PAS-C01 Operations and Maintenance Practice Test 21 — 15 Questions

Question 1

The operations team deploys the CloudFormation template above. After the stack creation completes, the EC2 instance is launched but the SAP application is not running. What is the most likely reason?

Accepted Answer

The UserData script only installs httpd, not the SAP application. The UserData script installs httpd (Apache), not the SAP application. The template does not include any steps to install or start the SAP application. The security group is referenced but not shown; it is likely correct. The instance type is appropriate for SAP. The AMI ID is valid.

Answer

The security group does not allow inbound traffic to the SAP application port

Answer

The instance type is not suitable for SAP applications

Answer

The AMI ID is incorrect

Question 2

A company runs SAP on AWS and notices that the SAP application performance degrades during peak hours. The system uses a db.r5.4xlarge RDS for SAP HANA database. Which AWS service should be used to analyze the database performance metrics and identify bottlenecks?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service because it provides a performance dashboard with detailed database metrics, allowing you to identify bottlenecks such as high CPU, memory, or I/O usage. AWS X-Ray is used for tracing requests across microservices, not for database performance analysis. AWS CloudTrail logs API calls for auditing, not performance metrics. Amazon CloudWatch Logs is for storing and monitoring log files, not for real-time database performance analysis.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 3

A company wants to automate the backup of their SAP HANA database running on an EC2 instance. The backup should be stored in Amazon S3 and retained for 30 days. Which AWS service can be used to schedule and manage these backups?

Accepted Answer

AWS Backup. AWS Backup. AWS Backup is a fully managed backup service that can be used to automate backups of EC2 instances, including SAP HANA databases, and store backups in Amazon S3. It allows scheduling and retention policies. Option A (AWS Lambda) can be used but requires custom code and is not the primary service for managing backups. Option B (Amazon S3 Lifecycle policies) manages object lifecycle transitions and deletions, not scheduling backups. Option C (AWS Storage Gateway) provides hybrid storage connectivity, not backup scheduling.

Answer

AWS Lambda

Answer

Amazon S3 Lifecycle policies

Answer

AWS Storage Gateway

Question 4

An SAP administrator notices that the SAP HANA database on an EC2 instance is running out of memory frequently. The instance type is r5.4xlarge with 128 GiB of memory. Which action should the administrator take to resolve this issue?

Accepted Answer

Scale up to a larger instance type with more memory. Scaling up to a larger instance type, such as moving from an r5.4xlarge to an r5.8xlarge or higher, directly increases the available memory for SAP HANA, resolving the out-of-memory issue. Option A is incorrect because reducing the SAP HANA buffer cache size would degrade database performance and does not address the underlying memory shortage. Option B is incorrect because increasing swap space introduces disk-based paging, which can severely slow down HANA due to high latency, and is not a recommended solution. Option C is incorrect because enabling SAP HANA compression can reduce memory usage for data storage but does not add memory capacity; it is a tuning measure, not a direct fix for running out of memory.

Answer

Reduce the SAP HANA buffer cache size

Answer

Increase swap space on the instance

Answer

Enable SAP HANA compression

Question 5

A company runs an SAP system on AWS and wants to implement a disaster recovery (DR) strategy that provides a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. The primary site is in us-east-1 and the DR site is in us-west-2. Which approach meets these requirements?

Accepted Answer

Configure SAP HANA system replication to the DR region and use automatic failover. Configuring SAP HANA system replication to the DR region with automatic failover provides an RTO of less than 2 hours and an RPO of 15 minutes or less. Option A is incorrect because Amazon EBS cross-Region replication does not exist for EBS volumes; snapshots must be copied manually or via AWS Backup, and the RPO would be higher. Option B is incorrect because AWS Backup can copy snapshots, but the minimum backup frequency is hourly (not every 15 minutes), and restoring from snapshots would exceed the RTO. Option D is incorrect because daily backups to S3 have an RPO of 24 hours, which exceeds the required 15 minutes.

Answer

Use Amazon EBS cross-Region replication for all volumes

Answer

Use AWS Backup to copy snapshots to the DR region every 15 minutes

Answer

Take daily backups of the SAP HANA database and store in S3, then restore in us-west-2

Question 6

An SAP administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The administrator wants to receive an alert when CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (Option D) are the correct choice because they can monitor Amazon CloudWatch metrics, such as EC2 CPU utilization, and trigger actions (e.g., SNS notifications) when a specified threshold (e.g., 90% for 5 consecutive minutes) is breached. Option A (AWS CloudTrail) is incorrect because it logs API calls for auditing, not performance metrics. Option B (AWS Config) tracks resource configuration changes, not real-time metrics. Option C (Amazon VPC Flow Logs) captures network traffic metadata, not CPU utilization.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 7

A company runs SAP on AWS and wants to reduce costs for non-production environments that are used only during business hours (8 AM to 6 PM). Which action should the administrator take to minimize costs without losing data?

Accepted Answer

Stop the instances during non-business hours and use Amazon EBS snapshots for backup. Stopping instances when not in use eliminates compute costs while preserving data via Amazon EBS snapshots. Option A (Reserved Instances) is wrong because Reserved Instances are intended for steady-state usage and do not provide savings for intermittent usage; the idea of reducing instance size is not relevant to this option. Option B (Terminate) would lose data unless snapshots are taken, and the question specifies 'without losing data.' Option C (Downsize) could reduce costs but still incurs compute charges 24/7, whereas stopping completely eliminates compute costs during non-business hours.

Answer

Convert the instances to Reserved Instances

Answer

Terminate the instances after business hours

Answer

Downsize the instance types to the smallest available

Question 8

An SAP system on AWS is experiencing high latency between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. Which action should the administrator take to reduce latency?

Accepted Answer

Move the application and database servers to the same Availability Zone. Moving both servers to the same Availability Zone (Option B) reduces network latency because data does not have to traverse the AZ boundary, which adds extra network hops and latency. Creating a placement group (Option A) can help co-locate instances but does not guarantee they are in the same AZ unless specified, and even then, moving to the same AZ is simpler. Upgrading instance types (Option C) does not affect network latency. AWS Direct Connect (Option D) is for connecting on-premises networks to AWS, not for inter-instance communication within a VPC.

Answer

Create a placement group and launch both instances in it

Answer

Upgrade the instance types to compute-optimized instances

Answer

Use AWS Direct Connect to connect the servers

Question 9

A company needs to ensure that only authorized users can access the SAP S/4HANA system running on AWS. Which AWS service can be used to manage user identities and permissions?

Accepted Answer

AWS Directory Service. AWS Directory Service can integrate with on-premises Active Directory to provide a managed directory service, which allows organizations to use existing corporate credentials to access SAP S/4HANA systems running on AWS. This enables centralized user identity management and single sign-on for SAP applications. Option C (IAM) is incorrect because IAM manages access to AWS resources (e.g., EC2, S3), not user identities within SAP applications themselves. Option B (AWS Organizations) is for managing multiple AWS accounts. Option D (Amazon Cognito) is aimed at customer-facing identity management.

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon Cognito

Question 10

Which TWO actions should an SAP administrator take to ensure high availability for an SAP HANA database on AWS? (Choose two.)

Accepted Answer

Enable SAP HANA system replication. Options A and D are correct. Enabling SAP HANA system replication provides data redundancy and automatic failover within the same region. Using a Multi-AZ deployment (e.g., with Amazon EBS multi-attach or cluster) ensures the database is available across different Availability Zones, providing automatic failover and high availability. Option B is wrong because a single large instance is a single point of failure. Option C is wrong because manual snapshots are not automatic and do not provide high availability. Option E is wrong because a single EBS volume is a single point of failure and does not provide redundancy.

Answer

Deploy the database on a single large instance

Answer

Schedule regular manual snapshots

Answer

Use a single EBS volume with high IOPS

Question 11

Which THREE AWS services can be used to monitor and log SAP system activities for security and compliance? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (C) stores log data from SAP systems, AWS CloudTrail (D) logs API calls for auditing, and AWS Config (E) tracks configuration changes for compliance. Amazon Athena (A) is a query service, not a logging service, and Amazon VPC Flow Logs (B) capture network traffic, not system activities.

Answer

Amazon Athena

Answer

Amazon VPC Flow Logs

Question 12

Which TWO Amazon EBS volume types are recommended for SAP HANA database workloads? (Choose two.)

Accepted Answer

io2 Block Express. Options D and E are correct. io2 Block Express provides high performance for SAP HANA, and gp3 provides balanced performance. Option A is wrong because sc1 is cold storage, not suitable for databases. Option B is wrong because st1 is throughput-optimized, not suitable for databases. Option C is wrong because io1 is an older SSD type; io2 Block Express is recommended for SAP HANA.

Answer

sc1 (Cold HDD)

Answer

st1 (Throughput Optimized HDD)

Answer

io1 (Provisioned IOPS SSD)

Question 13

A company is running an SAP application on an SAP HANA database in a multi-AZ deployment on AWS. The operations team notices that the system is experiencing high latency during peak hours. Upon investigation, they find that the EBS volumes attached to the HANA instances are frequently exceeding the provisioned IOPS limit. Which of the following is the MOST effective action to resolve this issue?

Accepted Answer

Increase the volume size of the EBS volumes to increase the baseline IOPS.. Increasing the volume size of EBS volumes increases the baseline IOPS (for gp3) or allows higher provisioned IOPS (for io2), directly addressing the IOPS limit. Option B is wrong because switching to General Purpose SSD (gp3) may not guarantee the needed IOPS if burst credits are exhausted. Option C is wrong because enabling EBS optimization is already enabled for current generation instances and does not increase IOPS limits. Option D is wrong because reducing concurrent connections does not address the IOPS limit of the EBS volumes.

Answer

Switch from Provisioned IOPS SSD (io2) to General Purpose SSD (gp3) volumes.

Answer

Enable EBS optimization on the EC2 instances.

Answer

Reduce the number of concurrent connections to the SAP HANA database.

Question 14

An SAP administrator is troubleshooting a failed backup of an SAP HANA database running on an EC2 instance. The backup is configured to use AWS Backup with a backup vault. The error log shows: 'AccessDenied: User: arn:aws:sts::123456789012:assumed-role/AWSBackupRole/backup-job is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/abcd1234-...' Which IAM policy modification is required to resolve this issue?

Accepted Answer

Add kms:Decrypt permission to the backup role on the KMS key.. The error indicates that the backup role is missing the kms:Decrypt permission on the KMS key used to encrypt the backup vault. This permission is necessary to decrypt the data during the backup process. Option A is incorrect because cloudhsm:Decrypt is unrelated to KMS keys. Option C is incorrect because kms:CreateGrant is used to create grants for cross-account access, not for decryption. Option D is incorrect because kms:Encrypt is used for encryption, not decryption.

Answer

Add cloudhsm:Decrypt permission to the backup role.

Answer

Add kms:CreateGrant permission to the backup role.

Answer

Add kms:Encrypt permission to the backup role.

Question 15

A company has an SAP system running on AWS that uses an Application Load Balancer (ALB) to distribute traffic to multiple EC2 instances. The operations team notices that the ALB is returning 503 errors intermittently. Which of the following is the MOST likely cause?

Accepted Answer

The target instances are failing health checks.. 503 errors are typically returned when the target instances fail health checks and become unhealthy. Option A is wrong because if the security group blocked inbound traffic from the targets, it would cause timeout or 502 errors, not 503. Option C is wrong because insufficient ALB capacity can lead to latency or 502 errors, but 503 specifically indicates unhealthy targets. Option D is wrong because an expired SSL certificate would result in 502 errors (bad gateway), not 503.

Answer

The security group attached to the ALB is blocking inbound traffic from the targets.

Answer

The ALB does not have enough capacity to handle the traffic.

Answer

The SSL certificate on the ALB has expired.