PAS-C01 Operations and Maintenance Practice Test 24 — 15 Questions

Question 1

An SAP administrator needs to ensure that all EC2 instances in the SAP landscape have the correct patches and configurations. Which AWS service can be used to automate OS patch management?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates the process of patching operating systems and applications across EC2 instances (and on-premises servers) using patch baselines, maintenance windows, and compliance reporting. It is the purpose-built AWS service for OS patch management at scale, making it the correct choice for an SAP landscape.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS Config

Question 2

An SAP system on AWS uses Amazon RDS for its database. The operations team needs to perform a point-in-time recovery (PITR) to restore the database to a specific timestamp. Which AWS feature enables PITR for RDS?

Accepted Answer

Automated backups. Amazon RDS automated backups enable point-in-time recovery (PITR) by continuously backing up the database transaction logs and storing them alongside daily snapshots. During the retention period (1–35 days), you can restore to any second within that window, which is exactly what PITR requires. Automated backups are enabled by default when you create an RDS instance (with a default retention of 7 days).

Answer

Manual DB snapshots

Answer

Read Replicas

Answer

Multi-AZ deployment

Question 3

Which THREE factors should be considered when designing an SAP HANA backup strategy on AWS? (Select THREE.)

Accepted Answer

Encryption of backup data at rest and in transit. Option A is correct because SAP HANA backups stored on Amazon S3, EBS snapshots, or transferred over the network must be protected with encryption at rest (e.g., SSE-S3, SSE-KMS, or EBS encryption) and in transit (TLS), which is a core design requirement for compliance and data protection. Option D is correct because a robust backup strategy must address disaster recovery, and cross-region replication of backups (e.g., S3 Cross-Region Replication or copying EBS snapshots to another region) protects against regional failures and supports defined RPO/RTO targets. Option E is correct because backup frequency and retention period directly determine the recoverability window and storage cost, and must be aligned with the SAP HANA recovery point objective (RPO) and any legal or regulatory retention requirements. Option B is not selected because, while security group rules may be part of the overall security configuration, they are not a primary factor in designing the backup strategy itself. Option C is not selected because the EC2 instance type for a backup server is an implementation detail and not a fundamental design factor for the SAP HANA backup strategy.

Answer

Security Group rules for backup traffic

Answer

EC2 instance type for backup server

Question 4

An SAP Basis administrator needs to monitor the memory usage of an SAP HANA database running on an EC2 instance. Which AWS service should be used to collect and visualize custom memory metrics from the OS?

Accepted Answer

Amazon CloudWatch with the CloudWatch Agent. Amazon CloudWatch with the CloudWatch Agent is the correct service to collect and visualize custom memory metrics from the OS. The CloudWatch Agent runs on the EC2 instance and can collect memory and disk metrics that are not available by default, sending them to CloudWatch for visualization and alarming.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Inventory

Answer

AWS Config

Question 5

An SAP administrator is troubleshooting a failed backup of SAP HANA to Amazon S3. The backup is initiated by an SAP HANA BACKUP command using the S3 backint agent. The error log shows 'HTTP 403 Forbidden' when the agent tries to upload to the S3 bucket. The bucket policy allows s3:PutObject from the VPC endpoint. What is the most likely cause?

Accepted Answer

The VPC endpoint policy for S3 does not grant the required actions to the IAM role.. Even when the S3 bucket policy allows s3:PutObject from the VPC endpoint, traffic to S3 via a Gateway VPC Endpoint is also evaluated against the endpoint policy attached to that endpoint. If the endpoint policy does not permit s3:PutObject (or is restricted to a different resource/role), the request is denied with HTTP 403 before the bucket policy is even consulted.

Answer

The S3 bucket does not exist.

Answer

The S3 bucket is not in the same AWS Region as the EC2 instance.

Answer

The S3 bucket uses server-side encryption with AWS KMS (SSE-KMS) and the IAM role lacks kms:GenerateDataKey.

Question 6

An SAP administrator is restoring an SAP HANA database from a backup stored in Amazon S3. The restore fails with an error indicating that the backup file is corrupt. The backup was created using the SAP HANA BACKUP command with the S3 backint agent. What could cause the backup file to be corrupt?

Accepted Answer

The multipart upload of the backup file was interrupted and not completed.. When using the SAP HANA backint agent to back up to S3, the backup file is uploaded via multipart upload. If this multipart upload is interrupted and not completed, the resulting object in S3 will be incomplete, causing it to appear corrupt when attempting to restore. Option A is incorrect because S3 Transfer Acceleration improves transfer speed but does not affect file integrity. Option C is incorrect because S3 Versioning creates multiple versions of the same object but does not corrupt data. Option D is incorrect because S3 Cross-Region Replication creates identical copies of the object, so it would not introduce corruption.

Answer

S3 Transfer Acceleration was used during backup.

Answer

The S3 bucket has versioning enabled.

Answer

The backup was replicated to another AWS Region using S3 Cross-Region Replication.

Question 7

A company uses AWS Systems Manager to automate patching of SAP application servers. Which TWO resources are required to use Systems Manager Patch Manager?

Accepted Answer

AWS Systems Manager Agent (SSM Agent) installed on the EC2 instances. Option B is correct because Patch Manager operates through the AWS Systems Manager Agent (SSM Agent), which must be installed and running on each EC2 instance so the instance can register as a managed node and receive patch commands from the Systems Manager service. Option D is correct because the EC2 instances need an IAM instance profile/role with the required Systems Manager permissions (for example the AWS-managed AmazonSSMManagedInstanceCore policy) so the SSM Agent can communicate with Systems Manager APIs and be managed. Option A is not required because an Application Load Balancer is only for distributing traffic and plays no role in patch management. Option C is not required because Systems Manager connectivity can be achieved via VPC endpoints (PrivateLink) or a NAT gateway, so a NAT gateway is not mandatory. Option E is not required because an internet gateway is only one possible connectivity path and is not a prerequisite for Patch Manager.

Answer

An Application Load Balancer in front of the instances

Answer

A NAT gateway for outbound internet access

Answer

An internet gateway attached to the VPC

Question 8

An SAP administrator needs to back up the SAP HANA database daily with a retention period of 30 days. The backups must be stored in a cost-effective manner and be instantly accessible for recovery. Which AWS service should be used?

Accepted Answer

Amazon S3 Standard. Amazon S3 Standard is the correct choice because it provides low-latency, millisecond access to backup data while remaining cost-effective for a 30-day retention window. SAP HANA backups written to S3 Standard can be restored instantly via AWS Backint Agent or native HANA commands, satisfying the 'instantly accessible' requirement. S3 Standard's durability (11 nines) and lifecycle flexibility make it ideal for short-term operational backups.

Answer

Amazon S3 Glacier

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon EBS Snapshots

Question 9

A company runs SAP on AWS and wants to monitor operating system metrics such as memory usage, disk space, and process status using Amazon CloudWatch. Which agent configuration is required on the SAP application and database servers to send these metrics to CloudWatch?

Accepted Answer

Amazon CloudWatch Agent. The Amazon CloudWatch Agent is the component that runs on EC2 instances (including SAP application and database servers) to collect guest-level OS metrics such as memory usage, disk space, and process status, and publish them to CloudWatch. The default EC2 hypervisor-level metrics do not include memory or disk usage, so the CloudWatch Agent must be installed and configured with a JSON config file specifying the metrics to collect.

Answer

AWS X-Ray Daemon

Answer

EC2 Launch Agent

Answer

AWS Systems Manager Agent

Question 10

A company uses an SAP HANA database on AWS. The database administrator wants to back up the database using Backint integration with AWS. Which AWS service is the recommended target for Backint backups?

Accepted Answer

Amazon S3. SAP Backint integration on AWS is designed to write backups directly to Amazon S3, which serves as the primary, durable, and cost-effective target. AWS provides a Backint agent that interfaces with S3 for both backup and restore operations. S3 is the recommended and supported target for Backint backups in AWS documentation.

Answer

Amazon EFS

Answer

Amazon EBS

Answer

Amazon S3 Glacier

Question 11

An SAP on AWS environment includes multiple instances across Availability Zones. The operations team needs to automatically replace an unhealthy EC2 instance that is part of an SAP application cluster. Which AWS service can automatically detect and replace the instance based on health checks?

Accepted Answer

Auto Scaling group. An Auto Scaling group is designed to automatically maintain a desired number of healthy EC2 instances. It can use EC2 health checks and Elastic Load Balancing health checks to detect unhealthy instances and replace them. This is the standard AWS mechanism for self-healing instance replacement in a cluster.

Answer

Elastic Load Balancing

Answer

AWS Systems Manager Automation

Answer

Amazon CloudWatch alarms

Question 12

An SAP administrator needs to receive alerts when the CPU utilization of an SAP application server exceeds 90% for 5 minutes. Which AWS service should be used to set up the alert?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms (option B) is correct because CloudWatch collects CPU utilization metrics from EC2 instances and can trigger an alarm when a metric breaches a threshold, such as CPUUtilization > 90% for a 5-minute period, using the Average statistic and a 5-minute period with the appropriate evaluation periods. VPC Flow Logs (option A) capture IP traffic metadata for network interfaces and have nothing to do with CPU metrics. AWS CloudTrail (option C) records API activity and management events for auditing, not performance metrics. AWS Config (option D) evaluates resource configuration compliance against rules, not real-time CPU utilization thresholds.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

Which THREE steps should be taken when troubleshooting a slow-running SAP HANA database on AWS? (Select THREE.)

Accepted Answer

Review HANA SQL plan cache for slow queries. Option B is correct because the SAP HANA SQL plan cache stores executed statements with their execution statistics, so reviewing it identifies the specific slow or expensive queries and their access plans that are degrading database performance. Option C is correct because Amazon CloudWatch provides the EC2-level metrics (CPUUtilization, EBSVolumeRead/WriteOps, disk throughput and latency) needed to determine whether the slowdown originates from compute saturation or storage I/O bottlenecks on the host. Option E is correct because HANA is an in-memory database whose performance depends on sufficient memory for column store, row store, and caches; checking allocation against the instance's available RAM and looking for memory pressure (e.g., high used memory, evictions, or swapping) reveals whether the working set no longer fits in memory. Option A is not appropriate as a first step because blindly scaling up the EC2 instance type without diagnosing the root cause wastes cost and may not fix a query, configuration, or I/O problem. Option D is not relevant because IAM roles govern AWS API authorization and do not affect HANA query execution speed or database resource utilization.

Answer

Immediately scale up the EC2 instance type

Answer

Review IAM roles attached to the instance

Question 14

Which TWO AWS services can be used to monitor the health of SAP systems and send notifications? (Select TWO.)

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (B) is correct because it is the AWS monitoring service that collects metrics and logs from SAP systems (e.g., via the CloudWatch agent or SAP-specific metrics), evaluates them against thresholds using CloudWatch alarms, and can trigger notifications when health conditions are breached. Amazon Simple Notification Service (E) is correct because SNS is the pub/sub messaging service that delivers those alarm or event notifications to subscribers via email, SMS, HTTP/S endpoints, or Lambda, completing the monitor-and-notify workflow. AWS Config (A) is incorrect because it records and evaluates resource configuration compliance, not runtime system health or metric-based monitoring. AWS CloudTrail (C) is incorrect because it only logs API activity and account events for auditing, not SAP health metrics. Amazon Athena (D) is incorrect because it is an interactive query service for data in S3, with no role in health monitoring or alerting.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Athena

Question 15

A company runs SAP ERP on AWS using a Multi-AZ RDS for SAP HANA database. The operations team needs to automate the rotation of the database master password. Which AWS service should be used to securely store and rotate the password?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing and automatically rotating secrets such as database credentials. It natively supports Amazon RDS (including RDS for SAP HANA) with built-in rotation Lambda functions that can rotate the master password without manual intervention. Parameter Store, while capable of storing secrets, does not provide automated rotation. CloudHSM is for dedicated hardware security modules, and IAM is for identity and access management, not secret storage and rotation.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)