PAS-C01 Operations and Maintenance Practice Test 28 — 15 Questions

Question 1

Which TWO AWS services can be used to automate the deployment of SAP infrastructure using infrastructure as code? (Choose 2)

Accepted Answer

AWS Service Catalog. AWS CloudFormation (B) is correct because it is AWS's native infrastructure-as-code service that lets you define SAP infrastructure (VPCs, EC2 instances, EBS volumes, security groups, etc.) in JSON/YAML templates and deploy them repeatably and automatically. AWS Service Catalog (A) is correct because it lets administrators create and govern curated CloudFormation-based products (portfolios) that end users can launch on demand, which is a standard way to automate and standardize SAP infrastructure deployments with IaC under centralized control. AWS OpsWorks (C) is a configuration-management service (Chef/Puppet) focused on application stack configuration rather than declarative infrastructure provisioning, so it is not the intended IaC deployment service here. AWS CodeDeploy (D) automates application code deployments to EC2/on-premises/lambda, not infrastructure provisioning. AWS Elastic Beanstalk (E) is a PaaS for deploying web applications and does not provision arbitrary SAP infrastructure as code.

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 2

An SAP workload running on AWS is experiencing intermittent performance issues. The operations team suspects that a recent change to a security group is causing traffic to be dropped. Which AWS service should the team use to analyze network traffic patterns and identify the source of the issue?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information going to and from network interfaces in a VPC. They record accepted and rejected traffic, including the source and destination IP, ports, protocol, and whether the traffic was allowed or denied by security groups or network ACLs. This makes them the ideal tool to analyze if a security group change is causing traffic to be dropped.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

An SAP system administrator needs to automate the patching of Amazon RDS for SAP ASE databases. Which AWS service can be used to schedule and apply database patches automatically?

Accepted Answer

Amazon RDS maintenance window. Amazon RDS maintenance window is a built-in feature that allows you to schedule automatic patching for RDS databases, including SAP ASE. It is the appropriate mechanism for automating patching. Options A (AWS OpsWorks) is for configuration management. Option C (AWS Systems Manager Maintenance Windows) can orchestrate tasks but cannot directly apply RDS patches; RDS manages patching internally. Option D (AWS Systems Manager Patch Manager) is designed for EC2 instances, not RDS.

Answer

AWS OpsWorks

Answer

AWS Systems Manager Maintenance Windows

Answer

AWS Systems Manager Patch Manager

Question 4

An SAP Basis administrator needs to restart the SAP application server on an EC2 instance after applying kernel patches. What is the recommended way to perform the restart to minimize downtime?

Accepted Answer

Log in to the instance and restart the SAP system using SAP MMC or sapcontrol.. Using SAP MMC to restart the SAP system allows a controlled restart that avoids a full OS reboot, minimizing downtime.

Answer

Stop and start the EC2 instance from the AWS CLI.

Answer

Reboot the EC2 instance from the AWS Management Console.

Answer

Terminate the instance and launch a new one from the same AMI.

Question 5

An SAP environment on AWS includes multiple EC2 instances running SAP application servers. The operations team needs to capture and analyze all API calls made to AWS services by these instances. Which THREE services should be used together?

Accepted Answer

Amazon Athena. AWS CloudTrail (B) is the service that records all API calls made to AWS services, including those originating from the SAP application server EC2 instances, so it is essential for capturing the required activity. CloudTrail delivers these event logs to an Amazon S3 bucket, making Amazon S3 (C) the required storage destination for the captured API call data. Amazon Athena (A) is then used to query the CloudTrail logs stored in S3 with standard SQL, enabling the operations team to analyze the API activity. AWS Config (D) is a configuration and compliance tracking service that records resource configuration changes, not API call auditing, so it does not fulfill the capture-and-analyze requirement. Amazon GuardDuty (E) is a threat detection service that analyzes logs for malicious activity but does not itself capture and store all API calls for querying, so it is not part of this solution.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

An SAP system administrator needs to monitor the health of Amazon RDS for SAP ASE database instances. Which TWO CloudWatch metrics should be used to detect if the database is under memory pressure?

Accepted Answer

`FreeableMemory`. FreeableMemory (option C) is correct because it reports the amount of available RAM on the RDS instance, so a steadily declining or very low value directly signals that the SAP ASE database is running short of memory. SwapUsage (option D) is correct because rising swap activity indicates the instance has exhausted physical memory and is paging to disk, which is a classic symptom of memory pressure. Together these two CloudWatch metrics give the clearest picture of memory exhaustion on an Amazon RDS for SAP ASE instance. WriteIOPS (A) and ReadIOPS (B) measure disk I/O throughput and say nothing about memory availability, and DatabaseConnections (E) only reflects the number of active sessions, which can be high or low regardless of memory pressure.

Answer

`WriteIOPS`

Answer

`ReadIOPS`

Answer

`DatabaseConnections`

Question 7

A company runs its SAP S/4HANA system on AWS using a cluster of EC2 instances for the application tier and a single large EC2 instance for the HANA database. The database instance uses EBS volumes striped with LVM for data and log. Recently, the operations team noticed that the database performance has degraded significantly during peak hours. CloudWatch metrics show that the average ReadIOPS for the data volume is consistently at 80% of the provisioned IOPS limit, and the average queue length is above 10. The CPU utilization of the database instance is around 60%, and memory usage is 70%. The team has already verified that there are no network bottlenecks and that the SAP application is not misconfigured. Which of the following is the MOST effective action to improve database performance?

Accepted Answer

Increase the provisioned IOPS on the existing EBS data volume to provide more headroom.. The symptoms indicate that the EBS volume is reaching its IOPS limit, causing queuing. Increasing the provisioned IOPS for the data volume (Option B) will directly address the I/O bottleneck. Option A suggests migrating to instance store volumes, which are ephemeral and not recommended for persistent database data. Option C involves adding more EBS volumes and re-striping, which could increase IOPS but is more complex and may not be necessary if the existing volume supports elastic IOPS adjustments. Option D suggests upgrading to a larger EC2 instance type with higher network bandwidth, but CPU and memory are not fully utilized, so that may not address the I/O bottleneck. Therefore, increasing IOPS on the existing volume is the simplest and most effective.

Answer

Migrate the database data to an instance store volume for higher IOPS.

Answer

Add additional EBS volumes to the LVM stripe and redistribute the data.

Answer

Upgrade the database instance to a larger EC2 instance type with higher network bandwidth.

Question 8

An SAP administrator runs the above CloudWatch Logs Insights query on an application log group. The query returns no results even though the administrator knows there are ERROR messages in the logs. What is the most likely cause?

Accepted Answer

The log events are not in plain text; they are in JSON format and the ERROR string is within a JSON field.. CloudWatch Logs Insights allows filtering log events using the @message field. When logs are in JSON format, the ERROR string may be embedded within a JSON field rather than appearing as plain text in @message. A simple pattern match like /ERROR/ on @message will not match if the @message contains the entire JSON object. To search JSON logs, parse the JSON fields and filter on the parsed fields. Option A is incorrect because CloudWatch Logs Insights supports regex patterns with the '/pattern/' syntax. Option B is incorrect because the correct filter syntax uses '/pattern/', not 'like' (which is not an operator in CloudWatch Logs Insights). Option C is incorrect because while the time range could exclude errors, the most likely cause given that errors are known to exist is the JSON structure. Therefore, Option D is the correct answer.

Answer

The query uses a regex pattern that is not supported by CloudWatch Logs Insights.

Answer

The query syntax is incorrect; the filter should use 'like' instead of '/.../'.

Answer

The time range is set to a period when no ERROR messages were logged.

Question 9

An SAP system fails to send emails via SAPconnect using SMTP. The EC2 instance has a public IP and the security group allows outbound traffic on port 25. The SMTP server is an on-premises relay. What is the most likely reason for the failure?

Accepted Answer

AWS blocks outbound traffic on port 25 by default for EC2 instances.. AWS applies a default throttle on outbound TCP port 25 for all EC2 instances as an anti-spam measure, regardless of security group rules. Even though the security group allows port 25 outbound, the instance's traffic is blocked at the network layer until AWS removes the restriction via a support request. This is the most likely reason the SAPconnect SMTP relay fails.

Answer

The security group does not allow outbound traffic on port 25.

Answer

The EC2 instance does not have a public IP address associated.

Answer

The route table does not have a default route to an internet gateway.

Question 10

An SAP HANA database running on an EC2 instance with EBS volumes experiences high write latency. The instance type is r5.4xlarge. The EBS volumes are gp2. Which change is MOST likely to reduce write latency?

Accepted Answer

Change the EBS volumes to io2 with provisioned IOPS.. gp2 volumes tie IOPS to volume size (3 IOPS/GB baseline, burst to 3000), so an r5.4xlarge with modest gp2 volumes cannot deliver the sustained write IOPS SAP HANA requires. io2 volumes provide provisioned IOPS independent of capacity, with sub-millisecond latency and 99.9% durability, directly addressing the write-latency bottleneck. Since HANA's redo log writes are latency-sensitive, moving to io2 with high provisioned IOPS is the most direct fix.

Answer

Move the database files to Amazon EFS.

Answer

Add a read replica for the database.

Answer

Change the instance type to a compute-optimized instance.

Question 11

An administrator needs to restore an SAP HANA database from a backup stored in Amazon S3. The backup was created using AWS Backup. Which AWS service should be used to perform the restore?

Accepted Answer

AWS Backup. AWS Backup is the correct service because the backup was created using AWS Backup, and AWS Backup provides native restore capabilities for SAP HANA databases. It automates the restore process by directly interacting with the underlying Amazon S3 storage where the backup resides, ensuring consistency with the backup metadata and recovery point objectives (RPOs).

Answer

AWS Systems Manager

Answer

Amazon S3

Answer

AWS Database Migration Service

Question 12

Which THREE metrics should be monitored to ensure the health of an SAP NetWeaver application server? (Choose three.)

Accepted Answer

Memory utilization. Memory utilization (A) is a core health metric for an SAP NetWeaver application server because the ABAP/Java stack relies on shared memory, heap, and extended memory; exhaustion leads to dumps, short dumps, or instance crashes, so it must be tracked via tools like SM04, ST06, or the SAP Management Console. CPU utilization (C) is essential because sustained high CPU on the application server indicates overloaded work processes, expensive reports, or runaway programs, and is monitored through ST06/OS-level collectors to prevent response-time degradation. Work process utilization (D) is critical since SAP NetWeaver dispatches requests to dialog, background, update, enqueue, and spool work processes; if all are busy, users queue or get 'no work process available' errors, so monitoring via SM50/SM66 is mandatory. Database connection count (B) is not one of the three primary application-server health metrics in this context, as it relates more to the database layer and is typically covered by DBA Cockpit rather than the app server itself. Network packet loss (E) is a network-layer metric that, while relevant to overall performance, is not one of the standard three SAP NetWeaver application server health indicators asked for here.

Answer

Database connection count

Answer

Network packet loss

Question 13

A company runs SAP on AWS with a distributed system: an SAP Central Services (ASCS) instance, a primary application server (PAS), and additional dialog instances (DI). All instances are in a single Availability Zone. The company wants to implement high availability for the ASCS instance using a shared filesystem for the /sapmnt directory. The ASCS instance uses a single EBS volume for /sapmnt. The operations team plans to use a Network File System (NFS) solution to share /sapmnt between instances. Which approach should the team use to achieve a highly available shared filesystem?

Accepted Answer

Deploy Amazon EFS and mount it on all instances as /sapmnt.. Amazon EFS is a fully managed, scalable, and highly available NFS file system that can be mounted on multiple EC2 instances across multiple Availability Zones. It provides a shared filesystem for /sapmnt that is highly available and durable. This meets the requirement for a highly available shared filesystem for the ASCS instance.

Answer

Use Amazon FSx for Windows File Server to host the /sapmnt share.

Answer

Use an instance store volume on the ASCS instance and share it via NFS.

Answer

Create a secondary EBS volume and attach it to both the ASCS and PAS instances, then use a cluster-aware filesystem like OCFS2.

Question 14

An SAP administrator receives an alert that the SAP application server is not responding. The administrator checks the EC2 console and sees that the instance state is 'running' but the status checks have failed. Which step should be taken first to restore the SAP application?

Accepted Answer

Use the EC2 console to stop and start the instance, which will move it to new underlying hardware.. When an EC2 instance is running but status checks fail, it often indicates a problem with the underlying host. Stopping and starting the instance forces it to migrate to new hardware, which typically resolves host-related issues. This is the first step because it is non-destructive and preserves the instance's configuration and data on EBS volumes.

Answer

Terminate the instance and launch a new one using the same AMI.

Answer

Reboot the EC2 instance from the AWS Management Console.

Answer

Create a new EC2 instance from the latest AMI and attach the existing EBS volumes.

Question 15

A company runs SAP on AWS and needs to ensure that the SAP application logs are centrally collected and analyzed for security incidents. Which AWS service should be used to collect and store the logs from EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the AWS-native service designed to collect, store, and analyze log data from EC2 instances via the CloudWatch Logs agent (or Unified CloudWatch Agent). It supports log groups, retention policies, metric filters, and integration with CloudWatch alarms and Logs Insights for security analysis. This makes it the correct choice for centrally collecting SAP application logs from EC2.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3