PAS-C01 Operations and Maintenance Practice Test 13 — 15 Questions

Question 1

A company is running SAP on AWS and wants to send alerts when the CPU utilization of an EC2 instance exceeds 90% for 5 minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (Option D) are the correct AWS service for creating alarms based on metrics such as CPU utilization. They monitor CloudWatch metrics and perform actions (e.g., send notifications via SNS) when thresholds are breached. Option A (AWS Lambda) can be a target action for an alarm but is not the alarm service itself. Option B (AWS Config) evaluates resource configurations against rules, not metric thresholds. Option C (Amazon SNS) is a notification service that can be triggered by CloudWatch Alarms but does not create the alarm.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 2

An SAP system administrator needs to perform a backup of an SAP HANA database running on EC2. Which TWO AWS services can be used together to create consistent backups? (Choose TWO.)

Accepted Answer

Amazon EBS snapshots. (Amazon EBS snapshots) captures block-level data and can be made consistent for SAP HANA by using pre/post snapshot scripts. Option C (AWS Backup) can automate and orchestrate EBS snapshots, ensuring consistency and integration with HANA backup processes. Option A (Amazon S3) is an object storage service, not directly used for creating consistent database backups. Option D (AWS CloudFormation) is for infrastructure as code and does not create backups. Option E (AWS Storage Gateway) is for hybrid cloud storage, not for database backups.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Storage Gateway

Question 3

An SAP system on AWS is experiencing performance degradation. The operations team suspects a network bottleneck. Which THREE metrics should they analyze in CloudWatch to diagnose the issue? (Choose THREE.)

Accepted Answer

NetworkOut. (NetworkOut), Option B (NetworkPacketsIn), and Option D (NetworkIn) are standard EC2 network metrics that help diagnose network bottlenecks by showing traffic volume. Option C (CPUUtilization) is compute-related, not network-related. Option E (DiskReadOps) is storage-related, not network-related.

Answer

CPUUtilization

Answer

DiskReadOps

Question 4

Which TWO actions should be taken to ensure high availability for an SAP NetWeaver system on AWS? (Choose TWO.)

Accepted Answer

Assign Elastic IP addresses to the instances for failover. To ensure high availability for an SAP NetWeaver system on AWS, two key actions are: A) Assign Elastic IP addresses to the instances for failover, which allows rapid IP remapping to a standby instance in case of failure; and E) Use Amazon RDS Multi-AZ for the database, which provides automatic failover to a standby replica in a different Availability Zone. Option B (placing instances in a single AZ) reduces availability. Option C (using Spot Instances) risks interruption and is not suitable for production SAP systems. Option D (deploying ASCS in an Auto Scaling group) is not recommended because ASCS is stateful and cannot scale horizontally.

Answer

Place all EC2 instances in a single Availability Zone

Answer

Use Amazon EC2 Spot Instances for cost savings

Answer

Deploy the ASCS instance in an Auto Scaling group

Question 5

A company runs an SAP HANA database on AWS. The operations team wants to automate the monitoring of HANA alert logs and send notifications when critical alerts occur. Which AWS service should they use to collect and analyze the logs?

Accepted Answer

Amazon CloudWatch Logs with metric filters and alarms. Amazon CloudWatch Logs can ingest HANA alert logs via the CloudWatch agent and trigger alarms based on metric filters. CloudTrail records API activity, not application logs. S3 Event Notifications do not analyze log content. Lambda alone does not provide log collection.

Answer

AWS CloudTrail

Answer

Amazon S3 Event Notifications

Answer

AWS Lambda scheduled functions

Question 6

An SAP Basis administrator is troubleshooting a performance issue on an SAP application server running on an Amazon EC2 instance. The administrator notices high CPU utilization. Which AWS tool can provide detailed insights into the CPU usage at the process level without installing additional agents?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Inventory collects metadata about instances but not process-level CPU. EC2 Instance Connect is for shell access. CloudWatch metrics provide aggregate CPU, not per-process. Systems Manager Run Command can execute scripts to gather process data, but the question asks for a tool that provides the information directly without agents; however, Systems Manager with default agent can run commands to get process-level data, which is more direct than the others. CloudWatch does not provide process-level CPU without custom metrics.

Answer

AWS Systems Manager Inventory

Answer

Amazon CloudWatch CPU Utilization metric

Answer

Amazon EC2 Instance Connect

Question 7

An SAP system on AWS is configured with a multi-AZ deployment for high availability. During a failover test, the secondary instance does not take over as expected. The administrator checks the AWS Management Console and sees that the Elastic IP address is still attached to the primary instance. What is the most likely cause?

Accepted Answer

The Elastic IP is not reassigned during the failover process. In a typical HA setup, the Elastic IP should be reassigned to the secondary instance during failover. If it remains attached to the primary, the secondary cannot be reached. The root device is not relevant to IP assignment. Route tables are not per-instance. Security groups allow traffic but do not prevent failover.

Answer

The secondary instance's root volume is not attached

Answer

The security group of the secondary instance blocks incoming traffic

Answer

The route tables are not updated to point to the secondary instance

Question 8

A company runs SAP on AWS and needs to ensure that all changes to the SAP system's underlying infrastructure are recorded and auditable. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing. CloudWatch Logs is for log monitoring. Config tracks resource configuration changes. Trusted Advisor provides best-practice checks. CloudTrail is the primary service for API activity auditing.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 9

An SAP system on AWS is experiencing intermittent network connectivity issues between the application servers and the database server. Both are in the same VPC but different subnets. The security groups allow all traffic between them. What should the administrator check next?

Accepted Answer

Network ACL rules for the subnets. Network ACLs are stateless and must allow both inbound and outbound traffic. If NACLs block return traffic, connectivity fails intermittently. VPC Flow Logs can help diagnose but are not the first check. Route tables are typically correct within a VPC. The issue is likely at the NACL level.

Answer

VPC Flow Logs to analyze dropped packets

Answer

Route tables to ensure proper routing

Answer

Security group rules for outbound traffic

Question 10

An SAP administrator needs to apply an OS-level security patch to all EC2 instances in an SAP landscape. The administrator wants to automate this process and track compliance. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates OS patching and tracks compliance. Elastic Beanstalk is for application deployments. OpsWorks is for configuration management. CodeDeploy is for application code. Patch Manager is the correct service for OS patches.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 11

An SAP HANA database on AWS is configured with automatic backups to Amazon S3. The backup process is failing with the error 'Access Denied'. The administrator has confirmed the S3 bucket exists and the IAM role attached to the EC2 instance has the correct permissions. What could be the issue?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the IAM role. If the bucket policy denies access even if the IAM role allows, the explicit deny in the bucket policy overrides. The error indicates a permissions issue. The role might lack proper trust policy only if it can't assume, but the error suggests access denied to S3. The bucket policy is likely the cause. KMS key issues would give a different error. VPC endpoint issues would cause connectivity errors.

Answer

The IAM role's trust policy does not allow the EC2 service

Answer

The S3 bucket is encrypted with AWS KMS and the role lacks kms:Decrypt permissions

Answer

The VPC does not have an S3 VPC endpoint configured

Question 12

An SAP system running on AWS uses a shared file system via Amazon EFS. Recently, the file system has become slow. The administrator suspects that the burst credits are exhausted. What metric should the administrator check in Amazon CloudWatch to confirm this?

Accepted Answer

BurstCreditBalance. EFS has a BurstCreditBalance metric that tracks available burst credits. When exhausted, throughput drops. PercentIOLimit is not a valid metric. Throughput is the actual throughput, not credit balance. PermittedThroughput is not a metric.

Answer

PermittedThroughput

Answer

Throughput

Answer

PercentIOLimit

Question 13

Which TWO actions are required to set up automated failover for an SAP HANA database using AWS services? (Choose TWO.)

Accepted Answer

Create an AWS Lambda function to reassign an Elastic IP address to the standby instance. Automated failover requires detecting failure and reassigning resources. CloudWatch alarms can detect database unavailability and trigger a Lambda to reassign the Elastic IP to the standby instance. Stopping the primary is unnecessary and might not be desired. Multi-AZ RDS is for non-HANA databases. EFS is not typically used for HANA failover. Snapshot restore is too slow for automated failover.

Answer

Use an Amazon RDS Multi-AZ deployment for the HANA database

Answer

Schedule a snapshot and restore on failure

Answer

Store HANA data on Amazon EFS and mount it on both instances

Question 14

Which THREE steps should an administrator take to troubleshoot an issue where an SAP application server cannot connect to the database server after a security group change? (Choose THREE.)

Accepted Answer

Check the outbound rules of the application server's security group. The first step is to verify the security group rules. Then check network ACLs. VPC Flow Logs can confirm if traffic is allowed or denied. Checking the OS firewall is also important. Restarting instances and changing route tables are too disruptive and unlikely to be the root cause. Changing security groups again without analysis is guesswork.

Answer

Modify the route tables to ensure direct communication

Answer

Restart both the application and database servers

Question 15

Which TWO AWS services can be used to monitor the performance of an SAP HANA database running on an EC2 instance? (Choose TWO.)

Accepted Answer

AWS Systems Manager. Amazon CloudWatch can monitor EC2 metrics like CPU and memory (with agent). AWS Systems Manager can run scripts to collect HANA-specific metrics. CloudTrail is for API auditing. Trusted Advisor is for best practices. Config tracks configuration. CloudWatch and Systems Manager are valid monitoring tools.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config