PAS-C01 Operations and Maintenance Practice Test 23 — 15 Questions

Question 1

A company has a production AWS account that contains an Amazon RDS for MySQL DB instance. The database is critical and must have automated backups enabled with a retention period of 30 days. The company also requires point-in-time recovery to any second within the retention period. The operations team has configured automated backups with a retention period of 30 days, but they notice that the automated backups are not being taken consistently. The DB instance is in a Multi-AZ deployment and has a storage size of 500 GB. The team checks the backup window and finds that it is set to 02:00-03:00 UTC. The backup window is non-overlapping with the maintenance window. The DB instance is actively used during the backup window with heavy write traffic. Which of the following is the MOST likely reason for the inconsistent automated backups?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The heavy write traffic during the backup window causes I/O suspension and backup failures.. The heavy write traffic during the backup window causes I/O suspension, which can lead to backup failures. When an RDS for MySQL DB instance experiences high write activity during a backup, the backup process may be delayed or fail due to I/O suspension, especially if the instance is under heavy load. This is because automated backups require a consistent snapshot, and excessive write I/O can prevent the snapshot from completing within the backup window.

Answer

The storage size of 500 GB exceeds the maximum backup size limit.

Answer

The Multi-AZ deployment does not support automated backups.

Answer

The backup window overlaps with the maintenance window.

Question 2

A company is running a critical web application on EC2 instances behind an Application Load Balancer. During a recent deployment, a new version of the application was released, and within minutes, the error rate spiked. The operations team rolled back the deployment, but the error rate remained high. The team suspects that the ALB is still routing traffic to unhealthy instances. Which step should the team take to immediately stop routing traffic to the problematic instances?

Accepted Answer

Deregister the instances from the target group.. Deregistering the problematic EC2 instances from the target group immediately stops the Application Load Balancer from routing any new traffic to them. The ALB performs health checks on registered targets, but if an instance is unhealthy, it still remains in the target group and can receive traffic if the health check logic is misconfigured or if the instance is in a 'draining' state. Deregistration forces the ALB to complete any in-flight requests and then remove the instance from the routing table, providing an immediate stop to traffic.

Answer

Modify the ALB listener rules to point to a different target group.

Answer

Modify the health check interval to 5 seconds and the unhealthy threshold to 2.

Answer

Stop the EC2 instances from the AWS Management Console.

Question 3

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.. Option C is correct because Patch Manager relies on the SSM Agent being installed, running, and able to reach the Systems Manager endpoints; if the agent is stopped, outdated, or blocked by networking/proxy issues, the instance cannot receive or execute the patch command and will report 'Failed'. Option D is correct because the AWS-RunPatchBaseline document is the SSM document that Patch Manager invokes, and its per-instance output in Run Command history contains the actual error details (for example, baseline resolution failures, missing permissions, or patch installation errors) needed to diagnose why patching failed. Option A is not appropriate because patch baselines are associated through patch groups or by default, not by directly assigning baselines to individual instance IDs, and doing so would not address the reported failure. Option B is not the best troubleshooting step here because the instances already have the SSM Agent and are appearing in Patch Manager, which indicates the required IAM role for Systems Manager is generally present; the failure is more likely execution- or communication-related. Option E is not correct because a Maintenance Window is a scheduling mechanism, not a fix for instances that already ran a patching operation and reported 'Failed'.

Answer

Assign the patch baseline to the instance IDs directly.

Answer

Ensure that the instances have the appropriate IAM role that allows them to be patched.

Answer

Configure a Maintenance Window for the patching operation.

Question 4

A financial services company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances for the web tier, and an Amazon RDS for MySQL database for the backend. The operations team uses AWS CloudFormation to manage infrastructure. During a recent deployment, a change to the database security group caused an outage because the web tier lost connectivity to the database. The team wants to prevent similar incidents in the future. They need a solution that allows them to review and approve changes to critical resources before deployment, while still enabling rapid deployment for non-critical changes. The team uses AWS CodePipeline for CI/CD. Which approach should the team implement?

Accepted Answer

Use CloudFormation Change Sets in the pipeline and add a manual approval step for any change that modifies the database security group.. CloudFormation Change Sets allow you to preview how proposed changes will affect your resources before execution. By integrating a manual approval step in the CodePipeline that triggers specifically when the change set modifies the database security group, the team can review and approve critical changes while allowing non-critical changes to proceed automatically. This directly addresses the requirement to prevent outages from unapproved security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant changes before they are applied.

Answer

Use AWS Service Catalog to create a portfolio of approved stacks and require all deployments to use the portfolio.

Answer

Use AWS CloudTrail to monitor changes to the security group and trigger a rollback if unauthorized changes are detected.

Question 5

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Accepted Answer

Check SAP application logs for errors, then check HANA database status using HDBSQL, then verify network connectivity using ping and telnet, then verify security group and NACL rules, then verify authentication credentials.. Troubleshooting should start with logs, then check database status, network, security groups, and authentication.

Answer

Check HANA database status using HDBSQL, then check SAP application logs for errors, then verify network connectivity using ping and telnet, then verify authentication credentials, then verify security group and NACL rules.

Answer

Verify network connectivity using ping and telnet, then verify security group and NACL rules, then check SAP application logs for errors, then check HANA database status using HDBSQL, then verify authentication credentials.

Answer

Verify authentication credentials, then check SAP application logs for errors, then check HANA database status using HDBSQL, then verify network connectivity using ping and telnet, then verify security group and NACL rules.

Question 6

Drag and drop the steps to configure an SAP Fiori front-end server on AWS behind an Application Load Balancer (ALB) into the correct order.

Accepted Answer

Launch EC2 instances, then create a target group, then register instances with target group, then create an ALB with HTTPS listener and SSL certificate, then update DNS.. Fiori ALB setup requires EC2 instances, target group, ALB listener, certificate, and DNS update.

Answer

Launch EC2 instances, then create an ALB with HTTPS listener and SSL certificate, then create a target group, then register instances, then update DNS.

Answer

Create a target group, then register instances, then create an ALB with HTTPS listener and SSL certificate, then launch EC2 instances, then update DNS.

Answer

Update DNS, then launch EC2 instances, then create a target group, then register instances, then create an ALB with HTTPS listener and SSL certificate.

Question 7

An SAP system on AWS is experiencing performance degradation. Amazon CloudWatch metrics show high CPU utilization on the application server, but the database server (RDS) metrics are normal. The application team suspects a memory leak. Which action should the operations team take FIRST to confirm the issue?

Accepted Answer

Install the CloudWatch agent on the application server and enable memory metrics.. CloudWatch cannot see inside the OS without the CloudWatch agent. Installing the agent and collecting memory metrics is the first step to confirm a memory leak. Option A is wrong because CloudWatch does not provide memory metrics by default. Option C is wrong because rebooting is disruptive and does not help diagnose. Option D is wrong because switching to a larger instance is a reactive fix, not diagnostic.

Answer

Review the existing CloudWatch CPU utilization and memory metrics for the application server.

Answer

Reboot the application server and monitor performance after reboot.

Answer

Increase the instance size of the application server to handle the load.

Question 8

An operations team needs to monitor the disk space usage of SAP application servers running on EC2. Which combination of AWS services should they use?

Accepted Answer

Amazon CloudWatch agent and Amazon CloudWatch alarms. Amazon CloudWatch agent is required to collect custom metrics like disk space usage from EC2 instances, as the standard CloudWatch metrics only cover CPU, memory, network, and disk I/O. By installing the agent and configuring it to report disk space metrics, you can then set CloudWatch alarms to trigger notifications when thresholds are breached, enabling proactive monitoring of SAP application servers.

Answer

Amazon CloudWatch and AWS CloudTrail

Answer

AWS Lambda and Amazon DynamoDB

Answer

Amazon S3 and Amazon SNS

Question 9

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the MOST likely cause?

Accepted Answer

The target instances are failing health checks.. ALB returns HTTP 503 Service Unavailable when no healthy targets are available in the target group to receive the request. If the target EC2 instances (web dispatchers) are failing health checks, the ALB marks them unhealthy and, once all targets are unhealthy, returns 503 to clients. This is the most likely cause of the observed failures.

Answer

The SSL certificate on the ALB has expired.

Answer

Security groups allow too much traffic.

Answer

The ALB is out of capacity.

Question 10

Which TWO actions should an operations team take to ensure high availability for SAP HANA in a single AWS Region?

Accepted Answer

Deploy SAP HANA in a Multi-AZ configuration using HANA System Replication.. Option B is correct because deploying SAP HANA across multiple Availability Zones within a single AWS Region using HANA System Replication provides the AZ-level fault tolerance required for high availability; if one AZ fails, the secondary HANA node in another AZ can take over. Option C is correct because HANA System Replication alone only keeps the secondary in sync—configuring automatic failover (e.g., via a cluster solution such as Pacemaker with a STONITH/fencing mechanism and an overlay IP) ensures the standby is promoted without manual intervention, which is essential for true high availability. Option A is not correct because read replicas are a read-scaling/reporting feature, not an HA failover mechanism for the primary HANA database. Option D is not correct because automated backups to Amazon S3 address durability and disaster recovery (RPO), not continuous availability or automatic failover. Option E is not correct because a single large EC2 instance in one Availability Zone is a single point of failure and provides no high availability at all.

Answer

Create read replicas of the HANA database.

Answer

Configure automated backups to Amazon S3.

Answer

Use a single large EC2 instance in one Availability Zone.

Question 11

Which THREE metrics should an operations team monitor to detect performance issues in an SAP HANA database running on EC2?

Accepted Answer

CPU utilization. CPU utilization (A) is a core SAP HANA metric because HANA is an in-memory, highly parallelized database whose column-store operations and SQL execution consume significant CPU, so sustained high utilization directly signals query or workload performance degradation. Disk I/O read/write latency (B) must be monitored because HANA persists data and logs to disk (savepoints, redo log writes, and data loads from disk into memory), and elevated latency on EBS volumes stalls commits and checkpoints. Memory usage (D) is critical since HANA keeps the working data set in RAM; if memory pressure forces column-store tables to be unloaded or causes out-of-memory conditions, query performance drops sharply. Network packets in/out (C) is not a primary HANA performance indicator because packet counts alone don't reveal database-internal bottlenecks such as CPU saturation, memory eviction, or storage latency. Swap usage (E) is not applicable as a HANA performance metric because SAP HANA does not support swapping — it requires sufficient RAM and disables OS swap, so swap activity indicates a misconfiguration rather than a normal performance signal.

Answer

Network packets in/out

Answer

Swap usage

Question 12

Refer to the exhibit. An SAP HANA instance is running on an EC2 instance. The volume `/dev/sdf` is used for HANA data. The operations team needs to increase the disk size for HANA data without downtime. Which action should they take?

Accepted Answer

Modify the EBS volume size while the instance is running.. Amazon EBS supports elastic volume modification, allowing you to increase size, adjust IOPS, or change volume type while the volume is attached and the instance is running. For SAP HANA, this means the data volume can be expanded online without downtime, provided the filesystem is grown afterward. This meets the no-downtime requirement.

Answer

Launch a new instance with a larger volume and migrate HANA data.

Answer

Stop the instance, modify the volume size, and start the instance.

Answer

Add a new EBS volume to the instance and move HANA data to the new volume.

Question 13

An SAP administrator needs to perform an OS-level patching of the underlying EC2 instances hosting an SAP HANA database in a production environment. The HANA database is configured with system replication across two Availability Zones. What is the best practice to minimize downtime?

Accepted Answer

Fail over to the secondary HANA instance, apply patches to the primary, then fail back.. With HANA system replication across two AZs, the best practice for OS patching is to perform a planned takeover to the secondary site, patch the now-secondary (original primary) instance, then take over back to the original primary. This keeps the database available throughout, minimizing downtime to only the brief takeover windows.

Answer

Stop the EC2 instance, apply patches, and start.

Answer

Take a snapshot of the volume, patch the OS, and restore if needed.

Answer

Stop the HANA database, apply patches, and restart.

Question 14

A company runs SAP ERP on AWS with a DR strategy using cross-region replication for SAP HANA. During a DR drill, the team discovers that the HANA database is not starting on the DR instance. Which configuration is most likely missing?

Accepted Answer

HANA system replication configuration with the correct 'PRIMARY' and 'SECONDARY' roles.. HANA system replication configuration with the correct PRIMARY and SECONDARY roles is most likely missing because the DR instance must be configured as a secondary site in the HANA system replication setup. Without proper configuration, the HANA database on the DR instance cannot start or take over. This is a critical configuration for cross-region replication and DR failover.

Answer

IAM roles for the DR instance to access S3.

Answer

EBS encryption on the DR volumes.

Answer

CloudWatch agent for logging.

Question 15

An SAP Basis team is troubleshooting a performance issue on an SAP HANA database running on AWS. The HANA index server is consuming high CPU. The team suspects that the underlying EC2 instance is throttled. Which CloudWatch metric should be checked to confirm CPU throttling?

Accepted Answer

CPUCreditBalance. CPUCreditBalance is the CloudWatch metric that reveals how many CPU credits remain on a T-series (burstable) EC2 instance. When the balance hits zero, the instance is throttled to its baseline CPU performance, which directly explains high CPU utilization inside HANA while the underlying instance is starved.

Answer

CPUUtilization

Answer

NetworkIn

Answer

DiskReadOps