PAS-C01 Operations and Maintenance Practice Test 17 — 15 Questions

Question 1

An SAP system is experiencing high CPU utilization on the application server. The administrator wants to automatically scale the EC2 instance based on CPU usage. Which AWS service should be used?

Accepted Answer

AWS Auto Scaling. Auto Scaling with scaling policies based on CloudWatch alarms can automatically adjust the number of instances. Option B is correct. Option A is wrong because Elastic Load Balancing distributes traffic, not scaling. Option C is wrong because Lambda can be used but is not the primary service for EC2 scaling. Option D is wrong because CloudWatch monitors but does not scale.

Answer

Elastic Load Balancing

Answer

AWS Lambda

Answer

Amazon CloudWatch

Question 2

A company wants to automate the backup of SAP HANA databases running on AWS. Which combination of AWS services is suitable for this task?

Accepted Answer

AWS Backup and the SAP HANA Backint agent. AWS Backup integrates with the SAP HANA Backint agent to automate HANA-specific backups, ensuring consistency and managing backup lifecycle. Option B is wrong because EBS snapshots alone cannot guarantee HANA database consistency. Option C is wrong because S3 and Glacier are storage services, not automation or backup orchestration. Option D is wrong because CloudWatch Events and Lambda can trigger actions but do not provide native HANA backup functionality.

Answer

Amazon EBS snapshots and AWS Lambda

Answer

Amazon S3 and Amazon Glacier

Answer

Amazon CloudWatch Events and AWS Lambda

Question 3

An SAP system running on AWS is experiencing intermittent connectivity issues between the application server and the database server. Both servers are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. Which AWS service can help diagnose the network path and identify packet loss?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic within the VPC, including accepted and rejected connections. By analyzing flow logs, you can identify packet loss, rejected requests, or other connectivity issues between subnets. Option A (AWS Direct Connect) is for dedicated on-premises connectivity, not for internal VPC traffic. Option C (AWS CloudTrail) records API calls, not network traffic. Option D (AWS Site-to-Site VPN) is for connecting remote networks, not for analyzing internal VPC paths.

Answer

AWS Direct Connect

Answer

AWS CloudTrail

Answer

AWS Site-to-Site VPN

Question 4

A company is running SAP on AWS and wants to ensure that the system meets the SLA for availability. The operations team needs to monitor the health of the SAP application stack (ASCS, PAS, DB). Which AWS service can provide a centralized dashboard to visualize the health and performance metrics?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards can aggregate metrics from multiple sources, including custom SAP metrics, into a single centralized view, making it ideal for monitoring SAP application stack health and performance. Option A is correct. Option B (AWS CloudTrail) records API calls for auditing, not real-time health monitoring. Option C (AWS Config) evaluates resource configurations for compliance, not performance. Option D (Amazon S3) is object storage, not a monitoring dashboard.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon S3

Question 5

Which TWO actions are recommended to ensure high availability for SAP NetWeaver on AWS? (Choose 2).

Accepted Answer

Use an Application Load Balancer with health checks to distribute traffic.. To ensure high availability for SAP NetWeaver on AWS, it is recommended to use an Application Load Balancer (ALB) with health checks to distribute traffic (Option A). The ALB automatically reroutes traffic away from unhealthy instances, improving fault tolerance. Additionally, deploying SAP application instances in different Availability Zones (Option D) provides redundancy if an entire AZ fails, which is a core HA practice. Option B is incorrect because a single Availability Zone introduces a single point of failure. Option C is incorrect: EBS snapshots provide data durability and backup, not high availability; they do not maintain service continuity. Option E is incorrect because t2 instances are burstable and not suitable for production SAP workloads due to performance limitations and lack of EBS-optimized support.

Answer

Use a single Availability Zone to reduce latency.

Answer

Take frequent EBS snapshots to ensure data durability.

Answer

Use t2 instance types to reduce cost.

Question 6

Which THREE steps should be taken to monitor the performance of an SAP HANA database on AWS? (Choose 3).

Accepted Answer

Install the CloudWatch agent on the EC2 instance to collect memory and disk metrics.. The correct steps to monitor SAP HANA performance on AWS include: A) installing the CloudWatch agent on the EC2 instance to collect OS-level memory and disk metrics; D) monitoring EBS volume queue length and IOPS using CloudWatch to detect storage bottlenecks; and E) configuring CloudWatch alarms for SAP HANA-specific metrics such as CPU and memory usage to get alerts on performance issues. Option B is incorrect because AWS Direct Connect is a network connectivity service, not a monitoring tool. Option C is incorrect because AWS CloudTrail tracks API calls for auditing, not performance metrics.

Answer

Set up AWS Direct Connect to monitor network latency.

Answer

Enable AWS CloudTrail to track all API calls to the HANA database.

Question 7

Which THREE AWS services can be used to automate the patching of SAP application servers on EC2? (Choose 3).

Accepted Answer

AWS OpsWorks. AWS OpsWorks is correct because it provides a configuration management service that uses Chef or Puppet to automate the patching and lifecycle management of SAP application servers on EC2. You can define custom recipes or manifests to apply OS and application patches consistently across your SAP infrastructure, ensuring compliance and reducing manual effort.

Answer

AWS Auto Scaling

Answer

AWS CloudFormation

Question 8

An SAP administrator created the IAM policy shown for a backup script. The script fails when trying to upload a backup to S3. What is the likely cause?

Accepted Answer

The KMS key ARN is malformed; it contains extra characters.. The KMS key ARN in the IAM policy is malformed (contains extra characters). When the backup script attempts to upload to S3 with server-side encryption using KMS (SSE-KMS), S3 needs to decrypt the object using the KMS key. If the key ARN is invalid, the kms:Decrypt permission cannot be evaluated, causing the upload to fail. Option A is incorrect because for PutObject, the resource must be the object ARN (arn:aws:s3:::sap-backup-bucket/*), not the bucket itself. Option B is incorrect because ec2:Describe* actions do not interfere with S3 operations. Option C is incorrect because the s3:* action, while broad, is permitted on the specified objects, and there is no indication of a restrictive bucket policy.

Answer

The resource for S3 should include the bucket itself (arn:aws:s3:::sap-backup-bucket).

Answer

The ec2:Describe* action is not required and causes a conflict.

Answer

The s3:* action is too broad and is denied by an S3 bucket policy.

Question 9

A company is deploying SAP S/4HANA on AWS and needs to ensure high availability for the central services (ASCS and ERS). The architecture uses two EC2 instances in different Availability Zones with a shared file system using Amazon EFS for /sapmnt. The SAP system is configured with an enqueue replication server. The operations team needs to automate the failover of the ASCS instance in case of a failure. The team is considering using AWS services for this purpose. Which approach should the team use?

Accepted Answer

Use Amazon Route 53 with health checks and a custom script to update DNS record on failover.. Route 53 health checks can monitor the ASCS instance and a custom script can update DNS records to point to the standby instance on failure, enabling failover across Availability Zones. Option B is incorrect because an Application Load Balancer cannot properly direct traffic to a single active ASCS instance and does not handle the stateful nature of SAP enqueue replication. Option C is incorrect because Auto Scaling is designed for scaling out, not for failover of stateful services like ASCS. Option D is incorrect because EC2 Auto Recovery only recovers the same instance on new hardware if it fails, but it does not failover to a different Availability Zone, which is required for high availability.

Answer

Use an Application Load Balancer with a target group containing both ASCS instances.

Answer

Use an Auto Scaling group with a minimum of 2 instances and a lifecycle hook to handle failover.

Answer

Enable EC2 Auto Recovery to automatically recover the ASCS instance on new hardware.

Question 10

A company runs a production SAP HANA database on AWS using an EC2 instance with EBS volumes. The database is experiencing high latency during peak hours. The operations team needs to identify the root cause. Which steps should the team take to diagnose the issue?

Accepted Answer

Monitor the EBS volume queue length and latency using Amazon CloudWatch metrics.. Amazon CloudWatch provides metrics such as EBS volume queue length (depth) and average latency, which are key indicators of I/O bottlenecks. High queue depth with corresponding latency spikes suggests that the EBS volume is overwhelmed and needs adjustment (e.g., switching to Provisioned IOPS). Option A is incorrect because migrating to Provisioned IOPS without diagnosing the root cause may not solve the issue and increases cost unnecessarily. Option C is incorrect because moving SAP HANA to Amazon RDS for SAP is not a direct solution for latency and introduces migration complexity. Option D is incorrect because increasing instance size without analyzing I/O patterns may not address the bottleneck and can also increase costs.

Answer

Migrate the EBS volumes to Provisioned IOPS SSD (io1) immediately.

Answer

Move the SAP HANA database to Amazon RDS for SAP.

Answer

Increase the instance size to improve performance.

Question 11

An SAP system on AWS is configured with a Multi-AZ deployment for high availability. During a failover test, the operations team notices that the secondary instance does not take over correctly. What is the most likely cause?

Accepted Answer

The route tables or security groups do not allow traffic to the secondary instance.. After a failover, the secondary instance becomes the active one, and if route tables or security groups do not permit traffic to it, clients cannot connect, causing the failover to appear ineffective. Option A is incorrect because the SAP application layer retry connections may affect user experience but not the failover mechanism itself. Option B is incorrect because CloudWatch alarms are monitoring thresholds and do not directly control failover behavior. Option D is incorrect because in a properly configured Multi-AZ setup, IP address changes are handled automatically (e.g., via Elastic IP or DNS updates), so this is less likely to be the root cause.

Answer

The SAP application layer is not configured to retry connections.

Answer

The CloudWatch alarm thresholds for failover are set too high.

Answer

The secondary instance's IP address is not automatically updated in DNS.

Question 12

A company has an SAP S/4HANA system running on AWS with a custom backup solution that uses AWS Backup. The backup policy includes daily backups with a retention of 30 days. The operations team notices that backup jobs for the SAP application server are failing intermittently. What should the team do to troubleshoot the issue?

Accepted Answer

Review the CloudWatch Logs for the backup job to identify error messages.. Amazon CloudWatch Logs capture detailed error messages from AWS Backup jobs, allowing the team to identify the root cause of intermittent failures. Option A is incorrect because while IAM permissions are necessary, intermittent failures are more likely due to transient issues detectable in logs. Option C is incorrect because switching to SAP HANA Studio does not leverage AWS Backup's integration and may not resolve underlying issues. Option D is incorrect because increasing backup frequency does not address the cause of failures and may increase load.

Answer

Verify that the IAM role used by AWS Backup has sufficient permissions.

Answer

Switch to using SAP HANA Studio for backups.

Answer

Increase the backup frequency to capture more recovery points.

Question 13

A company runs its SAP landscape on AWS and uses an Application Load Balancer (ALB) to distribute traffic to multiple web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the most likely cause?

Accepted Answer

The target group health checks are failing, causing the ALB to mark instances as unhealthy.. 503 errors from an ALB typically indicate that the target instances are unhealthy or the ALB cannot route traffic to them, often due to failed health checks. Option A is wrong because security groups blocking traffic would cause 504 or timeout errors, not 503. Option B is wrong because an expired SSL certificate on the ALB would cause 502 errors (bad gateway), not 503. Option C is wrong because CloudFront is not in the path; the question describes an ALB distributing traffic directly to web dispatchers, so CloudFront misconfiguration is irrelevant.

Answer

The security groups for the ALB are blocking incoming traffic.

Answer

The SSL certificate on the ALB has expired.

Answer

The CloudFront distribution in front of the ALB is misconfigured.

Question 14

An SAP system administrator needs to monitor the CPU and memory utilization of SAP EC2 instances. Which TWO AWS services can be used to collect and visualize these metrics? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. The correct answers are B (Amazon CloudWatch) and D (Amazon Managed Service for Prometheus). Amazon CloudWatch can collect CPU and memory metrics from EC2 instances using the CloudWatch agent, and Amazon Managed Service for Prometheus can scrape and store metrics from those instances. Option A is incorrect because AWS Trusted Advisor provides best-practice checks, not granular metrics. Option C is incorrect because AWS CloudTrail records API activity. Option E is incorrect because AWS Config tracks configuration changes.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

An operations team is planning a disaster recovery (DR) strategy for an SAP system on AWS. The system includes SAP HANA database and application servers. The DR site must have a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which THREE components are essential for this DR strategy? (Choose THREE.)

Accepted Answer

AWS CloudFormation templates to provision the DR infrastructure. Correct answers are A, C, and E. CloudFormation templates (A) automate infrastructure provisioning, helping meet the 2-hour RTO. S3 Cross-Region Replication for SAP backup files (C) ensures backups are available in the DR region, supporting RPO. Cross-Region replication of EBS snapshots for SAP HANA data volumes (E) enables frequent snapshots (e.g., every 15 minutes) to meet the RPO. B is wrong because Multi-AZ is for high availability within a region, not cross-region DR. D is wrong because Route 53 health checks and failover routing are important for traffic management but are not essential components for achieving the specified RTO/RPO; they support failover but do not directly provide data replication or infrastructure provisioning.

Answer

Multi-AZ deployment of the SAP application servers

Answer

Amazon Route 53 health checks and failover routing