PAS-C01 Operations and Maintenance Practice Test 2 — 15 Questions

Question 1

A company runs SAP HANA on AWS. The operations team needs to automate the creation of AMI backups for the HANA database server. Which AWS service should they use to schedule and manage these backups?

Accepted Answer

AWS Backup. AWS Backup provides a centralized, policy-driven service to schedule and manage backups of supported resources, including EC2 instances and their EBS volumes, which is how SAP HANA AMI backups are automated. It supports backup plans with cron or rate-based schedules, retention rules, and cross-region/cross-account copies. This makes it the correct service for scheduling and managing AMI backups.

Answer

Amazon S3 Lifecycle policies

Answer

AWS Systems Manager

Answer

Amazon CloudWatch Events

Question 2

An SAP system on AWS uses a Multi-AZ RDS for SQL Server as the database. During a failover test, the application experienced a 2-minute outage. The application team wants to reduce this downtime. What should the operations team recommend?

Accepted Answer

Enable automatic failover handling in the application's JDBC connection string.. Enabling Multi-AZ with automatic failover in the JDBC connection string allows the application to automatically reconnect to the new primary without manual intervention. Option A is wrong because increasing instance size does not affect failover time. Option B is wrong because a different Multi-AZ configuration does not reduce failover time. Option D is wrong because RDS Proxy is not supported for SQL Server.

Answer

Increase the DB instance size to improve failover performance.

Answer

Configure Multi-AZ with SQL Server Mirroring instead of Always On Availability Groups.

Answer

Use Amazon RDS Proxy to manage connections.

Question 3

An SAP system on AWS is experiencing intermittent connectivity issues between the application servers and the HANA database. The network team has confirmed that the VPC and subnets are configured correctly. What should the operations team check NEXT?

Accepted Answer

Security group rules on the database server.. Security group rules on the database server are the most likely cause of intermittent connectivity issues after VPC and subnet configurations are confirmed correct. Security groups act as stateful virtual firewalls at the instance level, and misconfigured rules can block specific ports or protocols intermittently, especially if rules are too restrictive or if multiple security groups are attached. Checking security group rules is the next logical step to identify the source of the connectivity problem.

Answer

DNS resolution for the database endpoint.

Answer

VPC route tables for the application subnet.

Answer

Network ACLs on the database subnet.

Question 4

An SAP system on AWS uses a custom AMI for its application servers. The operations team needs to update the AMI to include a new security patch. What is the MOST efficient way to update all existing instances without downtime?

Accepted Answer

Create a new AMI version, update the Auto Scaling group's launch template, and perform a rolling update.. The most efficient way to update all existing instances without downtime is to create a new AMI version, update the Auto Scaling group's launch template to use the new AMI, and then perform a rolling update. This replaces instances gradually, maintaining availability and ensuring the new patch is applied to all instances.

Answer

Stop all instances, apply the patch, create a new AMI, and start instances.

Answer

Use AWS Systems Manager Patch Manager to apply the patch to all running instances.

Answer

Create a new AMI, launch new instances manually, and terminate old ones.

Question 5

Which TWO AWS services can be used to automate the patching of SAP application servers?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager (B) is correct because it provides native, automated OS and application patch baselines, maintenance windows, and compliance reporting for EC2 instances running SAP application servers, using the SSM Agent to scan and install patches on a schedule. AWS Lambda (D) is correct because it can be used to automate patching workflows—for example, triggering patching jobs, invoking SSM Run Command documents, or orchestrating custom pre/post-patch scripts via EventBridge schedules—without managing servers. AWS CloudFormation (A) is not a patching engine; it provisions and manages infrastructure as code and does not scan or install OS patches. Amazon EC2 Auto Scaling (C) only adjusts instance capacity based on demand and does not perform patch management. AWS Elastic Beanstalk (E) is a PaaS deployment service for web applications and does not provide automated patching of SAP application servers.

Answer

AWS CloudFormation

Answer

Amazon EC2 Auto Scaling

Answer

AWS Elastic Beanstalk

Question 6

Refer to the exhibit. An operations team uses an EC2 instance with this IAM policy to manage EBS snapshots for SAP HANA backups. The backup script calls the DeleteSnapshot API for snapshot snap-0abcdef1234567890. What will happen?

Accepted Answer

The DeleteSnapshot API call will be denied.. The IAM policy contains an explicit Deny for the DeleteSnapshot action on the specified snapshot (snap-0abcdef1234567890), and in AWS IAM, an explicit Deny always overrides any Allow. Therefore the DeleteSnapshot API call will be denied, regardless of any Allow statement that might otherwise grant permission.

Answer

The snapshot will be deleted because the Deny applies only to other snapshots.

Answer

The snapshot will be deleted because the Allow statement grants permission.

Answer

The policy is invalid and will cause an error.

Question 7

Refer to the exhibit. An operations team sees this log entry in CloudWatch Logs for an SAP system. What is the MOST likely cause?

Accepted Answer

The network connection between the ABAP application server and HANA is down.. The log entry indicates a connection failure between the ABAP application server and the HANA database, typically showing errors like 'Connection refused' or 'SQLCODE -10709'. This points to a network-level issue rather than a database crash or authentication problem. The most likely cause is that the network connection between the ABAP application server and HANA is down, which prevents the application server from reaching the database.

Answer

The HANA database has crashed.

Answer

The SAP system user password has expired.

Answer

The ABAP program Z_MONITOR has a bug.

Question 8

Refer to the exhibit. An operations team uses this CloudFormation template to launch SAP application servers. After deployment, the application server fails to join the SAP system. The team verified that the security group allows outbound traffic to the SAP system. What is the MOST likely cause?

Accepted Answer

The `LatestAmiId` parameter is not defined in the template.. In the CloudFormation template, the SAP application server launch depends on the LatestAmiId parameter, which is referenced but not defined in the Parameters section. CloudFormation will fail to resolve the reference, causing the stack deployment to fail or the instance to launch without the intended AMI, so the server never joins the SAP system. The most likely cause is the missing parameter definition.

Answer

The instance type is not specified correctly.

Answer

The security group ID is not properly referenced.

Answer

The user data script is not base64 encoded correctly.

Question 9

A company runs SAP on AWS and uses a multi-AZ deployment for SAP HANA. The operations team notices that the secondary HANA node in the standby replica is not automatically taking over during a planned failover test. What is the most likely cause?

Accepted Answer

HANA system replication is not configured with 'PRIMARY' and 'SECONDARY' roles.. For SAP HANA system replication to support automatic failover in a multi-AZ setup, the primary and secondary nodes must be configured with the correct replication roles (`PRIMARY` and `SECONDARY`) and an operational replication mode (e.g., sync or syncmem). If the roles are not properly configured, the secondary never receives replication and cannot take over. This is the most likely cause of a planned failover failing to promote the standby.

Answer

Security Groups are blocking replication traffic.

Answer

The secondary instance is launched in a different instance family.

Answer

The EBS volumes are not configured for replication across AZs.

Question 10

Your SAP on AWS environment uses a central S3 bucket to store SAP transport files. The operations team reports that transport import fails intermittently. Which AWS service can be used to monitor and alert on S3 API call failures?

Accepted Answer

AWS CloudTrail. CloudTrail logs all S3 API calls and can be used to monitor failures via CloudWatch Logs or EventBridge. AWS Config tracks configuration changes, not API calls. CloudWatch Metrics provides S3 metrics but is not the primary service for detailed API call monitoring. Trusted Advisor offers best-practice checks, not real-time monitoring.

Answer

AWS Config

Answer

Amazon CloudWatch Metrics

Answer

AWS Trusted Advisor

Question 11

Your SAP system on AWS uses a shared file system with Amazon EFS. The operations team notices that the SAP application is experiencing latency when reading files from EFS. Which action can improve read performance?

Accepted Answer

Enable EFS performance mode 'max I/O'.. Enabling EFS 'max I/O' performance mode increases the file system's ability to handle a high number of concurrent read operations by distributing data across multiple servers within the AWS region. This mode is specifically designed for workloads like SAP that require high throughput and low-latency access to shared files, as it scales I/O operations horizontally without the bottleneck of a single file server.

Answer

Use Amazon FSx for Windows File Server instead.

Answer

Move the file system to Amazon EBS with provisioned IOPS.

Answer

Use Amazon S3 with Transfer Acceleration.

Question 12

A company runs SAP S/4HANA on AWS with a three-tier architecture. The operations team receives alerts that the application server's CPU utilization is consistently above 90%. The team wants to add an additional application server to distribute the load. Which AWS service should be used to register the new instance with the SAP system's load balancer?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is the correct service because SAP S/4HANA application servers register with an ALB target group, and the ALB performs HTTP/HTTPS health checks and load balancing at the application layer. In a three-tier SAP architecture on AWS, the ALB sits between the SAP Web Dispatcher (or directly in front of the application servers) and distributes incoming HTTP(S) traffic to the registered application server instances. When adding a new application server, you register it with the ALB's target group, and the ALB automatically begins routing traffic to it after health checks pass.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 13

Which TWO AWS services can be used to monitor the performance of SAP HANA on AWS and set alarms? (Select TWO.)

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (D) is correct because it is AWS's native monitoring service that collects performance metrics (such as CPU, memory, disk, and custom SAP HANA metrics via the CloudWatch agent or SAP HANA monitoring scripts) and supports CloudWatch Alarms to trigger notifications or automated actions when thresholds are breached. AWS Systems Manager (E) is also correct because its capabilities, particularly Systems Manager metrics/CloudWatch integration and automation runbooks, allow you to monitor managed instances and respond to alarms, including SAP HANA hosts, by collecting inventory, patching, and operational data that can drive alarm-based remediation. AWS CloudTrail (A) only records API activity and audit events, not performance metrics, so it cannot set performance alarms. AWS Config (B) evaluates resource configuration compliance and changes, not runtime performance. AWS Trusted Advisor (C) provides best-practice checks and recommendations, not performance metric monitoring or alarm creation for SAP HANA.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 14

Which TWO AWS services can be used to automate the start and stop of SAP EC2 instances based on a schedule? (Select TWO.)

Accepted Answer

AWS Lambda with CloudWatch Events. Option A (AWS Lambda with CloudWatch Events) is correct because CloudWatch Events (now Amazon EventBridge) can trigger a Lambda function on a cron or rate schedule, and the Lambda function can call EC2 APIs such as StartInstances and StopInstances to start and stop SAP EC2 instances automatically. Option C (AWS Instance Scheduler) is correct because it is an AWS solution specifically designed to schedule the start and stop of EC2 instances (and RDS instances) using tags and a schedule configuration, which fits the SAP EC2 scheduling scenario directly. Option B (AWS Systems Manager Run Command) is not a scheduling service; it runs commands on managed instances on demand or via maintenance windows, but it does not by itself provide the required schedule-based start/stop automation. Option D (AWS Auto Scaling) is for dynamically scaling capacity based on demand or policies, not for starting and stopping specific SAP instances on a fixed schedule. Option E (AWS OpsWorks) is a configuration management service (Chef/Puppet) and is not the intended service for simple scheduled EC2 start/stop automation.

Answer

AWS Systems Manager Run Command

Answer

AWS Auto Scaling

Answer

AWS OpsWorks

Question 15

A company runs SAP on AWS and uses a Multi-AZ architecture. The SAP application servers are in an Auto Scaling group across two Availability Zones, and the database is an RDS for SAP HANA Multi-AZ DB instance. During a recent failover test, the database failover completed within 2 minutes, but the application servers took 10 minutes to reconnect to the database. Which action would minimize the application reconnection time?

Accepted Answer

Configure the SAP application to use the RDS Multi-AZ automatic failover endpoint.. Configuring the SAP application to use the RDS Multi-AZ automatic failover endpoint allows the application to reconnect to the new primary database quickly after a failover. This endpoint automatically updates to point to the active database instance, minimizing the time for the application to detect and connect to the new primary. Option D is incorrect because RDS Proxy does not support SAP HANA; it is designed for RDS databases such as MySQL, PostgreSQL, etc. Therefore, it cannot be used to manage connections to an SAP HANA database. Option A is wrong because adjusting the health check grace period does not affect database reconnection. Option C is wrong because increasing the number of application servers does not address reconnection logic.

Answer

Reduce the health check grace period on the Auto Scaling group.

Answer

Increase the minimum number of application servers in the Auto Scaling group.

Answer

Use an RDS Proxy to manage database connections from the application servers.