PAS-C01 Operations and Maintenance Practice Test 15 — 15 Questions

Question 1

An SAP system administrator needs to automate the patching of Amazon RDS for SAP ASE databases. Which AWS service can be used to schedule and apply database patches automatically?

Accepted Answer

Amazon RDS maintenance window. Amazon RDS maintenance window is a built-in feature that allows you to schedule automatic patching for RDS databases, including SAP ASE. It is the appropriate mechanism for automating patching. Options A (AWS OpsWorks) is for configuration management. Option C (AWS Systems Manager Maintenance Windows) can orchestrate tasks but cannot directly apply RDS patches; RDS manages patching internally. Option D (AWS Systems Manager Patch Manager) is designed for EC2 instances, not RDS.

Answer

AWS OpsWorks

Answer

AWS Systems Manager Maintenance Windows

Answer

AWS Systems Manager Patch Manager

Question 2

An SAP system is running on EC2 instances in an Auto Scaling group. The operations team needs to ensure that when a new instance is launched, it is automatically registered with the SAP Application Server's load balancer. Which approach should be used?

Accepted Answer

Use a lifecycle hook with a Lambda function that runs a script to register the instance with the SAP load balancer.. Lifecycle hooks allow the Auto Scaling group to pause instance launch and run custom actions (via Lambda) to register the instance with the load balancer before it becomes healthy.

Answer

Modify the AMI to include a startup script that registers the instance with the SAP load balancer.

Answer

Configure the Auto Scaling group to use an Elastic Load Balancer target group, and set health checks.

Answer

Use an AWS Lambda function triggered by a CloudWatch Events rule for EC2 instance state changes to register the instance.

Question 3

An SAP Basis administrator needs to restart the SAP application server on an EC2 instance after applying kernel patches. What is the recommended way to perform the restart to minimize downtime?

Accepted Answer

Log in to the instance and restart the SAP system using SAP MMC or sapcontrol.. Using SAP MMC to restart the SAP system allows a controlled restart that avoids a full OS reboot, minimizing downtime.

Answer

Stop and start the EC2 instance from the AWS CLI.

Answer

Reboot the EC2 instance from the AWS Management Console.

Answer

Terminate the instance and launch a new one from the same AMI.

Question 4

An operations team is troubleshooting a performance issue in an SAP environment where the database server's memory usage is consistently high. The team suspects that the SAP buffer cache is not sized optimally. Which CloudWatch metric should be monitored to confirm this?

Accepted Answer

`FreeableMemory` for the RDS instance. The `DatabaseMemoryUsedPercent` metric for Amazon RDS provides the percentage of memory used by the database engine, including buffer cache. A consistently high value may indicate an oversized buffer cache relative to available memory, but the question asks for a metric to confirm. However, the correct metric for RDS memory is `FreeableMemory`. The buffer cache size can be inferred from `FreeableMemory`. Alternatively, for EC2-based SAP, the OS metrics are needed. Given the options, `FreeableMemory` is the best indicator.

Answer

`ReadIOPS` for the RDS instance

Answer

`DatabaseConnections` for the RDS instance

Answer

`SwapUsage` for the RDS instance

Question 5

An SAP administrator needs to grant an external auditor read-only access to view the configuration of all AWS resources in the account. Which IAM policy should be used?

Accepted Answer

ReadOnlyAccess. AWS managed policy `ReadOnlyAccess` grants read-only access to all AWS services and resources.

Answer

AdministratorAccess

Answer

PowerUserAccess

Answer

ViewOnlyAccess

Question 6

A company runs SAP HANA on AWS and wants to implement a backup strategy that ensures point-in-time recovery (PITR) with minimal data loss. Which TWO AWS services should be used?

Accepted Answer

AWS Backup. To implement point-in-time recovery (PITR) for SAP HANA on AWS with minimal data loss, you need both volume-level backups and automated management. Amazon EBS snapshots provide volume-level backups that can be used for PITR if taken frequently. AWS Backup centralizes and automates the scheduling and retention of these snapshots. Therefore, the correct combination is AWS Backup (option B) and Amazon EBS snapshots (option E). Note that Amazon S3 can store SAP HANA backups but does not directly provide PITR for volumes; AWS Storage Gateway is used for hybrid storage; and Amazon RDS is a managed database service, not applicable for SAP HANA. Thus, the correct answers are B and E.

Answer

Amazon S3

Answer

AWS Storage Gateway

Answer

Amazon RDS

Question 7

An SAP environment on AWS includes multiple EC2 instances running SAP application servers. The operations team needs to capture and analyze all API calls made to AWS services by these instances. Which THREE services should be used together?

Accepted Answer

Amazon Athena. AWS CloudTrail captures API calls, Amazon S3 stores the logs, and Amazon Athena allows querying the logs. Alternatively, CloudWatch Logs can be used, but Athena is more cost-effective for ad-hoc analysis. The three correct services are CloudTrail, S3, and Athena.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

An SAP system administrator needs to monitor the health of Amazon RDS for SAP ASE database instances. Which TWO CloudWatch metrics should be used to detect if the database is under memory pressure?

Accepted Answer

`FreeableMemory`. `FreeableMemory` shows available memory, and `SwapUsage` indicates memory pressure when swap is used.

Answer

`WriteIOPS`

Answer

`ReadIOPS`

Answer

`DatabaseConnections`

Question 9

Refer to the exhibit. An IAM policy is attached to a role used by an EC2 instance running SAP. The instance is unable to start or stop other EC2 instances. What is the most likely cause?

Accepted Answer

The policy resource ARN specifies a specific region (us-east-1), but the instances are in a different region.. The policy allows `ec2:StartInstances` and `ec2:StopInstances` on all resources (`"Resource": "*"`), so it should work. However, the condition is missing. The issue could be that the policy does not include the `ec2:DescribeInstanceStatus` action needed to check status before starting/stopping. But the question says it cannot start/stop; the policy seems correct. Actually, the most likely cause is that the role does not have permission to pass the instance profile (iam:PassRole) if the instance uses an instance profile, but that is not shown. Alternatively, the policy is missing `ec2:DescribeInstances` which is needed for the AWS CLI to list instances? But it is included. Let's think: The policy allows start/stop on all resources, so it should work. Possibly the issue is that the EC2 instance has an instance profile that the role cannot pass. But the question says the policy is attached to the role; the role is used by the instance. The policy looks correct. However, the exhibit might be missing the `ec2:DescribeInstanceStatus` action, but that is not required for start/stop. I'll choose option C: The policy does not include `ec2:DescribeInstances` for the specific instances? No, it's there. Actually, the correct answer is that the policy does not include `ec2:DescribeInstances` for the instances? It does. Hmm. Let's look at the options: A) The policy does not allow `ec2:StartInstances` on specific instance IDs. B) The policy does not include `ec2:DescribeInstances` for the instances. C) The policy does not include `ec2:RebootInstances`. D) The policy does not allow `s3:GetObject` on the backup bucket. None of these are correct. I need to adjust the exhibit to make the question work. Let me modify the exhibit to include a condition that restricts the resource to only certain instances. For example:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::sap-backup-bucket/*"
    }
  ]
}
```

Then the question: The instance is unable to start or stop instances in another region. Why? Because the resource ARN specifies us-east-1, but the instances are in eu-west-1. That is plausible. I'll use that.

Answer

The policy does not allow `ec2:RebootInstances` which is required to start instances.

Answer

The policy does not include `iam:PassRole` permission.

Answer

The policy does not include `ec2:DescribeInstances` for instances in other regions.

Question 10

Refer to the exhibit. An SAP administrator runs the AWS CLI command to retrieve the DatabaseConnections metric for an RDS for SAP ASE instance. The output shows a Sum statistic over 5-minute periods. What is the average number of connections per minute during this hour?

Accepted Answer

10. The Sum statistic over each 5-minute period is the total number of connections during that period. To get average per minute, divide each sum by 5. However, the question asks for the average number of connections per minute over the entire hour. The sum of all datapoints is 45+48+52+50+47+49+51+53+50+48+52 = 545. There are 11 datapoints, each covering 5 minutes, so total minutes = 11*5 = 55 minutes (but actually from 00:05 to 00:55 inclusive, that's 11 periods * 5 = 55 minutes). The total connections sum = 545. Average connections per minute = 545 / 55 ≈ 9.9. But the options are whole numbers: 10, 50, 52, 545. 10 is closest. Correct answer is 10.

Answer

545

Answer

50

Answer

52

Question 11

An SAP system on AWS experiences intermittent performance degradation during peak hours. CloudWatch metrics show high CPU utilization on the application server but normal on the database server. The application server is an m5.2xlarge instance. Which action should the operations team take FIRST to diagnose the issue?

Accepted Answer

Change the application server instance type to a compute-optimized instance like c5.4xlarge.. The application server is experiencing high CPU utilization; switching to a compute-optimized instance (like c5.4xlarge) helps determine if the performance issue is due to insufficient CPU resources. Option B is incorrect because the database server shows normal CPU, so increasing IOPS on its EBS volumes would not address the application server's CPU bottleneck. Option C is incorrect because the problem is not network-related; increasing network bandwidth would not alleviate CPU contention. Option D is incorrect because scaling out by adding more servers may help but is not the first diagnostic step; the first step should be to test a compute-optimized instance to isolate the CPU issue.

Answer

Increase the provisioned IOPS on the database server's EBS volumes.

Answer

Increase the network bandwidth of the application server.

Answer

Scale out the application tier by adding more application servers behind a load balancer.

Question 12

An SAP administrator runs the above CloudWatch Logs Insights query on an application log group. The query returns no results even though the administrator knows there are ERROR messages in the logs. What is the most likely cause?

Accepted Answer

The log events are not in plain text; they are in JSON format and the ERROR string is within a JSON field.. CloudWatch Logs Insights allows filtering log events using the @message field. When logs are in JSON format, the ERROR string may be embedded within a JSON field rather than appearing as plain text in @message. A simple pattern match like /ERROR/ on @message will not match if the @message contains the entire JSON object. To search JSON logs, parse the JSON fields and filter on the parsed fields. Option A is incorrect because CloudWatch Logs Insights supports regex patterns with the '/pattern/' syntax. Option B is incorrect because the correct filter syntax uses '/pattern/', not 'like' (which is not an operator in CloudWatch Logs Insights). Option C is incorrect because while the time range could exclude errors, the most likely cause given that errors are known to exist is the JSON structure. Therefore, Option D is the correct answer.

Answer

The query uses a regex pattern that is not supported by CloudWatch Logs Insights.

Answer

The query syntax is incorrect; the filter should use 'like' instead of '/.../'.

Answer

The time range is set to a period when no ERROR messages were logged.

Question 13

A company is running SAP on AWS and wants to automate the patching of SAP application servers. The servers are behind an Auto Scaling group. Which AWS service is BEST suited to apply OS patches without downtime?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is the best choice because it automates the patching of OS-level updates. Combined with Auto Scaling groups, you can perform rolling updates to avoid downtime. AWS Config (option A) is used for compliance and configuration auditing, not patching. AWS CloudFormation (option C) is an infrastructure-as-code service, not a patching solution. AWS OpsWorks (option D) supports Chef and Puppet automation but is less integrated and not the primary service for OS patching.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Question 14

An SAP system fails to send emails via SAPconnect using SMTP. The EC2 instance has a public IP and the security group allows outbound traffic on port 25. The SMTP server is an on-premises relay. What is the most likely reason for the failure?

Accepted Answer

AWS blocks outbound traffic on port 25 by default for EC2 instances.. The most likely reason is that AWS blocks outbound traffic on port 25 by default for EC2 instances to prevent spam. This restriction applies even if the security group allows outbound port 25 traffic. Option A is incorrect because the security group allows outbound traffic on port 25, but the default AWS block overrides it. Option C is incorrect because the instance has a public IP. Option D is incorrect because the route table is not the issue; the instance has a public IP and can reach the internet, but port 25 is blocked at the AWS level.

Answer

The security group does not allow outbound traffic on port 25.

Answer

The EC2 instance does not have a public IP address associated.

Answer

The route table does not have a default route to an internet gateway.

Question 15

An IAM policy is attached to an IAM role used by an SAP system to perform backups. The policy is shown above. The SAP system can successfully list EC2 instances but fails to start or stop them. What is the most likely cause?

Accepted Answer

The EC2 instances are in a different AWS account, and cross-account access is not configured.. The policy grants ec2:StartInstances and ec2:StopInstances on all resources (*), which would allow starting and stopping instances in the same account. However, if the EC2 instances are in a different AWS account, the IAM policy in the current account does not grant cross‑account access. Cross‑account access requires additional configuration such as a trust policy in the target account or resource‑based policies. Options A and B are unrelated, and option D is incorrect because the role does not need an instance profile for an SAP system that assumes the role directly.

Answer

The S3 bucket permissions are missing; the backup process requires S3 access first.

Answer

The policy does not include the ec2:DescribeInstanceStatus action.

Answer

The IAM policy is attached to the role, but the role is not associated with an instance profile.