PAS-C01 Operations and Maintenance Practice Test 12 — 15 Questions

Question 1

An SAP administrator needs to grant an external auditor read-only access to view SAP system logs stored in CloudWatch Logs. Which AWS identity-based policy should be used?

Accepted Answer

CloudWatchLogsReadOnlyAccess. The AWS managed policy CloudWatchLogsReadOnlyAccess grants read-only access specifically to CloudWatch Logs, which is required for viewing SAP system logs. Option A (AWSSupportAccess) is intended for AWS Support cases, not log access. Option C (AmazonS3ReadOnlyAccess) is for S3 buckets. Option D (CloudWatchReadOnlyAccess) includes CloudWatch metrics and alarms but not logs; for logs, CloudWatchLogsReadOnlyAccess is needed.

Answer

AWSSupportAccess

Answer

AmazonS3ReadOnlyAccess

Answer

CloudWatchReadOnlyAccess

Question 2

A company runs SAP on AWS and wants to reduce costs by stopping non-production instances during off-hours. Which AWS service can automatically start and stop EC2 instances on a schedule?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a solution that automatically starts and stops instances on a defined schedule, reducing costs for non-production instances during off-hours. Option A is wrong because while AWS Systems Manager Maintenance Windows can schedule start/stop tasks via automation documents, AWS Instance Scheduler is the dedicated solution designed specifically for this use case, making it the best answer. Option C is wrong because Amazon CloudWatch Alarms can trigger actions based on metrics but lack built-in recurring schedule capabilities. Option D is wrong because EC2 Auto Scaling manages instance counts based on demand, not on a time-based schedule.

Answer

AWS Systems Manager Maintenance Windows

Answer

Amazon CloudWatch Alarms

Answer

EC2 Auto Scaling

Question 3

An SAP system on AWS is experiencing high CPU utilization on the database server. The operations team suspects a specific query is causing the issue. Which combination of AWS services should be used to identify the query?

Accepted Answer

Amazon RDS Performance Insights and CloudWatch Logs. Amazon RDS Performance Insights and CloudWatch Logs. Amazon RDS Performance Insights provides database performance analysis and identifies the top queries by load, allowing you to pinpoint the specific query causing high CPU utilization. CloudWatch Logs can be used to correlate query patterns with system metrics. Option A is incorrect because CloudWatch Metrics shows CPU utilization but does not identify specific queries; AWS X-Ray is for tracing application requests, not database queries. Option C is incorrect because CloudTrail logs API calls to AWS services, not database queries. Option D is incorrect because VPC Flow Logs capture network traffic metadata, not database query details.

Answer

Amazon CloudWatch Metrics and AWS X-Ray

Answer

AWS CloudTrail and Amazon Athena

Answer

VPC Flow Logs and Amazon GuardDuty

Question 4

A company wants to ensure that its SAP system backups are stored in a different AWS Region to comply with disaster recovery requirements. Which AWS service should be used to copy EBS snapshots to another Region?

Accepted Answer

AWS Backup. AWS Backup is the correct answer because it provides a centralized backup service that can copy EBS snapshots across AWS Regions as part of backup plans. Amazon Data Lifecycle Manager (DLM) can automate snapshot creation and retention, but its cross-Region copy capabilities are limited compared to AWS Backup's comprehensive backup policies. Option C, S3 Cross-Region Replication, applies to S3 objects, not EBS snapshots. Option D, CloudFormation StackSets, is used for infrastructure provisioning across accounts/regions, not for backup.

Answer

Amazon Data Lifecycle Manager

Answer

Amazon S3 Cross-Region Replication

Answer

AWS CloudFormation StackSets

Question 5

A company runs SAP on AWS and needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail logs all API calls made to AWS services, providing an audit trail. Amazon CloudWatch Logs can then be used to store, monitor, and analyze these logs. Together, they satisfy the auditing requirement. Option A (Amazon S3) can store logs but does not log API calls itself. Option B (VPC Flow Logs) captures network traffic, not API calls. Option D (AWS Config) records resource configuration changes, not API calls. Therefore, the correct combination is CloudTrail and CloudWatch Logs.

Answer

Amazon S3

Answer

VPC Flow Logs

Answer

AWS Config

Question 6

A company wants to automatically recover an SAP HANA database EC2 instance if it becomes impaired due to underlying hardware issues. Which THREE components are required for this automatic recovery?

Accepted Answer

A CloudWatch alarm that monitors the StatusCheckFailed metric.. A CloudWatch alarm monitoring the StatusCheckFailed metric triggers the EC2 Auto Recovery process when the instance becomes impaired. Option B is correct because the instance must be explicitly configured for EC2 Auto Recovery; this is a prerequisite for automatic recovery. Option C is correct because EC2 Auto Recovery operates within a single Availability Zone; the instance is recovered in the same AZ. Option D is incorrect because multiple Availability Zones are not used—this feature does not support multi-AZ recovery. Option E is incorrect because an Elastic IP address is not required for automatic recovery; if an Elastic IP is associated, it will be remapped automatically, but it is not a component of the recovery configuration.

Answer

Multiple Availability Zones for the instance.

Answer

An Elastic IP address associated with the instance.

Question 7

An SAP administrator is troubleshooting why a user cannot stop a production EC2 instance. The IAM policy attached to the user is shown in the exhibit. Which action is likely causing the failure?

Accepted Answer

The instance does not have the tag Environment=production.. The IAM policy allows StopInstances only when the instance has the tag Environment=production. If the instance does not have this tag, the condition in the policy is not met, and the action is implicitly denied. Option B is not necessarily correct because there is no evidence of an explicit deny in another policy. Option C is incorrect because the policy does allow StopInstances with the condition. Option D is incorrect because the ec2:DescribeInstances action is not required to stop an instance.

Answer

There is an explicit deny statement in another policy.

Answer

The policy does not allow the StopInstances action.

Answer

The policy does not include ec2:DescribeInstances action.

Question 8

An SAP administrator runs the CLI commands shown in the exhibit for a production EC2 instance. The output indicates that the instance is running but the system status is impaired. Which action should the administrator take to recover the instance?

Accepted Answer

Configure EC2 Auto Recovery and wait for recovery.. EC2 Auto Recovery is the correct action when the system status check fails (impaired) because it automatically recovers the instance by moving it to new hardware while preserving its configuration. Option A (reboot) does not address underlying hardware issues. Option B (restart SAP services) is irrelevant to hardware impairment. Option D (stop and start) does move the instance to new hardware, but it is a manual process and not the recommended automated recovery method. EC2 Auto Recovery is designed specifically for this scenario.

Answer

Reboot the instance using the AWS console.

Answer

Restart the SAP application services.

Answer

Stop and start the instance.

Question 9

An SAP administrator is troubleshooting connectivity between an SAP application server (security group sg-12345) and an SAP HANA database server. The inbound rule on the database security group is shown in the exhibit. Which additional configuration is required for the application server to communicate with the database?

Accepted Answer

Modify the network ACL to allow inbound traffic on port 3300.. The security group inbound rule already references the application server's security group (sg-12345), which allows traffic from any instance with that security group. However, network ACLs (NACLs) are stateless and must allow both inbound and outbound traffic separately. If the NACL does not have an inbound rule allowing traffic on port 3300 (the default HANA database port), the traffic will be blocked at the subnet level despite the security group rule. Modifying the NACL to allow inbound traffic on port 3300 is required. Option A is incorrect because the security group rule already allows traffic from the application server's IP via the security group reference. Option B is incorrect because the application server's security group only controls outbound traffic to the database; the inbound rule on the database SG is already sufficient. Option D is incorrect because the NACL must be configured properly; the security group rule alone does not guarantee connectivity if the NACL blocks the traffic.

Answer

Add an inbound rule allowing traffic from the application server's IP address.

Answer

Add an inbound rule to the application server's security group.

Answer

No additional rule is needed; the rule allows traffic from sg-12345.

Question 10

A company is migrating an SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS service is best suited for this?

Accepted Answer

Amazon Route 53 weighted routing policy. None of the provided options is correct for ensuring high availability for SAP ASCS. ASCS requires a cluster manager with shared file systems (e.g., Amazon EFS) and failover mechanisms (e.g., overlay IP or Elastic Network Interface repositioning), which are not represented by any of the options. The current answer, Amazon Route 53 weighted routing policy, alone does not provide true high availability for ASCS as it lacks stateful failover and shared storage coordination.

Answer

Amazon RDS Multi-AZ deployment

Answer

EC2 Auto Scaling group

Answer

Amazon S3 cross-region replication

Question 11

An SAP on AWS environment uses a shared file system with Amazon EFS. The operations team reports slow performance during peak hours. Which configuration change would most likely improve throughput?

Accepted Answer

Increase provisioned throughput. Increasing provisioned throughput on Amazon EFS is a direct configuration change that raises the throughput limit, which most reliably improves performance during peak hours. Bursting throughput is the default mode and cannot be 'enabled' as a change; it automatically allows bursting based on stored data, but during sustained peak usage, provisioned throughput is needed to guarantee higher throughput. Option A (encryption at rest) does not affect performance. Option C (Enable Bursting Throughput) is misleading because bursting is already enabled by default and cannot be turned on as a new configuration; it also does not provide sustained throughput improvement. Option D (Max I/O performance mode) optimizes for high I/O operations but does not directly increase throughput.

Answer

Enable encryption at rest

Answer

Enable Bursting Throughput

Answer

Change the performance mode to Max I/O

Question 12

An SAP system is running on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers be encrypted in transit. Which solution meets this requirement with minimal latency?

Accepted Answer

Use security groups to allow traffic only between the instances, with IPsec configured. Security groups act as a virtual firewall, and when combined with IPsec configuration on the EC2 instances, they provide end-to-end encryption between the application and database tiers. This method introduces minimal latency because the encryption is handled by the instances themselves without additional network appliances or load balancers. Option A is incorrect because an AWS Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for internal traffic between tiers. Option C is incorrect because an Application Load Balancer with TLS termination adds unnecessary latency and does not encrypt traffic beyond the load balancer. Option D is incorrect because enabling HTTPS alone does not encrypt database traffic, as database protocols typically use different ports and are not HTTP-based.

Answer

Use an AWS Site-to-Site VPN connection between the tiers

Answer

Use an Application Load Balancer with TLS termination in front of the database tier

Answer

Install TLS certificates on each EC2 instance and enable HTTPS

Question 13

An SAP system administrator needs to automate the patching of SAP applications on EC2 instances. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates patching for managed instances, including SAP applications on EC2. Option A (Amazon Inspector) is for vulnerability assessment, not patching. Option C (AWS OpsWorks) is for configuration management with Chef/Puppet, not specifically for patching. Option D (AWS Config) is for configuration compliance monitoring, not patching.

Answer

Amazon Inspector

Answer

AWS OpsWorks

Answer

AWS Config

Question 14

An SAP HANA database is experiencing high memory utilization. The operations team needs to determine if the database is using more memory than allocated. Which CloudWatch metric should they monitor?

Accepted Answer

MemoryUtilization. (MemoryUtilization) is correct because the SAP HANA agent in CloudWatch publishes the 'MemoryUtilization' metric, which directly shows the percentage of memory used by the HANA database. Option D (HANA_Memory_Usage) is not a standard CloudWatch metric name. Option B (SwapUsage) is for swap, not memory. Option C (CPUUtilization) is for CPU usage.

Answer

SwapUsage

Answer

CPUUtilization

Answer

HANA_Memory_Usage

Question 15

An SAP system uses a large Amazon RDS for Oracle instance. The operations team wants to minimize downtime during a major version upgrade. Which strategy should they use?

Accepted Answer

Create a read replica, upgrade it, and then promote it to the primary. Using a read replica allows you to upgrade the replica and then promote it, minimizing downtime. Option A (taking a snapshot and restoring) has downtime. Option C (modifying the DB instance) causes downtime. Option D (using AWS DMS) requires complex setup and may introduce latency.

Answer

Take a snapshot of the database and restore it as a new instance with the upgraded version

Answer

Modify the DB instance and apply the upgrade immediately

Answer

Use AWS Database Migration Service (DMS) to migrate to a new instance