PAS-C01 Operations and Maintenance Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. An SAP administrator has attached the IAM policy above to an IAM role used by an EC2 instance for S3 backup operations. The backup process fails with 'Access Denied' when trying to upload a backup file. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not include kms:GenerateDataKey and kms:Encrypt. The policy allows s3:PutObject but missing kms:GenerateDataKey and kms:Encrypt for server-side encryption. Without those, PutObject fails if the bucket uses KMS encryption. The s3:GetObject is not needed for upload. kms:Decrypt alone is insufficient.

Answer

The policy does not include s3:ListBucket permission

Answer

The policy allows kms:Decrypt on all resources, which is too permissive

Answer

The policy uses s3:PutObject but the bucket policy denies uploads

Question 2

Refer to the exhibit. An SAP administrator has attached the IAM policy above to an IAM role used by an EC2 instance for S3 backup operations. The backup process fails with 'Access Denied' when trying to upload a backup file. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alarm is configured to evaluate based on a longer period than the data shown. The alarm is in OK state despite high CPU, likely because the alarm threshold is set higher than 95% or the evaluation period is longer than the data points shown. The data shows high CPU for only 10 minutes; if the alarm requires sustained high CPU over a longer period, it may not have breached yet.

Answer

The alarm is disabled or the action is not configured

Answer

The alarm threshold is set to 95% and the average is exactly 95%

Answer

The alarm threshold is set to 90% and the evaluation period is 1 hour

Question 3

Refer to the exhibit. An SAP administrator has attached the IAM policy above to an IAM role used by an EC2 instance for S3 backup operations. The backup process fails with 'Access Denied' when trying to upload a backup file. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance does not have an IAM instance profile with Systems Manager permissions. Session Manager requires the SSM Agent and an IAM role with proper permissions. The template installs the agent via UserData, but it does not attach an IAM instance profile. Without the profile, the instance cannot authenticate to Systems Manager. The security group allows HTTPS inbound, but that is for web traffic, not SSM. The instance type is fine.

Answer

The UserData script fails to install the SSM Agent

Answer

The security group does not allow outbound traffic to the Systems Manager endpoint

Answer

The instance type does not support Systems Manager

Question 4

A SAP administrator wants to monitor the CPU utilization of an SAP application server running on an EC2 instance. Which AWS service should be used to set up an alarm when CPU utilization exceeds 90% for 5 minutes?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service for monitoring CPU utilization and setting alarms. CloudWatch collects metrics like CPUUtilization from EC2 instances, and you can create a CloudWatch Alarm that triggers when the metric exceeds a threshold (e.g., 90%) for a specified duration (e.g., 5 minutes). The other options are incorrect: AWS CloudTrail logs API calls for auditing, not metrics; AWS Trusted Advisor provides best practice recommendations; and AWS Config tracks resource configuration changes. Therefore, CloudWatch (Option C) is the correct choice.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 5

A company runs SAP HANA on an m5.24xlarge EC2 instance. The instance has an EBS-optimized attachment and a high-performance EBS volume for data. The database team reports that write latency to the data volume is consistently above 5 ms during peak hours. Which action would most effectively reduce write latency?

Accepted Answer

Provision the data volume as an io2 Block Express volume with higher IOPS.. Io2 Block Express volumes are designed for high-performance workloads requiring low latency and high IOPS, which directly addresses the write latency issue. Option B is incorrect because EFA is for HPC and does not affect EBS latency. Option C is incorrect because gp3 volumes have lower performance than io2 for high-write workloads. Option D is incorrect because the m5.24xlarge instance already supports EBS optimization, and enabling it would not reduce latency further.

Answer

Use an Elastic Fabric Adapter (EFA) for storage traffic.

Answer

Change the data volume type to gp3.

Answer

Enable EBS optimization on the instance.

Question 6

An SAP system is deployed across multiple Availability Zones using an Application Load Balancer (ALB). The Operations team notices that during a failover test, the ALB is sending traffic to unhealthy instances. Which configuration change would ensure the ALB stops sending traffic to unhealthy targets?

Accepted Answer

Configure a health check with appropriate thresholds and interval.. Configuring a health check with appropriate thresholds and interval ensures the ALB can accurately determine the health of targets and stop routing traffic to unhealthy instances. Option A is incorrect because sticky sessions (session affinity) do not affect health checking; they only maintain session persistence. Option C is incorrect because increasing the deregistration delay only extends the time for connection draining, not health detection. Option D is incorrect because cross-zone load balancing distributes traffic across Availability Zones but does not influence health checks or unhealthy target routing.

Answer

Enable sticky sessions (session affinity).

Answer

Increase the deregistration delay value.

Answer

Enable cross-zone load balancing.

Question 7

A company wants to automate the backup of SAP HANA databases running on EC2 instances. The backups must be stored in Amazon S3 for long-term retention. Which AWS service can be used to schedule and manage these backups?

Accepted Answer

AWS Backup. AWS Backup (Option C) is the correct service for automating backups of SAP HANA databases on EC2, supporting application-consistent backups via pre- and post-scripts and storing them in S3 for long-term retention. Option A (Storage Gateway) is for hybrid storage integration, not backup automation. Option B (DMS) is for database migration, not backup. Option D (S3 Lifecycle policies) manage object lifecycle, not scheduling backups.

Answer

AWS Storage Gateway

Answer

AWS Database Migration Service (DMS)

Answer

Amazon S3 Lifecycle policies

Question 8

An organization runs SAP ERP on a single EC2 instance with a separate RDS for Oracle database. The Operations team needs to patch the operating system of the EC2 instance without causing downtime for the SAP application. What is the most effective approach?

Accepted Answer

Create an AMI of the instance, launch a new instance from the AMI, and patch it.. It allows creating a patched copy of the instance without affecting the running SAP application. By creating an AMI of the running EC2 instance, you capture the current state. Launching a new instance from this AMI and patching it does not impact the original instance. Then you can redirect traffic to the new instance (e.g., by updating an Elastic IP or DNS) to complete the cutover with minimal downtime. This is a classic blue/green deployment pattern.

Option B is incorrect because a rolling update requires multiple instances in an Auto Scaling group to maintain availability. With a single instance, there is no instance to serve traffic during the update.

Option C is incorrect because AWS Systems Manager Patch Manager applies patches in-place, which typically requires a reboot, causing downtime for the SAP application.

Option D is incorrect because most operating system patches require a reboot to take effect; running a script without rebooting does not fully apply the patches, leaving the system vulnerable and potentially not in compliance.

Answer

Use an Auto Scaling group with a launch template that references a patched AMI, and perform a rolling update.

Answer

Apply patches using AWS Systems Manager Patch Manager during a maintenance window.

Answer

Use AWS Systems Manager to run a script that patches the OS without rebooting.

Question 9

A company uses Amazon CloudWatch Logs to store SAP application logs. The Security team requires that logs be encrypted at rest using a customer-managed KMS key (CMK). How can this be achieved?

Accepted Answer

Associate the KMS key with the CloudWatch Logs log group.. CloudWatch Logs supports encryption at rest using a customer-managed KMS key (CMK) by associating the key with the log group. This encrypts all log data stored in the log group. Option B is incorrect because S3 default encryption applies only to data stored in S3, not to CloudWatch Logs data that is not exported. Option C is incorrect because encrypting the EBS volume of EC2 instances does not encrypt the logs after they are sent to CloudWatch Logs. Option D is incorrect because encryption is configured at the log group level, not the log stream level.

Answer

Enable default encryption on the S3 bucket where logs are exported.

Answer

Use an encrypted EBS volume for the EC2 instances generating the logs.

Answer

Enable encryption on the CloudWatch Logs log stream.

Question 10

A company runs SAP on AWS and uses a Network Load Balancer (NLB) to distribute traffic to multiple EC2 instances. The Operations team needs to ensure that the NLB only sends traffic to instances that are healthy. Which health check configuration is appropriate for TCP traffic?

Accepted Answer

TCP health check on the application port. The correct health check for a Network Load Balancer (NLB) handling TCP traffic is a TCP health check on the application port (Option B). NLB supports TCP, HTTP, HTTPS, and TLS health checks, but for raw TCP traffic, a TCP health check directly verifies that the target port is open and responding, which is efficient and appropriate. Option A (ICMP ping) is incorrect because NLB does not support ICMP health checks. Options C and D (HTTP/HTTPS on ports 80/443) are unnecessary for TCP traffic and require the target to run an HTTP server, which may not be the case for all TCP applications.

Answer

ICMP ping

Answer

HTTP health check on port 80

Answer

HTTPS health check on port 443

Question 11

Which TWO actions should be taken to securely manage database credentials for an SAP system running on Amazon RDS for Oracle? (Choose 2)

Accepted Answer

Use IAM database authentication to manage access without passwords.. Options C and D are correct. IAM database authentication (C) allows you to use IAM users and roles to authenticate to your RDS database, eliminating the need for passwords. AWS Secrets Manager (D) securely stores and automatically rotates database credentials, which is a best practice for managing secrets. Option A is incorrect because storing credentials as an S3 object lacks native rotation and is less secure than dedicated secrets management services. Option B is incorrect: although Systems Manager Parameter Store can store secure strings, it does not natively rotate RDS credentials. Option E is incorrect because AWS CloudHSM is a hardware security module for key generation and encryption, not for storing and rotating passwords.

Answer

Store the credentials as an S3 object with server-side encryption.

Answer

Use AWS Systems Manager Parameter Store with a secure string parameter.

Answer

Store the credentials in AWS CloudHSM.

Question 12

Which THREE AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose 3)

Accepted Answer

Amazon CloudWatch Logs. Options B, C, and D are correct. Amazon CloudWatch can monitor EC2-level metrics like CPU, memory, and disk I/O, which are critical for SAP HANA performance. Amazon CloudWatch Logs can collect and analyze SAP HANA log files for deeper insights. SAP HANA built-in monitoring (e.g., SAP HANA Studio) provides detailed database performance metrics. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not performance. Option E (AWS CloudTrail) is incorrect because it tracks API calls, not performance.

Answer

AWS Config

Answer

AWS CloudTrail

Question 13

Which TWO AWS services can be used to automate the deployment of SAP infrastructure using infrastructure as code? (Choose 2)

Accepted Answer

AWS Service Catalog. AWS CloudFormation (Option B) allows you to define and provision SAP infrastructure using infrastructure as code templates. AWS Service Catalog (Option A) enables you to create, manage, and deploy pre-approved CloudFormation templates for SAP infrastructure, automating the deployment process. Options C (OpsWorks) is for configuration management with Chef/Puppet, not for infrastructure as code. Option D (CodeDeploy) handles application deployments, not infrastructure provisioning. Option E (Elastic Beanstalk) is a PaaS service for web applications, not used for automating SAP infrastructure deployment as infrastructure as code.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 14

An SAP workload running on AWS is experiencing intermittent performance issues. The operations team suspects that a recent change to a security group is causing traffic to be dropped. Which AWS service should the team use to analyze network traffic patterns and identify the source of the issue?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information and can be used to analyze network traffic patterns, helping to diagnose security group rule issues.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

A company runs its SAP HANA database on an EC2 instance with multiple EBS volumes striped using LVM. The operations team notices increased latency and wants to ensure consistent I/O performance. What is the MOST effective way to monitor the average queue length of the EBS volumes?

Accepted Answer

Monitor the `VolumeQueueLength` CloudWatch metric for each EBS volume.. CloudWatch provides the `VolumeQueueLength` metric for EBS volumes, which is the best indicator of I/O queue depth.

Answer

Enable detailed monitoring on the EC2 instance to get per-minute metrics.

Answer

Create a custom CloudWatch metric using the `QueueDepth` performance counter from the OS.

Answer

Use the `iostat` command on the EC2 instance to monitor device queue length.