PAS-C01 Operations and Maintenance Practice Test 13 — 15 Questions

Question 1

A SAP administrator wants to monitor the CPU utilization of an SAP application server running on an EC2 instance. Which AWS service should be used to set up an alarm when CPU utilization exceeds 90% for 5 minutes?

Accepted Answer

Amazon CloudWatch. Option B is correct because CloudWatch Alarms can trigger based on metrics like CPUUtilization. Option A is wrong because CloudTrail tracks API calls, not metrics. Option C is wrong because Config records resource configuration changes. Option D is wrong because Trusted Advisor provides best practice checks, not real-time monitoring.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 2

A company runs SAP HANA on an m5.24xlarge EC2 instance. The instance has an EBS-optimized attachment and a high-performance EBS volume for data. The database team reports that write latency to the data volume is consistently above 5 ms during peak hours. Which action would most effectively reduce write latency?

Accepted Answer

Provision the data volume as an io2 Block Express volume with higher IOPS.. Option D is correct because io2 Block Express volumes offer higher IOPS and lower latency for demanding workloads. Option A is wrong because enabling EBS optimization is already present on m5.24xlarge. Option B is wrong because gp3 is a general-purpose SSD with lower performance than io2. Option C is wrong because Elastic Fabric Adapter is for HPC, not EBS latency.

Answer

Use an Elastic Fabric Adapter (EFA) for storage traffic.

Answer

Change the data volume type to gp3.

Answer

Enable EBS optimization on the instance.

Question 3

An SAP system is deployed across multiple Availability Zones using an Application Load Balancer (ALB). The Operations team notices that during a failover test, the ALB is sending traffic to unhealthy instances. Which configuration change would ensure the ALB stops sending traffic to unhealthy targets?

Accepted Answer

Configure a health check with appropriate thresholds and interval.. Option C is correct because configuring health checks properly ensures the ALB marks instances as unhealthy and stops routing traffic. Option A is wrong because increasing deregistration delay only affects how long connections are drained, not health check behavior. Option B is wrong because cross-zone load balancing distributes traffic across AZs, not health. Option D is wrong because enabling sticky sessions does not affect health routing.

Answer

Enable sticky sessions (session affinity).

Answer

Increase the deregistration delay value.

Answer

Enable cross-zone load balancing.

Question 4

A company wants to automate the backup of SAP HANA databases running on EC2 instances. The backups must be stored in Amazon S3 for long-term retention. Which AWS service can be used to schedule and manage these backups?

Accepted Answer

AWS Backup. Option A is correct because AWS Backup can automate backups of EC2 instances and supports application-consistent backups for SAP HANA via pre- and post-scripts. Option B is wrong because Storage Gateway is for on-premises storage integration. Option C is wrong because S3 Lifecycle policies manage object transitions, not backups. Option D is wrong because DMS is for database migration, not backup.

Answer

AWS Storage Gateway

Answer

AWS Database Migration Service (DMS)

Answer

Amazon S3 Lifecycle policies

Question 5

An organization runs SAP ERP on a single EC2 instance with a separate RDS for Oracle database. The Operations team needs to patch the operating system of the EC2 instance without causing downtime for the SAP application. What is the most effective approach?

Accepted Answer

Use an Auto Scaling group with a launch template that references a patched AMI, and perform a rolling update.. Option D is correct because using an Auto Scaling group with a launch template that includes the updated AMI allows for rolling updates with minimal downtime. Option A is wrong because patching a running instance requires a reboot, causing downtime. Option B is wrong because Systems Manager Patch Manager also requires a reboot. Option C is wrong because Snapshots are for data backup, not OS patching.

Answer

Create an AMI of the instance, launch a new instance from the AMI, and patch it.

Answer

Apply patches using AWS Systems Manager Patch Manager during a maintenance window.

Answer

Use AWS Systems Manager to run a script that patches the OS without rebooting.

Question 6

A company uses Amazon CloudWatch Logs to store SAP application logs. The Security team requires that logs be encrypted at rest using a customer-managed KMS key (CMK). How can this be achieved?

Accepted Answer

Associate the KMS key with the CloudWatch Logs log group.. Option B is correct because CloudWatch Logs supports encryption with KMS CMK by associating the key with the log group. Option A is wrong because S3 default encryption does not apply to CloudWatch Logs. Option C is wrong because CloudWatch Logs does not support EBS encryption. Option D is wrong because enabling encryption on the log group not the stream is the correct action.

Answer

Enable default encryption on the S3 bucket where logs are exported.

Answer

Use an encrypted EBS volume for the EC2 instances generating the logs.

Answer

Enable encryption on the CloudWatch Logs log stream.

Question 7

A SAP administrator needs to grant an IAM user permission to start and stop EC2 instances that are part of an SAP environment. The administrator wants to follow the principle of least privilege. Which IAM policy action should be included?

Accepted Answer

ec2:StartInstances and ec2:StopInstances. Option C is correct because ec2:StartInstances and ec2:StopInstances are the specific actions needed. Option A is wrong because ec2:RebootInstances is not required. Option B is wrong because ec2:RunInstances launches new instances. Option D is wrong because ec2:TerminateInstances is more destructive than needed.

Answer

ec2:TerminateInstances

Answer

ec2:RunInstances

Answer

ec2:RebootInstances

Question 8

A company runs SAP on AWS and uses a Network Load Balancer (NLB) to distribute traffic to multiple EC2 instances. The Operations team needs to ensure that the NLB only sends traffic to instances that are healthy. Which health check configuration is appropriate for TCP traffic?

Accepted Answer

TCP health check on the application port. Option D is correct because for TCP traffic, a TCP health check is the most efficient and appropriate. Option A is wrong because HTTP health checks are for HTTP/HTTPS traffic. Option B is wrong because HTTPS is for encrypted web traffic. Option C is wrong because while ICMP can test reachability, NLB does not support ICMP health checks.

Answer

ICMP ping

Answer

HTTP health check on port 80

Answer

HTTPS health check on port 443

Question 9

Which TWO actions should be taken to securely manage database credentials for an SAP system running on Amazon RDS for Oracle? (Choose 2)

Accepted Answer

Use IAM database authentication to manage access without passwords.. Options A and D are correct. Option A: AWS Secrets Manager can automatically rotate credentials. Option D: IAM database authentication allows using IAM users and roles for access, avoiding hardcoded passwords. Option B is wrong because CloudHSM is for hardware security modules, not credential management. Option C is wrong because storing credentials in S3 is less secure. Option E is wrong because Systems Manager Parameter Store can store secrets, but it does not natively rotate RDS credentials.

Answer

Store the credentials as an S3 object with server-side encryption.

Answer

Use AWS Systems Manager Parameter Store with a secure string parameter.

Answer

Store the credentials in AWS CloudHSM.

Question 10

Which THREE AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose 3)

Accepted Answer

Amazon CloudWatch Logs. Options A, C, and E are correct. CloudWatch provides metrics like CPU and memory; SAP HANA built-in monitoring provides detailed database metrics; CloudWatch Logs can collect and analyze log files. Option B is wrong because CloudTrail tracks API calls, not performance. Option D is wrong because Config tracks resource configurations.

Answer

AWS Config

Answer

AWS CloudTrail

Question 11

Which TWO AWS services can be used to automate the deployment of SAP infrastructure using infrastructure as code? (Choose 2)

Accepted Answer

AWS CloudFormation. Options A and C are correct. AWS CloudFormation allows defining infrastructure in templates; AWS Elastic Beanstalk can deploy and manage applications but is less commonly used for SAP. Option B is wrong because OpsWorks is for Chef/Puppet, not typical for SAP. Option D is wrong because CodeDeploy deploys applications, not infrastructure. Option E is wrong because Service Catalog creates a catalog of products, not direct deployment.

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 12

An SAP workload running on AWS is experiencing intermittent performance issues. The operations team suspects that a recent change to a security group is causing traffic to be dropped. Which AWS service should the team use to analyze network traffic patterns and identify the source of the issue?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information and can be used to analyze network traffic patterns, helping to diagnose security group rule issues.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 13

A company runs its SAP HANA database on an EC2 instance with multiple EBS volumes striped using LVM. The operations team notices increased latency and wants to ensure consistent I/O performance. What is the MOST effective way to monitor the average queue length of the EBS volumes?

Accepted Answer

Monitor the `VolumeQueueLength` CloudWatch metric for each EBS volume.. CloudWatch provides the `VolumeQueueLength` metric for EBS volumes, which is the best indicator of I/O queue depth.

Answer

Enable detailed monitoring on the EC2 instance to get per-minute metrics.

Answer

Create a custom CloudWatch metric using the `QueueDepth` performance counter from the OS.

Answer

Use the `iostat` command on the EC2 instance to monitor device queue length.

Question 14

An SAP system administrator needs to automate the patching of Amazon RDS for SAP ASE databases. Which AWS service can be used to schedule and apply database patches automatically?

Accepted Answer

AWS Systems Manager Maintenance Windows. AWS Systems Manager Patch Manager can automate patching for managed instances, but for RDS, the maintenance window is used. However, Systems Manager Maintenance Windows can schedule tasks on EC2 instances, not RDS directly. The best answer here is to use AWS Systems Manager Maintenance Windows to run automation documents that trigger RDS patching via AWS CLI or SDK.

Answer

AWS OpsWorks

Answer

Amazon RDS maintenance window

Answer

AWS Systems Manager Patch Manager

Question 15

An SAP system is running on EC2 instances in an Auto Scaling group. The operations team needs to ensure that when a new instance is launched, it is automatically registered with the SAP Application Server's load balancer. Which approach should be used?

Accepted Answer

Use a lifecycle hook with a Lambda function that runs a script to register the instance with the SAP load balancer.. Lifecycle hooks allow the Auto Scaling group to pause instance launch and run custom actions (via Lambda) to register the instance with the load balancer before it becomes healthy.

Answer

Modify the AMI to include a startup script that registers the instance with the SAP load balancer.

Answer

Configure the Auto Scaling group to use an Elastic Load Balancer target group, and set health checks.

Answer

Use an AWS Lambda function triggered by a CloudWatch Events rule for EC2 instance state changes to register the instance.