PAS-C01 Operations and Maintenance — 30 Questions

Question 1

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint. The error 'Unable to retrieve patch baseline' indicates that the EC2 instances cannot communicate with the AWS Systems Manager service to fetch the patch baseline configuration. Since the instances are in a private subnet with a VPC endpoint for SSM, the most likely cause is that the VPC endpoint's security group does not allow HTTPS outbound traffic (port 443) to the endpoint itself. Without this outbound rule, the SSM Agent on the instance cannot establish the TLS connection required to retrieve the patch baseline from the SSM API.

Answer

The CodeDeploy agent on the instances is outdated

Answer

The instances are not registered as managed instances with the SSM ManagedInstance role

Answer

The instances do not have an IAM instance profile attached

Question 2

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

Accepted Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance. To encrypt an unencrypted EBS volume, you must first take an unencrypted snapshot, then copy that snapshot with encryption enabled, and finally create a new encrypted volume from the copied snapshot. This approach minimizes downtime as the original volume remains attached during the snapshot and copy operations; only the detach/attach step causes brief downtime. Option A is incorrect because you cannot directly take an encrypted snapshot from an unencrypted volume; AWS does not allow setting encryption at the time of snapshot creation from an unencrypted source.

Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 3

A company has a CloudFormation stack that creates an EC2 instance with a custom AMI. The stack fails with the error 'Resource creation cancelled' during creation. The engineer checks the stack events and sees that the EC2 instance creation succeeded, but the subsequent creation of an EBS volume failed. What is the MOST likely reason for the failure?

Accepted Answer

The EBS volume creation failed, causing the stack to roll back and cancel the instance. When an EBS volume creation fails in a CloudFormation stack, the stack initiates a rollback of all previously created resources, including the EC2 instance. The 'Resource creation cancelled' error appears for the EC2 instance because its creation was successful but then undone during the rollback, not because it failed initially.

Answer

The EC2 instance creation failed and then was cancelled

Answer

The EC2 instance had a DeletionPolicy of Retain, which prevented rollback

Answer

The EC2 instance depended on the EBS volume, and the dependency caused a timeout

Question 4

A company is designing a disaster recovery strategy for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires RPO of 15 minutes and RTO of 1 hour. Which TWO approaches meet these requirements?

Accepted Answer

Use EBS Snapshots taken every 15 minutes and copy them to the DR region. EBS Snapshots can be taken every 15 minutes and copied across regions, enabling volume creation in the DR region with an RPO of 15 minutes and RTO under 1 hour if the EC2 instance is pre-provisioned. Using AWS Elastic Disaster Recovery (which may be referred to as 'EBS Reboot' in this context) provides continuous replication and failover, meeting the RPO/RTO requirements. Options B, C, and D are incorrect: AWS Backup has a minimum 1-hour backup interval; hourly AMIs exceed the 15-minute RPO; and EBS Multi-Attach does not support cross-region failover.

Answer

Use AWS Backup with a backup plan that takes cross-region backups every 15 minutes

Answer

Use Amazon Machine Images (AMIs) backed by EBS snapshots, taken hourly

Answer

Use EBS Multi-Attach volumes to allow the DR instance to access the same volumes

Question 5

A company is migrating a legacy application to AWS. The application requires a static IP address that does not change during instance stop/start. The application also needs to be highly available across two Availability Zones. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use a Network Load Balancer with an Elastic IP address. A Network Load Balancer (NLB) supports static IP addresses by allowing you to associate an Elastic IP address with each of its Availability Zone subnets. This provides a fixed entry point that does not change when backend instances are stopped or started, meeting the requirement for a static IP. Combined with an Auto Scaling group spanning two Availability Zones, the NLB ensures high availability by distributing traffic across healthy instances in both zones.

Answer

Place the instances in a placement group to ensure high availability

Answer

Use an Application Load Balancer to distribute traffic to the instances

Question 6

A company manages a multi-account AWS environment using AWS Organizations. The operations team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket. What is the MOST efficient way to enforce this configuration?

Accepted Answer

Deploy an AWS CloudFormation StackSet with a template that enables CloudTrail and configures the S3 bucket in every account and region.. AWS CloudFormation StackSets allow you to deploy a CloudTrail configuration template across multiple accounts and regions in a single, automated operation. This approach ensures consistent enforcement of the policy without manual intervention, leveraging the centralized management capabilities of AWS Organizations.

Answer

Configure CloudTrail in the management account with an S3 bucket policy that grants access to all member accounts.

Answer

Create a custom script using AWS CLI to enable CloudTrail in each account and region.

Answer

Use AWS Service Catalog to publish a CloudTrail product and require each account to launch it.

Question 7

Solutions Architect needs to automate the patching of Amazon EC2 instances running Amazon Linux 2. The instances are in an Auto Scaling group and must be patched without downtime. Which approach is BEST?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window and update the Auto Scaling group launch configuration to use a patched AMI for new instances.. AWS Systems Manager Patch Manager automates patching of existing EC2 instances without downtime by using a maintenance window to schedule patch installation, and updating the Auto Scaling group launch configuration ensures new instances launched by the group use a patched AMI, maintaining consistency. This approach avoids terminating all instances at once (which would cause downtime) and leverages AWS-native automation for ongoing compliance.

Answer

Use Amazon Inspector to scan for vulnerabilities and automatically apply patches.

Answer

Terminate all instances and let the Auto Scaling group launch new instances from a patched AMI.

Answer

Create a custom AMI with latest patches and update the Auto Scaling group manually during a maintenance window.

Question 8

A company runs a production application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. The operations team notices that during a recent deployment, a small percentage of instances failed health checks and were replaced, causing a brief increase in error rates. What is the MOST effective way to reduce deployment-related errors?

Accepted Answer

Configure the Auto Scaling group with a warm-up time in the instance refresh settings.. Configuring a warm-up time in the Auto Scaling group's instance refresh settings ensures that newly launched instances are fully initialized and pass health checks before they start receiving traffic. This prevents brief error spikes during deployments by allowing instances to stabilize before being marked as healthy and added to the ALB target group.

Answer

Use a lifecycle hook to delay instance registration until a script completes.

Answer

Increase the health check interval on the ALB to reduce rapid replacements.

Answer

Increase the desired capacity of the Auto Scaling group to absorb failures.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution requires the least operational overhead?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.. A Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.

Answer

Use AWS Config rules to detect untagged buckets and trigger a Lambda function to add tags.

Answer

Configure each account's S3 bucket creation process to include tagging.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Question 10

A company runs a web application on Amazon ECS with Fargate launch type. The application's memory utilization spikes periodically, causing tasks to be killed. The operations team wants to automatically scale the service based on memory usage. Which TWO steps are necessary to implement this?

Accepted Answer

Create an Application Auto Scaling target tracking scaling policy based on memory utilization.. Option B is correct because Application Auto Scaling for ECS services supports target tracking scaling policies, and memory utilization can be used as a predefined metric (ECSServiceAverageMemoryUtilization) to scale the desired task count automatically. Option E is correct because ECS tasks do not publish memory utilization metrics to CloudWatch by default; you must enable CloudWatch metrics (via the ECS service's metrics configuration or container-level metrics) so that memory utilization is available for the scaling policy to evaluate. Option A is incorrect because Fargate tasks are not backed by an EC2 Auto Scaling group; capacity is managed by Fargate, so attaching an ASG is neither possible nor necessary. Option C is incorrect because step scaling is a different policy type and is not required for this scenario; target tracking already handles scaling based on the metric. Option D is incorrect because target tracking scaling policies create and manage the required CloudWatch alarms automatically, so manually creating an alarm is not a necessary step.

Answer

Attach an EC2 Auto Scaling group to the ECS service to handle capacity.

Answer

Configure step scaling policies to add multiple tasks at once.

Answer

Create a CloudWatch alarm that triggers the scaling policy when memory exceeds a threshold.

Question 11

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application stores session state in an ElastiCache Redis cluster (Cluster Mode disabled). The operations team receives alerts that the application is experiencing intermittent timeouts and high error rates. Upon investigation, they find that the Redis cluster's CPU utilization is consistently above 90%, and there are frequent 'MAXMEMORY' evictions. The application team confirms that they recently increased the number of concurrent users and added more session data per user. The current Redis cluster is a single cache.r5.large node with 13.37 GB of memory. Which of the following should the operations team do FIRST to address the performance issues?

Accepted Answer

Enable Cluster Mode and add multiple shards to distribute the data across nodes.. The correct first step is to enable Cluster Mode and add multiple shards because the performance issue stems from CPU saturation and memory pressure on a single Redis node. Cluster Mode distributes data across multiple shards, reducing per-node CPU load and memory usage, which directly addresses the high CPU utilization and 'MAXMEMORY' evictions caused by increased concurrent users and session data.

Answer

Upgrade the instance type to cache.r5.2xlarge to double the memory and compute capacity.

Answer

Create a read replica in a different Availability Zone and redirect read traffic to it.

Answer

Change the eviction policy to 'allkeys-lru' to maximize memory utilization.

Question 12

An IAM policy is attached to a user. The user attempts to upload a file to s3://my-bucket/restricted/data.txt. What is the outcome?

Accepted Answer

The upload fails because the explicit Deny overrides the Allow.. C is correct because IAM policy evaluation follows a default-deny model where an explicit Deny always overrides any Allow. Even though the user has an Allow for s3:GetObject on all resources, the explicit Deny for the specific object path s3://my-bucket/restricted/* takes precedence, causing the upload (which requires s3:PutObject) to fail.

Answer

The upload succeeds because there is no explicit Deny for the specific object.

Answer

The upload succeeds because the Allow statement for s3:GetObject implies PutObject.

Answer

The upload succeeds because the Allow for s3:GetObject is on all resources.

Question 13

Match the AWS storage service to its characteristic relevant to SAP.

Accepted Answer

Amazon EBS: Block storage for SAP HANA data and log volumes. For SAP on AWS, EBS is used for HANA data/log volumes (block), S3 for backup/archiving (object), EFS for shared directories (file), and FSx for Lustre for high-performance analytics.

Answer

Amazon S3: File storage for SAP S/4HANA shared /sapmnt

Answer

Amazon EFS: Object storage for SAP backup and archiving

Question 14

Match the AWS service to its function in SAP disaster recovery.

Accepted Answer

AWS Elastic Disaster Recovery (DRS): Continuous block-level replication of SAP servers to a DR region.. In SAP disaster recovery on AWS, AWS Elastic Disaster Recovery (DRS) handles continuous replication, Amazon Route 53 manages DNS-based failover, and AWS Global Accelerator provides static IPs for traffic shifting. Common confusions involve mixing the distinct roles of these services.

Answer

AWS Elastic Disaster Recovery (DRS): Snapshot-based backup of SAP HANA databases.

Answer

AWS Global Accelerator: DNS-based failover routing to redirect traffic to the DR site.

Answer

Amazon Route 53: Continuous block-level replication of SAP servers to a DR region.

Question 15

A company runs SAP on AWS. During a maintenance window, the SAP application team needs to apply a kernel update that requires a reboot of the SAP application servers. The environment uses an Auto Scaling group for the application tier. What is the BEST approach to minimize downtime?

Accepted Answer

Terminate instances one at a time, allowing the Auto Scaling group to launch new instances with the updated configuration.. Terminating instances one at a time and letting the Auto Scaling group replace them with the updated configuration is the best approach because it maintains service availability throughout the maintenance window. The ASG automatically launches replacement instances using the new launch template or launch configuration, ensuring the application tier remains operational. This rolling replacement minimizes downtime by keeping the desired capacity available while progressively updating all instances.

Answer

Stop all instances in the Auto Scaling group, apply the update, and start them again.

Answer

Detach all instances from the Auto Scaling group, apply the update, and reattach them.

Answer

Double the desired capacity of the Auto Scaling group, wait for new instances, then terminate old instances.

Question 16

A company runs SAP HANA on AWS. The operations team needs to automate the creation of AMI backups for the HANA database server. Which AWS service should they use to schedule and manage these backups?

Accepted Answer

AWS Backup. AWS Backup provides a centralized, policy-driven service to schedule and manage backups of supported resources, including EC2 instances and their EBS volumes, which is how SAP HANA AMI backups are automated. It supports backup plans with cron or rate-based schedules, retention rules, and cross-region/cross-account copies. This makes it the correct service for scheduling and managing AMI backups.

Answer

Amazon S3 Lifecycle policies

Answer

AWS Systems Manager

Answer

Amazon CloudWatch Events

Question 17

An SAP system on AWS uses a Multi-AZ RDS for SQL Server as the database. During a failover test, the application experienced a 2-minute outage. The application team wants to reduce this downtime. What should the operations team recommend?

Accepted Answer

Enable automatic failover handling in the application's JDBC connection string.. Enabling Multi-AZ with automatic failover in the JDBC connection string allows the application to automatically reconnect to the new primary without manual intervention. Option A is wrong because increasing instance size does not affect failover time. Option B is wrong because a different Multi-AZ configuration does not reduce failover time. Option D is wrong because RDS Proxy is not supported for SQL Server.

Answer

Increase the DB instance size to improve failover performance.

Answer

Configure Multi-AZ with SQL Server Mirroring instead of Always On Availability Groups.

Answer

Use Amazon RDS Proxy to manage connections.

Question 18

An SAP system on AWS is experiencing intermittent connectivity issues between the application servers and the HANA database. The network team has confirmed that the VPC and subnets are configured correctly. What should the operations team check NEXT?

Accepted Answer

Security group rules on the database server.. Security group rules on the database server are the most likely cause of intermittent connectivity issues after VPC and subnet configurations are confirmed correct. Security groups act as stateful virtual firewalls at the instance level, and misconfigured rules can block specific ports or protocols intermittently, especially if rules are too restrictive or if multiple security groups are attached. Checking security group rules is the next logical step to identify the source of the connectivity problem.

Answer

DNS resolution for the database endpoint.

Answer

VPC route tables for the application subnet.

Answer

Network ACLs on the database subnet.

Question 19

An SAP system on AWS uses a custom AMI for its application servers. The operations team needs to update the AMI to include a new security patch. What is the MOST efficient way to update all existing instances without downtime?

Accepted Answer

Create a new AMI version, update the Auto Scaling group's launch template, and perform a rolling update.. The most efficient way to update all existing instances without downtime is to create a new AMI version, update the Auto Scaling group's launch template to use the new AMI, and then perform a rolling update. This replaces instances gradually, maintaining availability and ensuring the new patch is applied to all instances.

Answer

Stop all instances, apply the patch, create a new AMI, and start instances.

Answer

Use AWS Systems Manager Patch Manager to apply the patch to all running instances.

Answer

Create a new AMI, launch new instances manually, and terminate old ones.

Question 20

Which TWO AWS services can be used to automate the patching of SAP application servers?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager (B) is correct because it provides native, automated OS and application patch baselines, maintenance windows, and compliance reporting for EC2 instances running SAP application servers, using the SSM Agent to scan and install patches on a schedule. AWS Lambda (D) is correct because it can be used to automate patching workflows—for example, triggering patching jobs, invoking SSM Run Command documents, or orchestrating custom pre/post-patch scripts via EventBridge schedules—without managing servers. AWS CloudFormation (A) is not a patching engine; it provisions and manages infrastructure as code and does not scan or install OS patches. Amazon EC2 Auto Scaling (C) only adjusts instance capacity based on demand and does not perform patch management. AWS Elastic Beanstalk (E) is a PaaS deployment service for web applications and does not provide automated patching of SAP application servers.

Answer

AWS CloudFormation

Answer

Amazon EC2 Auto Scaling

Answer

AWS Elastic Beanstalk