PAS-C01 Operations and Maintenance Practice Test 2 — 15 Questions

Question 1

A company is running SAP ERP on AWS and wants to set up a disaster recovery (DR) strategy using AWS Regions. The DR site must have a copy of the SAP application and database data. Which solution provides the fastest recovery time objective (RTO) with the lowest data loss?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an RDS Multi-AZ DB cluster with a cross-region read replica.. Cross-region read replicas in Amazon RDS replicate asynchronously, which means there is a small window of potential data loss (RPO typically seconds to minutes). However, among the given options, this approach provides the fastest recovery time objective (RTO) because failover to the read replica can be promoted quickly, and it offers the lowest data loss compared to daily snapshots or DMS. Option A (SAP HANA system replication) would be ideal for SAP HANA but is not specified. Option B (daily snapshots) has higher RPO (up to 24 hours). Option D (DMS continuous replication) may have similar RPO but often requires more complex setup and slower failover. Therefore, an RDS cross-region read replica balances low RTO and low data loss for non-HANA SAP databases.

Answer

Use an EC2 instance with SAP HANA system replication across regions.

Answer

Take daily snapshots of the database and copy them to the DR region. Restore from snapshots during a disaster.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate changes to a database in the DR region.

Question 2

A company runs its SAP S/4HANA system on AWS using a cluster of EC2 instances for the application tier and a single large EC2 instance for the HANA database. The database instance uses EBS volumes striped with LVM for data and log. Recently, the operations team noticed that the database performance has degraded significantly during peak hours. CloudWatch metrics show that the average ReadIOPS for the data volume is consistently at 80% of the provisioned IOPS limit, and the average queue length is above 10. The CPU utilization of the database instance is around 60%, and memory usage is 70%. The team has already verified that there are no network bottlenecks and that the SAP application is not misconfigured. Which of the following is the MOST effective action to improve database performance?

Accepted Answer

Increase the provisioned IOPS on the existing EBS data volume to provide more headroom.. The symptoms indicate that the EBS volume is reaching its IOPS limit, causing queuing. Increasing the provisioned IOPS for the data volume (Option B) will directly address the I/O bottleneck. Option A suggests migrating to instance store volumes, which are ephemeral and not recommended for persistent database data. Option C involves adding more EBS volumes and re-striping, which could increase IOPS but is more complex and may not be necessary if the existing volume supports elastic IOPS adjustments. Option D suggests upgrading to a larger EC2 instance type with higher network bandwidth, but CPU and memory are not fully utilized, so that may not address the I/O bottleneck. Therefore, increasing IOPS on the existing volume is the simplest and most effective.

Answer

Migrate the database data to an instance store volume for higher IOPS.

Answer

Add additional EBS volumes to the LVM stripe and redistribute the data.

Answer

Upgrade the database instance to a larger EC2 instance type with higher network bandwidth.

Question 3

A company runs a critical SAP ERP system on AWS. The system consists of a single EC2 instance running SAP NetWeaver with an Oracle database on the same instance. The instance type is r5.4xlarge with 500 GB gp2 EBS volume for the database. The operations team receives a CloudWatch alarm that the EBS volume's 'BurstBalance' metric has dropped to 0%. Consequently, the database performance degrades significantly. The team needs to resolve the issue and prevent recurrence. The SAP system cannot tolerate more than 10 minutes of downtime. The budget is limited. Which action should the team take?

Accepted Answer

Change the EBS volume type from gp2 to gp3 and increase the IOPS and throughput settings as needed.. Switching to gp3 provides baseline performance without burst credits and is cost-effective. Option C is correct. Option A is wrong because io2 Block Express is expensive and may require downtime to migrate. Option B is wrong because adding volumes and RAID 0 striping increases complexity, may require downtime, and does not address the root cause of burst credit exhaustion. Option D is wrong because increasing volume size only temporarily increases baseline IOPS and burst credits; it does not prevent recurrence if usage continues to exceed baseline.

Answer

Migrate the database to an io2 Block Express volume with provisioned IOPS.

Answer

Add additional EBS volumes and configure RAID 0 striping to increase IOPS.

Answer

Increase the volume size to 1000 GB to increase baseline IOPS and burst credits.

Question 4

An operations team is responsible for patching the operating system of SAP EC2 instances. They want to automate the patching process while minimizing downtime. Which approach should they use?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window and a patch baseline.. AWS Systems Manager Patch Manager automates patching with minimal downtime when used with a maintenance window. Option A is wrong because OpsWorks is not designed for OS patching. Option C is wrong because manual patching is not automated. Option D is wrong because Auto Scaling groups are for scaling, not patching.

Answer

Deploy a configuration management tool like AWS OpsWorks to apply patches.

Answer

Schedule a weekly maintenance window and manually apply patches via RDP/SSH.

Answer

Create an Auto Scaling group with a custom AMI that includes the latest patches.

Question 5

An SAP HANA database administrator reviews the above CLI output for a data volume. The database team reports high write latency. What is the most likely performance bottleneck?

Accepted Answer

The volume is provisioned with too many IOPS for its size, exceeding the maximum IOPS/GB ratio.. The volume is io1 with 10,000 IOPS for a 500 GB volume, exceeding the maximum IOPS/GB ratio of 50:1 for io1 (max 50 IOPS/GB). This can cause throttling and high latency. Option A is wrong because EBS-optimized instances provide dedicated bandwidth but are not directly related to the IOPS/GB ratio issue. Option B is wrong because DeleteOnTermination does not affect write performance. Option C is wrong because encryption does not significantly impact performance.

Answer

The volume is attached to an instance that does not support EBS optimization.

Answer

The volume has DeleteOnTermination enabled, which affects write performance.

Answer

The volume is not encrypted, causing performance degradation.

Question 6

A company runs its SAP S/4HANA system on AWS with a production environment consisting of a primary SAP HANA database on an r5.8xlarge instance and a secondary HANA instance for high availability in a different Availability Zone. The application tier includes multiple EC2 instances behind an Application Load Balancer. The operations team uses AWS Backup to create nightly snapshots of the HANA data volumes and stores them in a separate backup vault. Recently, a storage administrator accidentally deleted a critical SAP transport file from the HANA primary instance. The team needs to restore the file as quickly as possible with minimal data loss. The last backup completed 6 hours ago, and the file was deleted 2 hours ago. The team has enabled HANA backup logging to S3 every 30 minutes. Which option provides the fastest recovery with minimal data loss?

Accepted Answer

Restore the specific transport file from the HANA log backup stored in S3.. Restoring the specific transport file from the HANA log backup stored in S3 is the fastest method, recovering data up to the last log backup (30-minute RPO), minimizing data loss. Option B is incorrect because restoring from the nightly AWS Backup snapshot would result in losing 6 hours of data, which is not minimal. Option C is incorrect because re-importing the transport file from the original development system would require additional export steps and coordination, and the file might not be available in the same state, leading to delays and potential data loss. Option D is incorrect because the secondary HANA instance replicates all data changes, so the deletion would have been replicated as well, and failing over would not recover the file but would incur unnecessary downtime.

Answer

Restore the entire HANA data volume from the last AWS Backup snapshot.

Answer

Re-import the transport file from the original development system.

Answer

Fail over to the secondary HANA instance and retrieve the file from there.

Question 7

A company is running SAP ERP on AWS using an SAP-certified AMI. The system uses a single EC2 instance for both the application and database. The operations team needs to implement a disaster recovery (DR) solution with a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 1 hour. The DR site must be in a different AWS Region. Currently, the system uses EBS snapshots for backup. What should the team do to meet the RTO and RPO requirements?

Accepted Answer

Schedule hourly EBS snapshots and copy them to the DR region using AWS Backup.. AWS Backup can be configured to take EBS snapshots every hour and copy them to the DR region, meeting the 1-hour RPO. For RTO, you can restore the snapshot to an EC2 instance in the DR region within 2 hours. Option A is wrong because read replicas are a feature of Amazon RDS, not for EC2-instance-based SAP databases like this one. Option B is wrong because Amazon S3 Cross-Region Replication is for objects in S3 buckets, not for EBS snapshots directly; while snapshots are stored in S3, you must use snapshot copy functionality. Option C is wrong because AWS CloudEndure Disaster Recovery provides continuous replication with a lower RPO than required (typically seconds), making it overkill and more expensive for the given 1-hour RPO requirement.

Answer

Set up a read replica in the DR region and promote it during failover.

Answer

Configure Amazon S3 Cross-Region Replication for the EBS snapshots.

Answer

Use AWS CloudEndure Disaster Recovery to replicate the entire server to the DR region.

Question 8

An operations team is troubleshooting an issue where an SAP application is unable to connect to an RDS for SQL Server database. The database is in a private subnet, and the application is in a public subnet. Which TWO actions should the team take to resolve the connectivity issue? (Choose TWO.)

Accepted Answer

Modify the security group for the database to allow inbound traffic from the application's security group. The application and database are in the same VPC, so the VPC's local route already provides network connectivity between subnets. No additional routes are needed. The only required action is to modify the database's security group to allow inbound traffic from the application's security group. Options A and B are unnecessary because both subnets are within the same VPC. Option C would not help because traffic originates from the application subnet, not the database subnet. Option E is not needed because the local route already handles inter-subnet traffic.

Answer

Attach an internet gateway to the VPC

Answer

Create a VPC peering connection between the application and database subnets

Answer

Add a route to the route table of the database's subnet that directs traffic to the application's subnet

Answer

Add a route to the route table of the application's subnet that directs traffic to the database subnet

Question 9

An SAP administrator needs to ensure that a critical SAP system on AWS is highly available with automatic failover across Availability Zones. The system uses an SAP HANA database with replication. Which configuration meets these requirements with minimal operational overhead?

Accepted Answer

Use a Network Load Balancer with static IP addresses. A Network Load Balancer (NLB) with static IP addresses can distribute traffic across multiple Availability Zones. When combined with health checks, the NLB automatically routes traffic away from unhealthy instances, providing automatic failover for SAP HANA. This approach uses layer-4 (TCP) which is suitable for HANA database connections, and static IPs are beneficial for consistent connectivity. Option A is incorrect because manual DNS updates require human intervention and are not automatic. Option C is incorrect because an Application Load Balancer operates at layer-7 (HTTP/HTTPS) and is not designed for database traffic like SAP HANA. Option D is incorrect because a single instance is a single point of failure with no redundancy.

Answer

Use a DNS failover record with manual update

Answer

Use an Application Load Balancer with health checks and Route 53 failover routing

Answer

Deploy a single EC2 instance in one Availability Zone

Question 10

Refer to the exhibit. An SAP administrator is creating an IAM policy for an automated backup script that creates EBS snapshots of SAP HANA volumes. The script also needs to tag the snapshots. However, when the script runs, it fails with an authorization error. What is the missing permission?

Accepted Answer

kms:Encrypt. When creating a snapshot of an encrypted EBS volume, the snapshot inherits the encryption and requires permission to use the KMS key. The IAM policy must include kms:Encrypt (or kms:ReEncrypt) in addition to kms:Decrypt and kms:GenerateDataKey. Since the script already has kms:Decrypt and kms:GenerateDataKey, the missing permission is kms:Encrypt, which is needed to encrypt the new snapshot. Option A (ec2:DescribeSnapshots) is used to list snapshots, not to create them. Option C (ec2:ModifySnapshotAttribute) modifies permissions on existing snapshots. Option D (ec2:DeleteSnapshot) deletes snapshots. Therefore, option B is correct.

Answer

ec2:DescribeSnapshots

Answer

ec2:ModifySnapshotAttribute

Answer

ec2:DeleteSnapshot

Question 11

An SAP administrator needs to restore an SAP HANA database from a backup stored in Amazon S3. The backup was created using AWS Backup. What is the required IAM permission for the restore operation?

Accepted Answer

s3:GetObject. To restore from S3, the HANA database user or the backup tool needs s3:GetObject permission to read the backup files. Option A is wrong because kms:Decrypt may be needed only if the backup is encrypted, but it is not the required permission for all restore operations. Option C is wrong because s3:PutObject is for writing backups, not for reading. Option D is wrong because ec2:DescribeInstances is not needed for restore from S3.

Answer

kms:Decrypt

Answer

s3:PutObject

Answer

ec2:DescribeInstances

Question 12

An SAP system on AWS experiences performance degradation during peak hours. Monitoring shows high CPU utilization on the application server EC2 instances. The instances are in an Auto Scaling group with a step scaling policy based on CPU utilization. Despite scaling, performance does not improve. What is the most likely cause?

Accepted Answer

The step scaling policy has a cooldown period that prevents immediate scaling.. Step scaling policies have a cooldown period that prevents additional scaling activities, which can delay response during rapid changes. Option A (insufficient memory) is possible but less likely given scaling is happening. Option B (CloudWatch alarm not configured) would prevent scaling from triggering. Option D (not associated with ELB) would affect traffic distribution but not scaling policy.

Answer

The selected EC2 instance types lack sufficient memory for SAP applications.

Answer

The CloudWatch alarm is not configured to trigger the scaling policy.

Answer

The Auto Scaling group is not associated with an Elastic Load Balancer.

Question 13

A company uses SAP S/4HANA on AWS with a multi-AZ deployment. During a quarterly maintenance, the administrator needs to update the kernel of the primary application server without downtime. The application servers are behind an Application Load Balancer. What is the best strategy?

Accepted Answer

Deregister the instance from the target group, apply the patch, and re-register it.. Deregistering the instance from the target group, applying the patch, and then re-registering ensures no traffic is sent during the update, achieving zero downtime. Option B (stop instance) causes downtime. Option C (apply patch directly while in service) would cause brief downtime or disruption because the kernel update requires a reboot, and traffic would still be sent during the update. Option D (launch new instance with updated kernel) is a valid approach but involves more effort and cost, and is not the best strategy as it requires provisioning and configuration.

Answer

Stop the instance, apply the patch, and start the instance.

Answer

Apply the patch directly while the instance is in service.

Answer

Launch a new instance with the updated kernel and terminate the old one.

Question 14

An SAP administrator needs to monitor the disk I/O performance of an Aurora PostgreSQL database used by SAP. Which Amazon CloudWatch metric should be used to track read and write operations per second?

Accepted Answer

ReadIOPS and WriteIOPS. ReadIOPS and WriteIOPS metrics track the number of read and write operations per second. Option A (FreeableMemory) tracks available memory. Option B (CPUUtilization) tracks CPU usage. Option D (DatabaseConnections) tracks the number of connections.

Answer

FreeableMemory

Answer

CPUUtilization

Answer

DatabaseConnections

Question 15

A company needs to track API calls made to create, modify, or delete SAP-related resources in AWS. Which service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls for auditing and governance. Option B (AWS Config) tracks configuration changes to resources. Option C (VPC Flow Logs) captures network traffic information. Option D (Amazon CloudWatch) monitors metrics and logs, not API calls.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch