PAS-C01 Operations and Maintenance Practice Test 32 — 15 Questions

Question 1

A company is running SAP on AWS and wants to automate the creation of consistent snapshots of EBS volumes attached to SAP HANA instances. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Backup. AWS Backup is purpose-built for centralized, policy-driven backup of AWS resources, including EBS volumes. It supports snapshot lifecycle management, cross-region and cross-account copies, and compliance controls like vault lock — all critical for SAP HANA's stringent RPO/RTO requirements. Unlike ad-hoc scripts, AWS Backup ensures consistent, automated snapshots without custom code, making it the best fit for this task.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

Amazon S3

Question 2

A company is running SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to SAP Web Dispatchers. The operations team notices that some requests are failing with 502 errors. Which THREE actions should be taken to troubleshoot the issue?

Accepted Answer

Review the ALB access logs to identify the target response codes.. Option C is correct because ALB access logs record the target response codes (such as 502) and other request-level details, allowing the team to pinpoint which backend targets are returning errors and when. Option D is correct because 502 Bad Gateway typically means the ALB cannot establish or maintain a connection to the target, which can result from security group rules blocking traffic on the target port or between the ALB and instances. Option E is correct because an unhealthy target or a misconfigured health check (wrong path, port, protocol, or threshold) causes the ALB to route to or report failures on targets, directly producing 502 responses. Option A is not appropriate because disabling cross-zone load balancing does not resolve 502 errors and would only reduce availability by preventing the ALB from routing to healthy targets in other Availability Zones. Option B is not appropriate because increasing the ALB idle timeout addresses idle connection timeouts (typically 504 or dropped connections), not the backend connection failures that generate 502 errors.

Answer

Disable cross-zone load balancing to isolate the issue.

Answer

Increase the idle timeout setting on the ALB.

Question 3

Refer to the exhibit. An SAP HANA database backup fails with the error shown. The backup target is an EFS file system mounted at /backup. The EC2 instance has the appropriate IAM role to access EFS. What is the MOST likely cause of this error?

Accepted Answer

The SAP HANA database user does not have write permissions on the backup directory.. The error indicates a permission issue when SAP HANA attempts to write the backup to the EFS mount. Even though the EC2 instance has an IAM role that allows EFS access, the SAP HANA database user (e.g., <sid>adm) must have write permissions on the mounted directory /backup. EFS mounts enforce POSIX permissions, and if the directory is owned by root with restrictive permissions, the HANA user cannot create backup files. Therefore, the most likely cause is that the SAP HANA database user lacks write permissions on the backup directory.

Answer

The IAM role attached to the EC2 instance does not have permissions to write to EFS.

Answer

The EFS file system has insufficient IOPS for the backup operation.

Answer

The EFS file system is out of storage capacity.

Question 4

An SAP NetWeaver administrator needs to patch the operating system of an SAP application server running in an Auto Scaling group. The instances are behind an Application Load Balancer. What is the correct procedure to minimize downtime?

Accepted Answer

Use an Auto Scaling rolling update with lifecycle hooks to launch new instances from a patched AMI and gradually deregister old ones.. The correct procedure is to use an Auto Scaling rolling update with lifecycle hooks. This launches new instances from a patched AMI, waits for them to become healthy, and then gradually deregisters and terminates old instances. The Application Load Balancer ensures traffic is only routed to healthy instances, minimizing downtime. Lifecycle hooks allow you to pause the instance launch or termination to perform validation or patching steps, ensuring a controlled rollout.

Answer

Detach one instance from Auto Scaling, patch it, test, then reattach.

Answer

Stop accepting traffic at the ALB, patch all instances manually, then re-enable traffic.

Answer

Terminate all instances at once and let Auto Scaling launch new ones with a patched AMI.

Question 5

An SAP Basis administrator needs to monitor the CPU utilization of all EC2 instances running SAP applications. The team wants to receive alerts when CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this monitoring and alerting?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it natively collects and monitors EC2 CPU utilization metrics (like CPUUtilization) at 1-minute granularity. You can create a CloudWatch alarm that triggers when the metric exceeds 80% for 5 consecutive minutes (using the 'Average' statistic over 5 periods of 1 minute each). CloudWatch then sends notifications via Amazon SNS, enabling the team to receive alerts. This directly matches the requirement for monitoring and alerting on CPU utilization.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company runs SAP on AWS using a multi-AZ deployment. The database is an SAP HANA system replicated across two Availability Zones. During a recent failure, the standby HANA instance did not take over automatically. The operations team finds that the HANA replication status was 'ERROR' before the failure. What is the most likely reason for the failed takeover?

Accepted Answer

The HANA system replication was not in sync; data was not fully replicated to the standby.. For an SAP HANA system replication takeover to succeed, the standby must be in sync with the primary; if replication status is 'ERROR', the standby lacks the latest data and cannot safely take over. The cluster's fencing and instance number consistency are important but secondary to replication health. High network latency could cause replication issues but would not directly prevent takeover if replication were in sync.

Answer

The standby HANA instance had a different instance number than the primary.

Answer

The fencing mechanism was not configured correctly in the cluster.

Answer

The network latency between the two Availability Zones was too high.

Question 7

Which TWO of the following are valid methods to monitor the health of an SAP HANA database running on AWS?

Accepted Answer

Amazon CloudWatch alarms based on EC2 instance metrics. Option A is correct because Amazon CloudWatch collects EC2 instance metrics such as CPUUtilization, StatusCheckFailed, and EBS burst balance, and CloudWatch alarms can notify or trigger actions when those infrastructure-level metrics breach thresholds, which is a valid way to monitor the health of the underlying EC2 host running SAP HANA. Option D is correct because SAP HANA exposes its own health and service state through SQL, and queries against system views such as M_SERVICES, M_SERVICE_REPLICATION, or M_ALERTS (or commands like hdbsql) let you check whether HANA services are running and alert-free, which is the application-level health check. Option B is not correct because AWS Trusted Advisor provides checks for cost, security, fault tolerance, performance, and service limits, not SAP HANA-specific best practices. Option C is not correct because AWS Config rules evaluate AWS resource configuration compliance, not the internal configuration or health of a HANA database. Option E is not correct because CloudTrail records AWS API activity for auditing, not HANA API calls or database health.

Answer

AWS Trusted Advisor checks for HANA best practices

Answer

AWS Config rules to check HANA configuration

Answer

AWS CloudTrail logs for HANA API calls

Question 8

Refer to the exhibit. An administrator has run a query to check the backup status of an SAP HANA database. The output shows that the backup on January 17 failed. What is the most appropriate next step?

Accepted Answer

Investigate the backup logs for the failed backup to identify the cause.. A failed HANA backup should never be blindly retried or ignored — the correct first step is to examine the backup log to determine the root cause (e.g., insufficient disk space, locked files, network interruption, or service outage). Only after understanding the failure can the administrator decide whether to retry, adjust configuration, or escalate. This diagnostic-first approach is standard SAP HANA DBA practice.

Answer

Restore the database from the last successful backup to ensure data integrity.

Answer

Immediately restart the failed backup from the catalog.

Answer

Ignore the failure because subsequent backups are successful.

Question 9

A company runs SAP on AWS using an SAP HANA database on an R5.8xlarge EC2 instance. The SAP application generates alerts about high disk I/O latency. Which AWS service should the administrator use to identify the root cause?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it collects and monitors metrics such as disk I/O latency, CPU, and network performance for EC2 instances. The administrator can use CloudWatch metrics and alarms to identify the root cause of high disk I/O latency on the SAP HANA instance. CloudWatch provides the granular, time-series data needed for performance troubleshooting.

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Answer

AWS Config

Question 10

An SAP administrator needs to apply an OS security patch to all SAP application servers running on EC2 instances in an Auto Scaling group. The patch requires a reboot. What is the most efficient way to apply the patch with minimal downtime?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window. AWS Systems Manager Patch Manager can orchestrate patching across instances, and using a maintenance window with a reboot strategy minimizes downtime. Option A is wrong because manual patching is not efficient. Option B is wrong because creating a new AMI and updating the Auto Scaling group requires creating a new launch configuration or template and rolling out new instances, which is more effort and not the most efficient. Option C is wrong because AWS CloudFormation is for infrastructure provisioning, not for applying OS patches.

Answer

SSH into each instance and apply the patch manually

Answer

Create a new AMI with the patch and update the Auto Scaling group

Answer

Use AWS CloudFormation to update the instances

Question 11

An SAP on AWS environment uses a shared file system via Amazon EFS for SAP transport files. The EFS file system is mounted on multiple EC2 instances. Users report that file operations are slow during peak hours. Which action should be taken to improve performance?

Accepted Answer

Enable EFS Provisioned Throughput mode and increase throughput. Amazon EFS performance is governed by its throughput mode; if the file system is in Bursting mode and credits are exhausted during peak hours, performance degrades. Switching to Provisioned Throughput mode and specifying a higher throughput level decouples performance from the amount of data stored and provides consistent, high throughput for the SAP transport file workload.

Answer

Migrate to Amazon EBS with Multi-Attach enabled

Answer

Move the transport files to Amazon S3 and use S3FS

Answer

Increase the number of EC2 instances to distribute the load

Question 12

Which TWO of the following are best practices for monitoring SAP on AWS? (Choose 2)

Accepted Answer

Set up Amazon CloudWatch alarms for HANA database metrics. Option A is correct because Amazon CloudWatch is the native AWS monitoring service and can collect and alarm on SAP HANA database metrics (via the CloudWatch agent or SAP-specific solution like SAP Data Provider for AWS), enabling proactive detection of threshold breaches on metrics such as memory usage, CPU, and disk. Option B is correct because SAP EarlyWatch Alert is SAP's built-in proactive monitoring service that analyzes the SAP system's health, performance, and configuration and delivers regular reports, making it a recommended best practice for monitoring SAP workloads on AWS. Option C is incorrect because disabling detailed monitoring reduces visibility rather than improving monitoring, and detailed monitoring provides 1-minute metric granularity needed for timely alarms. Option D is incorrect because manual weekly log review is reactive and not a scalable or timely best practice compared to automated monitoring and alerting. Option E is incorrect because daily EBS snapshots are a backup and disaster-recovery practice, not a monitoring best practice for SAP on AWS.

Answer

Disable detailed monitoring on EC2 instances to reduce costs

Answer

Manually review system logs weekly

Answer

Take daily EBS snapshots of the HANA data volume

Question 13

Which THREE actions should be taken to ensure a secure and compliant SAP environment on AWS? (Choose 3)

Accepted Answer

Restrict IAM permissions to only necessary actions. Option B is correct because applying least-privilege IAM policies ensures SAP administrators and services only receive the specific AWS API permissions they need, reducing the blast radius of compromised credentials and supporting compliance controls such as segregation of duties. Option C is correct because security groups act as stateful virtual firewalls at the ENI level, allowing you to restrict inbound and outbound traffic to only the required SAP ports and trusted sources, such as SAP GUI (3200/3300), SAP HANA (30013/30015), and RFC (3300), which is essential for a secure SAP landscape. Option D is correct because enabling encryption on EBS volumes and RDS instances protects SAP data at rest using AWS KMS-managed keys, satisfying compliance requirements like GDPR, HIPAA, and PCI DSS that mandate encryption of sensitive data. Option A is not appropriate because placing SAP servers in a public subnet exposes them directly to the internet and increases the attack surface; SAP systems should reside in private subnets behind load balancers or bastion hosts. Option E is not appropriate because storing application logs in Amazon S3 with public read access would expose potentially sensitive SAP data to anyone, violating confidentiality and compliance requirements; logs should be stored in private, encrypted buckets with restricted access.

Answer

Place all SAP servers in a public subnet for easy access

Answer

Store all application logs in Amazon S3 with public read access

Question 14

Which TWO options are valid methods to back up an SAP HANA database on AWS? (Choose 2)

Accepted Answer

Use SAP HANA Backint with AWS Backup. Option B is correct because SAP HANA Backint is the native SAP HANA backup API that integrates with external backup tools, and AWS Backup supports SAP HANA via the Backint interface on AWS, allowing full, differential, and log backups to be managed centrally. Option E is correct because application-consistent EBS snapshots of the HANA data and log volumes can be created using pre- and post-snapshot scripts (for example, suspending I/O or putting HANA in a consistent state) to ensure the snapshot is recoverable. Option A is not valid because Amazon RDS does not support SAP HANA as an engine, so RDS automated backups cannot back up a HANA database. Option C is not valid because AWS DMS is a data migration and replication service, not a backup mechanism for SAP HANA. Option D is not valid because simply copying HANA data files to Amazon S3 with the AWS CLI does not produce a supported, consistent HANA backup and cannot be restored through HANA's backup and recovery tools.

Answer

Use Amazon RDS automated backups

Answer

Use AWS Database Migration Service (DMS)

Answer

Copy HANA data files to Amazon S3 using AWS CLI

Question 15

An SAP administrator needs to monitor the CPU utilization of an SAP application server EC2 instance and send an alert if it exceeds 80% for 5 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarm. Amazon CloudWatch Alarm is the correct service because it can monitor EC2 instance metrics such as CPUUtilization, evaluate them against a threshold (80%), and trigger actions like Amazon SNS notifications when the condition is met for a specified number of consecutive periods (5 minutes). CloudWatch natively collects EC2 metrics at 1-minute intervals (detailed monitoring) or 5-minute intervals (basic monitoring), making it the appropriate tool for this alerting requirement.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config