PAS-C01 Multiple Select — 40 Questions

Question 1

A company is migrating a 10 TB SQL Server database to Amazon RDS for SQL Server using AWS DMS. The migration is taking longer than expected. Which TWO actions can improve the migration speed? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable parallel loading by splitting tables into multiple tasks. Splitting tables into multiple DMS tasks enables parallel loading, which significantly reduces migration time by processing multiple tables concurrently. Option D is correct because increasing the DMS replication instance size provides more CPU and memory resources, allowing the instance to handle larger data volumes and higher throughput more efficiently.

Answer

Use a single DMS task with full LOB mode

Answer

Use S3 multipart upload for the data

Answer

Disable transaction logging on the source

Question 2

Which TWO of the following are valid methods for monitoring SAP system performance on AWS? (Choose two.)

Accepted Answer

Configure SAP Solution Manager to send monitoring data to Amazon CloudWatch via the SAP Cloud Platform.. SAP Solution Manager can be configured to forward monitoring data to Amazon CloudWatch via the SAP Cloud Platform (now SAP BTP) using the Cloud Management Gateway or direct integration. This allows SAP-specific metrics like system load, work process usage, and response times to be visualized and alerted on in CloudWatch, enabling unified monitoring alongside AWS infrastructure metrics.

Answer

Enable AWS CloudTrail to capture system performance logs.

Answer

Use AWS Trusted Advisor to monitor real-time CPU utilization.

Answer

Use VPC Flow Logs to monitor database query performance.

Question 3

A company is migrating its SAP ERP system from an on-premises environment to AWS. The database is SAP HANA. The migration must minimize downtime. Which TWO approaches should the company consider?

Accepted Answer

Use AWS DMS with full load and ongoing change data capture (CDC).. AWS DMS with full load and ongoing change data capture (CDC) enables a near-zero-downtime migration by continuously replicating changes from the source SAP HANA database to the target on AWS after the initial full load, allowing the cutover to occur with minimal disruption. Option E is correct because SAP HANA System Replication provides a native, asynchronous or synchronous replication mechanism that can be configured between the on-premises HANA database and an AWS-hosted HANA instance, supporting a controlled switchover with very low downtime.

Answer

Use AWS Database Migration Service (DMS) with full load only.

Answer

Use VM Import/Export to migrate the entire on-premises virtual machine to AWS.

Answer

Use the SAP Software Provisioning Manager (SWPM) to perform a homogeneous system copy over the network.

Question 4

An architect is designing a disaster recovery plan for an SAP system using SAP HANA. The primary site is in us-east-1 and the DR site is in us-west-2. The RPO is 15 minutes and RTO is 1 hour. Which TWO AWS services or features should the architect use to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Elastic Disaster Recovery (AWS DRS). Option B, AWS Elastic Disaster Recovery (AWS DRS), is correct because it provides continuous block-level replication of on-premises or cloud servers into a staging area in the DR Region (us-west-2) with sub-second RPO and automated recovery, allowing the SAP application and non-HANA tiers to be recovered within the 1-hour RTO. Option D, SAP HANA System Replication, is correct because it is the SAP-native mechanism for replicating the HANA in-memory database to a secondary site in synchronous or asynchronous mode, and with asynchronous replication it can achieve an RPO well under 15 minutes while enabling fast takeover at the DR site. Option A, AWS Transit Gateway with VPC peering, is not a DR replication or recovery service; it only provides network connectivity between VPCs and Regions and does not by itself meet RPO/RTO. Option C, Amazon S3 Cross-Region Replication, replicates object data asynchronously and is not suitable for replicating a live SAP HANA database or application servers to meet a 15-minute RPO and 1-hour RTO. Option E, AWS CloudEndure Disaster Recovery, is the former name of the service now called AWS Elastic Disaster Recovery, so it is not a separate correct answer alongside option B.

Answer

AWS Transit Gateway with VPC peering

Answer

Amazon S3 Cross-Region Replication

Answer

AWS CloudEndure Disaster Recovery

Question 5

An SAP Basis administrator needs to apply security patches to the operating system of SAP EC2 instances. The administrator wants to use AWS Systems Manager Patch Manager. Which THREE steps are required to set up patching? (Choose THREE.)

Accepted Answer

Create a patch baseline in AWS Systems Manager.. Option A is correct because a patch baseline in AWS Systems Manager defines which patches are approved or rejected for the target operating system, and Patch Manager requires an appropriate baseline (default or custom) to determine what gets installed. Option C is correct because the SSM Agent must be installed and running on each EC2 instance so Systems Manager can send the Run Command documents that perform patching; instances also need an IAM instance profile allowing Systems Manager actions. Option E is correct because Patch Manager typically applies patches through a maintenance window, which schedules and targets the registered instances with the AWS-RunPatchBaseline document. Option B is not required because Patch Manager uses Systems Manager Run Command and documents rather than a customer-created Lambda function. Option D is not required because patch logs are stored by default in Amazon S3 and can optionally be sent to CloudWatch Logs, but CloudWatch Logs configuration is not a mandatory setup step.

Answer

Create an AWS Lambda function to invoke the patching process.

Answer

Configure Amazon CloudWatch Logs to store patch logs.

Question 6

Which TWO AWS services can be used to monitor the performance of an SAP system running on EC2?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (C) is correct because it collects and tracks performance metrics such as CPU utilization, disk I/O, and network throughput from EC2 instances running SAP, and can trigger alarms based on thresholds. Amazon CloudWatch Logs (D) is correct because it centralizes, stores, and monitors SAP application and OS logs from EC2 instances, enabling metric filters and alarms on log data for performance and error detection. AWS CloudTrail (A) only records API activity and audit events, not runtime performance metrics. AWS Shield (B) is a DDoS protection service and does not monitor SAP performance. AWS Config (E) tracks resource configuration changes and compliance, not performance monitoring.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

AWS Config

Question 7

Which THREE metrics should be monitored to ensure the health of an SAP NetWeaver application server? (Choose three.)

Accepted Answer

Memory utilization. Memory utilization (A) is a core health metric for an SAP NetWeaver application server because the ABAP/Java stack relies on shared memory, heap, and extended memory; exhaustion leads to dumps, short dumps, or instance crashes, so it must be tracked via tools like SM04, ST06, or the SAP Management Console. CPU utilization (C) is essential because sustained high CPU on the application server indicates overloaded work processes, expensive reports, or runaway programs, and is monitored through ST06/OS-level collectors to prevent response-time degradation. Work process utilization (D) is critical since SAP NetWeaver dispatches requests to dialog, background, update, enqueue, and spool work processes; if all are busy, users queue or get 'no work process available' errors, so monitoring via SM50/SM66 is mandatory. Database connection count (B) is not one of the three primary application-server health metrics in this context, as it relates more to the database layer and is typically covered by DBA Cockpit rather than the app server itself. Network packet loss (E) is a network-layer metric that, while relevant to overall performance, is not one of the standard three SAP NetWeaver application server health indicators asked for here.

Answer

Database connection count

Answer

Network packet loss

Question 8

A company is migrating a legacy three-tier web application to AWS. The application uses a MySQL database and stores session data in the database. The company wants to minimize database load and improve scalability. Which TWO actions should the company take to achieve these goals?

Accepted Answer

Use Amazon ElastiCache to store session data instead of the database.. Storing session data in the database creates unnecessary write load and latency. Amazon ElastiCache (Memcached or Redis) provides an in-memory key-value store that is ideal for transient session data, reducing database load and improving application scalability by offloading session management from the persistent MySQL layer.

Answer

Configure Amazon RDS Multi-AZ for high availability.

Answer

Use Auto Scaling for the web server tier to handle variable traffic.

Answer

Use Amazon RDS read replicas to offload read traffic from the primary database.

Question 9

Which TWO options are valid strategies for backing up an SAP HANA database running on Amazon EC2? (Choose two.)

Accepted Answer

Use SAP HANA Backint to back up to Amazon S3.. Option B is correct because SAP HANA's Backint API integrates with external backup tools, and on AWS you can configure Backint to write full, differential, and log backups directly to Amazon S3, which is a supported and durable target for HANA backups on EC2. Option C is correct because AWS Backup can orchestrate EBS snapshots of the EBS volumes holding HANA data and log files, providing crash-consistent volume-level backups that can be scheduled and retained per backup plan. Option A is wrong because Amazon RDS is a managed database service and does not host or back up SAP HANA, which runs on EC2 as a self-managed database. Option D is wrong because S3 Lifecycle policies only transition or expire objects already stored in S3; they are not themselves a backup strategy for HANA and cannot create the backups. Option E is wrong because EC2 instance store is ephemeral, non-persistent storage that loses data on instance stop, termination, or hardware failure, so it cannot serve as a reliable backup target.

Answer

Use Amazon RDS automated backups for SAP HANA.

Answer

Use Amazon S3 Lifecycle policies to transition HANA backups to Glacier.

Answer

Use EC2 instance store to copy HANA data files.

Question 10

A company runs SAP NetWeaver on AWS and wants to improve the operational resilience of its SAP application servers. The application servers are behind an Application Load Balancer (ALB) and run on Amazon EC2 instances in an Auto Scaling group. The operations team needs to ensure that unhealthy application servers are automatically replaced and that the replacement instances are correctly registered with the ALB. Which TWO configurations should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Configure the Auto Scaling group to use the ALB target group's health check as the health check type.. To automatically replace unhealthy SAP application servers and ensure replacements are registered with the ALB, the Auto Scaling group must use the ALB target group's health checks and have the target group attached. These two configurations together provide end-to-end health monitoring and automatic registration, eliminating manual intervention and ensuring high availability.

Answer

Configure a scheduled scaling policy to replace all instances every night, and use the ALB to drain connections before termination.

Answer

Create a lifecycle hook that sends a notification to an Amazon SNS topic when an instance is terminating, and use a Lambda function to deregister the instance from the target group.

Answer

Enable Elastic Load Balancing health checks on the EC2 instances and configure the Auto Scaling group to use EC2 status checks as the health check type.

Question 11

An SAP system on AWS is running on a single Availability Zone. The operations team wants to improve high availability. Which THREE actions should they take?

Accepted Answer

Use an Application Load Balancer to distribute traffic across AZs.. Option A is correct because an Application Load Balancer operates at the regional level and can distribute incoming traffic across targets in multiple Availability Zones, removing the single-AZ bottleneck and enabling failover if one AZ becomes unavailable. Option D is correct because placing SAP application servers in an Auto Scaling group spanning multiple AZs ensures the application tier can survive an AZ outage and automatically replace unhealthy instances. Option E is correct because the SAP database is the critical stateful component, and a Multi-AZ deployment (for example, RDS Multi-AZ or a database-level HA cluster with synchronous replication) provides automatic failover to a standby in another AZ. Option B is incorrect because EBS Multi-Attach only allows a volume to be attached to multiple Nitro instances within the same Availability Zone, not across AZs. Option C is incorrect because Elastic IP addresses provide static public addressing and instance-level remapping, but they do not by themselves create cross-AZ high availability or replicate data.

Answer

Use EBS Multi-Attach to share volumes across AZs.

Answer

Assign Elastic IP addresses to instances for failover.

Question 12

Which TWO AWS services can be used to monitor SAP system performance and send alerts? (Choose two.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch (C) is correct because it is the AWS monitoring service that collects SAP metrics (such as SAP application logs and OS-level metrics via the CloudWatch agent) and can create alarms that trigger when thresholds are breached. Amazon Simple Notification Service (A) is correct because SNS is the notification service that CloudWatch alarms target to deliver alerts to email, SMS, or other subscribers, completing the monitor-and-alert workflow. Amazon Inspector (B) is wrong because it is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a performance monitoring or alerting tool. AWS Config (D) is wrong because it records and evaluates resource configuration changes for compliance, not runtime SAP performance. AWS Trusted Advisor (E) is wrong because it provides best-practice checks and recommendations across cost, security, and limits, not SAP performance monitoring or alerting.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 13

An SAP environment on AWS includes multiple EC2 instances running SAP application servers. The operations team needs to capture and analyze all API calls made to AWS services by these instances. Which THREE services should be used together?

Accepted Answer

Amazon Athena. AWS CloudTrail (B) is the service that records all API calls made to AWS services, including those originating from the SAP application server EC2 instances, so it is essential for capturing the required activity. CloudTrail delivers these event logs to an Amazon S3 bucket, making Amazon S3 (C) the required storage destination for the captured API call data. Amazon Athena (A) is then used to query the CloudTrail logs stored in S3 with standard SQL, enabling the operations team to analyze the API activity. AWS Config (D) is a configuration and compliance tracking service that records resource configuration changes, not API call auditing, so it does not fulfill the capture-and-analyze requirement. Amazon GuardDuty (E) is a threat detection service that analyzes logs for malicious activity but does not itself capture and store all API calls for querying, so it is not part of this solution.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 14

A company is running SAP HANA on AWS and wants to implement a disaster recovery strategy using a standby system in another AWS Region. Which THREE components are essential for this setup?

Accepted Answer

A secondary EC2 instance in the DR Region. A secondary EC2 instance in the DR Region is required to host the standby SAP HANA system. This instance must be sized and configured to match the primary, and it will receive replicated data via SAP HANA System Replication to enable failover.

Answer

Amazon Route53

Answer

AWS CloudEndure Migration

Question 15

A company is planning to run SAP HANA on AWS. Which TWO of the following are required to ensure the system is supported by SAP? (Choose TWO.)

Accepted Answer

Use an operating system that is on the SAP HANA supported OS list. Option C is correct because SAP only supports SAP HANA on specific operating system versions and distributions listed in the SAP HANA supported OS matrix (for example, SUSE Linux Enterprise Server or Red Hat Enterprise Linux versions certified by SAP); running HANA on an unsupported OS voids SAP support. Option E is correct because SAP HANA on AWS must run on EC2 instance types that SAP has certified for HANA (such as the memory-optimized X1, X1e, X2, or High Memory instances), and using non-certified instance types means the deployment is not supported by SAP. Option A is not required: cluster placement groups are a performance/low-latency recommendation, not an SAP support prerequisite. Option B is not required: SAP supports HANA on multiple EBS volume types (including gp2/gp3 and io1/io2), so mandating io2 Block Express for all HANA data is not a support condition. Option D is not required: termination protection is an operational safeguard against accidental instance deletion and has no bearing on SAP certification or support.

Answer

Place all instances in a cluster placement group

Answer

Use only EBS io2 Block Express volumes for all HANA data

Answer

Enable termination protection on all instances

Question 16

Which THREE security best practices should be implemented for SAP systems on AWS? (Choose three.)

Accepted Answer

Use security groups to restrict inbound and outbound traffic to SAP systems.. Option B is correct because security groups act as stateful virtual firewalls at the ENI level, and restricting both inbound and outbound traffic to only the required SAP ports (for example, 3200-3299 for SAP dispatcher, 3300 for the gateway, and 3600 for the message server) follows the principle of least privilege. Option D is correct because attaching an IAM role to an EC2 instance delivers temporary credentials via the instance metadata service (IMDS), eliminating the need to embed long-lived access keys in SAP application code or configuration files. Option E is correct because enabling encryption at rest on all EBS volumes used by SAP protects data, redo logs, and backups using AWS KMS-managed keys, satisfying data-protection and compliance requirements. Option A is not appropriate because disabling SSH key pairs in favor of password authentication weakens access security; key-based SSH (or AWS Systems Manager Session Manager) is the recommended practice. Option C is not a security best practice because consolidating all SAP systems into a single VPC increases the blast radius and removes network segmentation, whereas separating production, non-production, and management workloads into distinct VPCs or subnets improves isolation.

Answer

Disable SSH key pair access and use only password authentication.

Answer

Deploy all SAP systems in a single VPC for simplified management.

Question 17

Which TWO services can be used to centrally manage and enforce backup policies for SAP systems on AWS? (Choose TWO.)

Accepted Answer

Amazon Data Lifecycle Manager. Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. For SAP systems, you can use DLM to enforce backup policies for the underlying EBS volumes (e.g., /usr/sap, /sapmnt, data volumes) by scheduling snapshots and applying retention rules. AWS Backup provides a centralized, policy-based backup service that supports SAP HANA databases (via Backint integration) and EC2 instances, enabling you to define backup plans, assign resources, and enforce compliance across your SAP landscape.

Answer

AWS CloudFormation

Answer

AWS Config

Answer

Amazon S3

Question 18

A company is migrating a SAP system to AWS and wants to use AWS Systems Manager for patching. Which TWO prerequisites are required to use AWS Systems Manager Patch Manager?

Accepted Answer

The AWS Systems Manager Agent (SSM Agent) must be installed on the EC2 instance.. Option C is correct because Patch Manager relies on the AWS Systems Manager Agent (SSM Agent) running on the instance to receive and execute patch commands; without the SSM Agent installed and running, the instance cannot be managed by Systems Manager. Option D is correct because the instance needs an IAM instance profile/role granting Systems Manager permissions (e.g., the AmazonSSMManagedInstanceCore policy) so the agent can register with the service and retrieve patch baselines and commands. Option A is incorrect because instances in private subnets can be managed via SSM VPC endpoints or NAT, so a public subnet is not required. Option B is incorrect because Patch Manager supports multiple operating systems, including Windows Server and various Linux distributions, not just Amazon Linux 2. Option E is incorrect because a maintenance window is optional; patching can be run on demand via Run Command without configuring a maintenance window or reboot option.

Answer

The EC2 instance must be in a public subnet.

Answer

The EC2 instance must be running Amazon Linux 2.

Answer

A maintenance window must be configured with a reboot option.

Question 19

Which TWO of the following are valid strategies to improve the availability of an SAP HANA database on AWS?

Accepted Answer

Implement automatic failover using SAP HANA System Replication.. Option A is correct because SAP HANA System Replication (HSR) provides continuous replication of data from a primary to a secondary HANA system and, combined with a cluster manager such as Pacemaker or an AWS overlay IP, enables automatic failover so the standby takes over with minimal RTO/RPO. Option D is correct because deploying HSR across two Availability Zones places the primary and secondary nodes in physically separate data centers with independent power and networking, protecting against a full AZ outage while keeping replication synchronous or near-synchronous. Option B is not valid because Amazon RDS does not offer a HANA engine, so Multi-AZ for HANA is not a supported service. Option C is not a high-availability strategy: daily snapshots only provide point-in-time recovery with hours of potential data loss and long restore times, not continuous availability. Option E is not correct because scaling up the EC2 instance improves performance/capacity, not availability, and a single larger instance remains a single point of failure.

Answer

Use Amazon RDS for HANA with Multi-AZ deployment.

Answer

Take daily snapshots of the HANA data volume.

Answer

Use a larger EC2 instance type for the HANA server.

Question 20

A company is designing an SAP system on AWS with SAP HANA as the database. The system must be highly available across multiple Availability Zones. Which TWO actions should the company take to meet this requirement?

Accepted Answer

Configure SAP HANA System Replication (HSR) in synchronous mode. Option A is correct because SAP HANA System Replication (HSR) in synchronous mode replicates data from the primary HANA instance to a secondary instance in another Availability Zone with zero data loss (RPO=0), which is the standard mechanism for HANA database high availability on AWS. Option D is correct because a Pacemaker cluster (typically with Corosync and a fencing/STONITH mechanism) automates the detection of a primary node failure and orchestrates the takeover of the HANA secondary, which is required for a true highly available, multi-AZ SAP HANA deployment. Option B is not appropriate because EBS snapshots are point-in-time backups with no continuous replication, so restoring in another AZ would incur significant RPO/RTO and does not provide automatic HA. Option C is incorrect because S3 cross-region replication is for object storage and is not a supported replication mechanism for live SAP HANA database files. Option E is incorrect because manual DNS failover is not automated, introduces human error and long recovery times, and does not satisfy a highly available multi-AZ design.

Answer

Perform periodic EBS snapshots and restore in another AZ

Answer

Use Amazon S3 cross-region replication for the database files

Answer

Use manual failover by changing DNS records