PAS-C01 Operations and Maintenance Practice Test 37 — 15 Questions

Question 1

A company runs SAP HANA on AWS and uses AWS Backup to protect the database. The backup plan specifies a daily backup with a 30-day retention. The operations team notices that backups are failing intermittently with the error 'Access Denied' when attempting to create snapshots. The SAP HANA instance uses an IAM role with the AWSBackupServiceRolePolicyForBackup managed policy attached. What is the most likely cause of the failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KMS key used to encrypt the EBS volumes does not allow the AWS Backup service role to use it.. When AWS Backup creates snapshots of EBS volumes encrypted with a customer-managed KMS key, it needs explicit permission to use that key. The default key policy may not include the AWS Backup service role. The backup role must be granted kms:CreateGrant, kms:Decrypt, and kms:GenerateDataKey permissions on the key. This is a frequent cause of 'Access Denied' errors during backup operations.

Answer

The EBS volumes are not tagged with the key 'Backup' and value 'true'.

Answer

The AWS Backup vault is not configured with the correct access policy.

Answer

The IAM role lacks permissions to create tags on the snapshots.

Question 2

An SAP basis team manages a production S/4HANA system on AWS. They must be able to detect whether any AWS resource in the account deviates from the approved configuration baseline (e.g., an EC2 instance type change or an S3 bucket policy modification). The security team wants a managed service that continuously evaluates these resources and reports compliance. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config is the only service listed that continuously records resource configurations and evaluates them against rules representing the approved baseline. It can detect changes such as an EC2 instance type modification or an S3 bucket policy update and flag them as noncompliant. The other services either provide recommendations, scan for vulnerabilities, or log API activity, but none perform ongoing configuration compliance evaluation against a custom baseline.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 3

A company runs SAP NetWeaver on Amazon EC2 instances in a single AWS account. The operations team needs to receive an alert when the CPU utilization of a production SAP application server exceeds 80% for 10 minutes. They want a fully managed AWS service that can trigger an Amazon SNS notification. Which service should they use to create the alarm?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the appropriate service because it collects EC2 metrics and supports alarms with threshold and time-period conditions. An alarm can be set to trigger when CPU utilization is greater than 80% for 10 minutes and publish to an SNS topic for notification. The other services either log API activity, provide best-practice recommendations, or report AWS service health, none of which can monitor and alarm on customer resource CPU metrics.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Health Dashboard

Question 4

A company runs SAP HANA on AWS using a scale-out deployment with multiple EC2 instances. The operations team needs to monitor the health of the HANA database and receive alerts when the replication status between primary and secondary nodes is degraded. They want to use AWS native services and minimize custom code. Which solution should they implement?

Accepted Answer

Use Amazon CloudWatch Application Insights for SAP HANA to automatically discover and monitor HANA replication metrics, and configure alarms for degraded status.. CloudWatch Application Insights for SAP HANA is designed to monitor SAP HANA on AWS. It automatically discovers HANA databases and collects metrics, including replication status. You can then create CloudWatch alarms on these metrics to alert on degraded replication. This requires minimal custom code and uses AWS native services.

Answer

Use AWS Health Dashboard to monitor the health of the EC2 instances running HANA and set up notifications for any instance-level issues.

Answer

Use Amazon CloudWatch agent on each HANA node to collect HANA replication metrics and create CloudWatch alarms based on those metrics.

Answer

Use AWS Systems Manager OpsCenter to aggregate HANA replication alerts from SAP Solution Manager and create OpsItems for degraded status.

Question 5

An SAP Basis team runs SAP NetWeaver application servers on Amazon EC2 instances behind an Application Load Balancer (ALB). After a recent deployment, users report intermittent 502 Bad Gateway errors when accessing the SAP GUI via the ALB. The ALB health checks for the target group are configured with the default HTTP path '/'. Which action should the team take to resolve the issue?

Accepted Answer

Configure the ALB health check to use the SAP application server's HTTP port and a valid SAP-specific path such as '/sap/public/ping'.. The ALB health check must target a path that the SAP application server responds to with a successful HTTP status. The default '/' often does not return a valid response, causing the ALB to mark targets unhealthy and return 502 errors. Using an SAP-specific ping path ensures accurate health monitoring and resolves the intermittent failures.

Answer

Change the ALB to a Network Load Balancer (NLB) because ALB does not support SAP GUI traffic.

Answer

Increase the ALB idle timeout to 4000 seconds to match the SAP GUI session timeout.

Answer

Enable sticky sessions on the ALB target group to ensure SAP GUI sessions stick to the same instance.

Question 6

An SAP team runs a mission-critical SAP HANA database on an Amazon EC2 X1 instance. The database must be backed up to Amazon S3 with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They want to use AWS Backint Agent for SAP HANA to perform the backups. Which configuration should they use to meet the RPO?

Accepted Answer

Use SAP HANA's built-in continuous log backups with AWS Backint Agent to write redo logs to S3 every 15 minutes.. To achieve a 15-minute RPO for SAP HANA, the most effective method is to use SAP HANA's continuous redo log backups. AWS Backint Agent allows these log backups to be written directly to Amazon S3. Configuring log backups every 15 minutes ensures that all transactions since the last log backup are captured, meeting the RPO. Data backups can be scheduled less frequently. The other options either are impractical, do not integrate with HANA's backup API, or do not control backup frequency.

Answer

Schedule SAP HANA data backups with AWS Backint Agent every 15 minutes to an S3 bucket.

Answer

Use AWS Storage Gateway to create a cached volume and take snapshots every 15 minutes.

Answer

Enable Amazon S3 Cross-Region Replication on the backup bucket to replicate data every 15 minutes.

Question 7

A company runs SAP S/4HANA on AWS and needs to ensure that the SAP HANA database is backed up regularly. The backup must be stored in Amazon S3 and retained for 90 days. The operations team wants to automate the backup process using AWS Backint Agent for SAP HANA. Which configuration should they implement?

Accepted Answer

Install AWS Backint Agent on the HANA instance, configure it to write backups to an S3 bucket, and set a lifecycle policy on the bucket to expire objects after 90 days.. AWS Backint Agent for SAP HANA is specifically designed to back up HANA databases to Amazon S3. It integrates with HANA's backup and recovery interface. Configuring it to write to an S3 bucket and using an S3 lifecycle policy to expire objects after 90 days meets the backup and retention requirements. This is the recommended approach for HANA backups on AWS.

Answer

Use Amazon EBS snapshots of the HANA data volume, schedule them with Amazon Data Lifecycle Manager, and copy snapshots to S3 for long-term retention.

Answer

Use AWS Backup to create a backup plan for the HANA EC2 instance, store backups in a backup vault, and set a retention period of 90 days.

Answer

Use AWS Storage Gateway to create a file share backed by S3, configure HANA to write backups to that file share, and use S3 lifecycle policies for retention.

Question 8

A company runs SAP HANA on AWS and uses AWS Backup to protect the database. The backup plan specifies a daily backup with a 30-day retention. The operations team notices that backups are failing intermittently with the error 'Access Denied' when attempting to create snapshots. The SAP HANA instance uses an IAM role with the AWSBackupServiceRolePolicyForBackup managed policy attached. What is the most likely cause of the failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Amazon S3 gateway endpoint and update the route table for the private subnet to use the endpoint. Using an Amazon S3 gateway endpoint allows instances in a private subnet to access S3 directly through the AWS private network, bypassing the NAT gateway and internet. This reduces latency, improves reliability, and avoids data transfer costs. For SAP HANA backups with AWS Backint Agent, this is a best practice to ensure efficient and consistent backup operations.

Answer

Enable S3 Transfer Acceleration on the S3 bucket used for backups

Answer

Attach an additional Elastic Network Interface (ENI) to the EC2 instance for backup traffic

Answer

Increase the size of the EC2 instance to a larger memory-optimized instance type

Question 9

A company runs SAP HANA on an Amazon EC2 instance with multiple EBS volumes. The operations team needs to implement a solution to automatically recover from an EC2 instance failure by relaunching the instance on new hardware while preserving the same private IP address, Elastic IP, and instance metadata. The solution should minimize downtime and require no manual intervention. Which approach should the team use?

Accepted Answer

Enable EC2 auto recovery for the instance by configuring a CloudWatch alarm that triggers the recover action.. EC2 auto recovery is a feature that automatically recovers an instance when it becomes impaired due to an underlying hardware failure or a system status check failure. It preserves the instance's private IP, Elastic IP, and metadata, and the instance retains its instance ID. By configuring a CloudWatch alarm for the status check and setting the action to recover, the instance is recovered on new hardware without manual intervention, minimizing downtime.

Answer

Configure an Auto Scaling group with a launch template that specifies the same network interface and Elastic IP.

Answer

Use AWS Elastic Disaster Recovery to replicate the instance to a staging area and fail over automatically.

Answer

Create an Amazon Machine Image (AMI) of the instance and use a Lambda function to launch a new instance with the same network settings.

Question 10

A company runs SAP ERP Central Component (ECC) on AWS with an Oracle database on Amazon RDS for Oracle. The operations team needs to apply a critical patch to the Oracle database with minimal downtime. The database is in a Multi-AZ deployment. Which approach should they take?

Accepted Answer

Modify the RDS instance to apply the patch during the next maintenance window, which will automatically fail over to the standby and back with minimal downtime.. Amazon RDS for Oracle Multi-AZ deployments are designed to minimize downtime during maintenance, including patching. When you initiate a patch, RDS applies it to the standby first, then performs a failover, and finally patches the old primary. The failover typically causes less than a minute of downtime, which is acceptable for a critical patch.

Answer

Use Oracle Data Guard to create a standby database on a separate RDS instance, apply the patch to the standby, and then switch over.

Answer

Take a snapshot of the RDS instance, restore it to a new instance with the patch applied, and then update the SAP application to point to the new instance.

Answer

Create a new RDS instance with the patched engine version, then use AWS Database Migration Service (DMS) to migrate the data with minimal downtime.

Question 11

A company runs SAP S/4HANA on AWS with a primary site in eu-west-1 and a disaster recovery (DR) site in eu-central-1. The DR strategy uses pilot light with a small EC2 instance for the SAP HANA database, which is continuously replicated using SAP HANA System Replication. During a recent DR test, the operations team discovered that the DR HANA instance had a different SAP HANA revision level than the primary. The team needs to ensure that the DR environment is always ready for a failover. Which action should be taken to prevent this configuration drift?

Accepted Answer

Implement a CI/CD pipeline that deploys SAP HANA updates to both primary and DR instances in a coordinated manner, with automated validation.. A CI/CD pipeline that deploys updates to both primary and DR instances in a coordinated manner ensures that the SAP HANA revision level remains consistent. Automated validation steps can verify that the DR instance is updated correctly and ready for failover. This prevents drift caused by manual updates or missed steps, which is critical for maintaining a reliable DR strategy.

Answer

Configure SAP HANA System Replication to automatically synchronize the SAP HANA revision level from the primary to the secondary.

Answer

Include the SAP HANA software update in the DR runbook and perform it manually on both sites simultaneously.

Answer

Use AWS Systems Manager State Manager to enforce a specific SAP HANA revision level on the DR instance.

Question 12

A company runs SAP NetWeaver on Amazon EC2 instances in a VPC. The operations team uses AWS Systems Manager Session Manager to connect to the instances for administration. After a recent security review, the team must ensure that all session activity is logged to an Amazon S3 bucket for audit purposes. The instances already have the SSM Agent installed and an IAM instance profile attached. Which combination of actions will meet this requirement with the LEAST operational overhead?

Accepted Answer

Configure Session Manager preferences to send session logs to an Amazon S3 bucket and ensure the IAM instance profile includes permissions to write to that bucket.. Session Manager preferences provide a centralized way to enable session logging to S3 or CloudWatch Logs. The instance profile needs permission to write to the target S3 bucket. This approach requires no changes to the instances and minimal configuration, making it the most efficient solution for auditing session activity.

Answer

Use AWS Config to record Session Manager API calls and store the configuration history in an S3 bucket for auditing.

Answer

Install and configure the Amazon CloudWatch agent on each instance to capture terminal sessions and forward them to CloudWatch Logs, then export to S3.

Answer

Enable AWS CloudTrail data events for the S3 bucket used by Session Manager and configure the instances to write session logs directly to that bucket.

Question 13

A company runs SAP NetWeaver on AWS and uses AWS Systems Manager to manage its EC2 instances. The operations team needs to run a pre-defined set of shell commands on all SAP application servers on a scheduled basis to collect performance metrics. The commands must run with root privileges, and the output must be stored in Amazon S3. What is the MOST operationally efficient way to achieve this?

Accepted Answer

Use AWS Systems Manager Run Command to execute the commands on all instances tagged as SAP application servers, and configure the command output to be sent to an S3 bucket.. AWS Systems Manager Run Command is the correct choice because it enables remote command execution across multiple instances without SSH, supports targeting by tags, and can log output to S3. It integrates with IAM for secure access and can be scheduled via maintenance windows. This provides an efficient, scalable, and auditable solution for the operations team.

Answer

Create an AWS Lambda function that uses SSH to connect to each SAP application server and run the commands, then upload the output to S3.

Answer

Configure AWS OpsWorks for Chef Automate to run recipes on the SAP instances that execute the commands and store output in S3.

Answer

Use AWS CloudFormation to deploy a custom resource that runs the commands on each instance via the EC2 user data script.

Question 14

A company runs SAP ERP Central Component (ECC) on AWS and wants to reduce operational overhead by automating the start and stop of its non-production EC2 instances on a schedule. The instances are tagged with Environment=NonProduction. Which AWS service should they use to accomplish this with the least effort?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a pre-built solution that automates the start and stop of EC2 instances based on schedules and tags. It is designed for exactly this use case, requiring minimal setup and no custom code, making it the most efficient choice for automating non-production SAP instances.

Answer

AWS Systems Manager Maintenance Windows

Answer

Amazon EC2 Auto Scaling scheduled actions

Answer

AWS Lambda with a custom script triggered by Amazon EventBridge

Question 15

A company runs SAP NetWeaver on AWS and uses AWS Backup to protect its Amazon EBS volumes. The compliance team requires that backup jobs for the SAP production account be isolated from the account's own administrators, so that even an account administrator cannot delete recovery points. Which AWS Backup feature should be implemented to meet this requirement?

Accepted Answer

Enable AWS Backup Vault Lock in compliance mode on the backup vault.. AWS Backup Vault Lock in compliance mode enforces a WORM policy that even the account root user cannot bypass. This is the only option that prevents account administrators from deleting SAP recovery points, meeting the strict compliance requirement. Other options either manage cost, rely on modifiable IAM policies, or add redundancy without preventing deletion.

Answer

Configure an AWS Backup lifecycle policy to transition recovery points to cold storage after 30 days.

Answer

Attach an IAM policy to the backup vault that denies backup:DeleteRecoveryPoint to all principals.

Answer

Enable AWS Backup Cross-Region Backup to copy recovery points to a secondary region.