PAS-C01 Operations and Maintenance Practice Test 11 — 15 Questions

Question 1

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances running SAP Web Dispatcher. The operations team needs to implement a health check that verifies the Web Dispatcher is ready to accept traffic. Which THREE configuration options should the team set for the health check? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the unhealthy threshold to 5 consecutive failures. Option A is correct because setting the unhealthy threshold to 5 consecutive failures ensures the ALB only marks a Web Dispatcher instance as unhealthy after sustained failure, avoiding false positives from transient SAP startup or load spikes. Option B is correct because the health check path must point to a valid Web Dispatcher readiness endpoint such as /sap/wdisp/health, allowing the ALB to verify the application layer is actually serving traffic rather than just checking TCP connectivity. Option D is correct because a 10-second health check interval provides frequent enough probing to detect failures quickly while not overwhelming the Web Dispatcher with excessive health requests. Option C is not correct because the health check port should match the port the Web Dispatcher actually listens on for ALB traffic, and hardcoding 443/HTTPS is not inherently required by the scenario. Option E is not correct because the healthy threshold is not specified as a required configuration in this scenario; while it is a valid ALB setting, the question asks for the three options the team should set, and the marked correct answers are A, B, and D.

Answer

Set the health check port to 443 (HTTPS)

Answer

Set the healthy threshold to 2 consecutive successes

Question 2

An operations team needs to monitor the performance of an SAP HANA database running on an EC2 instance. Which THREE CloudWatch metrics should the team monitor to ensure the database is not resource-constrained? (Choose THREE.)

Accepted Answer

DiskReadOps. Option B (DiskReadOps) is correct because it measures the number of read operations on the instance's EBS volumes, and SAP HANA is heavily I/O-intensive, so monitoring disk read activity helps detect storage bottlenecks that could constrain database performance. Option C (Memory using the CloudWatch agent) is correct because the default EC2 metrics do not include memory utilization; the CloudWatch agent must be installed to collect memory metrics, and SAP HANA is an in-memory database whose performance depends critically on sufficient RAM. Option D (CPUUtilization) is correct because it reflects the percentage of allocated EC2 compute units in use, and sustained high CPU indicates the instance is compute-constrained for HANA workloads. Option A (DatabaseConnections) is not a standard CloudWatch EC2 metric and is not directly relevant to detecting resource constraints on the underlying instance. Option E (NetworkIn) measures inbound network traffic but does not by itself indicate a resource constraint for an in-memory database like SAP HANA.

Answer

DatabaseConnections

Answer

NetworkIn

Question 3

The operations team uses the IAM policy above for a group of administrators. An administrator tries to terminate an EC2 instance that is tagged with Environment=Production. What will happen?

Accepted Answer

The termination will be denied because there is no explicit Allow for TerminateInstances. The scenario describes an IAM policy with a Deny statement conditioned on a tag (e.g., Environment=Production) and no explicit Allow for ec2:TerminateInstances. IAM is deny-by-default: any action not explicitly allowed is implicitly denied. Because there is no Allow for TerminateInstances, the termination is denied regardless of the Deny condition, making option D correct.

Answer

The termination will be denied because the Deny condition applies to all instances

Answer

The termination will be allowed because the Deny condition is not met

Answer

The termination will be allowed because the Deny does not apply to Production instances

Question 4

An operations engineer runs the AWS CLI command above to check the state of an EC2 instance. The output shows the instance is running. However, the SAP application cannot connect to the instance. The security group allows inbound traffic on port 443 from the application's IP. What is the most likely cause of the connectivity issue?

Accepted Answer

The network ACL for the subnet does not allow outbound traffic. The instance is running, so the issue is likely network configuration. A network ACL is stateless and must allow both inbound and outbound traffic. If the outbound rule denies traffic, responses are blocked. Security groups are stateful. The instance state is running, so it is not stopped or terminated. The command only checks state, not health checks.

Answer

The instance is in a stopped state

Answer

The instance is not passing its status checks

Answer

The security group is not associated with the instance

Question 5

The operations team deploys the CloudFormation template above. After the stack creation completes, the EC2 instance is launched but the SAP application is not running. What is the most likely reason?

Accepted Answer

The UserData script only installs httpd, not the SAP application. The UserData script in the CloudFormation template only installs httpd (Apache) and does not install or start the SAP application, so the EC2 instance launches successfully but the SAP application never runs. The root cause is the incomplete UserData content.

Answer

The security group does not allow inbound traffic to the SAP application port

Answer

The instance type is not suitable for SAP applications

Answer

The AMI ID is incorrect

Question 6

An SAP administrator needs to ensure that a critical SAP system on AWS is highly available with automatic failover across Availability Zones. The system uses an SAP HANA database with replication. Which configuration meets these requirements with minimal operational overhead?

Accepted Answer

Use a Network Load Balancer with static IP addresses. A Network Load Balancer (NLB) with static IP addresses can distribute traffic across multiple Availability Zones. When combined with health checks, the NLB automatically routes traffic away from unhealthy instances, providing automatic failover for SAP HANA. This approach uses layer-4 (TCP) which is suitable for HANA database connections, and static IPs are beneficial for consistent connectivity. Option A is incorrect because manual DNS updates require human intervention and are not automatic. Option C is incorrect because an Application Load Balancer operates at layer-7 (HTTP/HTTPS) and is not designed for database traffic like SAP HANA. Option D is incorrect because a single instance is a single point of failure with no redundancy.

Answer

Use a DNS failover record with manual update

Answer

Use an Application Load Balancer with health checks and Route 53 failover routing

Answer

Deploy a single EC2 instance in one Availability Zone

Question 7

A company wants to automate the backup of their SAP HANA database running on an EC2 instance. The backup should be stored in Amazon S3 and retained for 30 days. Which AWS service can be used to schedule and manage these backups?

Accepted Answer

AWS Backup. AWS Backup. AWS Backup is a fully managed backup service that can be used to automate backups of EC2 instances, including SAP HANA databases, and store backups in Amazon S3. It allows scheduling and retention policies. Option A (AWS Lambda) can be used but requires custom code and is not the primary service for managing backups. Option B (Amazon S3 Lifecycle policies) manages object lifecycle transitions and deletions, not scheduling backups. Option C (AWS Storage Gateway) provides hybrid storage connectivity, not backup scheduling.

Answer

AWS Lambda

Answer

Amazon S3 Lifecycle policies

Answer

AWS Storage Gateway

Question 8

A company runs an SAP system on AWS and wants to implement a disaster recovery (DR) strategy that provides a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. The primary site is in us-east-1 and the DR site is in us-west-2. Which approach meets these requirements?

Accepted Answer

Configure SAP HANA system replication to the DR region and use automatic failover. SAP HANA system replication to the DR region with automatic failover can achieve an RTO of 2 hours and RPO of 15 minutes. System replication continuously replicates data asynchronously or synchronously, and with automatic failover, the DR site can take over quickly, meeting the RTO. The RPO depends on the replication mode; asynchronous replication can achieve an RPO of less than 15 minutes.

Answer

Use Amazon EBS cross-Region replication for all volumes

Answer

Use AWS Backup to copy snapshots to the DR region every 15 minutes

Answer

Take daily backups of the SAP HANA database and store in S3, then restore in us-west-2

Question 9

A company runs SAP on AWS and wants to reduce costs for non-production environments that are used only during business hours (8 AM to 6 PM). Which action should the administrator take to minimize costs without losing data?

Accepted Answer

Stop the instances during non-business hours and use Amazon EBS snapshots for backup. Stopping EC2 instances during non-business hours eliminates compute charges while preserving the attached EBS volumes and their data. EBS snapshots provide durable backups so the environment can be restored or cloned if needed. This matches the requirement to minimize cost without losing data, since terminated instances would destroy ephemeral storage and require rebuilds.

Answer

Convert the instances to Reserved Instances

Answer

Terminate the instances after business hours

Answer

Downsize the instance types to the smallest available

Question 10

An SAP system on AWS is experiencing high latency between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. Which action should the administrator take to reduce latency?

Accepted Answer

Move the application and database servers to the same Availability Zone. Latency between two instances in different Availability Zones is caused by the physical network path traversing AZ boundaries, which adds round-trip time. Moving both the application and database servers into the same Availability Zone places them on the same low-latency network segment, directly reducing inter-instance latency. This is the most direct and effective action for the stated problem.

Answer

Create a placement group and launch both instances in it

Answer

Upgrade the instance types to compute-optimized instances

Answer

Use AWS Direct Connect to connect the servers

Question 11

A company needs to ensure that only authorized users can access the SAP S/4HANA system running on AWS. Which AWS service can be used to manage user identities and permissions?

Accepted Answer

AWS Directory Service. AWS Directory Service can integrate with on-premises Active Directory to provide a managed directory service, which allows organizations to use existing corporate credentials to access SAP S/4HANA systems running on AWS. This enables centralized user identity management and single sign-on for SAP applications. Option C (IAM) is incorrect because IAM manages access to AWS resources (e.g., EC2, S3), not user identities within SAP applications themselves. Option B (AWS Organizations) is for managing multiple AWS accounts. Option D (Amazon Cognito) is aimed at customer-facing identity management.

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon Cognito

Question 12

Which THREE AWS services can be used to monitor and log SAP system activities for security and compliance? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (C) is correct because it centralizes, stores, and monitors log data from SAP systems and their underlying EC2 instances, enabling metric filters and alarms for security and compliance auditing. AWS CloudTrail (D) is correct because it records API activity and account events across the AWS environment hosting SAP, providing an audit trail of who did what and when. AWS Config (E) is correct because it continuously assesses and records resource configurations and changes, helping verify that SAP-related AWS resources remain compliant with security policies. Amazon Athena (A) is not a monitoring or logging service itself; it is a serverless query service used to analyze data already stored in S3, so it does not directly monitor or log SAP activities. Amazon VPC Flow Logs (B) captures IP traffic metadata for network interfaces, which is useful for network forensics but is not one of the three services the question expects for monitoring and logging SAP system activities for security and compliance.

Answer

Amazon Athena

Answer

Amazon VPC Flow Logs

Question 13

Which TWO Amazon EBS volume types are recommended for SAP HANA database workloads? (Choose two.)

Accepted Answer

io2 Block Express. Options D and E are correct. io2 Block Express provides high performance for SAP HANA, and gp3 provides balanced performance. Option A is wrong because sc1 is cold storage, not suitable for databases. Option B is wrong because st1 is throughput-optimized, not suitable for databases. Option C is wrong because io1 is an older SSD type; io2 Block Express is recommended for SAP HANA.

Answer

sc1 (Cold HDD)

Answer

st1 (Throughput Optimized HDD)

Answer

io1 (Provisioned IOPS SSD)

Question 14

A company is running an SAP application on an SAP HANA database in a multi-AZ deployment on AWS. The operations team notices that the system is experiencing high latency during peak hours. Upon investigation, they find that the EBS volumes attached to the HANA instances are frequently exceeding the provisioned IOPS limit. Which of the following is the MOST effective action to resolve this issue?

Accepted Answer

Increase the volume size of the EBS volumes to increase the baseline IOPS.. For SAP HANA on AWS, EBS volume performance is critical for database operations. When using Provisioned IOPS SSD (io2) volumes, the provisioned IOPS is a hard limit that cannot be exceeded. Increasing the volume size of an io2 volume directly increases the maximum provisioned IOPS because io2 volumes support a ratio of 50 IOPS per GiB (up to 64,000 IOPS per volume). Therefore, increasing the volume size allows you to provision more IOPS, which resolves the bottleneck. This is the most effective action because it directly addresses the root cause—insufficient provisioned IOPS—without changing the volume type or relying on instance-level optimizations that do not increase the underlying EBS performance limit.

Answer

Switch from Provisioned IOPS SSD (io2) to General Purpose SSD (gp3) volumes.

Answer

Enable EBS optimization on the EC2 instances.

Answer

Reduce the number of concurrent connections to the SAP HANA database.

Question 15

An SAP administrator needs to implement a disaster recovery (DR) strategy for SAP HANA with an RTO of 2 hours and RPO of 15 minutes. The primary site is in us-east-1, and the DR site is in us-west-2. The system uses SAP HANA System Replication (HSR) for data replication. Which AWS service should be used to automate failover and minimize downtime?

Accepted Answer

AWS Elastic Disaster Recovery (AWS DRS).. AWS Elastic Disaster Recovery (DRS) provides continuous block-level replication and automated failover/failback for on-premises or cloud workloads, including SAP HANA, with RPO in seconds and RTO in minutes — meeting the 2-hour RTO and 15-minute RPO. It is the AWS-recommended service for automating DR failover.

Answer

AWS Backup with cross-region backup copies.

Answer

AWS CloudEndure Disaster Recovery.

Answer

Amazon RDS for SAP HANA.