PAS-C01 Mock Exam 86 — 25 Questions

Question 1

A company is designing a disaster recovery (DR) strategy for its SAP HANA database on AWS. The primary site is in us-east-1. The DR site must be in us-west-2. The company requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. Which AWS service should be used for replicating HANA data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SAP HANA System Replication to an EC2 instance in us-west-2.. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for replicating HANA databases to a secondary site with low RPO (typically seconds to minutes) and RTO (minutes to hours). It continuously ships log entries from the primary to a standby EC2 instance in us-west-2, meeting the 15-minute RPO and 2-hour RTO requirements. AWS Database Migration Service, EBS Snapshots, and S3 Cross-Region Replication do not provide the log-level, consistent replication needed for SAP HANA's ACID compliance and failover semantics.

Answer

AWS Database Migration Service with ongoing replication.

Answer

Amazon EBS Snapshots copied to us-west-2 every hour.

Answer

Amazon S3 Cross-Region Replication for HANA data files.

Question 2

A company runs SAP on EC2 instances in a private subnet. The instances need to download patches from the internet but must not be directly accessible from the internet. Which configuration meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and route traffic from the private subnet to it. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download patches) while preventing any unsolicited inbound connections from the internet. The private subnet's route table directs 0.0.0.0/0 traffic to the NAT Gateway, which performs source network address translation (SNAT) on the outbound traffic and drops unsolicited inbound packets.

Answer

Place a proxy server on a bastion host in a public subnet

Answer

Attach an Internet Gateway to the VPC and add a route to the private subnet

Answer

Use a VPN connection to the on-premises network and route internet traffic through it

Question 3

A company runs a large SAP ERP system on AWS. The SAP application servers are deployed across multiple Availability Zones using an Auto Scaling group behind an Application Load Balancer. The SAP HANA database is a single-node instance on a large EC2 instance with EBS io1 volumes. The database experiences high write latency during peak hours. The administrator investigates and finds that the EBS volume write throughput is consistently at the maximum limit of 250 MB/s. The volume is 4 TB with 10,000 provisioned IOPS. The application servers are idle during the peak hour due to database slowness. The company needs a solution to reduce write latency without changing the application. Which solution should the administrator implement?

Accepted Answer

Increase the provisioned IOPS on the io1 volume to 20,000. The bottleneck is write throughput at 250 MB/s, which is the maximum throughput achievable with 10,000 provisioned IOPS on an io1 volume (assuming 256 KB I/O size). By increasing the provisioned IOPS to 20,000, the throughput doubles to 500 MB/s, directly reducing write latency. Option A is incorrect because EBS Multi-Attach is designed for shared volumes in multi-node clusters, not for a single-node HANA database. Option C is incorrect because EBS-optimized instances are already enabled by default on current-generation EC2 instances; additional configuration would not increase throughput. Option D is incorrect because changing to gp3 would require a volume type conversion and might not achieve the same IOPS performance; gp3 has a maximum of 16,000 IOPS and 1,000 MB/s throughput, but the simplest and most direct fix is to increase IOPS on the existing io1 volume.

Answer

Enable EBS Multi-Attach and add additional EC2 instances to share the volume

Answer

Enable EBS-optimized on the EC2 instance

Answer

Change the volume type to gp3 and increase throughput to 500 MB/s

Question 4

An SAP system needs to send email notifications from the SAP application server running on EC2. Which AWS service should be used?

Accepted Answer

Amazon Simple Email Service (SES). Amazon Simple Email Service (SES) is the correct choice because it is a cloud-based email sending service designed specifically for sending transactional and notification emails from applications, including SAP systems running on EC2. SES supports SMTP and API-based integration, allowing the SAP application server to send outbound email notifications reliably without managing on-premises email infrastructure.

Answer

Amazon Pinpoint

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Simple Notification Service (SNS)

Question 5

A company wants to automate the installation of SAP software on AWS using AWS CloudFormation. Which service is most appropriate to execute the SAP installation scripts?

Accepted Answer

AWS Systems Manager Run Command.. AWS Systems Manager Run Command is the most appropriate service because it can execute scripts (including SAP installation scripts) on EC2 instances without requiring SSH or RDP access, and it integrates with CloudFormation via custom resources or the AWS::SSM::Document resource. This allows you to run complex, long-running installation commands that are typical for SAP software, which Lambda functions cannot handle due to time limits.

Answer

AWS CodeDeploy.

Answer

AWS Lambda functions triggered by CloudFormation.

Answer

AWS OpsWorks for Chef Automate.

Question 6

A company is planning to run SAP NetWeaver on AWS and needs to ensure high availability for the database layer. Which AWS service can be used to achieve automatic failover of an SAP HANA database?

Accepted Answer

SAP HANA System Replication (HSR). SAP HANA System Replication (HSR) is the native SAP mechanism for replicating data from a primary HANA database to one or more secondary systems, enabling automatic failover in the event of a primary failure. This is the correct approach for achieving high availability for SAP HANA on AWS, as it integrates with AWS services like Elastic IPs or Route53 for IP re-mapping during failover, and is fully supported by SAP for production workloads.

Answer

AWS Database Migration Service (DMS)

Answer

Application Load Balancer (ALB)

Answer

Amazon RDS Multi-AZ

Question 7

An SAP administrator notices that the SAP HANA database backups to Amazon S3 are failing intermittently with timeout errors. The backup script uses the AWS CLI to copy files to an S3 bucket. What is the most likely cause and solution?

Accepted Answer

The backup files are large and the CLI command does not use multipart upload; use multipart upload and increase timeout values. The intermittent timeout errors when copying large SAP HANA backup files to Amazon S3 via the AWS CLI are most likely caused by the CLI not using multipart upload for large files. The AWS CLI automatically uses multipart upload for files over a certain threshold (default 8 MB), but if the upload is timing out, the default timeout values may be insufficient for very large files. Enabling multipart upload and increasing the `--cli-read-timeout` and `--cli-connect-timeout` values resolves the issue by splitting the file into smaller parts and allowing more time for each part to complete.

Answer

The S3 bucket policy is too restrictive, modify the policy

Answer

The S3 bucket has a lifecycle policy that deletes objects too quickly

Answer

S3 Transfer Acceleration is not enabled, enable it

Question 8

An SAP administrator is setting up a new SAP HANA system on AWS and needs to ensure that the system can recover from an Availability Zone failure. Which strategy should they implement for high availability?

Accepted Answer

Set up HANA System Replication across two Availability Zones. HANA System Replication (HSR) is the native SAP mechanism for achieving high availability across Availability Zones (AZs). By replicating data synchronously or synchronously in-memory to a standby instance in a different AZ, it ensures automatic failover with minimal data loss in the event of an AZ failure. This directly meets the requirement for recovery from an AZ failure without relying on storage-level or database-agnostic approaches.

Answer

Attach multiple Elastic Network Interfaces (ENIs) to the HANA instance

Answer

Configure the HANA database with Amazon RDS Multi-AZ

Answer

Take EBS snapshots every hour and restore in another AZ

Question 9

An SAP administrator is restoring an SAP HANA database from a backup stored in Amazon S3. The restore fails with an error indicating that the backup file is corrupt. The backup was created using the SAP HANA BACKUP command with the S3 backint agent. What could cause the backup file to be corrupt?

Accepted Answer

The multipart upload of the backup file was interrupted and not completed.. When using the SAP HANA backint agent to back up to S3, the backup file is uploaded via multipart upload. If this multipart upload is interrupted and not completed, the resulting object in S3 will be incomplete, causing it to appear corrupt when attempting to restore. Option A is incorrect because S3 Transfer Acceleration improves transfer speed but does not affect file integrity. Option C is incorrect because S3 Versioning creates multiple versions of the same object but does not corrupt data. Option D is incorrect because S3 Cross-Region Replication creates identical copies of the object, so it would not introduce corruption.

Answer

S3 Transfer Acceleration was used during backup.

Answer

The S3 bucket has versioning enabled.

Answer

The backup was replicated to another AWS Region using S3 Cross-Region Replication.

Question 10

An SAP system administrator notices that an SAP S/4HANA system on AWS is experiencing high network latency between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. What is the most effective way to reduce latency?

Accepted Answer

Launch both instances in the same placement group and enable EBS optimization.. Launching both instances in the same placement group ensures they are in close physical proximity within the same Availability Zone, which minimizes network latency. Enabling EBS-optimized instances dedicates network bandwidth to EBS I/O, reducing contention and further improving database performance. This directly addresses the high latency caused by cross-AZ traffic between the SAP application and database servers.

Answer

Set up VPC peering between the two subnets.

Answer

Deploy AWS Global Accelerator to optimize the traffic path.

Answer

Add multiple Elastic Network Interfaces (ENIs) to the instances.

Question 11

A company is running SAP BusinessObjects on AWS. The application servers are behind an Application Load Balancer (ALB). The ALB is configured to use a single target group. The company wants to deploy a new version of the application with zero downtime. Which deployment strategy should be used?

Accepted Answer

Implement a blue/green deployment by creating a new target group and updating the ALB listener.. A blue/green deployment allows you to create a completely new target group with the new application version, then update the ALB listener rule to route all traffic from the existing target group to the new one. This ensures zero downtime because the switch is instantaneous at the listener level, and the old environment remains intact for immediate rollback if needed.

Answer

Perform a rolling update by terminating one instance at a time and launching a new one.

Answer

Create a new ALB and update the DNS record to point to the new ALB.

Answer

Use a canary release by routing 10% of traffic to the new version.

Question 12

You are an AWS administrator for a company running SAP S/4HANA on AWS. The system uses a three-tier architecture: web dispatchers, application servers, and a HANA database. All components are in a single VPC. Security requirements demand that the web dispatchers are in a public subnet, application servers in private subnets, and the database in a private subnet. The web dispatchers need to communicate with the application servers on port 443, and application servers communicate with the database on port 31341. You have configured security groups accordingly. However, the web dispatchers cannot connect to the application servers. The network ACL for the public subnet allows inbound HTTPS from the internet and outbound all traffic. The private subnet NACL allows inbound HTTPS from the public subnet and outbound all traffic. The security group for the web dispatchers allows outbound HTTPS to the application security group. The application security group allows inbound HTTPS from the web security group. What is the issue?

Accepted Answer

The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet.. The issue is that network ACLs are stateless. The web dispatchers initiate outbound HTTPS connections to the application servers. The application servers respond using ephemeral ports. The public subnet NACL allows inbound HTTPS from the internet, but it does not allow inbound traffic on ephemeral ports from the private subnet. This blocks the return traffic. Therefore, option A is correct. Options B and C are incorrect because security groups are stateful and allow return traffic automatically. Option D is incorrect because the VPC's local route handles traffic between subnets.

Answer

The security group for the application servers does not allow inbound HTTPS from the web dispatchers.

Answer

The security group for the web dispatchers does not allow outbound HTTPS to the application security group.

Answer

The VPC does not have a route between the public and private subnets.

Question 13

A company runs its SAP ERP system on AWS using SAP HANA as the database. The HANA database is deployed on an EC2 instance with 488 GiB of memory. The system has been running for months, but recently the application team reported that some queries are taking significantly longer than usual. The operations team checks the CloudWatch metrics and sees that the database instance's CPU utilization is consistently above 90% during peak hours. They also notice that the EBS volume used for HANA data files has a read latency of over 20 ms. The volume is a gp3 volume with 16,000 IOPS. The instance type is an x1e.8xlarge. The team suspects that the instance is not optimized for the workload. What should they do to resolve the performance issue?

Accepted Answer

Replace the instance with an x1e.16xlarge instance to increase CPU and memory capacity.. The x1e.8xlarge instance provides 4 vCPUs and 488 GiB of memory, which are insufficient for the workload causing consistently high CPU utilization. Upgrading to an x1e.16xlarge instance increases vCPUs to 8 and memory to 976 GiB, directly addressing the CPU bottleneck and memory pressure. The high EBS read latency may be a secondary effect of the overloaded instance, and additional capacity can help alleviate storage performance issues. Option A is incorrect because changing to gp2 with a larger size does not guarantee lower latency and does not address the CPU constraint. Option B is incorrect because increasing IOPS on the gp3 volume only addresses storage performance, not the compute bottleneck. Option D is incorrect because EBS optimization is enabled by default on x1e instances; there is no additional setting to toggle.

Answer

Change the EBS volume type to gp2 with a larger size.

Answer

Increase the gp3 volume IOPS to 32,000 to reduce read latency.

Answer

Enable EBS optimization on the EC2 instance.

Question 14

A company is migrating its SAP ERP system to AWS and wants to use SAP HANA as the database. Which AWS service can be used to automate the installation and configuration of SAP HANA?

Accepted Answer

AWS Systems Manager. AWS Systems Manager provides the capability to automate the installation and configuration of SAP HANA through its Automation and Run Command features, which can execute custom scripts and workflows. Specifically, AWS offers pre-built Automation documents (e.g., AWS-ConfigureSAP) and integration with SAP Landscape Management to streamline SAP HANA deployment on EC2 instances. This makes Systems Manager the correct choice for automating SAP HANA setup in a migration context.

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Question 15

A company runs SAP on AWS and wants to automate the failover of their SAP HANA database across Availability Zones using a multi-AZ setup. They are using Pacemaker and STONITH fencing. Which AWS resource is commonly used as a fencing device for SAP HANA multi-AZ clusters?

Accepted Answer

Amazon CloudWatch alarm and EC2 API. STONITH (Shoot The Other Node In The Head) fencing in a multi-AZ SAP HANA cluster on AWS requires a mechanism to forcibly isolate or terminate an unresponsive node. Amazon CloudWatch alarms combined with EC2 API calls (e.g., `aws ec2 stop-instances` or `aws ec2 terminate-instances`) serve as the fencing device by triggering an API action to shut down the faulty instance, ensuring data integrity and preventing split-brain scenarios.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon RDS

Question 16

A company has deployed an SAP HANA database on AWS using a single EC2 instance with EBS volumes. The database is used for a critical SAP system. The company needs to ensure that the database can be restored to a point in time within the last 24 hours with minimal data loss. The administrator currently takes nightly EBS snapshots of the data and log volumes. However, recent tests show that recovery to a specific point in time (e.g., one hour ago) is not possible because the log volume is not backed up frequently enough. The administrator must implement a solution that allows point-in-time recovery with a recovery point objective (RPO) of 15 minutes. Which solution should the administrator implement?

Accepted Answer

Configure SAP HANA Backint agent to back up log files to Amazon S3 every 15 minutes. SAP HANA Backint enables log backups to Amazon S3 at frequent intervals (e.g., 15 minutes), allowing point-in-time recovery with minimal data loss. This is the native SAP HANA method for log backup and is efficient for achieving a 15-minute RPO. Option A is incorrect because EBS snapshots of the log volume every 15 minutes would be costly, cause I/O spikes, and are not recommended for frequent log backups. Option B is incorrect because Amazon DLM automates EBS snapshots but still suffers from the same cost and performance issues as option A. Option D is incorrect because Multi-Attach does not address backup and replication of logs does not provide a usable backup for point-in-time recovery.

Answer

Create EBS snapshots of the log volume every 15 minutes using a cron job

Answer

Use Amazon Data Lifecycle Manager (DLM) to schedule snapshots of the log volume every 15 minutes

Answer

Enable EBS Multi-Attach on the log volume and attach it to a second instance to replicate logs

Question 17

A company runs its SAP HANA database on an EC2 instance with Amazon EBS volumes. The system is experiencing high write latency. The current EBS volume type is gp2. Which change should a solutions architect recommend to improve write performance for the SAP HANA data volume?

Accepted Answer

Use an io2 Block Express volume with sufficient IOPS.. SAP HANA requires consistently low-latency, high-IOPS storage for its data volume. The io2 Block Express volume is the only EBS volume type that can deliver up to 256,000 IOPS per volume with sub-millisecond latency, meeting SAP HANA's demanding performance requirements. In contrast, gp2 volumes have burst limitations and cannot sustain the high write throughput needed for SAP HANA workloads.

Answer

Migrate the data to an instance store volume.

Answer

Change the volume type to gp3 with increased IOPS.

Answer

Use a Throughput Optimized HDD (st1) volume.

Question 18

An SAP application on AWS needs to access an S3 bucket containing sensitive data. Which IAM policy element should be used to enforce encryption in transit?

Accepted Answer

"Condition": {"Bool": {"aws:SecureTransport": "true"}}. The `aws:SecureTransport` condition key in an IAM policy enforces that all requests to the S3 bucket must be made over HTTPS (TLS), ensuring encryption in transit. For an SAP application handling sensitive data, this prevents data exposure during transmission over the network. The `Bool` condition evaluates to `true` only when the request uses SSL/TLS.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "AES256"}}

Answer

"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}

Answer

"Condition": {"IpAddress": {"aws:SourceIp": "10.0.0.0/8"}}

Question 19

A company is designing an SAP HANA workload on AWS. They need to ensure high availability for the SAP HANA database with automatic failover in case of an instance failure. Which AWS service should they use to achieve this?

Accepted Answer

Pacemaker cluster on Amazon EC2 with EBS multi-attach. Pacemaker is a high-availability cluster resource manager that, when combined with Amazon EC2 and EBS Multi-Attach, enables automatic failover for SAP HANA. EBS Multi-Attach allows the same EBS volume to be attached to multiple EC2 instances in the same Availability Zone, which is required for SAP HANA's shared-storage-based scale-up or scale-out HA configurations. This setup supports the SAP HANA system replication or storage replication failover mechanism, ensuring automatic recovery upon instance failure.

Answer

Amazon RDS for SAP HANA

Answer

AWS Elastic Beanstalk

Answer

Amazon Route 53 health checks with DNS failover

Question 20

An SAP Basis administrator needs to apply an SAP kernel patch to the SAP Central Services (ASCS) instance running on an EC2 instance in a Multi-AZ deployment. The ASCS instance is configured with a floating IP address using Elastic IP. The administrator wants to minimize downtime during the patching process. Which approach should the administrator take?

Accepted Answer

Create a new EC2 instance with the patched kernel, associate the Elastic IP to the new instance, and terminate the old one.. It implements a blue/green deployment, allowing the patch to be applied on a new EC2 instance without affecting the running ASCS instance. After patching, associate the Elastic IP to the new instance and terminate the old one, minimizing downtime to a brief DNS propagation delay. Option A is wrong because stopping the instance causes downtime during the patch. Option C is wrong because an Application Load Balancer does not support floating IP setups like Elastic IP for ASCS. Option D is wrong because Auto Scaling rolling updates are designed for scaling groups, not a single ASCS instance, and would still cause downtime.

Answer

Stop the ASCS instance, apply the patch, and start the instance.

Answer

Add the ASCS instance to an Application Load Balancer and then perform the patch.

Answer

Use an Auto Scaling group with a rolling update to apply the patch.