PAS-C01 Operations and Maintenance Practice Test 26 — 15 Questions

Question 1

A company runs SAP on AWS and uses a distributed deployment with multiple application servers in an Auto Scaling group. They want to ensure that when a new instance is launched, it is automatically registered with the SAP Central Services instance. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Auto Scaling lifecycle hook that triggers a Lambda function to perform the registration when the instance enters the 'InService' state.. Auto Scaling lifecycle hooks allow you to pause an instance during launch and perform custom actions, such as invoking a Lambda function to register the instance with SAP Central Services, before the instance is placed in service. Option A is incorrect because user data runs at boot but does not integrate with the Auto Scaling lifecycle to ensure registration completes before the instance becomes healthy. Option B is incorrect because CloudFormation is used for infrastructure provisioning and not for per-instance registration triggered by scaling events. Option C is incorrect because AWS Systems Manager Run Command is not automatically triggered during Auto Scaling launches; it requires manual or scheduled execution.

Answer

Configure the user data script to run the registration command on instance boot.

Answer

Use an AWS CloudFormation template to create the instance and include the registration in the template.

Answer

Use AWS Systems Manager Run Command to register the instance after it launches.

Question 2

An SAP system running on EC2 is experiencing intermittent connectivity issues between application servers and the database server. The network team suspects that the security group rules are too restrictive. What is the best approach to identify which traffic is being blocked?

Accepted Answer

Enable VPC Flow Logs on the subnet or ENI and review the logs for rejected traffic.. VPC Flow Logs capture IP traffic metadata going to and from network interfaces in a VPC, including whether traffic was accepted or rejected by security groups and network ACLs. Enabling flow logs on the subnet or ENI and filtering for REJECT entries directly identifies which traffic the security group rules are blocking, making it the precise diagnostic tool.

Answer

Check the SAP application logs for connection errors.

Answer

Enable AWS CloudTrail and look for security group modification events.

Answer

Use Amazon CloudWatch to monitor network packets.

Question 3

A company runs SAP on AWS and uses a custom AMI for their EC2 instances. They want to ensure that all instances launched from this AMI automatically have the SAP host agent installed and configured. What is the most efficient way to achieve this?

Accepted Answer

Create a new AMI that includes the SAP host agent pre-installed and configured.. Baking the SAP host agent into the AMI ensures that every instance launched from that AMI automatically has the agent installed and configured with no additional steps. This is the most efficient approach as it avoids post-launch configuration, reduces potential failure points, and ensures consistency.

Answer

Use AWS Systems Manager Run Command to install the agent after launch.

Answer

Use a user data script that installs and configures the SAP host agent at instance launch.

Answer

Use AWS CodeDeploy to automatically deploy the agent to new instances.

Question 4

An SAP administrator needs to apply a security patch to the operating system of an EC2 instance running SAP. The instance is part of an Auto Scaling group. What is the best practice to apply the patch while minimizing downtime?

Accepted Answer

Create a new AMI with the patch applied, update the launch configuration, and perform a rolling update using an Auto Scaling lifecycle hook.. Creating a new AMI with the patch applied, updating the launch configuration, and performing a rolling update using an Auto Scaling lifecycle hook is the best practice to minimize downtime. This approach ensures that new instances are launched with the patched AMI, and the rolling update gradually replaces old instances without service interruption. Lifecycle hooks allow you to perform actions before instances are terminated or after they are launched, ensuring graceful transitions.

Answer

Update the launch configuration with the patched AMI and manually terminate running instances.

Answer

Stop the Auto Scaling group, patch the instance, and restart the group.

Answer

SSH into each instance and apply the patch manually.

Question 5

An SAP system is deployed on EC2 with a Multi-AZ RDS for SAP ASE database. The operations team needs to ensure that database backups are stored in a separate AWS account for compliance. Which TWO actions should they take?

Accepted Answer

Use AWS KMS with cross-account permissions to allow the target account to decrypt and copy the snapshots.. Option C is correct because RDS snapshots are encrypted with an AWS KMS customer managed key, and to copy a snapshot into a separate account the key policy must grant the target account (and its principal) permissions to use the key for Decrypt and CreateGrant, allowing the shared encrypted snapshot to be copied and re-encrypted in the destination account. Option D is correct because AWS Backup supports cross-account backup through a backup policy/vault in the source account and a cross-account monitoring/vault configuration in the target account, which copies RDS snapshots (including SAP ASE) to the separate account for compliance. Option A is wrong because RDS snapshots cannot be shared publicly, and public sharing would violate compliance requirements anyway. Option B is wrong because S3 cross-region replication applies to S3 objects, not to RDS automated backups or snapshots. Option E is wrong because there is no 'automatic cross-account backup' toggle in the RDS console; cross-account copying requires explicit KMS permissions or AWS Backup configuration.

Answer

Share the snapshots publicly and then copy them to the target account.

Answer

Configure S3 cross-region replication for the automated backups.

Answer

Enable automatic cross-account backup in the RDS console.

Question 6

A company runs SAP on AWS and uses CloudWatch for monitoring. They want to set up an alarm that notifies the operations team when the CPU utilization of their SAP application server exceeds 90% for 5 consecutive minutes. Which THREE components are required to achieve this? (Select THREE.)

Accepted Answer

A CloudWatch alarm configured with the metric and threshold.. Option B is correct because a CloudWatch alarm is the component that evaluates the CPU utilization metric against the 90% threshold over the specified evaluation period (5 consecutive minutes) and triggers the action when the condition is breached. Option C is correct because an Amazon SNS topic is the standard notification mechanism that CloudWatch alarms invoke to deliver email, SMS, or other messages to the operations team. Option E is correct because the alarm must be based on a CloudWatch metric for CPU utilization (e.g., CPUUtilization from the EC2 namespace) to have data to evaluate against the threshold. Option A is incorrect because CloudTrail records API activity for auditing, not alarm actions, and is not needed for notifications. Option D is incorrect because a Lambda function is not required; SNS alone can deliver the notification, and Lambda would only be needed for custom processing logic.

Answer

AWS CloudTrail to log the alarm actions.

Answer

An AWS Lambda function to process the alarm.

Question 7

A company is running an SAP HANA database on an EC2 instance with EBS volumes. The operations team notices that the /hana/data filesystem is growing faster than expected and the available space is critically low. Which action should be taken to monitor the disk space usage proactively?

Accepted Answer

Publish custom CloudWatch metrics for disk space and set an alarm.. The correct option is C: publishing custom CloudWatch metrics for disk space and setting an alarm. CloudWatch does not natively collect OS-level filesystem metrics like /hana/data usage from EC2, so the CloudWatch agent must be installed to publish custom metrics (e.g., via the disk_used_percent metric in the CWAgent namespace), and an alarm can then proactively notify the team before space runs out. AWS Budgets (A) only tracks cost/spend, not actual disk utilization. AWS Config rules (B) evaluate resource configuration compliance, not filesystem space consumption. AWS Trusted Advisor (D) provides service-limit and best-practice checks but does not offer per-filesystem disk utilization monitoring for EC2 instances.

Answer

Configure AWS Budgets to alert on storage costs.

Answer

Use AWS Config rules to monitor disk space.

Answer

Create an AWS Trusted Advisor check for disk utilization.

Question 8

A company wants to automate the patching of SAP application servers running on EC2 instances. Which AWS service should be used to schedule and apply OS patches?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager (option C) is the correct choice because it is purpose-built to automate OS patching on EC2 instances, including SAP application servers, by using patch baselines, maintenance windows, and compliance reporting to schedule and apply patches at scale. It integrates natively with EC2 and on-premises servers via the SSM Agent, allowing automated patch scans and installs without manual intervention. AWS Config (A) is an auditing and compliance service that records resource configurations and evaluates rules, but it does not apply patches. AWS CloudFormation (B) is an infrastructure-as-code provisioning service and cannot schedule or install OS patches. AWS OpsWorks (D) is a configuration management service (Chef/Puppet) that can manage instances but is not the dedicated patching solution and is not the recommended service for this specific automation task.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Question 9

A company runs SAP on AWS and has configured automated snapshots of EBS volumes for backup. The operations team discovers that the snapshots are not being deleted after the retention period. Which action should be taken to ensure snapshots are automatically deleted?

Accepted Answer

Use Amazon Data Lifecycle Manager to create a snapshot lifecycle policy.. Amazon Data Lifecycle Manager (DLM) is the native AWS service for automating the creation, retention, and deletion of EBS snapshots. By defining a lifecycle policy with a retention count or retention period, DLM automatically deregisters and deletes snapshots that exceed the schedule, which directly solves the problem of snapshots not being deleted.

Answer

Set an S3 Lifecycle policy on the snapshots.

Answer

Create a CloudWatch Events rule to invoke a Lambda function for deletion.

Answer

Configure retention policy directly on the EBS volume.

Question 10

An SAP administrator needs to grant an external auditor read-only access to view SAP system logs stored in CloudWatch Logs. Which AWS identity-based policy should be used?

Accepted Answer

CloudWatchLogsReadOnlyAccess. The AWS managed policy CloudWatchLogsReadOnlyAccess grants read-only permissions specifically for CloudWatch Logs actions such as DescribeLogGroups, DescribeLogStreams, GetLogEvents, and FilterLogEvents. This is the least-privilege policy for an auditor who only needs to view log data, not modify or delete it. It does not grant access to other CloudWatch services like metrics or alarms, which are not required for log inspection.

Answer

AWSSupportAccess

Answer

AmazonS3ReadOnlyAccess

Answer

CloudWatchReadOnlyAccess

Question 11

An SAP system on AWS is experiencing high CPU utilization on the database server. The operations team suspects a specific query is causing the issue. Which combination of AWS services should be used to identify the query?

Accepted Answer

Amazon RDS Performance Insights and CloudWatch Logs. Amazon RDS Performance Insights provides detailed database load and query-level metrics, allowing identification of the specific SQL query causing high CPU. CloudWatch Logs can capture database logs (e.g., slow query logs) for further analysis. Together, they pinpoint the problematic query. This combination is specific to database performance diagnostics.

Answer

Amazon CloudWatch Metrics and AWS X-Ray

Answer

AWS CloudTrail and Amazon Athena

Answer

VPC Flow Logs and Amazon GuardDuty

Question 12

A company runs SAP on AWS and needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (option E) is the service that records every API call made to AWS services, capturing the identity of the caller, the time, source IP, request parameters, and response, which is exactly what is needed for auditing API activity. Amazon CloudWatch Logs (option C) is used together with CloudTrail because CloudTrail can deliver its event logs to a CloudWatch Logs log group, enabling centralized storage, monitoring, metric filters, and alerting on those API events. Amazon S3 (option A) can store CloudTrail logs, but by itself it does not capture or log API calls, so it is not one of the two required services. VPC Flow Logs (option B) only capture IP traffic metadata for network interfaces in a VPC and do not record AWS API calls. AWS Config (option D) tracks resource configuration changes and compliance, not the full set of API calls made to AWS services.

Answer

Amazon S3

Answer

VPC Flow Logs

Answer

AWS Config

Question 13

An SAP system administrator needs to automate the patching of SAP applications on EC2 instances. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates patching for managed instances, including SAP applications on EC2. Option A (Amazon Inspector) is for vulnerability assessment, not patching. Option C (AWS OpsWorks) is for configuration management with Chef/Puppet, not specifically for patching. Option D (AWS Config) is for configuration compliance monitoring, not patching.

Answer

Amazon Inspector

Answer

AWS OpsWorks

Answer

AWS Config

Question 14

A company is running SAP on AWS and wants to send alerts when the CPU utilization of an EC2 instance exceeds 90% for 5 minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the service that evaluates metric thresholds (such as EC2 CPUUtilization) over a specified period and triggers actions when the threshold is breached. Configuring an alarm with CPUUtilization > 90% for 5 minutes directly satisfies the requirement. SNS is used as the notification target, not as the alarm engine itself.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 15

An SAP system on AWS is experiencing performance degradation. The operations team suspects a network bottleneck. Which THREE metrics should they analyze in CloudWatch to diagnose the issue? (Choose THREE.)

Accepted Answer

NetworkOut. NetworkOut (A) is correct because it measures the bytes leaving the EC2 instance, which directly reveals outbound bandwidth saturation or a bottleneck on the egress path affecting SAP application traffic. NetworkIn (D) is correct because it tracks bytes received by the instance, showing whether inbound traffic volume or a saturated receive path is degrading SAP performance. NetworkPacketsIn (B) is correct because packet-level ingress metrics expose issues such as packet storms, high PPS load, or dropped/retransmitted traffic that byte-level counters can mask. CPUUtilization (C) is not a network metric and would only indicate compute contention, while DiskReadOps (E) reflects EBS storage read activity, so neither belongs in a network-bottleneck diagnosis.

Answer

CPUUtilization

Answer

DiskReadOps