PAS-C01 Operations and Maintenance Practice Test 12 — 15 Questions

Question 1

An SAP Basis administrator is troubleshooting a performance issue on an SAP application server running on an Amazon EC2 instance. The administrator notices high CPU utilization. Which AWS tool can provide detailed insights into the CPU usage at the process level without installing additional agents?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Inventory collects metadata about instances but not process-level CPU. EC2 Instance Connect is for shell access. CloudWatch metrics provide aggregate CPU, not per-process. Systems Manager Run Command can execute scripts to gather process data, but the question asks for a tool that provides the information directly without agents; however, Systems Manager with default agent can run commands to get process-level data, which is more direct than the others. CloudWatch does not provide process-level CPU without custom metrics.

Answer

AWS Systems Manager Inventory

Answer

Amazon CloudWatch CPU Utilization metric

Answer

Amazon EC2 Instance Connect

Question 2

An SAP system on AWS is configured with a multi-AZ deployment for high availability. During a failover test, the secondary instance does not take over as expected. The administrator checks the AWS Management Console and sees that the Elastic IP address is still attached to the primary instance. What is the most likely cause?

Accepted Answer

The Elastic IP is not reassigned during the failover process. In a typical HA setup, the Elastic IP should be reassigned to the secondary instance during failover. If it remains attached to the primary, the secondary cannot be reached. The root device is not relevant to IP assignment. Route tables are not per-instance. Security groups allow traffic but do not prevent failover.

Answer

The secondary instance's root volume is not attached

Answer

The security group of the secondary instance blocks incoming traffic

Answer

The route tables are not updated to point to the secondary instance

Question 3

A company runs SAP on AWS and needs to ensure that all changes to the SAP system's underlying infrastructure are recorded and auditable. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing. CloudWatch Logs is for log monitoring. Config tracks resource configuration changes. Trusted Advisor provides best-practice checks. CloudTrail is the primary service for API activity auditing.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 4

An SAP administrator notices that an Amazon RDS for SAP HANA instance is running low on storage. The administrator needs to increase the storage with minimal downtime. What is the most efficient approach?

Accepted Answer

Modify the RDS instance and increase the allocated storage. RDS supports storage modification without downtime if using Elastic Volumes (gp2/gp3/io1/io2). Increasing allocated storage does not require a new instance or snapshot restoration. Modifying the instance class is separate. Stopping the instance is unnecessary.

Answer

Create a new RDS instance with larger storage and migrate data

Answer

Stop the instance, modify storage, and start the instance

Answer

Take a snapshot, restore to a larger instance, and update DNS

Question 5

An SAP system on AWS is experiencing intermittent network connectivity issues between the application servers and the database server. Both are in the same VPC but different subnets. The security groups allow all traffic between them. What should the administrator check next?

Accepted Answer

Network ACL rules for the subnets. Network ACLs are stateless and must allow both inbound and outbound traffic. If NACLs block return traffic, connectivity fails intermittently. VPC Flow Logs can help diagnose but are not the first check. Route tables are typically correct within a VPC. The issue is likely at the NACL level.

Answer

VPC Flow Logs to analyze dropped packets

Answer

Route tables to ensure proper routing

Answer

Security group rules for outbound traffic

Question 6

An SAP administrator needs to apply an OS-level security patch to all EC2 instances in an SAP landscape. The administrator wants to automate this process and track compliance. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates OS patching and tracks compliance. Elastic Beanstalk is for application deployments. OpsWorks is for configuration management. CodeDeploy is for application code. Patch Manager is the correct service for OS patches.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 7

An SAP HANA database on AWS is configured with automatic backups to Amazon S3. The backup process is failing with the error 'Access Denied'. The administrator has confirmed the S3 bucket exists and the IAM role attached to the EC2 instance has the correct permissions. What could be the issue?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the IAM role. If the bucket policy denies access even if the IAM role allows, the explicit deny in the bucket policy overrides. The error indicates a permissions issue. The role might lack proper trust policy only if it can't assume, but the error suggests access denied to S3. The bucket policy is likely the cause. KMS key issues would give a different error. VPC endpoint issues would cause connectivity errors.

Answer

The IAM role's trust policy does not allow the EC2 service

Answer

The S3 bucket is encrypted with AWS KMS and the role lacks kms:Decrypt permissions

Answer

The VPC does not have an S3 VPC endpoint configured

Question 8

An SAP system running on AWS uses a shared file system via Amazon EFS. Recently, the file system has become slow. The administrator suspects that the burst credits are exhausted. What metric should the administrator check in Amazon CloudWatch to confirm this?

Accepted Answer

BurstCreditBalance. EFS has a BurstCreditBalance metric that tracks available burst credits. When exhausted, throughput drops. PercentIOLimit is not a valid metric. Throughput is the actual throughput, not credit balance. PermittedThroughput is not a metric.

Answer

PermittedThroughput

Answer

Throughput

Answer

PercentIOLimit

Question 9

Which TWO actions are required to set up automated failover for an SAP HANA database using AWS services? (Choose TWO.)

Accepted Answer

Create an AWS Lambda function to reassign an Elastic IP address to the standby instance. Automated failover requires detecting failure and reassigning resources. CloudWatch alarms can detect database unavailability and trigger a Lambda to reassign the Elastic IP to the standby instance. Stopping the primary is unnecessary and might not be desired. Multi-AZ RDS is for non-HANA databases. EFS is not typically used for HANA failover. Snapshot restore is too slow for automated failover.

Answer

Use an Amazon RDS Multi-AZ deployment for the HANA database

Answer

Schedule a snapshot and restore on failure

Answer

Store HANA data on Amazon EFS and mount it on both instances

Question 10

Which THREE steps should an administrator take to troubleshoot an issue where an SAP application server cannot connect to the database server after a security group change? (Choose THREE.)

Accepted Answer

Check the outbound rules of the application server's security group. The first step is to verify the security group rules. Then check network ACLs. VPC Flow Logs can confirm if traffic is allowed or denied. Checking the OS firewall is also important. Restarting instances and changing route tables are too disruptive and unlikely to be the root cause. Changing security groups again without analysis is guesswork.

Answer

Modify the route tables to ensure direct communication

Answer

Restart both the application and database servers

Question 11

Which TWO AWS services can be used to monitor the performance of an SAP HANA database running on an EC2 instance? (Choose TWO.)

Accepted Answer

AWS Systems Manager. Amazon CloudWatch can monitor EC2 metrics like CPU and memory (with agent). AWS Systems Manager can run scripts to collect HANA-specific metrics. CloudTrail is for API auditing. Trusted Advisor is for best practices. Config tracks configuration. CloudWatch and Systems Manager are valid monitoring tools.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

Refer to the exhibit. An SAP administrator has attached the IAM policy above to an IAM role used by an EC2 instance for S3 backup operations. The backup process fails with 'Access Denied' when trying to upload a backup file. What is the most likely cause?

Accepted Answer

The policy does not include kms:GenerateDataKey and kms:Encrypt. The policy allows s3:PutObject but missing kms:GenerateDataKey and kms:Encrypt for server-side encryption. Without those, PutObject fails if the bucket uses KMS encryption. The s3:GetObject is not needed for upload. kms:Decrypt alone is insufficient.

Answer

The policy does not include s3:ListBucket permission

Answer

The policy allows kms:Decrypt on all resources, which is too permissive

Answer

The policy uses s3:PutObject but the bucket policy denies uploads

Question 13

Refer to the exhibit. An SAP administrator receives reports that an application server is slow. The administrator checks the CloudWatch alarm for high CPU but it shows 'OK' state. The get-metric-statistics output shows CPU utilization around 90-95%. What is the most likely reason the alarm is not triggering?

Accepted Answer

The alarm is configured to evaluate based on a longer period than the data shown. The alarm is in OK state despite high CPU, likely because the alarm threshold is set higher than 95% or the evaluation period is longer than the data points shown. The data shows high CPU for only 10 minutes; if the alarm requires sustained high CPU over a longer period, it may not have breached yet.

Answer

The alarm is disabled or the action is not configured

Answer

The alarm threshold is set to 95% and the average is exactly 95%

Answer

The alarm threshold is set to 90% and the evaluation period is 1 hour

Question 14

Refer to the exhibit. An SAP administrator uses the CloudFormation template snippet to create an application server. After deployment, the administrator cannot connect to the instance using AWS Systems Manager Session Manager. What is the most likely missing configuration?

Accepted Answer

The instance does not have an IAM instance profile with Systems Manager permissions. Session Manager requires the SSM Agent and an IAM role with proper permissions. The template installs the agent via UserData, but it does not attach an IAM instance profile. Without the profile, the instance cannot authenticate to Systems Manager. The security group allows HTTPS inbound, but that is for web traffic, not SSM. The instance type is fine.

Answer

The UserData script fails to install the SSM Agent

Answer

The security group does not allow outbound traffic to the Systems Manager endpoint

Answer

The instance type does not support Systems Manager

Question 15

A company is using AWS Systems Manager to automate patching of EC2 instances. The patch baseline includes both security and non-security updates. The Operations team notices that some instances are not patching within the scheduled maintenance window. What is the most likely cause?

Accepted Answer

The SSM Agent on the instances is outdated.. Option C is correct because Systems Manager Patch Manager requires the SSM Agent to be installed and updated. Option A is wrong because the patch baseline being in the wrong Region would affect all instances in that Region, not just some. Option B is wrong because instance profile is required for Systems Manager to manage instances. Option D is wrong because the maintenance window schedule being set to a different time zone would affect all instances uniformly.

Answer

The maintenance window schedule is set to a different time zone.

Answer

The instances do not have an IAM instance profile attached.

Answer

The patch baseline is configured in the wrong AWS Region.