PAS-C01 Operations and Maintenance Practice Test 18 — 15 Questions

Question 1

An SAP Basis administrator needs to apply security patches to the operating system of SAP EC2 instances. The administrator wants to use AWS Systems Manager Patch Manager. Which THREE steps are required to set up patching? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a patch baseline in AWS Systems Manager.. To set up patching with AWS Systems Manager Patch Manager, you need three steps: Create a patch baseline (A) to define which patches to apply. Install the SSM Agent on each EC2 instance (C) to allow Systems Manager to communicate with the instances. Associate the instances with a maintenance window (E) to schedule when patching occurs. Options B and D are not required: Lambda is not needed because Patch Manager handles the patching process, and CloudWatch Logs are not mandatory for patching operations.

Answer

Create an AWS Lambda function to invoke the patching process.

Answer

Configure Amazon CloudWatch Logs to store patch logs.

Question 2

A company is running SAP on AWS and wants to implement a centralized logging solution for all SAP components. The solution must be scalable and cost-effective. Which TWO services should the company use? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. The correct answers are C and E. Amazon CloudWatch Logs can collect logs from EC2 instances and AWS services, centralizing real-time log data. Amazon S3 provides cost-effective long-term storage for archived logs. A is incorrect because Amazon Athena is a query service for data in S3, not a logging service. B is incorrect because Kinesis Data Firehose is for real-time streaming, but the question asks for a scalable and cost-effective centralized logging solution, and CloudWatch Logs plus S3 is simpler and more cost-effective. D is incorrect because EFS is a file system, not suitable for log aggregation.

Answer

Amazon Athena

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Elastic File System (EFS)

Question 3

An operations team uses this IAM policy for a role assumed by SAP administrators. An administrator tries to stop a production SAP HANA instance in the us-west-2 region but receives an access denied error. What is the cause?

Accepted Answer

The Deny statement with a condition on aws:RequestedRegion prevents actions outside us-east-1.. The Deny statement includes a condition using aws:RequestedRegion that blocks any action unless the request is made in us-east-1. Since the administrator's request is in us-west-2, the condition fails and the Deny applies, causing the access denied error. Option A is incorrect because the Allow statement's resource ARN is for us-east-1, but the Deny overrides the Allow; the resource region is not the primary issue. Option B is incorrect because even if the instance has the tag, the Deny still overrides. Option C is incorrect because the Deny does not require a tag; it checks the region.

Answer

The Allow statement's resource ARN specifies us-east-1, but the instance is in us-west-2.

Answer

The Allow statement only permits stopping instances with the tag Environment=production, and the instance does not have that tag.

Answer

The Deny statement requires the resource to have a specific tag, which is missing.

Question 4

An operations team receives an alert that an SAP application server EC2 instance is unreachable. The team checks the AWS Management Console and sees that the instance status check shows "Instance reachability check failed". What is the most likely cause?

Accepted Answer

The operating system on the instance is not responding.. An instance reachability check failure typically indicates OS-level issues such as a crashed OS or kernel panic. Therefore, option A is correct. Option B is incorrect because security group issues would cause network connectivity failure but not necessarily a status check failure. Option C is incorrect because a stopped instance would show a different status. Option D is incorrect because EBS volume issues would be reported as a volume status check failure.

Answer

The security group associated with the instance is blocking all traffic.

Answer

The EBS root volume is detached from the instance.

Answer

The instance was stopped by an Auto Scaling group.

Question 5

An operations team manages an SAP ERP system on AWS that uses a single EC2 instance for the SAP central services (SCS) and multiple instances for application servers. The system is running in a VPC with both public and private subnets. The team notices that the SCS instance is unreachable from the application servers after a maintenance window where network ACLs were updated. The application servers are in private subnets, and the SCS instance is in a public subnet. The team has verified that the security groups allow the required traffic. Which step should the team take to resolve the connectivity issue?

Accepted Answer

Review the network ACL rules for both the public and private subnets.. The issue is that after maintenance, network ACLs were updated, causing connectivity loss between the SCS instance (public subnet) and application servers (private subnets). Network ACLs are stateless and control traffic at the subnet level. Since security groups are already verified, the likely cause is the NACL rules. Option A is correct because reviewing NACL rules for both subnets will identify missing inbound/outbound rules. Option B is incorrect because route tables to the internet gateway affect internet-bound traffic, not internal VPC traffic. Option C is incorrect because Elastic IPs are for internet access, not internal connectivity. Option D is incorrect because security groups were confirmed to allow traffic, so the issue is at the NACL level.

Answer

Verify that the route tables have a route to the internet gateway.

Answer

Assign an Elastic IP to the SCS instance.

Answer

Check the security group rules on the application servers.

Question 6

A company has an SAP system running on AWS with a production database on an RDS for SAP ASE instance. The operations team needs to perform a minor version upgrade of the database engine. The upgrade must be applied with minimal downtime. The team has a maintenance window scheduled for the upcoming weekend. Which action should the team take to apply the upgrade?

Accepted Answer

Enable auto minor version upgrade on the DB instance and let the upgrade occur during the maintenance window.. Setting the AutoMinorVersionUpgrade flag to true allows RDS to apply minor upgrades automatically during the maintenance window with minimal downtime. Option B is wrong because manual upgrade via the console can cause downtime if not done during a maintenance window. Option C is wrong because modifying the DB instance to a new version immediately can cause downtime. Option D is wrong because creating a new instance and migrating requires additional setup and downtime.

Answer

Manually upgrade the DB instance using the AWS Management Console immediately.

Answer

Modify the DB instance to specify the new engine version and apply immediately.

Answer

Create a new DB instance with the new version and migrate the data.

Question 7

A company runs its SAP HANA database on an EC2 instance in a single Availability Zone. The system is critical and requires high availability. The current setup uses an EBS volume for data storage. During a recent failure simulation, the database took 45 minutes to recover because the EBS volume had to be reattached and the database had to replay logs. The operations team wants to reduce recovery time to less than 15 minutes. Which solution should they implement?

Accepted Answer

Deploy a second EC2 instance in a different Availability Zone and configure SAP HANA system replication.. Deploying a second EC2 instance in a different Availability Zone with SAP HANA system replication (synchronous replication) provides a standby database that can be promoted quickly, reducing recovery time to minutes. Option B is incorrect because more frequent snapshots still require restoring and log replay, which takes longer. Option C is incorrect because increasing provisioned IOPS improves performance but does not affect recovery time during failure. Option D is incorrect because Amazon S3 is an object storage service not suitable for low-latency database operations like SAP HANA.

Answer

Use AWS Backup to create more frequent snapshots.

Answer

Increase the provisioned IOPS of the EBS volume.

Answer

Move the database to Amazon S3 for faster access.

Question 8

An SAP Basis administrator notices that the SAP application server logs show repeated connection timeouts to the database. The database is running on an RDS for SAP HANA instance. The application server and database are in the same VPC but different subnets. The security groups allow inbound traffic from the application server's security group on port 3xx17. Network ACLs allow both inbound and outbound traffic on ephemeral ports. Despite this, connections fail intermittently. What is the most likely cause?

Accepted Answer

The security group for the RDS instance does not allow inbound traffic on the HANA internal communication port (e.g., 3xx18).. SAP HANA uses multiple ports for internal communication. While port 3xx17 (SQL) is allowed, the missing inbound rule for the HANA internal communication port (e.g., 3xx18) causes intermittent connection timeouts. Option A is incorrect because RDS DNS names are stable and do not change intermittently. Option B is incorrect because network ACLs are stateless, but the problem states both inbound and outbound are allowed on ephemeral ports, so return traffic is not blocked. Option D is incorrect because route tables within a VPC use local routes for database traffic, and NAT gateways do not affect intra-VPC traffic.

Answer

The RDS instance's DNS name resolves to a different IP address intermittently.

Answer

The network ACL is stateful and blocking return traffic.

Answer

The application server's subnet has a route table that points to a NAT gateway instead of the database subnet.

Question 9

An SAP system running on AWS uses a Multi-AZ deployment with an Application Load Balancer (ALB) distributing traffic across two application servers in different Availability Zones. The ALB health checks are configured to check the /sap/public/health endpoint on each instance. Recently, the operations team noticed that one of the instances is being marked as unhealthy intermittently, causing a slight increase in response times. The instance's CPU utilization is under 40%, memory is sufficient, and the health endpoint returns a 200 OK status when tested manually. What is the most likely cause?

Accepted Answer

The health check interval is too frequent or the timeout is too short.. A health check interval that is too frequent or a timeout that is too short can cause the ALB to mark an instance as unhealthy intermittently, even when the endpoint returns 200 OK manually. The instance may occasionally respond slower than the timeout, especially under brief transient conditions. Option A is incorrect because the health check endpoint path is correct (as it returns 200 OK). Option B is incorrect because security group rules allowing inbound traffic from the ALB are typically configured correctly; otherwise, the health check would fail consistently. Option C is incorrect because network ACLs are stateless and would affect all traffic equally, not intermittently.

Answer

The health check endpoint is configured with the wrong path.

Answer

The security group for the instances does not allow inbound traffic from the ALB.

Answer

The health check requests are blocked by a network ACL.

Question 10

A company runs SAP BusinessObjects on AWS. The system includes a web application server and a CMS database on separate EC2 instances. The operations team receives alerts that the CMS database server's EBS volume is approaching its maximum capacity. The volume is a gp3 EBS volume with 3000 IOPS and 125 MB/s throughput. Upon investigation, the team finds that the volume is 90% full and write performance has degraded. The application is experiencing slow response times. What should the team do to resolve the issue without downtime?

Accepted Answer

Expand the EBS volume size and extend the file system.. Expanding the EBS volume size increases both capacity and, for gp3, the baseline throughput (since gp3 throughput scales with volume size up to a maximum), which can resolve the capacity issue and improve write performance. This operation can be performed online without downtime. Option A is incorrect because instance store volumes are ephemeral and not suitable for persistent database data; migrating would also require downtime. Option B is incorrect because while io2 Block Express offers higher performance, it is not necessary for this scenario and may increase cost unnecessarily; the primary issue is capacity, which can be addressed by expanding the existing volume. Option C is incorrect because increasing only IOPS and throughput does not add storage capacity; the volume is 90% full, so capacity must also be increased.

Answer

Move the database to an instance store volume for better performance.

Answer

Migrate the database to an io2 Block Express volume with higher performance.

Answer

Increase the IOPS and throughput of the existing volume.

Question 11

An SAP system on AWS uses an Auto Scaling group for the application tier. The scaling policy is based on the average CPU utilization of the EC2 instances. During peak hours, the system scales out, but the new instances take a long time to become available because they need to install SAP software and configure them. This delay causes performance degradation. The operations team wants to reduce the time to scale out. Which solution should they implement?

Accepted Answer

Create a custom AMI with SAP software pre-installed and use it in the launch configuration.. The correct solution is to create a custom AMI with SAP software pre-installed and use it in the launch configuration. This approach eliminates the need for software installation and configuration at instance launch, significantly reducing the time for new instances to become available. Option A is incorrect because increasing instance size does not reduce boot time; it only provides more resources. Option C is incorrect because AWS Elastic Beanstalk is a platform-as-a-service offering that is not optimized for SAP workloads and would require significant reconfiguration. Option D is incorrect because instance store-backed AMIs are ephemeral and data is lost on instance stop/termination, which is not suitable for persistent SAP installations.

Answer

Increase the instance size to reduce boot time.

Answer

Switch to AWS Elastic Beanstalk for automatic scaling.

Answer

Use an instance store-backed AMI instead of EBS-backed.

Question 12

A company is running SAP S/4HANA on AWS with an RDS for SAP HANA database. The operations team needs to perform a minor version upgrade of the database. They want to minimize downtime and ensure that the upgrade can be rolled back if needed. What should they do?

Accepted Answer

Take a manual snapshot before the upgrade, then perform the upgrade.. Taking a manual snapshot before the upgrade provides a point-in-time backup that can be restored if the upgrade fails, enabling a rollback. RDS minor version upgrades are typically performed with minimal downtime (usually a few minutes). Option B is incorrect because enabling Multi-AZ does not provide a rollback mechanism; it only provides high availability during the upgrade. Option C is incorrect because the clone feature is specific to SAP HANA native tools, not RDS; RDS for SAP HANA does not support cloning for version upgrades. Option D is incorrect because creating a read replica does not facilitate rollback of the primary instance; read replicas are used for read scaling and cannot be used to revert an upgrade on the source.

Answer

Enable Multi-AZ, then perform the upgrade.

Answer

Use the clone feature of SAP HANA to create a copy.

Answer

Create a read replica, promote it after the upgrade.

Question 13

An SAP system on AWS uses a shared file system for the SAP transport directory. The file system is hosted on an Amazon EFS file system. Recently, the operations team noticed that SAP transports are failing with errors indicating file locking issues. The EFS file system is mounted using the NFS client with default options. What is the most likely cause of the file locking issues?

Accepted Answer

The EFS file system is mounted using NFS version 3, which has limited locking support.. The default NFS client options typically use NFSv3, which has limited file locking support. SAP transport processes rely on robust file locking to coordinate access to the shared transport directory. NFSv4.1, which EFS recommends, provides proper locking with NFSv4.1 state management and lease-based locking. Option A is incorrect because insufficient throughput would manifest as performance degradation or timeouts, not file locking failures. Option B is incorrect because a security group blocking inbound traffic on port 2049 (NFS) would cause mount failures or accessibility issues, not specifically locking errors. Option C is incorrect because EFS access points do not affect locking; they manage file system paths and permissions, and restrictions would cause permission errors.

Answer

The EFS file system has insufficient throughput for the number of concurrent mounts.

Answer

The security group for the EFS mount targets does not allow inbound traffic on port 2049.

Answer

The EFS file system is using access points that restrict permissions.

Question 14

A company has an SAP HANA database running on an EC2 instance with multiple EBS volumes striped using LVM. The database is experiencing high latency during peak hours. Monitoring shows that the EBS volumes have a high Average Queue Length (avgqueue) and are frequently hitting the IOPS limit. The volumes are gp2 with 3000 IOPS each. The operations team wants to improve performance without increasing storage size. What should they do?

Accepted Answer

Change the volume type to gp3 and increase the IOPS and throughput.. Gp3 volumes provide a higher baseline IOPS (3000) than gp2 at the same storage size, and allow increasing IOPS and throughput independently without increasing storage. This addresses the high latency and IOPS limit issue without requiring additional volume size. Option A is wrong because io2 Block Express is designed for very high performance and may be excessive for this scenario, also likely increasing cost. Option B is wrong because instance store is ephemeral and not suitable for persistent database storage. Option D is wrong because adding more gp2 volumes would increase the total IOPS (since each gp2 volume has 3000 IOPS) and could help if the bottleneck is at the volume level, but gp3 provides a more cost-effective and simpler solution without adding more volumes.

Answer

Change the volume type to io2 Block Express with higher IOPS.

Answer

Migrate the database to an instance store-backed instance.

Answer

Add more gp2 volumes to the LVM stripe set.

Question 15

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The administrator wants to receive an alert when the CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms are the correct service for monitoring EC2 instance CPU utilization and triggering alerts based on thresholds. In this scenario, the administrator needs to create an alarm that triggers when CPU utilization exceeds 80% for 5 consecutive minutes. CloudWatch Alarms can evaluate metric data against specified thresholds and perform actions such as sending notifications via SNS. Option D is correct. Option A (AWS CloudTrail) is for auditing API activity, not metric monitoring. Option B (AWS Config) is for resource configuration compliance. Option C (Amazon CloudWatch Logs) is for storing and monitoring log files, not for setting metric-based alarms.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon CloudWatch Logs