PAS-C01 Operations and Maintenance Practice Test 35 — 15 Questions

Question 1

Which TWO AWS services can be used to automate the patching of SAP EC2 instances? (Choose 2)

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager (A) is correct because it automates OS and application patching on EC2 instances through patch baselines, maintenance windows, and Run Command, and it supports SAP workloads via patching SAP HANA and SAP NetWeaver instances. EC2 Image Builder (E) is correct because it automates the creation, testing, and distribution of patched Amazon Machine Images (AMIs), which can then be used to launch or replace SAP EC2 instances with up-to-date patches. AWS Backup (B) is incorrect because it only centralizes backup and restore of AWS resources, not patch deployment. Amazon Inspector (C) is incorrect because it assesses and reports vulnerabilities but does not perform patching. AWS Config (D) is incorrect because it evaluates and records resource configuration compliance, not patch automation.

Answer

AWS Backup

Answer

Amazon Inspector

Answer

AWS Config

Question 2

Which TWO AWS services can be used to monitor the health of SAP application servers? (Choose 2)

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (D) is correct because it collects metrics, logs, and alarms from SAP application servers via the CloudWatch agent, enabling health monitoring of CPU, memory, disk, and custom SAP metrics. AWS Systems Manager (E) is correct because its tools such as Run Command, State Manager, and OpsCenter can check instance health, patch compliance, and run automation to remediate issues on SAP application servers. Amazon Route 53 (A) is a DNS and traffic-routing service, not an application server health monitor, though it can perform endpoint health checks for failover. Amazon S3 (B) is object storage and does not monitor server health. AWS CloudTrail (C) records API activity for auditing, not the runtime health of SAP application servers.

Answer

Amazon Route 53

Answer

Amazon S3

Answer

AWS CloudTrail

Question 3

An SAP administrator needs to monitor the free space of EBS volumes across multiple EC2 instances running SAP. Which AWS service should be used to collect and visualize this data?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS monitoring and observability service that collects metrics, logs, and events from EC2 instances and can visualize them via dashboards and alarms. To monitor EBS free space, the administrator installs the CloudWatch agent on each SAP EC2 instance, which publishes disk-space metrics (e.g., LogicalDisk % Free Space on Windows or disk_used_percent on Linux) to CloudWatch. CloudWatch then provides the visualization and alerting layer required.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 4

An SAP system administrator needs to ensure that all API calls made to AWS services by the SAP system are logged for security auditing. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to AWS services, including who made the call, when, from which IP, and what was requested. Enabling CloudTrail provides the audit trail required for security auditing of SAP system interactions with AWS services. This is the standard service for API activity logging across AWS.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Question 5

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy. The primary site is in us-east-1, and the DR site is in us-west-2. The database is SAP HANA. Which approach provides the lowest RPO?

Accepted Answer

SAP HANA system replication in synchronous mode across regions.. SAP HANA system replication in synchronous mode commits transactions on the primary only after the secondary acknowledges them, guaranteeing zero data loss (RPO ≈ 0) as long as the replication link is healthy. Although cross-region synchronous replication adds latency, it provides the lowest possible RPO, which is what the question asks for.

Answer

SAP HANA system replication in asynchronous mode.

Answer

Database backups to S3 and cross-region replication of S3 bucket.

Answer

EBS snapshots replicated to the DR region using cross-region snapshot copy.

Question 6

An SAP system administrator is troubleshooting a failed HANA database backup to Amazon S3. The backup job returns an error: 'Access Denied'. Which TWO actions should the administrator take to resolve the issue?

Accepted Answer

Review the S3 bucket policy for any deny statements that may block the backup.. Option A is correct because an explicit Deny in the S3 bucket policy always overrides any Allow granted elsewhere, so a deny statement blocking the backup principal or actions like s3:PutObject would produce exactly the 'Access Denied' error seen in the failed HANA backup. Option C is correct because the EC2 instance running SAP HANA must obtain S3 permissions through its attached IAM role (or instance profile); if that role lacks the required s3:PutObject/s3:ListBucket permissions or is missing entirely, the backup job will fail with 'Access Denied'. Option B is not relevant because S3 Transfer Acceleration only improves upload performance via edge locations and does not grant or fix permissions. Option D is not the cause because a disabled or misconfigured KMS key typically yields a KMS-related error such as 'Access Denied' only when encryption permissions are missing, but the question's generic permission failure is addressed by policy and IAM role checks, and enabling a KMS key is not a standard fix. Option E is not applicable because a VPC endpoint affects network routing to S3, not authorization, so it would not resolve an 'Access Denied' error.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Verify that the S3 bucket's KMS key is enabled.

Answer

Set up a VPC endpoint for S3.

Question 7

A company runs SAP on AWS and wants to automate the patching of SAP application servers. The servers are in an Auto Scaling group. Which THREE steps should be included in the automation?

Accepted Answer

Update the Auto Scaling group's launch configuration or launch template to use the new AMI.. Option B is correct because the immutable-infrastructure pattern for patching Auto Scaling instances starts by building a new, patched Amazon Machine Image (AMI) from the existing SAP application server image. Option A is correct because the Auto Scaling group must be pointed at that new AMI by updating its launch configuration or launch template, otherwise new instances would still launch from the old unpatched image. Option D is correct because an instance refresh then performs a rolling replacement of the running instances so they pick up the new launch template/configuration and the patched AMI with minimal disruption. Option C is not part of this pattern: patching running instances in place via AWS Systems Manager does not update the launch template, so replacement instances would revert to the unpatched AMI. Option E is wrong because terminating all instances simultaneously causes an outage and defeats the gradual, availability-preserving replacement that an instance refresh provides.

Answer

Use AWS Systems Manager to apply patches to running instances.

Answer

Terminate all existing instances at once.

Question 8

An SAP system administrator notices that the SAP HANA database backup job to Amazon S3 is failing intermittently. The backup script uses the AWS CLI. Which step should be taken to diagnose the issue?

Accepted Answer

Check AWS CloudTrail logs for S3 API call errors. AWS CloudTrail logs record all S3 API calls, including errors such as AccessDenied, SlowDown, or RequestTimeout, which are essential for diagnosing intermittent backup failures. By examining these logs, the administrator can identify the exact error code and message returned by S3, pinpointing whether the issue is permissions, throttling, or network-related. This is the most direct and informative step for troubleshooting API-level failures.

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Configure S3 Lifecycle policy to expire incomplete multipart uploads

Answer

Modify the backup script to use the AWS SDK instead of CLI

Question 9

An SAP system is deployed on EC2 instances across multiple Availability Zones. Which AWS service should be used to automatically distribute incoming traffic across the SAP application servers?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) operates at the application layer (Layer 7) and is ideal for distributing HTTP/HTTPS traffic to SAP application servers, supporting advanced routing based on content. It integrates with Auto Scaling and provides health checks to ensure traffic only goes to healthy instances.

Answer

Amazon Route 53

Answer

Network Load Balancer

Answer

Amazon CloudFront

Question 10

An SAP system administrator wants to monitor the CPU and memory usage of SAP HANA database instances. Which AWS service should be used to collect and visualize these metrics?

Accepted Answer

Amazon CloudWatch Agent. The Amazon CloudWatch Agent is installed on the SAP HANA instances to collect custom metrics such as CPU and memory usage at the OS level and publish them to CloudWatch. CloudWatch Agent is required because default CloudWatch metrics do not include memory utilization.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Run Command

Answer

Amazon CloudWatch metrics

Question 11

Which THREE steps should be taken when recovering an SAP system from an EBS snapshot? (Choose 3.)

Accepted Answer

Attach the new volume to the EC2 instance. Option E is correct because recovery from an EBS snapshot requires first creating a new EBS volume from that snapshot, since a snapshot itself cannot be directly attached or mounted. Option A is correct because the newly created EBS volume must be attached to the EC2 instance (using the appropriate device name, e.g., /dev/xvdf or /dev/sdf) so the instance can access the recovered data. Option C is correct because after attachment, the volume must be mounted on the appropriate mount point (e.g., /usr/sap or /oracle) so the SAP system can use the restored file systems. Option B is not needed because the existing EC2 instance is typically retained and reused during snapshot recovery rather than terminated. Option D is not relevant because S3 bucket reconfiguration is unrelated to restoring an SAP system from an EBS snapshot.

Answer

Terminate the existing EC2 instance

Answer

Reconfigure the S3 bucket for backup storage

Question 12

An SAP system administrator is troubleshooting a performance issue on an SAP ERP Central Component (ECC) system running on AWS. The system uses an Oracle database on an EC2 instance with EBS volumes. Users report that some transactions are slow, especially during month-end closing. The administrator checks CloudWatch metrics and notices that the EBS volume read latency is high (average 20 ms) and the queue depth is consistently 0. The volume type is gp2 with 3000 IOPS. The administrator suspects the volume is not meeting the IOPS demand. What should the administrator do to resolve this issue?

Accepted Answer

Increase the EBS volume size to increase the baseline IOPS. Increasing the EBS volume size raises the baseline IOPS for a gp2 volume, since gp2 performance scales at 3 IOPS per GiB up to 16,000 IOPS, so a larger volume directly addresses the IOPS shortfall causing the high read latency. The consistently zero queue depth combined with 20 ms latency indicates the volume is hitting its IOPS ceiling rather than being throttled by throughput or instance limits. Option A (gp2 to gp3) does not by itself increase IOPS unless provisioned IOPS are explicitly configured above the 3,000 baseline, so it does not guarantee a fix. Option C addresses throughput (MB/s), not IOPS, and gp2 throughput is tied to IOPS anyway, so it would not resolve the latency. Option D (EBS optimization) only affects instance-level bandwidth and is already enabled by default on most modern instance types, so it does not raise the volume's IOPS limit.

Answer

Switch the volume type from gp2 to gp3

Answer

Increase the volume throughput to 250 MB/s

Answer

Enable EBS optimization on the EC2 instance

Question 13

A company is using AWS Systems Manager to automate patching of SAP EC2 instances. The patching fails for some instances with the error 'Unable to retrieve SSM Agent registration'. What is the MOST likely cause?

Accepted Answer

The instance does not have outbound internet access or a VPC endpoint for Systems Manager.. The SSM Agent must be able to reach the Systems Manager service endpoints to register. If the instance has no outbound internet access and no VPC endpoint (interface endpoint) for ssm, ssmmessages, and ec2messages, the agent cannot register and patching fails with 'Unable to retrieve SSM Agent registration'.

Answer

The patching window is too short and the instance times out.

Answer

The IAM role attached to the instance does not have permissions to list patches.

Answer

The SSM Agent is not installed because the instance is running in a container.

Question 14

An SAP Basis administrator needs to apply an OS-level security patch to a fleet of SAP EC2 instances running Red Hat Enterprise Linux. The instances are part of an Auto Scaling group. Which approach is the MOST efficient and minimizes downtime?

Accepted Answer

Create a new AMI with the patch applied, update the launch template, and perform a rolling update via Auto Scaling.. The most efficient, lowest-downtime approach is to bake the patch into a new AMI, update the launch template, and perform a rolling update via Auto Scaling. This uses immutable infrastructure: new instances launch with the patch already applied, and Auto Scaling replaces old instances gradually (respecting min/max/desired and health checks), so capacity is maintained throughout and rollback is as simple as reverting the launch template version.

Answer

Create a custom AMI and manually terminate each instance to launch new ones.

Answer

Stop all instances, apply the patch using a script, and restart them.

Answer

Use AWS Systems Manager Patch Manager to apply the patch to all instances simultaneously.

Question 15

An SAP system is experiencing high disk I/O latency. The operations team checks the Amazon CloudWatch metrics and finds that the Average Queue Length for the EBS volumes is consistently above the recommended threshold. Which action should be taken to address this issue?

Accepted Answer

Increase the provisioned IOPS for the EBS volumes.. High Average Queue Length on EBS volumes indicates that the volume is not able to keep up with the I/O demand, leading to queuing and increased latency. Increasing the provisioned IOPS for the EBS volumes directly increases the volume's ability to handle more I/O operations per second, reducing the queue length and latency.

Answer

Change the volume type to Throughput Optimized HDD (st1).

Answer

Enable EBS encryption to improve I/O performance.

Answer

Increase the volume size to improve I/O performance.