PAS-C01 Operations and Maintenance — 50 Questions

Question 1

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance. To encrypt an unencrypted EBS volume, you must first take an unencrypted snapshot, then copy that snapshot with encryption enabled, and finally create a new encrypted volume from the copied snapshot. This approach minimizes downtime as the original volume remains attached during the snapshot and copy operations; only the detach/attach step causes brief downtime. Option A is incorrect because you cannot directly take an encrypted snapshot from an unencrypted volume; AWS does not allow setting encryption at the time of snapshot creation from an unencrypted source.

Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 2

A company runs SAP on AWS and uses a Multi-AZ architecture. The SAP application servers are in an Auto Scaling group across two Availability Zones, and the database is an RDS for SAP HANA Multi-AZ DB instance. During a recent failover test, the database failover completed within 2 minutes, but the application servers took 10 minutes to reconnect to the database. Which action would minimize the application reconnection time?

Accepted Answer

Configure the SAP application to use the RDS Multi-AZ automatic failover endpoint.. Configuring the SAP application to use the RDS Multi-AZ automatic failover endpoint allows the application to reconnect to the new primary database quickly after a failover. This endpoint automatically updates to point to the active database instance, minimizing the time for the application to detect and connect to the new primary. Option D is incorrect because RDS Proxy does not support SAP HANA; it is designed for RDS databases such as MySQL, PostgreSQL, etc. Therefore, it cannot be used to manage connections to an SAP HANA database. Option A is wrong because adjusting the health check grace period does not affect database reconnection. Option C is wrong because increasing the number of application servers does not address reconnection logic.

Answer

Reduce the health check grace period on the Auto Scaling group.

Answer

Increase the minimum number of application servers in the Auto Scaling group.

Answer

Use an RDS Proxy to manage database connections from the application servers.

Question 3

An SAP system administrator wants to automate the patching of SAP HANA database instances running on EC2. Which AWS service can schedule and execute patching workflows with approval gates?

Accepted Answer

AWS Systems Manager Maintenance Windows. AWS Systems Manager Maintenance Windows allow scheduling of patching with optional approval workflows. Option B is wrong because AWS Config is for compliance, not patching. Option C is wrong because AWS CloudFormation is for infrastructure provisioning, not patching. Option D is wrong because Amazon CloudWatch Events can trigger actions but lacks built-in approval gates.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

Amazon CloudWatch Events

Question 4

A company runs its SAP environment on AWS and needs to ensure that all changes to the SAP landscape are tracked for auditing. The environment includes EC2 instances, RDS databases, and Lambda functions. Which combination of AWS services provides the most comprehensive audit trail?

Accepted Answer

AWS CloudTrail and AWS Config. CloudTrail logs API calls for all services, and AWS Config records resource configuration changes, together providing a complete audit trail.

Option A is wrong because Systems Manager Inventory collects software inventory, not all configuration changes, and although AWS Config records configurations, the combination is not as comprehensive as CloudTrail + Config.

Option C is wrong because VPC Flow Logs capture network traffic, not configuration changes; CloudTrail logs API calls but still misses configuration recording.

Option D is wrong because CloudWatch Logs and Metrics are for monitoring and logging, not auditing changes.

Answer

AWS Systems Manager Inventory and AWS Config

Answer

Amazon VPC Flow Logs and AWS CloudTrail

Answer

Amazon CloudWatch Logs and Amazon CloudWatch Metrics

Question 5

An SAP administrator needs to receive alerts when the CPU utilization of an SAP application server exceeds 90% for 5 minutes. Which AWS service should be used to set up the alert?

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Alarms can monitor Amazon EC2 instance CPU utilization metrics and trigger alerts when they exceed a threshold for a specified duration. Option A is incorrect because VPC Flow Logs capture network traffic information, not CPU utilization. Option C is incorrect because AWS CloudTrail records API activity for auditing, not metric monitoring. Option D is incorrect because AWS Config evaluates resource configurations against desired policies, not real-time performance metrics.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company is running an SAP HANA database on an EC2 instance with EBS volumes. The operations team notices that the /hana/data filesystem is growing faster than expected and the available space is critically low. Which action should be taken to monitor the disk space usage proactively?

Accepted Answer

Publish custom CloudWatch metrics for disk space and set an alarm.. Amazon CloudWatch allows you to publish custom metrics from your EC2 instances, such as disk space utilization, and set CloudWatch alarms to proactively notify you when disk space falls below a threshold. Option A is incorrect because AWS Budgets tracks cost and usage, not disk space on an instance. Option B is incorrect because AWS Config evaluates resource configurations for compliance, not operational metrics like disk usage. Option D is incorrect because AWS Trusted Advisor provides recommendations for best practices but does not monitor real-time disk space on EC2 instances.

Answer

Configure AWS Budgets to alert on storage costs.

Answer

Use AWS Config rules to monitor disk space.

Answer

Create an AWS Trusted Advisor check for disk utilization.

Question 7

A company wants to automate the patching of SAP application servers running on EC2 instances. Which AWS service should be used to schedule and apply OS patches?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager allows scheduling and applying OS patches. Option A is wrong because AWS Config is for compliance and configuration, not patching. Option B is wrong because AWS CloudFormation is for infrastructure provisioning. Option D is wrong because AWS OpsWorks is for Chef/Puppet, not primarily for patching.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Question 8

A company runs SAP on AWS and uses a Multi-AZ RDS for SAP HANA database. The database fails over unexpectedly, causing application downtime. The operations team wants to analyze the cause of the failover. Which set of logs should be examined?

Accepted Answer

RDS events and DB instance logs.. RDS events and DB instance logs (error log, slow query log) provide information about failover causes. Option A is wrong because CloudTrail logs API calls, not database events. Option C is wrong because CloudWatch Logs from the EC2 instance are not available for RDS; RDS provides its own logging. Option D is wrong because VPC Flow Logs and NLB logs capture network traffic, not database failover events.

Answer

AWS CloudTrail logs and S3 access logs.

Answer

CloudWatch Logs from the EC2 instance hosting the database.

Answer

VPC Flow Logs and Network Load Balancer logs.

Question 9

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic across multiple EC2 instances. The operations team notices that some instances are marked as unhealthy even though the application is running correctly. Which TWO actions could resolve this issue?

Accepted Answer

Increase the healthy threshold count.. Increasing the healthy threshold count makes the load balancer require more consecutive successful health checks before marking an instance as healthy, preventing flapping. Option B is wrong because associating an Elastic IP address does not affect health check status; it only provides a static public IP. Option C is wrong because changing the health check protocol to TCP would not resolve application-level health issues; ALB supports HTTP/HTTPS health checks which are more appropriate for web applications. Option D is correct because changing the health check path to a simpler endpoint (e.g., a static page) reduces the chance of false failures caused by complex application logic. Option E is wrong because decreasing the health check interval increases the frequency of checks, which could cause unnecessary load and does not prevent false failures.

Answer

Associate an Elastic IP address with each instance.

Answer

Change the health check protocol to TCP.

Answer

Decrease the health check interval.

Question 10

A company runs an SAP HANA database on an EC2 instance with EBS volumes. The operations team notices increased latency and I/O errors. Which AWS service should they use to analyze performance and identify bottlenecks?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides metrics and logs to monitor EC2 and EBS performance. Option A (AWS Config) tracks configuration changes, not performance. Option C (AWS Service Catalog) manages service portfolios, not monitoring. Option D (AWS Trusted Advisor) gives recommendations but not real-time performance data.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS Trusted Advisor

Question 11

An SAP system is running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The SAP application logs indicate intermittent timeouts. The operations team has enabled detailed CloudWatch metrics for the ALB. Which metric should they analyze to determine if the ALB is the cause of the timeouts?

Accepted Answer

RequestCount per target. `RequestCount per target` helps identify if traffic is unbalanced across targets, which can cause intermittent timeouts. Option A (`HTTPCode_ELB_5XX`) shows ALB errors but not per-target imbalance directly. Option B (`HealthyHostCount`) shows health status but not request distribution. Option C (`TargetResponseTime`) indicates latency but not directly timeouts.

Answer

HTTPCode_ELB_5XX

Answer

HealthyHostCount

Answer

TargetResponseTime

Question 12

An SAP administrator notices that an Amazon RDS for SAP HANA instance is running low on storage. The administrator needs to increase the storage with minimal downtime. What is the most efficient approach?

Accepted Answer

Modify the RDS instance and increase the allocated storage. For SAP HANA on AWS, the database runs on an EC2 instance with attached EBS volumes. To increase storage with minimal downtime, you can modify the EBS volume size while the instance is running using Elastic Volumes (gp2/gp3/io1/io2). This does not require stopping the instance, creating a new instance, or restoring from a snapshot. The ModifyVolume API or AWS Console allows online resizing.

Answer

Create a new RDS instance with larger storage and migrate data

Answer

Stop the instance, modify storage, and start the instance

Answer

Take a snapshot, restore to a larger instance, and update DNS

Question 13

A company is using AWS Systems Manager to automate patching of EC2 instances. The patch baseline includes both security and non-security updates. The Operations team notices that some instances are not patching within the scheduled maintenance window. What is the most likely cause?

Accepted Answer

The SSM Agent on the instances is outdated.. Systems Manager Patch Manager requires the SSM Agent to be installed and updated; an outdated agent can fail to apply patches. Option A is incorrect because a maintenance window time zone mismatch would affect all instances uniformly, not just some. Option B is incorrect because while an IAM instance profile is required for Systems Manager to manage instances, its absence would prevent any patching, not just occasional failures. Option D is incorrect because a patch baseline in the wrong Region would only affect instances in that Region, not a subset of instances across multiple Regions.

Answer

The maintenance window schedule is set to a different time zone.

Answer

The instances do not have an IAM instance profile attached.

Answer

The patch baseline is configured in the wrong AWS Region.

Question 14

A SAP administrator needs to grant an IAM user permission to start and stop EC2 instances that are part of an SAP environment. The administrator wants to follow the principle of least privilege. Which IAM policy action should be included?

Accepted Answer

ec2:StartInstances and ec2:StopInstances. Ec2:StartInstances and ec2:StopInstances are the specific actions needed to start and stop EC2 instances. Option A is wrong because ec2:TerminateInstances would terminate instances, which is more destructive than required. Option B is wrong because ec2:RunInstances launches new instances, not start/stop existing ones. Option D is wrong because ec2:RebootInstances only reboots instances, not start or stop them.

Answer

ec2:TerminateInstances

Answer

ec2:RunInstances

Answer

ec2:RebootInstances

Question 15

A company runs SAP HANA on AWS and uses AWS Backup to back up the HANA database volumes. The backup job fails with an error indicating that the volume is in use. What is the most likely cause of this failure?

Accepted Answer

The volume is attached to an instance and the filesystem is not frozen before snapshot.. AWS Backup relies on resource tags to determine which EBS volumes to include in backup plans. If the volume does not have the required tags (e.g., 'BackupPlan' tag), AWS Backup may skip the volume or fail to create a snapshot, leading to a backup failure. The error message 'volume is in use' can be misleading; the underlying issue is often missing tags, not the volume being active. Ensuring volumes are properly tagged with the backup plan's required tags resolves the issue.

Answer

The AWS Backup service does not have permission to create snapshots in the account.

Answer

The EBS volume is not tagged with the required backup tags.

Answer

The EC2 instance does not have the AWS Backup agent installed.

Question 16

A company is running SAP ERP on AWS and wants to set up a disaster recovery (DR) strategy using AWS Regions. The DR site must have a copy of the SAP application and database data. Which solution provides the fastest recovery time objective (RTO) with the lowest data loss?

Accepted Answer

Use an RDS Multi-AZ DB cluster with a cross-region read replica.. Cross-region read replicas in Amazon RDS replicate asynchronously, which means there is a small window of potential data loss (RPO typically seconds to minutes). However, among the given options, this approach provides the fastest recovery time objective (RTO) because failover to the read replica can be promoted quickly, and it offers the lowest data loss compared to daily snapshots or DMS. Option A (SAP HANA system replication) would be ideal for SAP HANA but is not specified. Option B (daily snapshots) has higher RPO (up to 24 hours). Option D (DMS continuous replication) may have similar RPO but often requires more complex setup and slower failover. Therefore, an RDS cross-region read replica balances low RTO and low data loss for non-HANA SAP databases.

Answer

Use an EC2 instance with SAP HANA system replication across regions.

Answer

Take daily snapshots of the database and copy them to the DR region. Restore from snapshots during a disaster.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate changes to a database in the DR region.

Question 17

A company runs its SAP S/4HANA system on AWS using a cluster of EC2 instances for the application tier and a single large EC2 instance for the HANA database. The database instance uses EBS volumes striped with LVM for data and log. Recently, the operations team noticed that the database performance has degraded significantly during peak hours. CloudWatch metrics show that the average ReadIOPS for the data volume is consistently at 80% of the provisioned IOPS limit, and the average queue length is above 10. The CPU utilization of the database instance is around 60%, and memory usage is 70%. The team has already verified that there are no network bottlenecks and that the SAP application is not misconfigured. Which of the following is the MOST effective action to improve database performance?

Accepted Answer

Increase the provisioned IOPS on the existing EBS data volume to provide more headroom.. The symptoms indicate that the EBS volume is reaching its IOPS limit, causing queuing. Increasing the provisioned IOPS for the data volume (Option B) will directly address the I/O bottleneck. Option A suggests migrating to instance store volumes, which are ephemeral and not recommended for persistent database data. Option C involves adding more EBS volumes and re-striping, which could increase IOPS but is more complex and may not be necessary if the existing volume supports elastic IOPS adjustments. Option D suggests upgrading to a larger EC2 instance type with higher network bandwidth, but CPU and memory are not fully utilized, so that may not address the I/O bottleneck. Therefore, increasing IOPS on the existing volume is the simplest and most effective.

Answer

Migrate the database data to an instance store volume for higher IOPS.

Answer

Add additional EBS volumes to the LVM stripe and redistribute the data.

Answer

Upgrade the database instance to a larger EC2 instance type with higher network bandwidth.

Question 18

A company runs a critical SAP ERP system on AWS. The system consists of a single EC2 instance running SAP NetWeaver with an Oracle database on the same instance. The instance type is r5.4xlarge with 500 GB gp2 EBS volume for the database. The operations team receives a CloudWatch alarm that the EBS volume's 'BurstBalance' metric has dropped to 0%. Consequently, the database performance degrades significantly. The team needs to resolve the issue and prevent recurrence. The SAP system cannot tolerate more than 10 minutes of downtime. The budget is limited. Which action should the team take?

Accepted Answer

Change the EBS volume type from gp2 to gp3 and increase the IOPS and throughput settings as needed.. Switching to gp3 provides baseline performance without burst credits and is cost-effective. Option C is correct. Option A is wrong because io2 Block Express is expensive and may require downtime to migrate. Option B is wrong because adding volumes and RAID 0 striping increases complexity, may require downtime, and does not address the root cause of burst credit exhaustion. Option D is wrong because increasing volume size only temporarily increases baseline IOPS and burst credits; it does not prevent recurrence if usage continues to exceed baseline.

Answer

Migrate the database to an io2 Block Express volume with provisioned IOPS.

Answer

Add additional EBS volumes and configure RAID 0 striping to increase IOPS.

Answer

Increase the volume size to 1000 GB to increase baseline IOPS and burst credits.

Question 19

An operations team is responsible for patching the operating system of SAP EC2 instances. They want to automate the patching process while minimizing downtime. Which approach should they use?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window and a patch baseline.. AWS Systems Manager Patch Manager automates patching with minimal downtime when used with a maintenance window. Option A is wrong because OpsWorks is not designed for OS patching. Option C is wrong because manual patching is not automated. Option D is wrong because Auto Scaling groups are for scaling, not patching.

Answer

Deploy a configuration management tool like AWS OpsWorks to apply patches.

Answer

Schedule a weekly maintenance window and manually apply patches via RDP/SSH.

Answer

Create an Auto Scaling group with a custom AMI that includes the latest patches.

Question 20

An SAP HANA database administrator reviews the above CLI output for a data volume. The database team reports high write latency. What is the most likely performance bottleneck?

Accepted Answer

The volume is provisioned with too many IOPS for its size, exceeding the maximum IOPS/GB ratio.. The volume is io1 with 10,000 IOPS for a 500 GB volume, exceeding the maximum IOPS/GB ratio of 50:1 for io1 (max 50 IOPS/GB). This can cause throttling and high latency. Option A is wrong because EBS-optimized instances provide dedicated bandwidth but are not directly related to the IOPS/GB ratio issue. Option B is wrong because DeleteOnTermination does not affect write performance. Option C is wrong because encryption does not significantly impact performance.

Answer

The volume is attached to an instance that does not support EBS optimization.

Answer

The volume has DeleteOnTermination enabled, which affects write performance.

Answer

The volume is not encrypted, causing performance degradation.