Set up a Route 53 health check to redirect traffic to the secondary instance manually.

Answer

Use Amazon RDS for SAP HANA with Multi-AZ enabled.

Answer

Configure an Auto Scaling group with a lifecycle hook to launch a new HANA instance.

Question 17

A company runs SAP NetWeaver on AWS and notices that the application server is experiencing high CPU utilization during peak hours. They need to scale out the SAP application tier. What is the best approach?

Accepted Answer

Use an Auto Scaling group to automatically launch additional application servers and register them with the SAP application load balancer. It provides an automated, elastic scaling solution for the SAP application tier. An Auto Scaling group can dynamically launch additional EC2 instances based on CPU utilization metrics and automatically register them with the SAP application load balancer, ensuring seamless distribution of incoming user traffic across multiple application servers without manual intervention.

Answer

Use AWS Global Accelerator to distribute traffic

Answer

Increase the instance size of the existing application server

Answer

Manually launch additional EC2 instances and configure them as application servers

Question 18

A company runs SAP HANA on AWS. The system is experiencing high CPU utilization during peak hours. Which TWO actions should the administrator take to address this? (Choose two.)

Accepted Answer

Right-size the EC2 instance to a larger type with more vCPUs.. Right-sizing the EC2 instance to a larger type with more vCPUs directly addresses high CPU utilization by providing additional compute capacity for peak workloads. SAP HANA is CPU-intensive, especially during query processing and data compression, so increasing vCPUs alleviates the bottleneck without requiring architectural changes.

Answer

Disable HANA columnar compression to reduce CPU overhead.

Answer

Increase the size of the /hana/data EBS volumes.

Answer

Reduce the network throughput of the EC2 instance.

Question 19

An SAP Basis administrator is troubleshooting a performance issue on an SAP NetWeaver application server running on Amazon EC2. The administrator notices that the CPU utilization is low but the application response times are high. The system is using an Amazon EBS gp2 volume. Which configuration change is most likely to improve performance?

Accepted Answer

Increase the IOPS of the EBS gp2 volume or switch to io1.. Low CPU utilization with high application response times on an SAP NetWeaver server indicates that the bottleneck is I/O latency, not compute capacity. Amazon EBS gp2 volumes have a baseline IOPS performance that scales with volume size, and if the volume is small or the workload exceeds the burst balance, throughput can be throttled. Increasing the IOPS (by resizing the gp2 volume or switching to io1/io2 with provisioned IOPS) directly addresses the I/O bottleneck, reducing latency and improving application response times.

Answer

Change the EBS volume to instance store.

Answer

Move the EC2 instance to a larger instance family.

Answer

Increase the number of vCPUs on the EC2 instance.

Question 20

A company is migrating its SAP landscape to AWS and wants to ensure that all SAP systems can communicate with each other using private IP addresses only. The systems are deployed in multiple VPCs. Which AWS solution should be used to enable private connectivity between these VPCs?

Accepted Answer

VPC Peering.. VPC Peering is the correct solution because it enables direct, private IP connectivity between VPCs using the AWS global network, with no gateways or VPN connections required. Traffic stays within AWS and never traverses the public internet, satisfying the requirement for SAP systems to communicate using only private IP addresses across multiple VPCs.

Answer

VPC Endpoints.

Answer

AWS Site-to-Site VPN.

Answer

AWS Direct Connect.