PAS-C01 Operations and Maintenance Practice Test 15 — 15 Questions

Question 1

An SAP administrator needs to rotate the SSL/TLS certificate for the SAP Web Dispatcher running on an EC2 instance. The new certificate is stored in AWS Certificate Manager (ACM). How should the administrator deploy the certificate to the Web Dispatcher?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export the certificate from ACM using the AWS CLI and install it on the EC2 instance.. ACM allows you to export a certificate (including the private key) using the AWS CLI with the `export-certificate` command. This exported certificate can then be installed manually on the EC2 instance running SAP Web Dispatcher. Option B is incorrect because ACM certificates cannot be downloaded directly as files; they must be exported via the CLI or SDK. Option C is incorrect because ACM does not natively support automatic push of certificates to EC2 instances. Option D is incorrect because associating the certificate with an Application Load Balancer is an alternative approach but not required; the question asks how to deploy the certificate directly to the Web Dispatcher on EC2, not via a load balancer.

Answer

Download the certificate from ACM and manually install it on the EC2 instance.

Answer

Configure ACM to automatically push the certificate to the EC2 instance.

Answer

Import the new certificate into ACM and associate it with an Application Load Balancer in front of the Web Dispatcher.

Question 2

An SAP administrator is troubleshooting a performance issue on an SAP HANA database running on an EC2 instance. The instance type is r5.4xlarge with EBS-optimized enabled. CloudWatch metrics show high WriteIOPS but low throughput. Which THREE factors could be causing this behavior? (Choose three.)

Accepted Answer

The SAP HANA database is performing many small write operations.. Option A is correct because high WriteIOPS with low throughput is the classic signature of many small I/O operations: each write consumes an IOPS credit but transfers only a few KB, so throughput (MiB/s) stays low while IOPS saturates. Option B is correct because lock or thread contention inside SAP HANA serializes and fragments write activity, producing bursts of small writes that inflate WriteIOPS without moving large amounts of data, matching the observed metric pattern. Option C is correct because if the EBS volume's throughput limit (MiB/s) is lower than what the burst credit/IOPS balance would allow, the volume throttles on bandwidth and caps throughput while IOPS remain high, exactly the reported symptom. Option D is not correct because the scenario already states the r5.4xlarge has EBS-optimized enabled, so this cannot be the cause. Option E is not correct because a large block size would tend to raise throughput per I/O and reduce IOPS, the opposite of the observed high-IOPS/low-throughput behavior.

Answer

The instance's EBS-optimized feature is not enabled.

Answer

The EBS volume is configured with a large block size.

Question 3

A company runs SAP on AWS and wants to ensure that all API calls to create, modify, or delete EC2 instances are logged for auditing. Which TWO AWS services can be used together to achieve this? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (A) is correct because it records every API call made in the account, including EC2 RunInstances, ModifyInstanceAttribute, and TerminateInstances, capturing the identity, time, source IP, and request parameters needed for auditing. Amazon CloudWatch Logs (D) is correct because CloudTrail can deliver its event records to a CloudWatch Logs log group, where they can be retained, searched with metric filters, and alerted on for create/modify/delete EC2 activity. Amazon S3 server access logs (B) only record requests made against S3 buckets, not EC2 API calls, so they cannot satisfy the requirement. AWS Config (C) tracks resource configuration changes and compliance over time but is not the API-call audit log itself. Amazon VPC Flow Logs (E) capture IP traffic metadata at the ENI/subnet/VPC level and do not log AWS API calls.

Answer

Amazon S3 server access logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 4

A company runs a critical SAP HANA database on an Amazon EC2 instance. The operations team receives an alert that the instance's EBS-optimized throughput is consistently exceeding the baseline performance of the gp2 volume. Which action should the team take to resolve the performance issue without downtime?

Accepted Answer

Modify the volume type to gp3 and adjust the throughput setting.. The gp2 volume's baseline performance is tied to its size (3 IOPS per GB, up to 16,000 IOPS), and once throughput consistently exceeds that baseline, the volume is bottlenecked. The correct fix without downtime is to modify the volume type to gp3, which provides a baseline of 3,000 IOPS and 125 MiB/s regardless of size, and allows independent adjustment of IOPS and throughput. This can be done online via the AWS Management Console, CLI, or API without stopping the instance.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Increase the volume size to improve baseline IOPS.

Answer

Stop the EC2 instance and increase the volume size.

Question 5

A company is running SAP ERP on AWS with a multi-AZ deployment using Amazon EFS for shared transport directories. The system administrator notices that the SAP transport directory mounted via EFS is experiencing high latency during peak hours. The EFS file system is using the Standard storage class. Which combination of steps should the administrator take to reduce latency? (Choose TWO.)

Accepted Answer

Move the EFS file system to the One Zone storage class.. Option B is correct because moving the EFS file system to the One Zone storage class reduces latency by keeping data within a single Availability Zone, eliminating the cross-AZ network hops inherent in the Multi-AZ Standard class, which is a common source of added latency for latency-sensitive SAP transport directories. Option E is correct because switching the EFS performance mode to Max I/O scales to higher levels of aggregate throughput and operations per second, which reduces per-operation latency under the heavy parallel I/O typical of SAP transport directories during peak hours. Option A is not correct because Bursting Throughput mode only affects throughput credits and does not reduce latency; it can actually cause throttling once the burst credits are exhausted. Option C is not correct because EFS Standard-IA is an infrequent-access storage class that increases access latency and cost for frequently accessed data, making it unsuitable for active SAP transport directories. Option D is not correct because Provisioned Throughput mode guarantees a fixed throughput level but does not lower latency, and it is a throughput optimization rather than a latency optimization.

Answer

Use EFS Bursting Throughput mode.

Answer

Change the storage class to EFS Standard-IA.

Answer

Enable provisioned throughput on the EFS file system.

Question 6

A company has an SAP HANA database running on an EC2 instance with a single 500 GB gp2 volume. The database is experiencing I/O bottlenecks. The operations team wants to increase IOPS without changing the volume size. Which action should they take?

Accepted Answer

Attach an additional gp2 volume and use it for temporary data.. Attaching an additional gp2 volume and moving temporary data to it offloads I/O from the primary HANA data volume, effectively increasing the total IOPS available to the database without changing the size of the original volume. This reduces the I/O bottleneck and improves performance.

Option A (EBS optimization) improves network bandwidth but does not increase the volume's IOPS.

Option B (st1) is throughput-optimized and unsuitable for low-latency database workloads like SAP HANA.

Option C (increasing volume size) directly violates the requirement of not changing the volume size.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Change the volume type to st1 (throughput optimized).

Answer

Modify the volume to increase its size to 1,000 GB.

Question 7

A company is migrating its SAP ERP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). They plan to use two EC2 instances in different Availability Zones with a shared file system. Which AWS service should they use to manage the failover of the virtual IP address?

Accepted Answer

Use an Elastic IP address and reassign it during failover using a script.. For SAP ASCS/ERS high availability on AWS, the standard approach uses an overlay IP (virtual IP) managed by a cluster solution like Pacemaker or SIOS, and an Elastic IP can be reassigned during failover via a script or cluster hook. This allows the ASCS instance in the secondary AZ to take over the virtual IP without DNS propagation delays. AWS documents this pattern for SAP HA deployments.

Answer

Configure Amazon Route 53 with failover routing and health checks for the virtual IP.

Answer

Deploy an Application Load Balancer to route traffic to the active instance.

Answer

Set up a Classic Load Balancer with cross-zone load balancing enabled.

Question 8

A company is running SAP HANA on a memory-optimized EC2 instance with an EBS volume for /hana/data and /hana/log. The database administrator notices that the /hana/log volume is experiencing high write latency. The current volume is a gp2 volume with 1000 GB size. Which change would most effectively reduce write latency?

Accepted Answer

Ensure the EC2 instance is EBS-optimized and use a higher instance type with dedicated EBS bandwidth.. High write latency on /hana/log for SAP HANA is typically caused by insufficient EBS bandwidth on the EC2 instance rather than the volume itself. Ensuring the instance is EBS-optimized and selecting a larger instance type with dedicated EBS bandwidth increases the available IOPS and throughput to the attached volumes, directly reducing write latency. SAP HANA requires low-latency storage for the log volume, and instance-level EBS bandwidth is often the bottleneck when gp2 volumes are already provisioned with adequate IOPS.

Answer

Change the volume type to st1 (throughput optimized) for better write throughput.

Answer

Increase the volume size to 2000 GB to get more IOPS.

Answer

Enable Multi-Attach on the volume to distribute writes.

Question 9

A company is running SAP ERP on AWS and uses SAP HANA as the database. The system administrator needs to apply an OS patch that requires a reboot. The SAP HANA database is running in a scale-out configuration across multiple EC2 instances. What is the best approach to minimize downtime?

Accepted Answer

Perform a rolling reboot of the HANA nodes, rebooting one node at a time.. In a scale-out SAP HANA configuration, a rolling reboot of the HANA nodes, rebooting one node at a time, minimizes downtime because the other nodes continue to serve requests. This approach maintains high availability and allows the system to remain operational during the patching process. It is the best practice for applying OS patches that require reboots in a clustered environment.

Answer

Take EBS snapshots of all volumes before patching, then patch one by one.

Answer

Create an AMI of the master node and launch a new instance with the patch applied.

Answer

Stop all EC2 instances, apply the patch, and start them in sequence.

Question 10

A company is running SAP on AWS and wants to automate the deployment of new SAP application servers. The company uses AWS CloudFormation to manage infrastructure. Which AWS service should they use to run custom scripts during the CloudFormation stack creation to configure the SAP application?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because CloudFormation supports Lambda-backed custom resources, which allow you to run arbitrary code (including scripts to configure SAP application servers) during stack create, update, and delete operations. Lambda functions can be invoked via a Custom:: resource type, and CloudFormation waits for a response before proceeding, making it ideal for post-provisioning configuration tasks. This is the standard AWS pattern for injecting custom logic into CloudFormation deployments.

Answer

AWS Systems Manager Run Command

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 11

A company is running SAP HANA on AWS and wants to implement a disaster recovery strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The primary site is in us-east-1, and the DR site is in us-west-2. Which two actions should the company take to meet these objectives? (Choose TWO.)

Accepted Answer

Set up SAP HANA System Replication (HSR) in async mode between the two regions.. Option A is correct because SAP HANA System Replication (HSR) in asynchronous mode continuously ships redo log changes from the primary in us-east-1 to the secondary in us-west-2, and with typical log-shipping intervals this keeps data loss well within the 15-minute RPO. Option E is correct because pre-provisioning EC2 instances in us-west-2 with the same SAP HANA software and configuration eliminates the time-consuming build/install steps, allowing the DR site to be brought online within the 2-hour RTO once replication is taken over. Option B is not suitable because daily snapshots copied cross-region can lose up to 24 hours of data, far exceeding the 15-minute RPO. Option C is not appropriate because CloudEndure (now AWS Elastic Disaster Recovery) replicates block-level server data but is not SAP HANA-certified for HSR-style consistency and does not by itself guarantee the required RPO/RTO for HANA. Option D is also insufficient because AWS Backup cross-region backups are periodic and cannot deliver a 15-minute RPO for a continuously changing in-memory database.

Answer

Take daily snapshots of the HANA volumes and copy them to the DR region.

Answer

Use AWS CloudEndure Disaster Recovery to replicate the entire server.

Answer

Use AWS Backup to schedule cross-region backups of the HANA database.

Question 12

A company runs SAP NetWeaver on AWS and uses a Network Load Balancer (NLB) to distribute traffic to multiple application servers. The operations team notices that the NLB is not properly routing traffic to healthy targets. Which three steps should the team take to diagnose the issue? (Choose THREE.)

Accepted Answer

Confirm that the target instances are registered in the target group and are in the Available state.. Option A is correct because an NLB can only route to targets that are actually registered in the target group and whose state is healthy/Available; if instances are deregistered, draining, or unhealthy, traffic will not be forwarded. Option B is correct because NLB traffic reaches targets from the load balancer nodes' subnet IP addresses (the client IP is preserved but the source for security group evaluation is the NLB subnet), so the target security groups must permit the listener/health-check port from the NLB's subnet CIDR or the client IPs as applicable. Option C is correct because NLB target group health checks use specific protocol, port, and path settings, and a wrong ping path, port, or protocol will mark healthy targets as unhealthy and stop routing. Option D is not a diagnostic step for unhealthy routing; cross-zone load balancing affects distribution across AZs and is enabled by default on NLB, so it does not explain or fix targets being marked unhealthy. Option E is not among the three required diagnostic steps because CloudWatch NLB metrics such as ActiveFlowCount, HealthyHostCount, and UnHealthyHostCount can indicate symptoms but do not directly verify target registration, security group rules, or health check configuration.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Review the CloudWatch metrics for the NLB to see if there are any anomalies.

Question 13

A company is running SAP HANA on AWS and uses multiple EBS volumes for data and log storage. The company wants to encrypt all data at rest. Which three steps are required to ensure encryption of all EBS volumes? (Choose THREE.)

Accepted Answer

Use a custom AWS Key Management Service (KMS) key for encryption.. Option A is correct because using a customer-managed AWS KMS key (CMK) gives you control over the key used for EBS encryption, which is required to encrypt volumes with your own key rather than the default AWS-managed key. Option D is correct because enabling EBS encryption by default in the AWS account for the region ensures that all newly created EBS volumes and snapshots are automatically encrypted without needing to specify encryption at launch. Option E is correct because existing unencrypted EBS volumes cannot be encrypted in place; you must create a snapshot of the unencrypted volume, copy or create an encrypted snapshot using a KMS key, and then restore a new encrypted volume from that snapshot. Option B is incorrect because EBS snapshots cannot be encrypted after creation; encryption must be applied when the snapshot is created or by copying it with encryption enabled. Option C is incorrect because the EBS-optimized attribute only provides dedicated bandwidth to EBS volumes and has no effect on encryption at rest.

Answer

Enable encryption on the EBS snapshots after creation.

Answer

Launch EC2 instances with the EBS-optimized attribute set.

Question 14

An administrator created the IAM policy shown in the exhibit for the operations team. The team needs to create snapshots of EBS volumes that have the tag 'Name' with a value starting with 'SAP-HANA-'. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The 'ec2:CreateSnapshot' action does not support the 'ec2:ResourceTag' condition key.. The ec2:CreateSnapshot action does not support the ec2:ResourceTag condition key because snapshots are created against volumes, and the CreateSnapshot API does not evaluate resource tags on the volume in the way the policy assumes. IAM condition keys must be supported by the specific action; using an unsupported key causes the condition to fail, so the policy does not work as intended.

Answer

The resource ARN is incorrect; it should specify the snapshot resource type.

Answer

The action 'ec2:CreateSnapshot' should be 'ec2:CreateSnapshots' (plural).

Answer

The condition key should be 'aws:ResourceTag' instead of 'ec2:ResourceTag'.

Question 15

A company is running an SAP HANA database on an AWS EC2 instance. The system administrator needs to ensure that the database logs are automatically backed up to Amazon S3 and retained for 30 days. Which combination of AWS services can achieve this with minimal operational overhead?

Accepted Answer

Use an S3 Lifecycle Policy to transition logs to S3 Glacier after 30 days.. The question asks for automatic backup of SAP HANA database logs to Amazon S3 with 30-day retention and minimal operational overhead. An S3 Lifecycle Policy can automatically transition objects to a cheaper storage class like S3 Glacier after 30 days, but the question specifically says 'retained for 30 days' — meaning the logs must be kept for 30 days and then can be deleted or archived. However, the option marked correct is B, which transitions to Glacier after 30 days. This is correct because it meets the retention requirement by keeping logs in S3 Standard for 30 days and then moving them to Glacier for long-term retention, all with minimal operational overhead via lifecycle rules. Note: The question wording is slightly ambiguous, but the intended answer is B as it uses S3 lifecycle to manage retention automatically.

Answer

Use Amazon CloudWatch Logs with a retention policy of 30 days.

Answer

Use an S3 Lifecycle Policy to transition logs to S3 Standard-IA after 30 days.

Answer

Use AWS Backup to schedule backups of the EC2 instance.