PAS-C01 Hard Questions — 25 Difficult Questions

Question 1

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.. Option C is correct because if the SSM Agent is not running or cannot communicate with the AWS Systems Manager service, Patch Manager cannot execute the patching commands. The agent must be in a healthy state and have network connectivity (e.g., via VPC endpoints or internet gateway) to receive the patch baseline and report status. Option D is correct because the AWS-RunPatchBashelline SSM document execution history in Run Command provides detailed logs and error messages for each instance, allowing the team to identify why the patching failed, such as missing dependencies or timeout issues.

Answer

Assign the patch baseline to the instance IDs directly.

Answer

Ensure that the instances have the appropriate IAM role that allows them to be patched.

Answer

Configure a Maintenance Window for the patching operation.

Question 2

Which THREE of the following are valid considerations when designing an SAP HANA backup strategy on AWS?

Accepted Answer

Use EBS snapshots for backing up HANA data volumes.. Option A is correct because EBS snapshots provide a consistent, point-in-time backup of HANA data volumes when the database is in backup mode (e.g., using hdbsql to create a snapshot). This method is supported by SAP and AWS, and it allows for fast recovery by restoring the entire volume without needing to replay transaction logs from a separate backup.

Answer

Back up HANA data directly to Amazon S3 using standard tools.

Answer

Replicate backups to another AWS Region using S3 Cross-Region Replication.

Question 3

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are also in private subnets. The security group for the RDS instance allows inbound traffic on port 3306 from the security group attached to the ECS tasks. However, the application cannot connect to the database. Which solution should the company implement to resolve this issue?

Accepted Answer

Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306. Option B is correct because when using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

Answer

Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway

Answer

Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity

Answer

Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID

Question 4

A company runs a stateful web application on EC2 instances in an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The application maintains session state in memory on each instance. Users report that they are frequently logged out and lose their session data during scaling events. What should the company do to resolve this issue?

Accepted Answer

Modify the application to store session state in an Amazon ElastiCache cluster. Option C is correct because storing session state externally in ElastiCache decouples session data from individual EC2 instances. This ensures that when instances are terminated or added during scaling events, users retain their session state regardless of which instance serves their request. ElastiCache provides a low-latency, in-memory cache that is ideal for session persistence in stateful web applications.

Answer

Change the scaling policy to a simple scaling policy instead of dynamic scaling

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer

Answer

Increase the cooldown period for the Auto Scaling group

Question 5

A company is migrating a 10 TB SQL Server database to Amazon RDS for SQL Server using AWS DMS. The migration is taking longer than expected. Which TWO actions can improve the migration speed? (Choose two.)

Accepted Answer

Enable parallel loading by splitting tables into multiple tasks. Option B is correct because splitting tables into multiple DMS tasks enables parallel loading, which significantly reduces migration time by processing multiple tables concurrently. Option D is correct because increasing the DMS replication instance size provides more CPU and memory resources, allowing the instance to handle larger data volumes and higher throughput more efficiently.

Answer

Use a single DMS task with full LOB mode

Answer

Use S3 multipart upload for the data

Answer

Disable transaction logging on the source

Question 6

A company is migrating a multi-tier application to AWS. The application includes a load balancer, web servers, and an Oracle database. The migration plan includes using AWS DMS for the database. During the initial full load, the DMS task fails with an error indicating insufficient memory. The source database is on an EC2 instance with 4 GB RAM. What should the migration team do to resolve this issue?

Accepted Answer

Increase the size of the DMS replication instance. Option C is correct because the error 'insufficient memory' during the initial full load in AWS DMS typically indicates that the replication instance does not have enough memory to handle the data volume or LOB processing. Increasing the size of the DMS replication instance provides more memory for caching, transformation, and LOB handling, directly resolving the resource constraint without altering the source database or task structure.

Answer

Disable LOB support in the DMS task

Answer

Split the migration into multiple smaller tasks

Answer

Increase the memory of the source EC2 instance

Question 7

A company is migrating a critical application to AWS using a lift-and-shift strategy. The application has a legacy licensing model tied to specific hardware IDs. The company has already migrated the application to an Amazon EC2 instance but the license validation fails because the hardware ID changed. What is the MOST cost-effective and least disruptive solution?

Accepted Answer

Use AWS License Manager to create a hardware-based license token that matches the original hardware ID.. Option D is correct because AWS License Manager can create a hardware-based license token that binds the license to a specific hardware ID, allowing the application to validate against the original hardware ID even after migration to EC2. This is the most cost-effective and least disruptive solution as it avoids modifying the application code or reverting the migration, and it leverages AWS-native licensing management without requiring dedicated hardware.

Answer

Revert the migration and keep the application on-premises with a VPN connection to AWS for other services.

Answer

Provision a Dedicated Host and associate the instance with it to control hardware IDs.

Answer

Modify the application's license file to accept the new hardware ID.

Question 8

A company is migrating a multi-tier application to AWS and wants to ensure high availability. The application has a web tier, application tier, and database tier. The database is currently running on a single on-premises server. Which migration strategy minimizes downtime and provides the HIGHEST availability for the database tier?

Accepted Answer

Use AWS DMS to migrate the database to Amazon RDS Multi-AZ deployment.. Option C is correct because AWS DMS can perform a live migration with minimal downtime by continuously replicating changes from the source database to the target Amazon RDS Multi-AZ deployment. Multi-AZ provides automatic failover to a standby replica in a different Availability Zone, ensuring the highest availability for the database tier. This combination minimizes downtime during migration and provides built-in high availability post-migration.

Answer

Use AWS Database Migration Service (DMS) to migrate to Amazon RDS in a single-AZ deployment, then manually take snapshots.

Answer

Migrate the database to a single large Amazon EC2 instance using AWS Application Migration Service.

Answer

Migrate to Amazon RDS with Multi-AZ deployment and use DMS for initial load.

Question 9

A company is migrating a critical application to AWS using a phased approach. The application uses a custom Linux distribution that is not supported by AWS Application Migration Service. Which THREE steps should the company take to migrate the application? (Choose THREE)

Accepted Answer

Use AWS Server Migration Service (SMS) to replicate the on-premises server to AWS.. AWS Server Migration Service (SMS) is the correct choice because it is an agentless service that can replicate on-premises servers running custom Linux distributions as long as they are supported by the underlying hypervisor. SMS uses incremental replication to create Amazon Machine Images (AMIs) from the source server, enabling a lift-and-shift migration without requiring the application to be converted to a different OS. This approach directly addresses the scenario where AWS Application Migration Service does not support the custom Linux distribution.

Answer

Convert the application to run on Amazon Linux 2 to simplify future management.

Answer

Use AWS Database Migration Service (DMS) to migrate the application server.

Question 10

A team is migrating an Oracle database to Amazon RDS for MySQL using AWS DMS with ongoing replication (CDC). The initial load succeeded, but the CDC task fails with the error shown in the exhibit. The source Oracle database is on-premises. Which action should the team take to resolve the issue?

Accepted Answer

Connect to the source Oracle database and enable full supplemental logging by executing the command: ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;. AWS DMS requires full supplemental logging on the source Oracle database to capture all column values for CDC (ongoing replication). Without it, DMS cannot reconstruct the complete row changes from the redo logs, causing the CDC task to fail. Enabling full supplemental logging with `ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;` ensures that every column is logged, allowing DMS to replicate all changes correctly.

Answer

Configure binary logging on the target MySQL RDS instance.

Answer

Stop and restart the DMS task to clear the error.

Answer

Switch the target database to Amazon RDS for Oracle to maintain compatibility.

Question 11

A company is migrating a legacy application to AWS. The application requires a static IP address that does not change during instance stop/start. The application also needs to be highly available across two Availability Zones. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use a Network Load Balancer with an Elastic IP address. A Network Load Balancer (NLB) supports static IP addresses by allowing you to associate an Elastic IP address with each of its Availability Zone subnets. This provides a fixed entry point that does not change when backend instances are stopped or started, meeting the requirement for a static IP. Combined with an Auto Scaling group spanning two Availability Zones, the NLB ensures high availability by distributing traffic across healthy instances in both zones.

Answer

Place the instances in a placement group to ensure high availability

Answer

Use an Application Load Balancer to distribute traffic to the instances

Question 12

A company runs a production web application on EC2 instances behind an ALB. The operations team receives an alert that the application is returning HTTP 503 errors. Which THREE steps should be taken to diagnose the issue?

Accepted Answer

Check the ALB's HealthyHostCount metric in CloudWatch.. The ALB's HealthyHostCount metric in CloudWatch shows the number of healthy targets registered to the target group. A value of zero or a persistent drop indicates that all EC2 instances are failing health checks, which directly causes HTTP 503 errors because the ALB has no healthy targets to forward traffic to. This metric is the first place to check when diagnosing 503 errors, as it pinpoints whether the issue is with target health rather than network connectivity or load.

Answer

Review VPC Flow Logs to identify if traffic is reaching the ALB.

Question 13

A company runs a critical workload on Amazon RDS for PostgreSQL with Multi-AZ. The operations team notices that during a recent failover test, the DNS record updated in about 60 seconds. However, the application experienced a 2-minute downtime because some connections were not re-established quickly. What should the team do to reduce downtime during failover?

Accepted Answer

Configure the application's connection string to use the RDS read-replica endpoint with a retry mechanism.. Option C is correct because configuring the application's connection string to use the RDS read-replica endpoint with a retry mechanism allows the application to quickly fail over to the read replica during a Multi-AZ failover. The read-replica endpoint remains constant and does not rely on DNS propagation, reducing downtime from DNS TTL delays. Combined with a retry mechanism, this ensures connections are re-established immediately after the failover completes, rather than waiting for the DNS record to update.

Answer

Enable automated backups with a short retention period.

Answer

Increase the TTL of the RDS DNS record to 300 seconds.

Answer

Place a Network Load Balancer in front of the RDS instance.

Question 14

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

Accepted Answer

Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.. AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Answer

Examine the S3 server access logs for the bucket.

Answer

Review the configuration timeline in AWS Config for the S3 bucket.

Answer

Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.

Question 15

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

Accepted Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume. Option A is correct because taking a snapshot of the unencrypted volume with encryption enabled creates an encrypted snapshot. From that snapshot, you can create a new encrypted EBS volume. Detaching the original volume and attaching the new encrypted volume to the same EC2 instance achieves encryption with minimal downtime—only the brief period required for the detach/attach operations. This approach does not require copying the snapshot, which would add unnecessary time.

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 16

A company runs a web application on Amazon ECS with Fargate launch type. The application's memory utilization spikes periodically, causing tasks to be killed. The operations team wants to automatically scale the service based on memory usage. Which THREE steps are necessary to implement this?

Accepted Answer

Create an Application Auto Scaling target tracking scaling policy based on memory utilization.. Option B is correct because Application Auto Scaling with a target tracking scaling policy allows the ECS service to automatically adjust its desired count based on a CloudWatch metric, such as memory utilization. This ensures the service scales out when memory usage spikes and scales in when it drops, preventing tasks from being killed due to OOM (out-of-memory) errors.

Answer

Attach an EC2 Auto Scaling group to the ECS service to handle capacity.

Answer

Configure step scaling policies to add multiple tasks at once.

Question 17

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

Accepted Answer

The reserved concurrency is set too low; increase the reserved concurrency for the function.. Option D is correct because Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Answer

The SQS visibility timeout is too short; increase it.

Answer

The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

Answer

The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.

Question 18

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.

Question 19

An administrator is migrating an on-premises application to AWS. The application stores persistent data on a separate disk. The administrator launched an EC2 instance as a test and attached an additional EBS volume for the persistent data. The above exhibit shows the block device mapping for the test instance. Later, the administrator terminates the test instance, but the persistent data must be retained. However, after termination, the persistent data volume is also deleted. What is the most likely cause?

Accepted Answer

The administrator mistakenly stored the persistent data on the root volume (vol-0a1b2c3d4e5f67890), which has DeleteOnTermination set to true.. Option C is correct because the exhibit shows the root volume (vol-0a1b2c3d4e5f67890) as the only volume with DeleteOnTermination set to true. The administrator intended to store persistent data on a separate EBS volume, but the data was actually stored on the root volume. When the instance was terminated, the root volume was deleted due to its DeleteOnTermination flag being true, causing the loss of the persistent data.

Answer

The instance was stopped instead of terminated, and the persistent data volume was detached during the stop.

Answer

The persistent data volume (vol-0f1e2d3c4b5a67890) had DeleteOnTermination set to false, but the administrator inadvertently changed it before termination.

Answer

The persistent data volume was not properly attached to the instance before termination.

Question 20

A company is migrating a large-scale SAP environment to AWS. Which THREE AWS services can be used to optimize storage costs for SAP workloads? (Choose three.)

Accepted Answer

Amazon S3 Lifecycle policies to transition data. Amazon S3 Lifecycle policies (Option B) allow you to automatically transition SAP backup and archival data from S3 Standard to lower-cost storage classes like S3 Standard-IA or S3 Glacier, reducing storage costs without manual intervention. This is critical for SAP workloads where large volumes of backup data accumulate over time and do not require immediate access.

Answer

AWS Storage Gateway for on-premises caching

Answer

Amazon S3 Standard for all data