PAS-C01 Operations and Maintenance Practice Test 33 — 15 Questions

Question 1

A company is migrating its SAP environment to AWS. The operations team needs to ensure that all changes to the SAP infrastructure are tracked and that unauthorized changes are detected. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config continuously records resource configurations and evaluates them against rules, which is exactly what is needed to track changes to SAP infrastructure and detect unauthorized modifications. It provides a configuration timeline and can trigger remediation or alerts when a resource drifts from the desired state. CloudTrail records API activity but does not evaluate configuration compliance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 2

A company runs SAP on AWS and uses a central syslog server to collect logs from all SAP instances. The operations team wants to use a managed AWS service to centralize log storage and enable real-time analysis. Which service should they use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is a fully managed service designed to centralize log data from multiple sources, including EC2 instances via the CloudWatch agent, and supports real-time analysis through metric filters, Logs Insights queries, and subscription filters. It directly meets the requirement for centralized storage and real-time analysis of syslog data from SAP instances.

Answer

Amazon Athena

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3

Question 3

An SAP system on AWS is experiencing performance issues during peak hours. The operations team notices that the EBS volumes are consistently showing high queue depth. What should they do to improve performance?

Accepted Answer

Provision more IOPS on the EBS volumes.. High queue depth on EBS volumes indicates that the volume cannot keep up with the I/O demand, so provisioning more IOPS (for gp3, io1, io2) directly increases the volume's ability to handle concurrent I/O requests. This addresses the root cause of the performance bottleneck during peak hours.

Answer

Change the EC2 instance type to a larger one.

Answer

Change the EBS volume type to Throughput Optimized HDD (st1).

Answer

Increase the size of the EBS volumes.

Question 4

An SAP administrator needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made to AWS services, capturing the identity of the caller, the time, the source IP, the request parameters, and the response. It is the canonical service for auditing API activity across an AWS account, including calls made by SAP automation, Lambda, or administrators.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 5

An SAP system on AWS is running on a single Availability Zone. The operations team wants to improve high availability. Which THREE actions should they take?

Accepted Answer

Use an Application Load Balancer to distribute traffic across AZs.. Option A is correct because an Application Load Balancer operates at the regional level and can distribute incoming traffic across targets in multiple Availability Zones, removing the single-AZ bottleneck and enabling failover if one AZ becomes unavailable. Option D is correct because placing SAP application servers in an Auto Scaling group spanning multiple AZs ensures the application tier can survive an AZ outage and automatically replace unhealthy instances. Option E is correct because the SAP database is the critical stateful component, and a Multi-AZ deployment (for example, RDS Multi-AZ or a database-level HA cluster with synchronous replication) provides automatic failover to a standby in another AZ. Option B is incorrect because EBS Multi-Attach only allows a volume to be attached to multiple Nitro instances within the same Availability Zone, not across AZs. Option C is incorrect because Elastic IP addresses provide static public addressing and instance-level remapping, but they do not by themselves create cross-AZ high availability or replicate data.

Answer

Use EBS Multi-Attach to share volumes across AZs.

Answer

Assign Elastic IP addresses to instances for failover.

Question 6

An SAP administrator wants to automate the patching of SAP application servers. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager (A) is correct because it provides the automation capability to scan for and install missing patches on managed nodes, including SAP application servers, using patch baselines and compliance reporting. AWS Systems Manager Maintenance Windows (C) is correct because it defines a scheduled time window during which Patch Manager tasks can run, enabling automated, recurring patching without manual intervention. Together, Patch Manager performs the patching and Maintenance Windows schedules it, which is the standard AWS pattern for automated OS patching. AWS Lambda (B) is a compute service for running code in response to events, not a patching tool, so it does not directly automate patch installation. AWS OpsWorks (D) is a configuration management service for Chef/Puppet stacks and is not the intended patching mechanism for SAP application servers. Amazon CloudWatch Alarms (E) only monitors metrics and triggers notifications or actions; it does not perform patching.

Answer

AWS Lambda

Answer

AWS OpsWorks

Answer

Amazon CloudWatch Alarms

Question 7

A company runs SAP HANA on AWS and wants to implement a backup strategy using AWS Backint agent for SAP HANA. Which storage service is best suited for storing the backup files when using Backint?

Accepted Answer

Amazon S3. AWS Backint agent for SAP HANA is designed to store backups directly in Amazon S3, providing durable, scalable, and cost-effective storage. It integrates natively with S3 APIs and supports lifecycle policies to transition data to Glacier if needed. S3 is the only storage service officially supported by Backint for SAP HANA on AWS.

Answer

Amazon S3 Glacier

Answer

Amazon EFS

Answer

Amazon EBS

Question 8

A company is running SAP on AWS and wants to automatically recover an unhealthy EC2 instance that hosts their SAP application. Which AWS feature should they configure to automatically restart the instance in the same Availability Zone if it fails?

Accepted Answer

EC2 Auto Recovery. EC2 Auto Recovery is an AWS feature that automatically recovers an impaired EC2 instance by restarting it on new hardware within the same Availability Zone. It is configured via a CloudWatch alarm that triggers the 'recover' action when status checks fail, making it the correct choice for automatic recovery of a single SAP application instance.

Answer

Cluster Placement Group

Answer

Auto Scaling group

Answer

Lifecycle Hook

Question 9

An AWS administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The instance type is r5.2xlarge. Which CloudWatch metric should the administrator use to track the CPU usage of the instance?

Accepted Answer

CPUUtilization. For an EC2 instance, CPU utilization is a standard metric provided by CloudWatch without any additional configuration. The metric name is 'CPUUtilization' and it measures the percentage of allocated EC2 compute units that are currently in use. This is the correct metric to track CPU usage for SAP NetWeaver on an r5.2xlarge instance.

Answer

MemoryUtilization

Answer

NetworkIn

Answer

DiskReadOps

Question 10

A company runs SAP HANA on AWS and needs to perform a system copy from production to a test environment. The test environment is in a different AWS account. Which AWS service can be used to securely share the HANA backup files stored in Amazon S3 across accounts?

Accepted Answer

S3 bucket policy. To securely share HANA backup files stored in Amazon S3 across AWS accounts, you can use an S3 bucket policy. The bucket policy can grant cross-account access to the specific IAM principals in the test account, allowing them to read the backup objects. This is the standard method for cross-account S3 access.

Answer

VPC Peering

Answer

S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 11

An organization runs SAP on AWS and needs to ensure that their SAP HANA database backups are encrypted at rest. Which AWS service should they use to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the managed service for creating, rotating, and controlling customer master keys (CMKs) used to encrypt data at rest, including SAP HANA backups stored in S3, EBS snapshots, or Backint-managed storage. KMS integrates natively with AWS Backup, EBS, S3, and SAP-certified backup tools, and provides CloudTrail-auditable key usage. CloudHSM is for dedicated single-tenant HSM requirements, IAM handles authorization not encryption, and Certificate Manager handles TLS certificates, not data-at-rest keys.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Certificate Manager

Question 12

A company is running SAP on AWS and needs to reduce the cost of their development and test systems. The systems are only needed during business hours on weekdays. Which AWS service can be used to automatically stop and start the EC2 instances on a schedule?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a solution that automatically stops and starts instances based on a schedule. Option B is wrong because Auto Scaling is for scaling, not scheduling. Option C is wrong because CloudWatch Alarms trigger based on metrics, not time-based schedules. Option D is wrong because Systems Manager Maintenance Windows are for patching and maintenance tasks, not scheduling stop/start.

Answer

Amazon EC2 Auto Scaling

Answer

Amazon CloudWatch Alarms

Answer

AWS Systems Manager Maintenance Windows

Question 13

An SAP administrator needs to monitor the CPU utilization of an EC2 instance running SAP HANA. Which AWS service should be used to set an alarm when CPU utilization exceeds 90% for 5 minutes?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service for monitoring metrics such as CPU utilization. You can create a CloudWatch alarm that triggers when CPU utilization exceeds 90% for 5 minutes, and it can send notifications via Amazon SNS. This is the standard way to monitor EC2 instance metrics.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 14

During an SAP system refresh, the operations team needs to restore an SAP HANA database from an S3 backup to a new EC2 instance. The backup was created using SAP HANA Backint. Which AWS service is required to read the backup from S3?

Accepted Answer

SAP HANA Backint agent for Amazon S3. SAP HANA Backint is an SAP-defined API, and AWS provides a Backint agent that runs on the HANA host and reads/writes backups directly to and from Amazon S3. To restore from an S3 backup, the Backint agent for Amazon S3 must be installed and configured on the target EC2 instance.

Answer

Amazon EBS snapshots

Answer

AWS Backup

Answer

AWS Storage Gateway

Question 15

An SAP administrator needs to review API calls made by a user who accidentally deleted an S3 bucket used for SAP backups. Which AWS service provides a record of these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion events. When a user accidentally deletes an S3 bucket, CloudTrail captures the event details such as the user identity, source IP, and timestamp, enabling the SAP administrator to audit the action. This is essential for security analysis and operational troubleshooting in the context of SAP backups.

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config