PAS-C01 Operations and Maintenance Practice Test 27 — 15 Questions

Question 1

A company runs an SAP HANA database on AWS. The operations team wants to automate the monitoring of HANA alert logs and send notifications when critical alerts occur. Which AWS service should they use to collect and analyze the logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Logs with metric filters and alarms. Amazon CloudWatch Logs can ingest HANA alert logs via the CloudWatch agent and trigger alarms based on metric filters. CloudTrail records API activity, not application logs. S3 Event Notifications do not analyze log content. Lambda alone does not provide log collection.

Answer

AWS CloudTrail

Answer

Amazon S3 Event Notifications

Answer

AWS Lambda scheduled functions

Question 2

A company runs SAP on AWS and needs to ensure that all changes to the SAP system's underlying infrastructure are recorded and auditable. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing. CloudWatch Logs is for log monitoring. Config tracks resource configuration changes. Trusted Advisor provides best-practice checks. CloudTrail is the primary service for API activity auditing.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

An SAP system on AWS is experiencing intermittent network connectivity issues between the application servers and the database server. Both are in the same VPC but different subnets. The security groups allow all traffic between them. What should the administrator check next?

Accepted Answer

Network ACL rules for the subnets. The administrator should check Network ACL rules for the subnets. Network ACLs are stateless and can block traffic even if security groups allow it. Since both instances are in the same VPC but different subnets, each subnet has its own NACL. If the NACLs are not configured to allow the necessary traffic (both inbound and outbound), connectivity issues can occur. This is the next logical check after security groups.

Answer

VPC Flow Logs to analyze dropped packets

Answer

Route tables to ensure proper routing

Answer

Security group rules for outbound traffic

Question 4

An SAP administrator needs to apply an OS-level security patch to all EC2 instances in an SAP landscape. The administrator wants to automate this process and track compliance. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is purpose-built for automating OS-level patch application across EC2 instances (and on-premises/hybrid nodes) at scale. It uses patch baselines, maintenance windows, and compliance reporting to both automate patching and track which instances are compliant. This directly satisfies the administrator's dual requirement of automation and compliance tracking for an SAP landscape.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 5

An SAP HANA database on AWS is configured with automatic backups to Amazon S3. The backup process is failing with the error 'Access Denied'. The administrator has confirmed the S3 bucket exists and the IAM role attached to the EC2 instance has the correct permissions. What could be the issue?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the IAM role. Even if the IAM role attached to the EC2 instance has the correct permissions, an explicit deny in the S3 bucket policy overrides any allow permissions. Bucket policies are resource-based policies that can grant or deny access to the bucket and its objects. If the bucket policy includes a Deny statement that matches the IAM role, access will be denied regardless of the role's permissions.

Answer

The IAM role's trust policy does not allow the EC2 service

Answer

The S3 bucket is encrypted with AWS KMS and the role lacks kms:Decrypt permissions

Answer

The VPC does not have an S3 VPC endpoint configured

Question 6

Which TWO actions are required to set up automated failover for an SAP HANA database using AWS services? (Choose TWO.)

Accepted Answer

Create an AWS Lambda function to reassign an Elastic IP address to the standby instance. Option A is correct because automated failover requires an action to redirect traffic or reassign the Elastic IP address to the standby SAP HANA instance, and an AWS Lambda function can perform this reassignment programmatically when triggered. Option B is correct because a CloudWatch alarm is needed to detect the database failure or unhealthy state and then invoke the failover automation, such as the Lambda function. Option C is incorrect because Amazon RDS Multi-AZ does not support SAP HANA, which is not an RDS engine. Option D is incorrect because scheduling snapshots and restores is a backup/recovery approach, not an automated failover mechanism, and would cause significant downtime. Option E is incorrect because SAP HANA does not support storing its data on Amazon EFS for a shared active/standby failover setup; HANA data and log volumes must be on supported block storage such as Amazon EBS.

Answer

Use an Amazon RDS Multi-AZ deployment for the HANA database

Answer

Schedule a snapshot and restore on failure

Answer

Store HANA data on Amazon EFS and mount it on both instances

Question 7

Which THREE steps should an administrator take to troubleshoot an issue where an SAP application server cannot connect to the database server after a security group change? (Choose THREE.)

Accepted Answer

Check the outbound rules of the application server's security group. Option A is correct because after a security group change, the application server's outbound rules must permit the database port (for example, 1521 for Oracle or 30015 for SAP HANA) to the database server's IP or security group; a missing or overly restrictive egress rule blocks the connection. Option D is correct because network ACLs are stateless subnet-level filters, so both inbound and outbound rules on the application and database subnets must allow the database port and ephemeral return traffic, and a security group change often coincides with tightened NACL rules. Option E is correct because the database server's security group must have an inbound rule allowing the database port from the application server's security group or private IP; if the change removed or narrowed that rule, the connection is refused. Option B is not appropriate because route tables control subnet-to-subnet or internet routing, and a security group change does not alter routes; checking routes is only relevant if connectivity is entirely broken at the network layer. Option C is not appropriate because restarting servers does not fix a security group or NACL misconfiguration and would only cause unnecessary downtime without addressing the root cause.

Answer

Modify the route tables to ensure direct communication

Answer

Restart both the application and database servers

Question 8

Refer to the exhibit. An SAP administrator uses the CloudFormation template snippet to create an application server. After deployment, the administrator cannot connect to the instance using AWS Systems Manager Session Manager. What is the most likely missing configuration?

Accepted Answer

The instance does not have an IAM instance profile with Systems Manager permissions. Systems Manager Session Manager requires the SSM Agent on the instance and an IAM instance profile attached to the instance that grants the SSM Agent permissions to communicate with the Systems Manager service. Without the instance profile, the agent cannot register with SSM and Session Manager connections fail.

Answer

The UserData script fails to install the SSM Agent

Answer

The security group does not allow outbound traffic to the Systems Manager endpoint

Answer

The instance type does not support Systems Manager

Question 9

A SAP administrator wants to monitor the CPU utilization of an SAP application server running on an EC2 instance. Which AWS service should be used to set up an alarm when CPU utilization exceeds 90% for 5 minutes?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service for monitoring CPU utilization and setting alarms. CloudWatch collects metrics like CPUUtilization from EC2 instances, and you can create a CloudWatch Alarm that triggers when the metric exceeds a threshold (e.g., 90%) for a specified duration (e.g., 5 minutes). The other options are incorrect: AWS CloudTrail logs API calls for auditing, not metrics; AWS Trusted Advisor provides best practice recommendations; and AWS Config tracks resource configuration changes. Therefore, CloudWatch (Option C) is the correct choice.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 10

An SAP system is deployed across multiple Availability Zones using an Application Load Balancer (ALB). The Operations team notices that during a failover test, the ALB is sending traffic to unhealthy instances. Which configuration change would ensure the ALB stops sending traffic to unhealthy targets?

Accepted Answer

Configure a health check with appropriate thresholds and interval.. Configuring a health check with appropriate thresholds and interval ensures the ALB can accurately determine the health of targets and stop routing traffic to unhealthy instances. Option A is incorrect because sticky sessions (session affinity) do not affect health checking; they only maintain session persistence. Option C is incorrect because increasing the deregistration delay only extends the time for connection draining, not health detection. Option D is incorrect because cross-zone load balancing distributes traffic across Availability Zones but does not influence health checks or unhealthy target routing.

Answer

Enable sticky sessions (session affinity).

Answer

Increase the deregistration delay value.

Answer

Enable cross-zone load balancing.

Question 11

A company wants to automate the backup of SAP HANA databases running on EC2 instances. The backups must be stored in Amazon S3 for long-term retention. Which AWS service can be used to schedule and manage these backups?

Accepted Answer

AWS Backup. AWS Backup (Option C) is the correct service for automating backups of SAP HANA databases on EC2, supporting application-consistent backups via pre- and post-scripts and storing them in S3 for long-term retention. Option A (Storage Gateway) is for hybrid storage integration, not backup automation. Option B (DMS) is for database migration, not backup. Option D (S3 Lifecycle policies) manage object lifecycle, not scheduling backups.

Answer

AWS Storage Gateway

Answer

AWS Database Migration Service (DMS)

Answer

Amazon S3 Lifecycle policies

Question 12

A company uses Amazon CloudWatch Logs to store SAP application logs. The Security team requires that logs be encrypted at rest using a customer-managed KMS key (CMK). How can this be achieved?

Accepted Answer

Associate the KMS key with the CloudWatch Logs log group.. CloudWatch Logs encrypts log data at rest using an AWS KMS key, and the customer-managed key (CMK) is associated at the log group level, not the log stream. Associating a CMK with the log group ensures all log events stored in that group are encrypted with the customer-managed key, satisfying the requirement for CMK-based encryption at rest.

Answer

Enable default encryption on the S3 bucket where logs are exported.

Answer

Use an encrypted EBS volume for the EC2 instances generating the logs.

Answer

Enable encryption on the CloudWatch Logs log stream.

Question 13

A SAP administrator needs to grant an IAM user permission to start and stop EC2 instances that are part of an SAP environment. The administrator wants to follow the principle of least privilege. Which IAM policy action should be included?

Accepted Answer

ec2:StartInstances and ec2:StopInstances. ec2:StartInstances and ec2:StopInstances, because these are the exact IAM actions that authorize starting and stopping existing EC2 instances, which matches the administrator's requirement while adhering to least privilege. ec2:TerminateInstances (A) is wrong because it permanently deletes instances, a more destructive permission than needed. ec2:RunInstances (B) is wrong because it launches new instances rather than controlling the power state of existing ones. ec2:RebootInstances (D) is wrong because it only reboots an instance, not starts or stops it.

Answer

ec2:TerminateInstances

Answer

ec2:RunInstances

Answer

ec2:RebootInstances

Question 14

A company runs SAP on AWS and uses a Network Load Balancer (NLB) to distribute traffic to multiple EC2 instances. The Operations team needs to ensure that the NLB only sends traffic to instances that are healthy. Which health check configuration is appropriate for TCP traffic?

Accepted Answer

TCP health check on the application port. For a Network Load Balancer handling TCP traffic, the appropriate health check is a TCP health check on the application port. NLB operates at Layer 4 and supports TCP, HTTP, and HTTPS health checks; a TCP check verifies that the target port is accepting connections, which directly reflects the health of the TCP service. This ensures traffic is only sent to instances where the application port is listening and responsive.

Answer

ICMP ping

Answer

HTTP health check on port 80

Answer

HTTPS health check on port 443

Question 15

Which THREE AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose 3)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch (D) is correct because it collects native EC2 metrics such as CPUUtilization, CPUCreditBalance, NetworkIn/Out, and EBS volume metrics, and supports custom metrics and alarms that can be used to monitor the performance of an SAP HANA database hosted on EC2. Amazon CloudWatch Logs (B) is correct because HANA and OS logs (e.g., /usr/sap//HDB/trace, syslog, and SAP HANA alert logs) can be shipped via the CloudWatch agent and then searched, filtered, and alarmed on for performance and error conditions. SAP HANA built-in monitoring (C) is correct because SAP HANA Studio, SAP HANA Cockpit, and SQL queries against system views such as M_CS_TABLES, M_SERVICE_MEMORY, and M_EXPENSIVE_STATEMENTS provide database-level performance insight (memory, CPU, locks, expensive statements) that generic AWS metrics cannot. AWS Config (A) is not a performance monitoring service; it records resource configuration changes and evaluates compliance rules. AWS CloudTrail (E) records API activity and audit events, not runtime performance metrics of the HANA database.

Answer

AWS Config

Answer

AWS CloudTrail