PAS-C01 Operations and Maintenance Practice Test 17 — 15 Questions

Question 1

A company runs its SAP landscape on AWS and uses an Application Load Balancer (ALB) to distribute traffic to multiple web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the most likely cause?

Accepted Answer

The target group health checks are failing, causing the ALB to mark instances as unhealthy.. Option C is correct because 503 errors typically indicate that the target instances are unhealthy or the ALB cannot route traffic to them. Option A is wrong because security groups blocking traffic would cause 504 or timeout errors. Option B is wrong because SSL certificate issues cause 502 errors. Option D is wrong because CloudFront is not in the path.

Answer

The security groups for the ALB are blocking incoming traffic.

Answer

The SSL certificate on the ALB has expired.

Answer

The CloudFront distribution in front of the ALB is misconfigured.

Question 2

An SAP system administrator needs to monitor the CPU and memory utilization of SAP EC2 instances. Which TWO AWS services can be used to collect and visualize these metrics? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. A and D are correct. CloudWatch can collect CPU and memory metrics (via agent), and Managed Service for Prometheus can scrape and store metrics. B is wrong because CloudTrail is for API logs. C is wrong because Config is for configuration compliance. E is wrong because Trusted Advisor provides best-practice checks, not granular metrics.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

An operations team is planning a disaster recovery (DR) strategy for an SAP system on AWS. The system includes SAP HANA database and application servers. The DR site must have a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which THREE components are essential for this DR strategy? (Choose THREE.)

Accepted Answer

AWS CloudFormation templates to provision the DR infrastructure. A, C, and D are correct. Cross-Region replication of EBS snapshots provides RPO of 15 minutes. CloudFormation templates automate infrastructure deployment to meet RTO. S3 Cross-Region Replication for backups ensures data availability. B is wrong because Multi-AZ is for high availability, not DR. E is wrong because while Route 53 is important, it is not the core component for meeting RTO/RPO.

Answer

Multi-AZ deployment of the SAP application servers

Answer

Amazon Route 53 health checks and failover routing

Question 4

An SAP Basis administrator needs to apply security patches to the operating system of SAP EC2 instances. The administrator wants to use AWS Systems Manager Patch Manager. Which THREE steps are required to set up patching? (Choose THREE.)

Accepted Answer

Create a patch baseline in AWS Systems Manager.. A, B, and D are correct. Installing SSM Agent on instances is required. Creating a patch baseline defines which patches to apply. Associating the instances with a maintenance window schedules the patching. C is wrong because CloudWatch Logs are not required for patching. E is wrong because Lambda is not needed.

Answer

Create an AWS Lambda function to invoke the patching process.

Answer

Configure Amazon CloudWatch Logs to store patch logs.

Question 5

A company is running SAP on AWS and wants to implement a centralized logging solution for all SAP components. The solution must be scalable and cost-effective. Which TWO services should the company use? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. A and C are correct. CloudWatch Logs can collect logs from EC2 instances and services. S3 can serve as a cost-effective storage for archived logs. B is wrong because Kinesis Data Firehose is for real-time streaming, not needed here. D is wrong because Athena is for querying data in S3, not for logging itself. E is wrong because EFS is file storage, not suited for log aggregation.

Answer

Amazon Athena

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Elastic File System (EFS)

Question 6

An operations team uses this IAM policy for a role assumed by SAP administrators. An administrator tries to stop a production SAP HANA instance in the us-west-2 region but receives an access denied error. What is the cause?

Accepted Answer

The Deny statement with a condition on aws:RequestedRegion prevents actions outside us-east-1.. Option A is correct. The Deny statement blocks all actions unless the request is made in us-east-1. Since the administrator is in us-west-2, the condition fails and the deny applies. Option B is wrong because the Allow statement explicitly allows stop/start on production instances, but the Deny overrides. Option C is wrong because the policy does not require tags for the Deny. Option D is wrong because the condition checks the requested region, not the resource region.

Answer

The Allow statement's resource ARN specifies us-east-1, but the instance is in us-west-2.

Answer

The Allow statement only permits stopping instances with the tag Environment=production, and the instance does not have that tag.

Answer

The Deny statement requires the resource to have a specific tag, which is missing.

Question 7

An SAP HANA database administrator reviews the above CLI output for a data volume. The database team reports high write latency. What is the most likely performance bottleneck?

Accepted Answer

The volume is provisioned with too many IOPS for its size, exceeding the maximum IOPS/GB ratio.. Option D is correct. The volume is io1 with 10,000 IOPS for a 500 GB volume, exceeding the maximum IOPS/GB ratio of 50:1 for io1 (max 50 IOPS/GB). This can cause throttling and high latency. Option A is wrong because EBS-optimized instances support up to certain bandwidth, but not directly related. Option B is wrong because encryption does not significantly impact performance. Option C is wrong because DeleteOnTermination does not affect performance.

Answer

The volume is attached to an instance that does not support EBS optimization.

Answer

The volume has DeleteOnTermination enabled, which affects write performance.

Answer

The volume is not encrypted, causing performance degradation.

Question 8

An operations team receives an alert that an SAP application server EC2 instance is unreachable. The team checks the AWS Management Console and sees that the instance status check shows "Instance reachability check failed". What is the most likely cause?

Accepted Answer

The operating system on the instance is not responding.. Option B is correct. An instance reachability check failure typically indicates OS-level issues such as a crashed OS or kernel panic. Option A is wrong because security group issues would cause network connectivity failure but not necessarily a status check failure. Option C is wrong while a stopped instance would show a different status. Option D is wrong because EBS volume issues would be reported as a volume status check failure.

Answer

The security group associated with the instance is blocking all traffic.

Answer

The EBS root volume is detached from the instance.

Answer

The instance was stopped by an Auto Scaling group.

Question 9

A company runs its SAP S/4HANA system on AWS with a production environment consisting of a primary SAP HANA database on an r5.8xlarge instance and a secondary HANA instance for high availability in a different Availability Zone. The application tier includes multiple EC2 instances behind an Application Load Balancer. The operations team uses AWS Backup to create nightly snapshots of the HANA data volumes and stores them in a separate backup vault. Recently, a storage administrator accidentally deleted a critical SAP transport file from the HANA primary instance. The team needs to restore the file as quickly as possible with minimal data loss. The last backup completed 6 hours ago, and the file was deleted 2 hours ago. The team has enabled HANA backup logging to S3 every 30 minutes. Which option provides the fastest recovery with minimal data loss?

Accepted Answer

Restore the specific transport file from the HANA log backup stored in S3.. Option A is correct because restoring from the HANA log backup in S3 is the fastest and recovers data up to the time of the last log backup, which is 30 minutes before deletion. Option B is wrong because restoring from the nightly snapshot would lose 6 hours of data. Option C is wrong because using the secondary instance requires failover and may not have the latest data. Option D is wrong because rebuilding the transport directory from scratch would take time and may not restore the specific file.

Answer

Restore the entire HANA data volume from the last AWS Backup snapshot.

Answer

Re-import the transport file from the original development system.

Answer

Fail over to the secondary HANA instance and retrieve the file from there.

Question 10

An operations team manages an SAP ERP system on AWS that uses a single EC2 instance for the SAP central services (SCS) and multiple instances for application servers. The system is running in a VPC with both public and private subnets. The team notices that the SCS instance is unreachable from the application servers after a maintenance window where network ACLs were updated. The application servers are in private subnets, and the SCS instance is in a public subnet. The team has verified that the security groups allow the required traffic. Which step should the team take to resolve the connectivity issue?

Accepted Answer

Review the network ACL rules for both the public and private subnets.. Option C is correct because network ACLs are stateless and require both inbound and outbound rules. During maintenance, the NACL might have been modified to block required traffic. Option A is wrong because security groups are already verified. Option B is wrong because route tables affect routing, not connectivity if they are within the same VPC. Option D is wrong because the issue is not about Elastic IPs.

Answer

Verify that the route tables have a route to the internet gateway.

Answer

Assign an Elastic IP to the SCS instance.

Answer

Check the security group rules on the application servers.

Question 11

A company has an SAP system running on AWS with a production database on an RDS for SAP ASE instance. The operations team needs to perform a minor version upgrade of the database engine. The upgrade must be applied with minimal downtime. The team has a maintenance window scheduled for the upcoming weekend. Which action should the team take to apply the upgrade?

Accepted Answer

Enable auto minor version upgrade on the DB instance and let the upgrade occur during the maintenance window.. Option A is correct because setting the AutoMinorVersionUpgrade flag to true allows RDS to apply minor upgrades automatically during the maintenance window with minimal downtime. Option B is wrong because manual upgrade via the console can cause downtime if not done during a maintenance window. Option C is wrong because modifying the DB instance to a new version immediately can cause downtime. Option D is wrong because creating a new instance and migrating requires additional setup and downtime.

Answer

Manually upgrade the DB instance using the AWS Management Console immediately.

Answer

Modify the DB instance to specify the new engine version and apply immediately.

Answer

Create a new DB instance with the new version and migrate the data.

Question 12

A company runs its SAP HANA database on an EC2 instance in a single Availability Zone. The system is critical and requires high availability. The current setup uses an EBS volume for data storage. During a recent failure simulation, the database took 45 minutes to recover because the EBS volume had to be reattached and the database had to replay logs. The operations team wants to reduce recovery time to less than 15 minutes. Which solution should they implement?

Accepted Answer

Deploy a second EC2 instance in a different Availability Zone and configure SAP HANA system replication.. Option C is correct because using Multi-AZ deployment with synchronous replication ensures that a standby database is ready to take over immediately, reducing recovery time significantly. Option A is wrong because increasing EBS volume size does not reduce recovery time. Option B is wrong because Amazon S3 is not suitable for low-latency database storage. Option D is wrong because manual snapshots take time to restore and do not provide automatic failover.

Answer

Use AWS Backup to create more frequent snapshots.

Answer

Increase the provisioned IOPS of the EBS volume.

Answer

Move the database to Amazon S3 for faster access.

Question 13

An SAP Basis administrator notices that the SAP application server logs show repeated connection timeouts to the database. The database is running on an RDS for SAP HANA instance. The application server and database are in the same VPC but different subnets. The security groups allow inbound traffic from the application server's security group on port 3xx17. Network ACLs allow both inbound and outbound traffic on ephemeral ports. Despite this, connections fail intermittently. What is the most likely cause?

Accepted Answer

The security group for the RDS instance does not allow inbound traffic on the HANA internal communication port (e.g., 3xx18).. Option A is correct because RDS for SAP HANA uses a database port (e.g., 3xx17) but also requires an additional port for internal services. If the security group does not allow traffic on that additional port, connections may fail. Option B is incorrect because NACLs are stateless but properly configured. Option C is incorrect because RDS does not use DNS-based routing issues typically. Option D is incorrect because the issue is not about routing tables if within same VPC.

Answer

The RDS instance's DNS name resolves to a different IP address intermittently.

Answer

The network ACL is stateful and blocking return traffic.

Answer

The application server's subnet has a route table that points to a NAT gateway instead of the database subnet.

Question 14

A company is running SAP ERP on AWS using an SAP-certified AMI. The system uses a single EC2 instance for both the application and database. The operations team needs to implement a disaster recovery (DR) solution with a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 1 hour. The DR site must be in a different AWS Region. Currently, the system uses EBS snapshots for backup. What should the team do to meet the RTO and RPO requirements?

Accepted Answer

Schedule hourly EBS snapshots and copy them to the DR region using AWS Backup.. Option D is correct because using AWS Backup with cross-region snapshot copy allows automated backups to another region with RPO of 1 hour. For RTO, you can restore from those snapshots. Option A is wrong because S3 replication is for objects, not EBS snapshots. Option B is wrong because Cross-Region Replication is for S3. Option C is wrong because CloudEndure requires continuous replication, which is not needed and may be overkill.

Answer

Set up a read replica in the DR region and promote it during failover.

Answer

Configure Amazon S3 Cross-Region Replication for the EBS snapshots.

Answer

Use AWS CloudEndure Disaster Recovery to replicate the entire server to the DR region.

Question 15

An SAP system running on AWS uses a Multi-AZ deployment with an Application Load Balancer (ALB) distributing traffic across two application servers in different Availability Zones. The ALB health checks are configured to check the /sap/public/health endpoint on each instance. Recently, the operations team noticed that one of the instances is being marked as unhealthy intermittently, causing a slight increase in response times. The instance's CPU utilization is under 40%, memory is sufficient, and the health endpoint returns a 200 OK status when tested manually. What is the most likely cause?

Accepted Answer

The health check interval is too frequent or the timeout is too short.. Option C is correct because the health check request may be timing out due to a short timeout setting. The health endpoint works manually but may take longer under load, causing intermittent failures. Option A is wrong because the health check URL is correct. Option B is wrong because health checks are sent from the ALB, not the internet. Option D is wrong because security group allows inbound from ALB.

Answer

The health check endpoint is configured with the wrong path.

Answer

The security group for the instances does not allow inbound traffic from the ALB.

Answer

The health check requests are blocked by a network ACL.