PAS-C01 Migration Practice Test 12 — 15 Questions

Question 1

The above IAM policy is attached to an IAM role used by an AWS DMS replication instance. The DMS task is migrating data from an on-premises Oracle database to Amazon S3. The DMS task fails with an access error. What is missing from the policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Permissions to pass the IAM role to the DMS replication instance are missing. AWS DMS requires the replication instance's IAM role to include iam:PassRole so that DMS can assume the service role used to access source and target endpoints. If the policy attached to the DMS role lacks iam:PassRole for the DMS service role, the task fails with an access error even though S3 and RDS permissions may be present. This is the classic missing-permission in DMS IAM policies.

Answer

Permissions to describe EC2 instances are missing

Answer

Permissions to access Amazon RDS are missing

Answer

Permissions to write to the S3 bucket are missing

Question 2

A company is migrating a legacy SAP ECC 6.0 system to SAP S/4HANA on AWS. The current database is IBM Db2. Which AWS service should be used to assess the source system and plan the migration?

Accepted Answer

AWS Migration Evaluator. AWS Migration Evaluator (formerly TSO Logic) is the correct service for assessing the source SAP ECC 6.0 system and planning the migration to SAP S/4HANA. It provides a data-driven business case, including SAP-specific insights such as system sizing, licensing, and total cost of ownership. AWS Application Discovery Service is used for server-level discovery and dependency mapping, not SAP-specific assessment. AWS CloudEndure Migration is for lift-and-shift migration, not assessment. AWS Database Migration Service (DMS) is for migrating databases, not assessment.

Answer

AWS Application Discovery Service

Answer

AWS CloudEndure Migration

Answer

AWS Database Migration Service (DMS)

Question 3

A company is migrating an SAP ERP system to AWS. The SAP application servers use a shared /sapmnt filesystem. Which AWS storage solution is most suitable for this shared filesystem with high availability?

Accepted Answer

Amazon EFS. (Amazon EFS) is correct because Amazon EFS is a managed NFS filesystem that provides high availability and can be shared across multiple EC2 instances, making it suitable for the shared /sapmnt filesystem required by SAP. Option A (Amazon S3) is wrong because S3 is object storage, not a POSIX-compliant filesystem, and cannot be mounted as a shared filesystem. Option B (Amazon FSx for Windows File Server) is incorrect because SAP typically runs on Linux, and FSx for Windows is designed for Windows workloads. Option C (Amazon EBS with Multi-Attach) is not ideal because EBS Multi-Attach has limitations (max 16 instances, single Availability Zone) and is not as scalable or resilient as EFS for this use case.

Answer

Amazon S3 with a mount point

Answer

Amazon FSx for Windows File Server

Answer

Amazon EBS with Multi-Attach enabled

Question 4

A company is migrating a large SAP landscape to AWS. The migration plan includes using AWS CloudEndure Migration for the application servers. However, the SAP database requires a different approach. Which database migration method is recommended for an SAP HANA database?

Accepted Answer

Use SAP HANA System Replication (HSR).. SAP HANA System Replication (HSR) is the SAP-recommended method for migrating or replicating an SAP HANA database because it operates at the database layer, continuously replicating data from a primary HANA system to a secondary HANA system (on-premises or on AWS EC2). For large SAP HANA landscapes, AWS documents HSR as the supported approach for near-zero-downtime cutover, since it preserves HANA's in-memory structures and transactional consistency, unlike generic block-level or schema-level tools.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the HANA schema.

Answer

Use AWS CloudEndure Migration for both application and database servers.

Answer

Use AWS DMS with Oracle as a source and HANA as target.

Question 5

An IAM policy for a migration team is shown in the exhibit. The team is unable to start a DMS replication task. What is the most likely missing permission?

Accepted Answer

ec2:CreateNetworkInterface. The most likely missing permission is ec2:CreateNetworkInterface because AWS DMS replication instances require an EC2 network interface (ENI) to be created in the target VPC for communication with source and target databases. Without this permission, DMS cannot provision the necessary network path, causing the replication task to fail at startup. This is a common oversight when crafting IAM policies for DMS, as the service relies on EC2 networking under the hood.

Answer

dms:CreateReplicationInstance and dms:CreateEndpoint

Answer

s3:ListBucket

Answer

kms:Decrypt

Question 6

Which TWO AWS services can be used to migrate an on-premises SAP HANA database to AWS with minimal downtime? (Choose 2.)

Accepted Answer

SAP Landscape Transformation (SLT). SAP Landscape Transformation (SLT) (A) is correct because it enables trigger-based, near-real-time replication of data from the on-premises SAP HANA source into a target SAP HANA database on AWS, allowing the cutover to occur after the bulk load and delta replication are complete, which keeps downtime to a minimum. SAP HANA System Replication (HSR) (E) is correct because it continuously replicates the primary HANA database to a secondary HANA system on AWS in synchronous or asynchronous mode, so the AWS copy stays current and can be promoted during a short takeover window. AWS Backup (B) is not a migration service; it only creates and manages backups of existing AWS resources and cannot replicate an on-premises SAP HANA database. AWS Database Migration Service (DMS) (C) does not natively support SAP HANA as a source or target endpoint, so it cannot perform this migration. AWS CloudEndure Migration (D) performs block-level replication of servers (now part of AWS Application Migration Service) and is not an SAP HANA-aware database migration mechanism.

Answer

AWS Backup

Answer

AWS Database Migration Service (DMS)

Answer

AWS CloudEndure Migration

Question 7

A company is migrating its SAP environment to AWS and needs to ensure that the SAP systems can communicate with each other using their hostnames without relying on a DNS service. Which AWS feature should be used?

Accepted Answer

Amazon Route 53 private hosted zone. Amazon Route 53 private hosted zones allow you to define DNS records for your VPC that resolve to private IP addresses, enabling SAP systems to communicate using hostnames without relying on an external DNS service. This is the correct AWS feature because it provides internal DNS resolution within the VPC, which is exactly what the requirement specifies. The other options do not provide DNS resolution: NLB is for load balancing, security groups are for firewall rules, and VPC peering connects VPCs but does not resolve hostnames.

Answer

Network Load Balancer (NLB)

Answer

Security Group rules

Answer

VPC Peering

Question 8

A company is migrating an SAP HANA database to AWS. The source system uses a Linux filesystem with a specific block size. After migration, the performance is lower than expected. What is the most likely cause?

Accepted Answer

The Amazon EBS volume block size does not match the SAP HANA requirements. SAP HANA has specific requirements for storage block size, typically 4 KB or 512 bytes depending on the filesystem and configuration. If the Amazon EBS volume is formatted with a different block size than the source system, performance can degrade due to misalignment or inefficient I/O operations. Therefore, the most likely cause is that the EBS volume block size does not match SAP HANA requirements.

Answer

The EC2 instance is not in a placement group

Answer

The Amazon EBS volume is not provisioned with enough IOPS

Answer

The EBS volume encryption is enabled, causing overhead

Question 9

A company is migrating its SAP production system to AWS and needs to ensure that the migration does not exceed the allowed downtime window of 4 hours. The source database is 5 TB. Which migration strategy should be used?

Accepted Answer

Heterogeneous migration using AWS DMS with ongoing replication. Heterogeneous migration using AWS DMS with ongoing replication allows near-zero downtime by continuously replicating changes from the source to the target database during the migration, enabling a short cutover window. Option A is incorrect because homogeneous migration using AWS SCT and DMS is typically for same-database-engine migrations, but SCT is unnecessary for homogeneous, and the combination may not achieve the 4-hour window without ongoing replication. Option C is incorrect because AWS Snowball Edge is an offline data transfer method that involves shipping physical devices, which takes days to transfer 5 TB, exceeding the 4-hour window. Option D is incorrect because AWS Application Migration Service (MGN) is designed for server migration (rehosting), not database migration, and does not provide the database-level replication needed for this scenario.

Answer

Homogeneous migration using AWS Schema Conversion Tool (SCT) and AWS DMS

Answer

AWS Snowball Edge for offline data transfer

Answer

AWS Application Migration Service (MGN) replication

Question 10

A company is migrating SAP applications to AWS and needs to test the migration process without affecting the production environment. Which AWS service should be used to create an isolated test environment?

Accepted Answer

AWS CloudFormation. AWS CloudFormation (option D) allows you to create an isolated test environment using infrastructure as code (IaC) templates, enabling you to replicate the production setup without affecting the live environment. Option A is wrong because AWS CodePipeline is a CI/CD service for automating build, test, and deploy pipelines, not for creating test environments. Option B is wrong because AWS Service Catalog is for creating and managing catalogs of IT services, not for provisioning isolated test environments. Option C is wrong because AWS OpsWorks is a configuration management service using Chef and Puppet, not primarily for creating isolated test environments. Therefore, D is correct.

Answer

AWS CodePipeline

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 11

Refer to the exhibit. An administrator is creating an IAM policy for a user who will perform database migrations using AWS DMS. The migration fails with an error 'Insufficient permissions to create DMS endpoint'. Which missing action should be added to the policy?

Accepted Answer

dms:CreateEndpoint. The policy allows creating replication tasks but not endpoints. To create endpoints, the action 'dms:CreateEndpoint' is required. Option B is wrong because 'dms:ModifyEndpoint' is for modifying existing endpoints. Option C is wrong because 'dms:TestConnection' is for testing connections. Option D is wrong because 'dms:CreateReplicationInstance' is for creating replication instances.

Answer

dms:ModifyEndpoint

Answer

dms:TestConnection

Answer

dms:CreateReplicationInstance

Question 12

A company is migrating SAP applications to AWS and needs to ensure that the migration complies with regulatory requirements for data encryption. Which TWO AWS services can be used to encrypt data at rest? (Choose TWO.)

Accepted Answer

Amazon EBS encryption. Amazon EBS encryption (C) is correct because it provides encryption at rest for EBS volumes, snapshots, and instance store volumes attached to supported EC2 instances, using AWS KMS-managed keys (or customer-managed CMKs), which directly satisfies SAP data-at-rest regulatory requirements. AWS Key Management Service (KMS) (E) is correct because it is the service used to create, manage, and control the customer master keys (CMKs) that encrypt data at rest across AWS services such as EBS, S3, RDS, and EFS, providing the key management foundation for encryption compliance. AWS WAF (A) is incorrect because it is a web application firewall that filters HTTP/HTTPS traffic at Layer 7 to protect against exploits, not a data-at-rest encryption service. AWS Certificate Manager (B) is incorrect because ACM provisions and manages SSL/TLS certificates for encryption in transit, not at rest. AWS CloudHSM (D) is incorrect in this context because it provides dedicated hardware security modules for key storage and cryptographic operations, but it is not itself a data-at-rest encryption service for SAP storage.

Answer

AWS WAF

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 13

A company is migrating SAP to AWS and needs to set up connectivity between on-premises and AWS VPC with high bandwidth and low latency. Which TWO AWS services should be used? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Direct Connect (E) is correct because it provides a dedicated private network connection from on-premises to AWS, delivering the high bandwidth and consistent low latency required for a latency-sensitive SAP workload. AWS Transit Gateway (A) is correct because it acts as a central hub to aggregate and route connectivity between the on-premises network (via Direct Connect or VPN attachments) and multiple VPCs, simplifying and scaling the SAP network topology. Together they meet the high-bandwidth, low-latency requirement while supporting multi-VPC connectivity. AWS Client VPN (B) is a remote-user access service, not a site-to-site high-bandwidth link, so it does not fit. AWS Site-to-Site VPN (D) and AWS VPN CloudHub (C) run over the public internet and cannot guarantee the high bandwidth and low latency that SAP migration demands.

Answer

AWS Client VPN

Answer

AWS VPN CloudHub

Answer

AWS Site-to-Site VPN

Question 14

A company is migrating SAP HANA to AWS and needs to ensure that the database instances have high network throughput for replication traffic. Which THREE AWS features should be enabled? (Choose THREE.)

Accepted Answer

Placement Groups. Placement Groups [CORRECT] are right because a cluster placement group packs instances close together within a single Availability Zone, providing low-latency, high-throughput (up to 100 Gbps) networking ideal for SAP HANA replication traffic. EBS-optimized instances [CORRECT] are correct because they dedicate network bandwidth to Amazon EBS I/O, preventing storage traffic from competing with replication traffic and thereby preserving throughput for the database. Enhanced Networking (SR-IOV) [CORRECT] is correct because it uses single-root I/O virtualization to deliver higher bandwidth, lower latency, and lower CPU utilization than traditional virtualized networking, which is essential for HANA system replication. Elastic IP addresses (D) are not correct because they are static public IPv4 addresses for internet-facing connectivity and do not increase network throughput. VPC peering connections (E) are not correct because they only provide private IP routing between VPCs and do not by themselves improve bandwidth or throughput.

Answer

Elastic IP addresses

Answer

VPC peering connections

Question 15

A company is migrating an SAP ERP system running on an on-premises IBM AIX server to AWS. The server hosts both the SAP application and the DB2 database. The company has a tight deadline and wants to minimize the migration effort. The current system uses a storage area network (SAN) with 2 TB of data. The company wants to use AWS native services and avoid re-architecting. What is the BEST migration strategy?

Accepted Answer

Use AWS Application Migration Service (MGN) to replicate the entire server to AWS.. AWS MGN supports migration of IBM AIX servers with block-level replication. Option B (manual install) is wrong because manual installation is more effort and not leveraging AWS services. Option C is wrong because AWS Snowball would require downtime and is not real-time. Option D is wrong because AWS DMS does not support DB2 on AIX as a source.

Answer

Manually install SAP and DB2 on EC2 and restore from backup.

Answer

Use AWS Snowball Edge to transfer the data offline and then launch EC2 instances.

Answer

Use AWS DMS to migrate the DB2 database to Amazon RDS for DB2.