PAS-C01 Operations and Maintenance Practice Test 11 — 15 Questions

Question 1

A company runs SAP on AWS and uses a Multi-AZ RDS for Oracle as the database. They observe that the database failover took longer than expected during a recent test. What is the most likely cause of the increased failover time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The primary instance had a high volume of ongoing transactions that needed to be completed or rolled back before failover could proceed.. In a Multi-AZ RDS deployment, during a failover, the primary instance must complete or roll back any in-flight transactions before the standby can take over. If there is a high volume of ongoing transactions, this process can take longer, increasing failover time. Option A is incorrect because uncommitted transactions are typically rolled back quickly; the issue is more about transactions that need to reach a consistent state. Option B is incorrect because DNS TTL does not significantly affect RDS failover detection; the failover mechanism uses a CNAME update that is fast. Option D is incorrect because in Multi-AZ RDS, the standby is kept in sync synchronously, and read replicas are not used for Multi-AZ; they are a separate feature.

Answer

The database had a large number of uncommitted transactions that needed to be rolled back.

Answer

The DNS TTL was set too high, causing delays in routing to the new primary.

Answer

The standby instance was not in sync because read replicas were used for reads.

Question 2

An SAP system is deployed on EC2 instances with EBS volumes. The operations team needs to implement a backup strategy that provides point-in-time recovery for the EBS volumes with minimal downtime. Which AWS service should they use?

Accepted Answer

Amazon EBS Snapshots. Amazon EBS Snapshots are the correct service for point-in-time recovery of EBS volumes with minimal downtime. They capture the volume data at a specific point in time and can be taken while the volume is attached and in use, with minimal performance impact (by taking snapshots during low usage). Option A, AWS Storage Gateway, is used for hybrid cloud storage, not for direct EBS backups. Option B, AWS Backup, is a centralized backup service that can automate EBS snapshots, but the question asks which service provides point-in-time recovery for EBS volumes directly; EBS Snapshots are the underlying mechanism. Option D, Amazon S3, is object storage and not directly for EBS volume backups.

Answer

AWS Storage Gateway

Answer

AWS Backup

Answer

Amazon S3

Question 3

A company runs SAP on AWS and uses a distributed deployment with multiple application servers in an Auto Scaling group. They want to ensure that when a new instance is launched, it is automatically registered with the SAP Central Services instance. Which approach should they use?

Accepted Answer

Use an Auto Scaling lifecycle hook that triggers a Lambda function to perform the registration when the instance enters the 'InService' state.. Auto Scaling lifecycle hooks allow you to pause an instance during launch and perform custom actions, such as invoking a Lambda function to register the instance with SAP Central Services, before the instance is placed in service. Option A is incorrect because user data runs at boot but does not integrate with the Auto Scaling lifecycle to ensure registration completes before the instance becomes healthy. Option B is incorrect because CloudFormation is used for infrastructure provisioning and not for per-instance registration triggered by scaling events. Option C is incorrect because AWS Systems Manager Run Command is not automatically triggered during Auto Scaling launches; it requires manual or scheduled execution.

Answer

Configure the user data script to run the registration command on instance boot.

Answer

Use an AWS CloudFormation template to create the instance and include the registration in the template.

Answer

Use AWS Systems Manager Run Command to register the instance after it launches.

Question 4

An administrator needs to monitor the CPU utilization of an SAP HANA database running on an EC2 instance. The monitoring data must be stored for 15 months. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon CloudWatch Metrics. Amazon CloudWatch Metrics is the correct service for monitoring and storing CPU utilization data. It supports custom metrics with retention up to 15 months, meeting the requirement. Amazon S3 is for object storage, not metrics. AWS CloudTrail records API activity, not performance data. Amazon CloudWatch Logs is for log files, not numeric metrics.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 5

An SAP system running on EC2 is experiencing intermittent connectivity issues between application servers and the database server. The network team suspects that the security group rules are too restrictive. What is the best approach to identify which traffic is being blocked?

Accepted Answer

Enable VPC Flow Logs on the subnet or ENI and review the logs for rejected traffic.. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC. They can show accepted and rejected traffic, making them ideal for identifying blocked traffic. Option A is wrong because SAP application logs only show connection errors from the application's perspective, not network-level blocking. Option B is wrong because CloudTrail logs API calls (e.g., security group changes), not network traffic. Option C is wrong because CloudWatch metrics aggregate network data but do not provide per-packet detail to identify rejected traffic.

Answer

Check the SAP application logs for connection errors.

Answer

Enable AWS CloudTrail and look for security group modification events.

Answer

Use Amazon CloudWatch to monitor network packets.

Question 6

A company runs SAP on AWS and uses a custom AMI for their EC2 instances. They want to ensure that all instances launched from this AMI automatically have the SAP host agent installed and configured. What is the most efficient way to achieve this?

Accepted Answer

Create a new AMI that includes the SAP host agent pre-installed and configured.. Baking the SAP host agent into the AMI ensures that every instance launched from that AMI automatically has the agent installed and configured with no additional steps. This is the most efficient approach as it avoids post-launch configuration, reduces potential failure points, and ensures consistency.

Answer

Use AWS Systems Manager Run Command to install the agent after launch.

Answer

Use a user data script that installs and configures the SAP host agent at instance launch.

Answer

Use AWS CodeDeploy to automatically deploy the agent to new instances.

Question 7

An SAP administrator needs to apply a security patch to the operating system of an EC2 instance running SAP. The instance is part of an Auto Scaling group. What is the best practice to apply the patch while minimizing downtime?

Accepted Answer

Create a new AMI with the patch applied, update the launch configuration, and perform a rolling update using an Auto Scaling lifecycle hook.. The best practice because it leverages a lifecycle hook to perform a rolling update, replacing old instances with new ones based on a patched AMI without downtime. This approach ensures that each instance is gracefully terminated after a new instance is ready. Option B is incorrect because simply updating the launch configuration and manually terminating instances can cause downtime and is not automated. Option C is incorrect because stopping the Auto Scaling group and patching in place leads to downtime and is not scalable. Option D is incorrect because applying patches manually via SSH is error-prone and requires sequential instance patching, causing downtime.

Answer

Update the launch configuration with the patched AMI and manually terminate running instances.

Answer

Stop the Auto Scaling group, patch the instance, and restart the group.

Answer

SSH into each instance and apply the patch manually.

Question 8

An SAP system is deployed on EC2 with a Multi-AZ RDS for SAP ASE database. The operations team needs to ensure that database backups are stored in a separate AWS account for compliance. Which TWO actions should they take?

Accepted Answer

Use AWS KMS with cross-account permissions to allow the target account to decrypt and copy the snapshots.. The correct answers are C and D. Option C: Using AWS KMS with cross-account permissions allows the target account to decrypt and copy encrypted snapshots, enabling secure cross-account backup. Option D: AWS Backup with a cross-account backup policy can automatically copy RDS snapshots to another account, meeting compliance requirements. Option A is wrong because sharing snapshots publicly is a severe security risk. Option B is wrong because S3 cross-region replication is for S3 objects, not RDS snapshots. Option E is wrong because the RDS console does not have an automatic cross-account backup feature; this requires AWS Backup or manual snapshot sharing with KMS.

Answer

Share the snapshots publicly and then copy them to the target account.

Answer

Configure S3 cross-region replication for the automated backups.

Answer

Enable automatic cross-account backup in the RDS console.

Question 9

An SAP HANA database is running on an EC2 instance with multiple EBS volumes for data, log, and shared storage. The administrator needs to ensure that the volumes are backed up consistently to avoid data corruption. Which THREE measures should be taken? (Select THREE.)

Accepted Answer

Take snapshots of all volumes simultaneously using the EBS multi-volume snapshot feature.. Options B, C, and D are correct. Option B: Using the EBS multi-volume snapshot feature allows snapshots of all volumes to be taken simultaneously, ensuring crash consistency. Option C: Taking snapshots in the correct order (data volumes first, then log volumes) is important for SAP HANA to maintain transactional consistency. Option D: Freezing the filesystem with xfs_freeze (or equivalent) before taking snapshots ensures filesystem consistency and prevents data corruption. Option A is incorrect because although AWS Backup provides application-consistent snapshots, the question asks for measures the administrator should take directly; the recommended practice for SAP HANA on EC2 with EBS is to use the EBS multi-volume snapshot feature in conjunction with filesystem freeze and proper ordering. Option E is incorrect because stopping the instance causes downtime and is not necessary if using the other measures.

Answer

Use the application-consistent snapshot feature of AWS Backup with pre/post scripts.

Answer

Stop the EC2 instance before taking snapshots.

Question 10

A company runs SAP on AWS and uses CloudWatch for monitoring. They want to set up an alarm that notifies the operations team when the CPU utilization of their SAP application server exceeds 90% for 5 consecutive minutes. Which THREE components are required to achieve this? (Select THREE.)

Accepted Answer

A CloudWatch alarm configured with the metric and threshold.. Options B, C, and E are correct. Option B: A CloudWatch alarm is required to define the threshold and trigger when CPU utilization exceeds 90% for 5 consecutive minutes. Option C: An Amazon SNS topic is needed to send notifications to the operations team. Option E: A CloudWatch metric for CPU utilization is the data source for the alarm. Option A is incorrect because CloudTrail logs API calls, not needed for this monitoring setup. Option D is incorrect because Lambda is not required; the alarm can directly trigger SNS.

Answer

AWS CloudTrail to log the alarm actions.

Answer

An AWS Lambda function to process the alarm.

Question 11

Refer to the exhibit. An administrator runs the AWS CLI command shown. The instance is running Windows. Which of the following is true based on the output?

Accepted Answer

The instance is in the 'running' state, but the status of the SAP application is unknown from this output.. The AWS CLI command output shows the instance state as 'running', but it does not provide any information about the SAP application status. Therefore, we know the instance is running, but the SAP application status remains unknown from this output. Option A is incorrect because the state shown is 'running', not 'stopped'. Option C is incorrect because the output does not include the instance type 't2.micro' (or the actual type is different). Option D is incorrect because the instance is running Windows, as indicated in the stem and likely confirmed by the output, so it is not Linux.

Answer

The instance is in the 'stopped' state.

Answer

The instance type is t2.micro.

Answer

The instance is running Linux.

Question 12

Refer to the exhibit. An IAM policy is attached to a user who manages SAP EC2 instances. Which of the following actions can the user perform?

Accepted Answer

Describe all EC2 instances, but start and stop only those with the tag Environment=production.. The IAM policy grants ec2:Describe* on all resources, allowing the user to describe any EC2 instance. However, ec2:StartInstances and ec2:StopInstances are only allowed on instances with the tag Environment=production, so the user can start and stop only those instances. Option B is incorrect because the user cannot start/stop all instances—only those with the production tag. Option C is incorrect because the user cannot start/stop any instance; the tag condition restricts these actions. Option D is incorrect because the policy does not allow the ec2:TerminateInstances action at all.

Answer

Describe, start, and stop all EC2 instances regardless of tags.

Answer

Start and stop any EC2 instance in the account.

Answer

Terminate any EC2 instance with the tag Environment=production.

Question 13

Refer to the exhibit. A CloudTrail log entry shows that the user 'sapadmin' stopped an instance. Which of the following is true based on the log?

Accepted Answer

The user 'sapadmin' stopped the instance i-0abcdef1234567890.. The eventName is StopInstances and the user is sapadmin, meaning the user successfully stopped instance i-0abcdef1234567890. Options A and B are incorrect: A is wrong because there is no error code, indicating the API call succeeded; B is wrong because the eventName is StopInstances, not StartInstances. Option D is wrong because the eventSource is ec2.amazonaws.com, indicating an EC2 instance, not an RDS instance.

Answer

The StopInstances API call failed.

Answer

The user 'sapadmin' started the instance.

Answer

The event was related to an RDS instance.

Question 14

A company runs its SAP system on AWS and uses an Application Load Balancer (ALB) to distribute traffic to SAP Web Dispatchers. The operations team reports that some users experience intermittent connectivity issues. The ALB health checks are configured to check the /sap/public/bc/icf/logon endpoint. Which configuration change would best improve the reliability of health checks?

Accepted Answer

Change the health check endpoint to a static HTML page that does not require authentication.. Health checks should target a simple, static resource that is always available and does not require authentication. The /sap/public/bc/icf/logon endpoint requires a session and may fail due to transient authentication issues, causing false health check failures. Using a static HTML page eliminates this dependency and improves reliability. Option A is incorrect because increasing the unhealthy threshold would actually delay detection of real failures, potentially allowing unhealthy instances to receive traffic longer. Option B is incorrect because HTTP/2 is a protocol enhancement for performance, not health check reliability. Option C is incorrect because replacing the ALB with a Network Load Balancer would not address the root cause; the issue is the health check endpoint itself.

Answer

Increase the unhealthy threshold count to reduce false positives.

Answer

Enable HTTP/2 support on the ALB.

Answer

Replace the ALB with a Network Load Balancer.

Question 15

A company runs SAP on AWS and has configured automated snapshots of EBS volumes for backup. The operations team discovers that the snapshots are not being deleted after the retention period. Which action should be taken to ensure snapshots are automatically deleted?

Accepted Answer

Use Amazon Data Lifecycle Manager to create a snapshot lifecycle policy.. Amazon Data Lifecycle Manager (DLM) allows you to create automated lifecycle policies for EBS snapshots, including automatic deletion after a retention period. Option A is incorrect because S3 Lifecycle policies do not apply to EBS snapshots; EBS snapshots are stored in S3 but are managed separately. Option C is incorrect because while possible, using CloudWatch Events and Lambda is not the recommended managed solution; DLM is purpose-built for this task. Option D is incorrect because there is no native retention policy on EBS volumes; retention is handled through snapshot lifecycle policies.

Answer

Set an S3 Lifecycle policy on the snapshots.

Answer

Create a CloudWatch Events rule to invoke a Lambda function for deletion.

Answer

Configure retention policy directly on the EBS volume.