PAS-C01 Operations and Maintenance Practice Test 22 — 15 Questions

Question 1

A company runs SAP S/4HANA on AWS with a production database on Amazon EC2. The backup strategy includes daily Amazon EBS snapshots of the SAP HANA data and log volumes. The operations team needs to restore the database to a specific point in time within the last 24 hours after a logical data corruption event. The team wants to use AWS native services to perform the restore with minimal manual effort. Which approach should the team use to restore the SAP HANA database to a specific point in time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Backup to create a backup plan that includes the EC2 instance and EBS volumes, and enable point-in-time recovery (PITR) for the SAP HANA database using AWS Backup's continuous backup feature.. AWS Backup continuous backup for EBS volumes enables point-in-time recovery within the retention period, allowing restoration to any point in time within the last 24 hours. This is the only option that uses AWS native services to provide true PITR for the SAP HANA volumes. Other options either rely on snapshot intervals or do not support arbitrary point-in-time recovery.

Answer

Take hourly EBS snapshots instead of daily snapshots and restore the snapshot closest to the desired point in time, then apply SAP HANA redo logs manually.

Answer

Restore the most recent EBS snapshot and then use SAP HANA's point-in-time recovery by replaying the redo log files from the log volume backup.

Answer

Configure SAP HANA to use its native backup tool to write backups directly to Amazon S3, and use S3 versioning to restore to a specific point in time.

Question 2

A company runs a production SAP S/4HANA system on AWS. The IT team needs to ensure that all Amazon EBS volumes attached to the SAP HANA database instance are backed up on a daily basis, with the ability to restore individual volumes if needed. Which AWS service should they use to automate this process?

Accepted Answer

AWS Backup. AWS Backup is the appropriate service to automate daily backups of EBS volumes with centralized management and restore capabilities. It supports EBS volumes and provides a unified backup solution. EBS snapshot lifecycle policies are limited to EBS and lack full backup management features, while Storage Gateway and S3 Lifecycle policies serve different purposes and do not back up EBS volumes.

Answer

Amazon EBS snapshot lifecycle policies

Answer

AWS Storage Gateway

Answer

Amazon S3 Lifecycle policies

Question 3

A company runs SAP S/4HANA on AWS with a production database on Amazon EC2. The backup strategy includes daily Amazon EBS snapshots of the SAP HANA data and log volumes. The operations team needs to restore the database to a specific point in time within the last 24 hours after a logical data corruption event. The team wants to use AWS native services to perform the restore with minimal manual effort. Which approach should the team use to restore the SAP HANA database to a specific point in time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Load Balancer with a static IP address. The SAP central services instance requires a stable endpoint for application servers to connect. A Network Load Balancer provides a static IP address and can forward traffic at the TCP level to the central services instance. If the instance changes, the NLB target can be updated, and the application servers continue to use the same NLB endpoint. Other options either lack static IPs, are not protocol-appropriate, or require application changes.

Answer

AWS Cloud Map

Answer

Application Load Balancer with sticky sessions

Answer

Amazon Route 53 private hosted zone with a CNAME record

Question 4

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

Accepted Answer

Review CloudWatch metrics for the instance and the ALB target group. Reviewing CloudWatch metrics for the instance and the ALB target group is the correct first step because it provides immediate visibility into the root cause of intermittent connectivity issues. Metrics such as TargetResponseTime, RequestCount, and HealthyHostCount can reveal whether the problem is due to high latency, request failures, or the instance being marked unhealthy by the ALB health checks. This data-driven approach avoids unnecessary changes and aligns with the AWS Well-Architected Framework's principle of observability.

Answer

Modify the security group to allow all traffic temporarily

Answer

Terminate the instance and let Auto Scaling launch a new one

Answer

Attach an additional Elastic Network Interface (ENI) to the instance

Question 5

A DevOps engineer needs to automatically restart a specific service on an EC2 instance whenever the service crashes. The instance is running Amazon Linux 2. Which approach is the MOST operationally efficient?

Accepted Answer

Configure the service as a systemd unit with Restart=on-failure. Systemd, the default init system on Amazon Linux 2, provides a built-in `Restart=` directive that can be set to `on-failure`. This instructs systemd to automatically restart the service unit when it exits with a non-zero exit code or is terminated by a signal, without requiring any external monitoring or additional infrastructure. This is the most operationally efficient approach as it leverages the native service manager functionality with zero external dependencies.

Answer

Set up a CloudWatch alarm that triggers an SSM Run Command to restart the service

Answer

Write a cron job that checks the service status every minute and restarts it if needed

Answer

Use an AWS Lambda function that polls the service status and calls the EC2 reboot API

Question 6

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

Accepted Answer

Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.. AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Answer

Examine the S3 server access logs for the bucket.

Answer

Review the configuration timeline in AWS Config for the S3 bucket.

Answer

Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.

Question 7

A company wants to centralize monitoring of EC2 instance metrics across multiple AWS accounts. Which solution is MOST scalable and cost-effective?

Accepted Answer

Set up CloudWatch cross-account observability with a monitoring account.. CloudWatch cross-account observability (option D) is the most scalable and cost-effective solution for centralizing monitoring across multiple AWS accounts, as it allows a single monitoring account to aggregate metrics, logs, and traces from source accounts without manual logins or complex data pipelines. Option A, while not scalable for large environments, can be used for simple, ad-hoc checks in small setups; however, the question specifically asks for the MOST scalable and cost-effective approach, which is solely option D. The previous marking of option B as correct was in error; option B refers to cross-region metrics, which do not aggregate across accounts. Option C is inefficient and costly due to storage and query overhead.

Answer

Log in to each account and view CloudWatch metrics individually.

Answer

Use CloudWatch cross-region metrics to aggregate metrics in a single account.

Answer

Configure each account to publish metrics to an S3 bucket and use Athena to query.

Question 8

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

Accepted Answer

The reserved concurrency is set too low; increase the reserved concurrency for the function.. Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Answer

The SQS visibility timeout is too short; increase it.

Answer

The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

Answer

The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.

Question 9

A company is designing a disaster recovery plan for a critical application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses an RDS Multi-AZ database. Which TWO actions should the operations team take to minimize recovery time and data loss?

Accepted Answer

Configure automated EBS snapshots for EC2 instances and copy them to a secondary region.. Automated EBS snapshots, when copied to a secondary region, provide a mechanism to restore EC2 instances and their data in the event of a regional failure. This minimizes recovery time by having the snapshots available in the DR region, and minimizes data loss by ensuring point-in-time backups are replicated off-site. The snapshots can be used to launch new instances or create AMIs in the secondary region, supporting the recovery of the Auto Scaling group.

Answer

Create an AMI from a running instance and share it with the secondary region.

Answer

Use Route53 health checks to automatically failover traffic to a standby environment.

Question 10

A company runs a production web application on EC2 instances behind an ALB. The operations team receives an alert that the application is returning HTTP 503 errors. Which THREE steps should be taken to diagnose the issue?

Accepted Answer

Check the ALB's HealthyHostCount metric in CloudWatch.. The ALB's HealthyHostCount metric in CloudWatch shows the number of healthy targets registered to the target group. A value of zero or a persistent drop indicates that all EC2 instances are failing health checks, which directly causes HTTP 503 errors because the ALB has no healthy targets to forward traffic to. This metric is the first place to check when diagnosing 503 errors, as it pinpoints whether the issue is with target health rather than network connectivity or load.

Answer

Review VPC Flow Logs to identify if traffic is reaching the ALB.

Question 11

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.

Question 12

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

Accepted Answer

A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.. The CodePipeline service role needs permissions to write objects to the S3 bucket and list its contents to verify the upload. A custom policy with s3:PutObject and s3:ListBucket on the target bucket grants exactly these required actions, resolving the 'Access Denied' error during the Deploy stage.

Answer

CloudFrontFullAccess

Answer

AdministratorAccess

Answer

AmazonS3ReadOnlyAccess

Question 13

A company runs a critical workload on Amazon RDS for PostgreSQL with Multi-AZ. The operations team notices that during a recent failover test, the DNS record updated in about 60 seconds. However, the application experienced a 2-minute downtime because some connections were not re-established quickly. What should the team do to reduce downtime during failover?

Accepted Answer

Configure the application's connection string to use the RDS endpoint with a retry mechanism.. During a Multi-AZ failover, the RDS DNS record is updated to point to the standby instance. However, DNS caching at the client side can cause delays. By configuring the application to use a retry mechanism on the RDS endpoint, connections are re-established quickly after failover completes, without waiting for DNS TTL expiry. This reduces downtime compared to approaches that rely solely on DNS propagation.

Answer

Enable automated backups with a short retention period.

Answer

Increase the TTL of the RDS DNS record to 300 seconds.

Answer

Place a Network Load Balancer in front of the RDS instance.

Question 14

A company uses AWS CloudTrail to log API calls. The security team wants to detect unauthorized attempts to modify security group rules and send real-time alerts. Which TWO AWS services should be used together to achieve this?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Events (or EventBridge) can capture CloudTrail API calls related to security group modifications (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress) and route them to an SNS topic. SNS then sends real-time alerts (e.g., email, SMS) to the security team. This combination provides event-driven, near-instantaneous notification without polling or custom code.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances running a web server. The web servers write logs to an Amazon EFS file system mounted across all instances. The operations team reports that the web application is experiencing intermittent high latency and timeouts. Monitoring shows that the ALB's target response time is normal, but the application's internal processing time is high. Further investigation reveals that the EFS performance metrics show high 'BurstCreditBalance' and 'PercentIOLimit' during the latency spikes. The EFS file system is configured with 'Bursting' throughput mode. The team needs to resolve the latency issue with minimal cost. What should they do?

Accepted Answer

Increase the size of the EFS file system to increase the baseline throughput and burst credits.. Increasing the size of an EFS file system in Bursting mode raises its baseline throughput and burst credit accumulation rate. The high BurstCreditBalance and PercentIOLimit indicate the file system is exhausting its burst credits and hitting its I/O limit, causing throttling and latency. A larger EFS volume provides a higher baseline throughput, reducing reliance on burst credits and smoothing performance without additional cost for Provisioned Throughput.

Answer

Migrate the log files to Amazon S3 and use S3 Transfer Acceleration for writes.

Answer

Switch the EFS throughput mode to Provisioned Throughput to guarantee higher performance.

Answer

Add more EC2 instances to the Auto Scaling group to distribute the I/O load.