PAS-C01 Mock Exam 83 — 25 Questions

Question 1

A company is running SAP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. They have two EC2 instances in different Availability Zones within a single AWS Region. Which AWS service should be used to automatically fail over the ASCS instance if the primary instance fails?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Route 53. Amazon Route 53 can be configured with a health check that monitors the primary ASCS instance. When the health check fails, Route 53 automatically updates DNS records to point to the secondary instance in the other Availability Zone, enabling failover routing. This provides a DNS-level failover mechanism that is suitable for SAP Central Services, which requires a stable IP address or hostname for client connections.

Answer

Application Load Balancer (ALB)

Answer

AWS Auto Scaling

Answer

AWS CloudFormation

Question 2

An SAP system uses a Multi-AZ RDS for Oracle instance. During a recent failover, the application experienced a long outage because the SAP application server did not automatically reconnect to the new database endpoint. What is the most efficient way to resolve this issue?

Accepted Answer

Reduce the DNS TTL for the RDS endpoint and ensure the application re-resolves DNS on connection failure.. The RDS endpoint remains the same after failover; the issue is DNS caching. Reducing the TTL ensures the application picks up the new IP quickly. Option B (rebooting) is disruptive and not a fix. Option C (modifying the connection string) is not needed. Option D (using a load balancer) adds complexity and latency.

Answer

Reboot the application server after every failover.

Answer

Deploy an Application Load Balancer in front of the RDS instance.

Answer

Modify the application connection string to use the standby instance IP directly.

Question 3

A company is running SAP on AWS and needs to ensure high availability for their SAP Central Services (ASCS) instance. They plan to use a multi-AZ deployment with a floating IP. Which AWS service should they use to manage the floating IP and failover?

Accepted Answer

Amazon Route 53. Amazon Route 53 can be used to associate a DNS name with a health check and failover to a secondary IP in another AZ. Option A is wrong because Elastic Load Balancer (ELB) is for distributing traffic, not for floating IPs. Option C is wrong because AWS Global Accelerator improves performance, not floating IP failover. Option D is wrong because Amazon CloudFront is a CDN.

Answer

Elastic Load Balancer

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 4

The operations team uses the IAM policy above for a group of administrators. An administrator tries to terminate an EC2 instance that is tagged with Environment=Production. What will happen?

Accepted Answer

The termination will be denied because there is no explicit Allow for TerminateInstances. The Deny statement has a condition that denies termination only when the tag is NOT Production. Since the instance is tagged Production, the condition is not met, so the Deny does not apply. The Allow statement does not include TerminateInstances, so there is no explicit Allow for termination. The default is implicit Deny, so the action is denied.

Answer

The termination will be denied because the Deny condition applies to all instances

Answer

The termination will be allowed because the Deny condition is not met

Answer

The termination will be allowed because the Deny does not apply to Production instances

Question 5

A company runs SAP S/4HANA on AWS with a multi-Node HA cluster using Pacemaker and SUSE Linux Enterprise Server. The SAP application and database are on separate EC2 instances. After a planned failover test, the secondary node fails to take over the database role. What is the most likely cause?

Accepted Answer

STONITH fencing is not configured for the cluster.. In a Pacemaker HA cluster, STONITH (Shoot The Other Node In The Head) fencing is mandatory to ensure that a failed node is forcibly isolated before the cluster can safely promote the secondary node. Without STONITH, the cluster cannot guarantee that the primary node is truly dead, so it refuses to promote the secondary to avoid a split-brain scenario. This is why the secondary node fails to take over the database role after a planned failover test.

Answer

The SAP HANA system replication is using asynchronous mode.

Answer

The EBS volumes are not configured with multi-attach enabled.

Answer

The SAP HANA system replication is not configured with ENSA2.

Question 6

An SAP environment on AWS includes multiple EC2 instances running SAP application servers. The operations team needs to capture and analyze all API calls made to AWS services by these instances. Which THREE services should be used together?

Accepted Answer

Amazon Athena. AWS CloudTrail captures API calls, Amazon S3 stores the logs, and Amazon Athena allows querying the logs. Alternatively, CloudWatch Logs can be used, but Athena is more cost-effective for ad-hoc analysis. The three correct services are CloudTrail, S3, and Athena.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 7

An SAP system running on AWS is experiencing high latency to its S3-backed backup destination. Which architectural change would most effectively reduce backup latency?

Accepted Answer

Configure an S3 Gateway Endpoint in the VPC to route traffic to S3 privately.. An S3 Gateway Endpoint provides a private, low-latency path from the SAP EC2 instance to S3 without traversing the public internet or NAT gateways. This eliminates network hops and reduces latency by keeping traffic within the AWS network, directly addressing the high-latency issue for S3-backed backups.

Answer

Increase the size of the EC2 instance running SAP to improve I/O throughput.

Answer

Move the SAP instance to a different Availability Zone closer to the S3 bucket.

Answer

Enable S3 Transfer Acceleration on the backup bucket.

Question 8

A company is migrating a 50 TB Oracle database to Amazon RDS for Oracle using AWS DMS. The source database is running on-premises and the network link has a bandwidth of 100 Mbps. The migration must complete within 5 days. What is the MOST effective approach to meet the deadline?

Accepted Answer

Use AWS Snowball to transfer the data offline, then use DMS for CDC. The 50 TB database over a 100 Mbps link would take approximately 48 days for a full load (50 TB * 8 / 100 Mbps / 86400 seconds/day), far exceeding the 5-day deadline. AWS Snowball allows offline transfer of the full database snapshot, bypassing network bandwidth constraints, after which AWS DMS can be used for ongoing change data capture (CDC) to replicate incremental changes. This hybrid approach meets the deadline while ensuring minimal data loss.

Answer

Provision a Direct Connect connection to increase bandwidth

Answer

Use AWS DMS with full load and change data capture (CDC) online

Answer

Use AWS Schema Conversion Tool (SCT) to convert schema, then DMS for data

Question 9

An SAP administrator needs to back up the SAP HANA database daily. The backups must be stored securely and retained for 30 days. Which storage option is the most cost-effective?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). S3 Standard-IA is for infrequently accessed data with lower cost. Option A is incorrect because S3 Standard is more expensive. Option B is incorrect because Glacier is for long-term archival, not 30-day retention. Option D is incorrect because EBS snapshots are for volumes, not database backups directly.

Answer

Amazon S3 Standard

Answer

Amazon S3 Glacier

Answer

Amazon EBS Snapshots

Question 10

A company is migrating an SAP system from on-premises to AWS. The migration involves rehosting SAP HANA on EC2. Which of the following is the best practice for sizing the EC2 instance?

Accepted Answer

Use an EC2 instance that is listed in the SAP Certified and Supported SAP HANA Hardware Directory.. SAP HANA instances must be SAP-certified. The AWS instance types that are SAP-certified for HANA (e.g., r5.metal, u-6tb1) should be used. General-purpose instances are not certified. Memory optimized instances are correct but must be specific certified types. Compute optimized are not suitable.

Answer

Use a memory-optimized EC2 instance with the required memory.

Answer

Use a general-purpose EC2 instance with sufficient vCPUs and memory.

Answer

Use a compute-optimized EC2 instance to ensure high CPU performance.

Question 11

An SAP system on AWS is configured with a multi-AZ deployment for high availability. During a failover test, the secondary instance does not take over as expected. The administrator checks the AWS Management Console and sees that the Elastic IP address is still attached to the primary instance. What is the most likely cause?

Accepted Answer

The Elastic IP is not reassigned during the failover process. In a typical HA setup, the Elastic IP should be reassigned to the secondary instance during failover. If it remains attached to the primary, the secondary cannot be reached. The root device is not relevant to IP assignment. Route tables are not per-instance. Security groups allow traffic but do not prevent failover.

Answer

The secondary instance's root volume is not attached

Answer

The security group of the secondary instance blocks incoming traffic

Answer

The route tables are not updated to point to the secondary instance

Question 12

A company is planning to migrate its SAP workloads to AWS. Which THREE AWS services are commonly used to set up a secure network connectivity between on-premises and AWS? (Choose THREE.)

Accepted Answer

AWS Transit Gateway. Options A, B, and C are correct. AWS VPN, Direct Connect, and Transit Gateway are used for hybrid connectivity. Option D is not correct because VPC Peering is for VPC-to-VPC, not on-premises. Option E is not correct because Client VPN is for individual clients.

Answer

VPC Peering

Answer

AWS Client VPN

Question 13

An SAP system on AWS uses a shared file system with Amazon EFS. The operations team notices that file operations have high latency during peak hours. The EFS file system is configured with Bursting Throughput mode. The team monitors the CloudWatch metric PercentIOLimit and sees it consistently at 100%. What should the team do to improve performance?

Accepted Answer

Change the file system to Provisioned Throughput mode. PercentIOLimit at 100% indicates the file system is using all its burst credits. To avoid throttling, the team should change to Provisioned Throughput mode or increase the amount of data stored to earn more credits. Changing to General Purpose performance mode affects latency, not throughput. Enabling encryption adds overhead. Increasing file system size indirectly helps earn more credits but is not a direct solution.

Answer

Enable encryption at rest for the file system

Answer

Change the performance mode to General Purpose

Answer

Increase the size of the file system by adding more files

Question 14

An SAP HANA database on AWS is configured with automatic backups to Amazon S3. The backup process is failing with the error 'Access Denied'. The administrator has confirmed the S3 bucket exists and the IAM role attached to the EC2 instance has the correct permissions. What could be the issue?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the IAM role. If the bucket policy denies access even if the IAM role allows, the explicit deny in the bucket policy overrides. The error indicates a permissions issue. The role might lack proper trust policy only if it can't assume, but the error suggests access denied to S3. The bucket policy is likely the cause. KMS key issues would give a different error. VPC endpoint issues would cause connectivity errors.

Answer

The IAM role's trust policy does not allow the EC2 service

Answer

The S3 bucket is encrypted with AWS KMS and the role lacks kms:Decrypt permissions

Answer

The VPC does not have an S3 VPC endpoint configured

Question 15

A company is migrating a large SAP ERP system to AWS. The source system runs on IBM Db2. The target is SAP HANA on AWS. Which tool should be used for schema conversion?

Accepted Answer

AWS Schema Conversion Tool (AWS SCT). AWS SCT supports schema conversion from IBM Db2 to SAP HANA. SAP HANA Studio and SAP DMO are SAP tools, but SCT is the AWS-native option for heterogeneous migrations. AWS DMS is for data migration, not schema conversion.

Answer

AWS Database Migration Service (AWS DMS)

Answer

SAP HANA Studio

Answer

SAP DMO

Question 16

Which TWO AWS services can be used to monitor the performance of an SAP HANA database running on an EC2 instance? (Choose TWO.)

Accepted Answer

AWS Systems Manager. Amazon CloudWatch can monitor EC2 metrics like CPU and memory (with agent). AWS Systems Manager can run scripts to collect HANA-specific metrics. CloudTrail is for API auditing. Trusted Advisor is for best practices. Config tracks configuration. CloudWatch and Systems Manager are valid monitoring tools.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 17

An SAP administrator needs to grant an external auditor read-only access to view the configuration of all AWS resources in the account. Which IAM policy should be used?

Accepted Answer

ReadOnlyAccess. AWS managed policy `ReadOnlyAccess` grants read-only access to all AWS services and resources.

Answer

AdministratorAccess

Answer

PowerUserAccess

Answer

ViewOnlyAccess

Question 18

A company runs SAP ERP on AWS with a multi-AZ deployment. The SAP application tier uses Auto Scaling groups with a custom AMI. After a recent patching of the AMI, the new instances fail to start the SAP application services. What should the administrator do to ensure that the new AMI correctly starts SAP services?

Accepted Answer

Modify the Auto Scaling group launch configuration to include a user data script that starts SAP services. Using user data scripts to start SAP services ensures that new instances automatically start SAP correctly regardless of AMI changes.

Answer

Use AWS Systems Manager Run Command to start SAP services on running instances

Answer

Configure the SAP service to start via a cron job on the AMI

Answer

Create a new AMI with SAP services set to auto-start and update the Auto Scaling group

Question 19

Refer to the exhibit. An IAM policy is attached to a role used by an EC2 instance running SAP. The instance is unable to start or stop other EC2 instances. What is the most likely cause?

Accepted Answer

The policy resource ARN specifies a specific region (us-east-1), but the instances are in a different region.. The policy allows `ec2:StartInstances` and `ec2:StopInstances` on all resources (`"Resource": "*"`), so it should work. However, the condition is missing. The issue could be that the policy does not include the `ec2:DescribeInstanceStatus` action needed to check status before starting/stopping. But the question says it cannot start/stop; the policy seems correct. Actually, the most likely cause is that the role does not have permission to pass the instance profile (iam:PassRole) if the instance uses an instance profile, but that is not shown. Alternatively, the policy is missing `ec2:DescribeInstances` which is needed for the AWS CLI to list instances? But it is included. Let's think: The policy allows start/stop on all resources, so it should work. Possibly the issue is that the EC2 instance has an instance profile that the role cannot pass. But the question says the policy is attached to the role; the role is used by the instance. The policy looks correct. However, the exhibit might be missing the `ec2:DescribeInstanceStatus` action, but that is not required for start/stop. I'll choose option C: The policy does not include `ec2:DescribeInstances` for the specific instances? No, it's there. Actually, the correct answer is that the policy does not include `ec2:DescribeInstances` for the instances? It does. Hmm. Let's look at the options: A) The policy does not allow `ec2:StartInstances` on specific instance IDs. B) The policy does not include `ec2:DescribeInstances` for the instances. C) The policy does not include `ec2:RebootInstances`. D) The policy does not allow `s3:GetObject` on the backup bucket. None of these are correct. I need to adjust the exhibit to make the question work. Let me modify the exhibit to include a condition that restricts the resource to only certain instances. For example:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::sap-backup-bucket/*"
    }
  ]
}
```

Then the question: The instance is unable to start or stop instances in another region. Why? Because the resource ARN specifies us-east-1, but the instances are in eu-west-1. That is plausible. I'll use that.

Answer

The policy does not allow `ec2:RebootInstances` which is required to start instances.

Answer

The policy does not include `iam:PassRole` permission.

Answer

The policy does not include `ec2:DescribeInstances` for instances in other regions.

Question 20

Refer to the exhibit. An SAP administrator runs the AWS CLI command to retrieve the DatabaseConnections metric for an RDS for SAP ASE instance. The output shows a Sum statistic over 5-minute periods. What is the average number of connections per minute during this hour?

Accepted Answer

10. The Sum statistic over each 5-minute period is the total number of connections during that period. To get average per minute, divide each sum by 5. However, the question asks for the average number of connections per minute over the entire hour. The sum of all datapoints is 45+48+52+50+47+49+51+53+50+48+52 = 545. There are 11 datapoints, each covering 5 minutes, so total minutes = 11*5 = 55 minutes (but actually from 00:05 to 00:55 inclusive, that's 11 periods * 5 = 55 minutes). The total connections sum = 545. Average connections per minute = 545 / 55 ≈ 9.9. But the options are whole numbers: 10, 50, 52, 545. 10 is closest. Correct answer is 10.

Answer

545

Answer

50

Answer

52