PAS-C01 Operations and Maintenance Practice Test 18 — 15 Questions

Question 1

A company has deployed SAP on AWS with a shared file system using Amazon EFS for the /sapmnt directory. The EFS file system is mounted on all SAP application servers. Recently, users reported that the SAP system is slow when accessing reports that are stored as PDF files in the /sapmnt directory. The operations team checks the CloudWatch metrics and finds that the EFS file system's PercentIOLimit metric is consistently at 100% during peak hours. The file system is using the General Purpose performance mode. The team also notices that the BurstCreditBalance is decreasing over time. What action should be taken to resolve this performance issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the size of the EFS file system to improve performance.. Increasing the size of the EFS file system increases the baseline throughput (which scales at 50 MiB/s per TB of storage) and also increases the rate at which burst credits are earned, helping to reduce the percent I/O limit and rebuild the burst credit balance. Option A is wrong because lifecycle management only moves files to Infrequent Access, which does not improve I/O performance and may add latency. Option C is wrong because enabling Provisioned Throughput does not increase the burst credit balance; it provides a fixed throughput independent of credits, but the wording is misleading. Option D is wrong because the EFS performance mode cannot be changed after creation; it is set when the file system is created.

Answer

Enable EFS lifecycle management to move infrequently accessed files to Infrequent Access storage class.

Answer

Increase the burst credit balance by enabling throughput mode.

Answer

Switch the EFS performance mode to Max I/O to get higher throughput.

Question 2

A company runs SAP on AWS and uses a Multi-AZ RDS for SAP ASE database. The operations team receives an alert that the database instance failed over automatically. After the failover, the SAP application servers are unable to connect to the database. The team checks the RDS console and sees that the DB instance status is 'available' and the endpoint is the same as before. The security groups and network ACLs have not changed. What is the MOST likely reason for the connectivity issue?

Accepted Answer

The application servers have cached the old database IP address and need to flush DNS.. The application servers have cached the old database IP address and need to flush DNS (B) is correct because during a Multi-AZ failover, the RDS endpoint's DNS record is updated to point to the new primary instance's IP address. However, application servers may have cached the old IP address due to DNS TTL, causing connection failures until the cache expires or is flushed. This is a common issue after failover.

Answer

The RDS endpoint changed after the failover.

Answer

The DNS record for the RDS endpoint did not update after the failover.

Answer

The security group for the database instance no longer allows traffic from the application servers.

Question 3

A company runs SAP HANA on AWS using a multi-node scale-out configuration. During a routine maintenance window, the administrator needs to apply an HANA database software update. What is the BEST practice to minimize downtime?

Accepted Answer

Perform a rolling update by updating one node at a time while keeping the system operational.. In a multi-node scale-out SAP HANA configuration, a rolling update—updating one node at a time while keeping the system operational—minimizes downtime by allowing the remaining nodes to continue serving requests. This approach maintains service availability and is the recommended best practice.

Answer

Use HANA System Replication to fail over to a standby system, then update the primary.

Answer

Stop all HANA services, apply the update to all nodes, then restart.

Answer

Create a new HANA cluster with the updated version and migrate data.

Question 4

An SAP administrator is troubleshooting a network connectivity issue between an SAP application server and an SAP HANA database, both running on EC2 in the same VPC. The security groups allow traffic on port 3xx15 and 3xx17. Which TWO steps should the administrator take to diagnose the problem?

Accepted Answer

Check the route tables to ensure the subnets can communicate.. Option C is correct because, even within a single VPC, the route tables associated with each subnet must contain a route (typically the local route for the VPC CIDR) that allows the application server subnet and the HANA database subnet to reach each other; a missing or misconfigured route will silently break connectivity. Option E is correct because network ACLs are stateless subnet-level firewalls that must explicitly allow both inbound and outbound traffic on the SAP ports (3xx15 and 3xx17) in both subnets; since they are evaluated independently of security groups, a restrictive NACL rule can drop the packets even when the security groups permit them. Option A is not needed because security groups are stateful, so return traffic for an allowed inbound connection is automatically permitted without explicit outbound rules. Option B is not relevant because an internet gateway is only required for traffic to or from the internet, not for intra-VPC communication between two EC2 instances. Option D, while useful for later forensic analysis, is not one of the two immediate diagnostic steps for this scenario and is not marked correct.

Answer

Check that the security groups have outbound rules that allow return traffic.

Answer

Ensure the internet gateway is attached to the VPC.

Answer

Enable VPC Flow Logs and analyze logs for dropped packets.

Question 5

A company runs SAP ERP on AWS. The system includes a primary application server and a secondary application server for high availability. The secondary server is not receiving updates from the primary. Which THREE steps should the administrator take to investigate?

Accepted Answer

Verify network connectivity between the primary and secondary servers using ping or telnet on SAP ports.. Option B is correct because SAP application servers communicate over specific TCP ports (for example, the SAP dispatcher port 32 and the message server port 36), so verifying reachability with ping or telnet on those ports is a valid first step to rule out AWS security group, NACL, or routing issues blocking updates. Option C is correct because the SAP message server trace logs record the registration and communication of application servers, so errors there would reveal why the secondary server is not receiving updates from the primary. Option D is correct because transaction SM51 lists the application servers known to the message server and their status, and enqueue replication status can be checked to confirm whether the secondary is properly registered and synchronized. Option A is not appropriate because blindly restarting the secondary server does not diagnose the root cause and could disrupt the HA setup. Option E is not relevant because the SAP Gateway service handles RFC/CPIC connections for external interfaces, not the internal update propagation between application servers.

Answer

Restart the secondary application server to force a resync.

Answer

Check the SAP Gateway service status on the primary server.

Question 6

A company runs SAP S/4HANA on AWS. The environment includes an SAP HANA database on an EC2 instance with multiple EBS volumes for data, log, and backup. The backup strategy uses AWS Backup to create daily snapshots of all EBS volumes. During a disaster recovery test, the team discovers that the snapshots are not crash-consistent and the database cannot be restored to a consistent state. The backup window is set to 2 AM daily. What should the team do to ensure crash-consistent backups?

Accepted Answer

Configure AWS Backup to create multi-volume crash-consistent snapshots for the instance.. AWS Backup can create multi-volume crash-consistent snapshots when you include all volumes of an EC2 instance in a single backup plan. This ensures that all EBS volumes are snapshotted at the same point in time, maintaining data consistency across volumes, which is essential for SAP HANA databases that span multiple volumes. This is the correct solution to achieve crash-consistent backups.

Answer

Use SAP HANA backup to S3 instead of EBS snapshots for database backups.

Answer

Take individual EBS snapshots of each volume sequentially within the backup window.

Answer

Stop the EC2 instance before the backup window and start it after the snapshots complete.

Question 7

A company runs SAP Business Suite on AWS. The SAP application servers are behind an Application Load Balancer (ALB). The operations team notices that occasionally, some requests fail with HTTP 503 errors. The team checks the ALB and finds that the target group has healthy instances. The SAP application logs show no errors. What is the most likely cause of the 503 errors?

Accepted Answer

The ALB connection draining timeout is set too low, causing requests to be routed to instances that are being de-registered.. When an ALB target group shows healthy targets but clients intermittently receive 503s, a common cause is connection draining (deregistration delay) being too short: in-flight requests to a target being deregistered are cut off and the ALB returns 503. The default is 300 seconds, but if lowered, requests can fail during deployments or scaling events. The other options would typically produce different symptoms or be visible in health checks.

Answer

The security groups for the application servers do not allow traffic from the ALB.

Answer

The SSL certificate on the ALB has expired.

Answer

The target group health checks are misconfigured, marking instances as healthy when they are not.

Question 8

A company runs SAP S/4HANA on AWS. The system uses an SAP HANA database with a single EC2 instance. The operations team needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The DR site is in a different AWS Region. The team currently takes daily EBS snapshots and sends them to the DR region using AWS Backup cross-region copy. However, the RPO is not met because snapshots are only taken daily. Which combination of actions should the team take to meet the RPO and RTO?

Accepted Answer

Set up HANA System Replication (HSR) between the primary and DR regions. In the DR region, maintain a standby HANA instance in sync. Use automated failover scripts.. HANA System Replication (HSR) is SAP's native, application-aware replication mechanism that continuously ships redo log entries from the primary HANA database to a secondary HANA instance, typically achieving an RPO of seconds to minutes — well within the 15-minute requirement. Because the standby HANA instance is already running and in sync, failover can be completed in minutes, satisfying the 1-hour RTO. Automated failover scripts (or SAP's cluster integration) further reduce manual intervention time.

Answer

Increase the frequency of EBS snapshots to every hour and use cross-region copy. Also, pre-warm the DR instance by restoring the latest snapshot.

Answer

Use AWS CloudEndure Disaster Recovery to replicate the entire EC2 instance to the DR region.

Answer

Use Amazon EBS multi-region replication for the HANA data volumes.

Question 9

A company runs SAP ERP on AWS with a multi-AZ deployment. The SAP application tier uses Auto Scaling groups with a custom AMI. After a recent patching of the AMI, the new instances fail to start the SAP application services. What should the administrator do to ensure that the new AMI correctly starts SAP services?

Accepted Answer

Modify the Auto Scaling group launch configuration to include a user data script that starts SAP services. Modifying the Auto Scaling group launch configuration (or launch template) to include a user data script that starts SAP services ensures every new instance launched from the updated AMI automatically starts the SAP application. This is the standard, repeatable way to guarantee service startup at boot in an Auto Scaling environment.

Answer

Use AWS Systems Manager Run Command to start SAP services on running instances

Answer

Configure the SAP service to start via a cron job on the AMI

Answer

Create a new AMI with SAP services set to auto-start and update the Auto Scaling group

Question 10

Which THREE factors should be considered when planning a recovery point objective (RPO) and recovery time objective (RTO) for an SAP system on AWS?

Accepted Answer

Storage type (EBS vs. instance store). Option A is correct because the storage type directly determines durability and recovery characteristics: EBS volumes support snapshots and can be reattached or restored quickly, while instance store is ephemeral and lost if the instance stops or fails, which materially affects achievable RTO and RPO. Option C is correct because the EC2 instance type and size dictate compute, memory, and I/O capacity, which determine how fast an SAP system can be restored and brought back to a performant state, directly influencing RTO. Option E is correct because backup frequency sets the maximum data loss window (RPO) and retention period determines how far back you can restore, both being core inputs to RPO/RTO planning. Option B is not selected because Region and Availability Zone are architectural placement choices affecting resilience and latency, not the primary factors that define RPO/RTO values themselves. Option D is not selected because the number of SAP users is a workload/sizing consideration rather than a direct determinant of recovery point or recovery time objectives.

Answer

AWS Region and Availability Zone

Answer

Number of SAP users

Question 11

A company runs SAP S/4HANA on AWS. They want to ensure high availability for the central services (ASCS) and enqueue replication. Which TWO components should be deployed to meet this requirement?

Accepted Answer

Primary ASCS instance in one Availability Zone. Option B is correct because the primary ASCS (ABAP SAP Central Services) instance must be deployed in one Availability Zone to host the message server and the enqueue server, forming the foundation of the high-availability ASCS setup. Option D is correct because the Enqueue Replication Server (ERS) must run in a different Availability Zone from the primary ASCS, continuously replicating the lock table so it can take over enqueue and message server duties if the primary AZ fails. Together, the primary ASCS in one AZ and the ERS in a second AZ provide the standard SAP high-availability architecture for central services with enqueue replication. Option A is not correct because a secondary ASCS instance is not the SAP-supported mechanism for enqueue replication; the ERS fulfills that role. Option C is not correct because SAP's ASCS/ERS high-availability model uses exactly two nodes (primary ASCS plus ERS), not a third ASCS in a third AZ. Option E is not correct because SAP HANA database replication protects the database tier, not the ASCS central services or the enqueue lock table.

Answer

Secondary ASCS instance in a different Availability Zone

Answer

Third ASCS instance in a third Availability Zone

Answer

SAP HANA database replication

Question 12

Your organization runs SAP S/4HANA on AWS. The system is critical and must have high availability. The architecture includes two SAP application servers behind an Application Load Balancer, and the HANA database uses replication to a standby in another Availability Zone. During a recent test of a failure scenario, you noticed that when the standby HANA instance takes over, the application servers cannot connect because the database hostname changes. What is the best solution to ensure application servers can connect to the database without manual intervention after a failover?

Accepted Answer

Use Amazon Route 53 with a weighted record that points to the primary and standby instances, and use health checks to automatically fail over. Using Amazon Route 53 with a weighted record and health checks allows the application servers to connect to a stable DNS name that automatically resolves to the active HANA database. When the primary fails, the health check marks it unhealthy and Route 53 directs traffic to the standby, eliminating manual intervention. This is the standard AWS pattern for abstracting database failover from application connection strings.

Answer

Configure the application servers with both database IP addresses and retry logic

Answer

Place the database behind a Network Load Balancer

Answer

Update the application server configuration to use the standby hostname as a fallback

Question 13

A multinational company runs SAP on AWS with a complex landscape including development, quality assurance, and production environments. The production SAP HANA database is running on an r5.8xlarge instance with 3.5 TB of data on EBS gp3 volumes. The operations team has been asked to implement a disaster recovery (DR) strategy that can recover the system in another AWS Region within 4 hours. The maximum acceptable data loss is 30 minutes. The current backup strategy uses daily EBS snapshots stored in the same Region. Which approach should the team take to meet the DR requirements?

Accepted Answer

Take EBS snapshots every 30 minutes and copy them to the DR Region using cross-Region snapshot copy. In the DR Region, have pre-provisioned EC2 instances and EBS volumes ready to attach the restored snapshots. The requirement is RPO 30 minutes and RTO 4 hours in a different Region. Taking EBS snapshots every 30 minutes and copying them cross-Region satisfies the RPO, and having pre-provisioned EC2 instances and EBS volumes in the DR Region allows the team to restore and attach snapshots quickly, meeting the 4-hour RTO. This is the standard AWS DR pattern for SAP HANA on EBS-backed instances when near-zero RPO is not required.

Answer

Use AWS Backup to schedule daily backups and copy them to the DR Region

Answer

Set up a pilot light environment in the DR Region with a HANA instance replicating via log shipping

Answer

Configure SAP HANA System Replication across Regions using a VPN connection

Question 14

Your company runs SAP ERP on AWS with a multi-AZ deployment. The SAP HANA database is replicated across two Availability Zones using HANA System Replication. The application servers are behind an Application Load Balancer. During a recent Availability Zone failure, the primary HANA instance failed, and the standby took over. However, the application servers continued to try to connect to the primary instance for several minutes, causing downtime. The DNS record for the database endpoint was manually updated after the failover. What is the most effective solution to automate the failover and minimize downtime?

Accepted Answer

Implement Amazon Route 53 DNS failover with health checks on the primary and secondary HANA instances. Amazon Route 53 DNS failover with health checks on the primary and secondary HANA instances automates the DNS update during failover, redirecting application servers to the standby instance without manual intervention. This minimizes downtime by ensuring the database endpoint resolves to the healthy instance.

Answer

Configure a Network Load Balancer in front of the HANA instances

Answer

Create a custom script on each application server to detect failover and update the connection string

Answer

Use an Amazon RDS for SAP HANA instead of self-managed

Question 15

A company runs an SAP NetWeaver application server on an Amazon EC2 instance in a private subnet. The SAP administrator needs to securely connect to the instance's OS for maintenance without exposing SSH to the internet. The company has an existing AWS Site-to-Site VPN connection to its on-premises network. Which solution should the administrator use?

Accepted Answer

Use AWS Systems Manager Session Manager to start a session.. AWS Systems Manager Session Manager enables secure, auditable access to EC2 instances without the need for bastion hosts, SSH keys, or open inbound ports. It uses the Systems Manager agent to establish a secure channel, and access can be controlled via IAM policies. This aligns with the requirement to avoid exposing SSH to the internet while using existing VPN connectivity.

Answer

Configure a NAT gateway and use SSH from the on-premises network.

Answer

Set up an AWS Client VPN endpoint and connect from the administrator's laptop.

Answer

Attach an Elastic IP to the instance and allow SSH from the corporate CIDR.