PAS-C01 Operations and Maintenance Practice Test 5 — 15 Questions

Question 1

A company is migrating its SAP environment to AWS and wants to automate the installation of SAP software on EC2 instances. Which AWS service is best suited for this purpose?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is an Infrastructure as Code (IaC) service that allows you to define and provision AWS infrastructure and automate software installation using templates. For SAP on AWS, CloudFormation templates can automate the creation of EC2 instances, EBS volumes, security groups, and run user data scripts or AWS Systems Manager documents to install SAP software. AWS provides SAP-specific CloudFormation templates and Quick Starts for this purpose.

Answer

AWS Elastic Beanstalk

Answer

Amazon EC2 Launch Templates

Answer

AWS OpsWorks

Question 2

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. The primary site is in us-east-1 and the DR site in us-west-2. The SAP HANA database is 5 TB. Which approach meets these requirements cost-effectively?

Accepted Answer

Configure HANA System Replication in async mode between the primary and DR instances over AWS Direct Connect.. HANA System Replication (HSR) in async mode is the native SAP HANA disaster recovery solution that continuously replicates data changes from the primary to the secondary instance. It can achieve an RPO of 15 minutes (often much lower) and an RTO of 2 hours, and it is cost-effective because it uses the existing HANA instances and network connectivity without additional data transfer services.

Answer

Use Amazon S3 cross-region replication to copy database backups every 15 minutes.

Answer

Use AWS Database Migration Service (DMS) for ongoing replication to a HANA instance in us-west-2.

Answer

Take EBS snapshots of the data volume every 15 minutes and copy them to us-west-2.

Question 3

An administrator needs to apply a critical OS security patch to multiple SAP application servers in an Auto Scaling group without disrupting ongoing operations. Which strategy should be used?

Accepted Answer

Use AWS CloudFormation with a rolling update policy to gradually replace instances in the Auto Scaling group.. Using AWS CloudFormation with a rolling update policy allows you to gradually replace instances in the Auto Scaling group, ensuring that a minimum number of instances remain in service during the update. This strategy applies the patch without disrupting ongoing operations, as the update is performed in batches.

Answer

Stop all instances, apply the patch using AWS Systems Manager, then restart all instances.

Answer

Use AWS Systems Manager Patch Manager to patch instances at the next maintenance window.

Answer

Create a new Amazon Machine Image (AMI) with the patch, update the Auto Scaling group's launch configuration, and terminate all instances.

Question 4

An SAP administrator receives an alert that the SAP HANA database is using 95% of its allocated memory. The system is running on an EC2 instance with 1 TB of RAM. The administrator needs to add more memory without significant downtime. Which action should be taken?

Accepted Answer

Stop the SAP HANA database, change the EC2 instance type to one with more memory, then restart the database.. SAP HANA is an in-memory database, so adding memory requires moving to an EC2 instance type with a larger memory footprint. EC2 instance types cannot be changed while the instance is running for most families, so the instance must be stopped, the type modified, and the instance restarted. This is the correct approach to increase memory with only the downtime of a stop/start cycle.

Answer

Modify the EC2 instance type to a larger size while the instance is running.

Answer

Add additional EBS volumes to the instance to increase memory capacity.

Answer

Increase the swap space on the instance to provide virtual memory.

Question 5

A company is running SAP on AWS and needs to monitor the health of their SAP application servers. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (B) is correct because it collects and tracks metrics, logs, and alarms from the SAP application servers (via the CloudWatch agent and SAP-specific metrics), providing the health and performance monitoring data needed. Amazon Route 53 (C) is correct because its health checks can probe the SAP application endpoints and, combined with CloudWatch alarms, enable DNS failover and availability monitoring of the SAP servers. AWS X-Ray (A) is not appropriate here since it traces requests through distributed applications rather than monitoring server health. AWS CloudTrail (D) only records API activity and audit events, not application server health. Amazon Inspector (E) performs vulnerability and security assessments, not ongoing health monitoring.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 6

An SAP system on AWS is experiencing high latency. Which THREE metrics should be examined in Amazon CloudWatch to diagnose the issue?

Accepted Answer

NetworkIn/NetworkOut. NetworkIn/NetworkOut (A) is correct because these CloudWatch metrics report the bytes received and sent on the instance's network interfaces, and sustained high or saturated throughput directly indicates network-level latency affecting SAP communication. CPUUtilization (D) is correct because high CPU usage on the EC2 instance can delay SAP work processes and dialog response times, making it a primary latency indicator. EBS VolumeQueueLength (E) is correct because it measures the number of pending I/O requests on the EBS volume; a growing queue signals storage I/O contention that adds latency to SAP database and application reads/writes. DiskReadBytes (B) is not among the marked answers because it only shows read throughput volume, not latency or saturation, so it is less diagnostic here. StatusCheckFailed (C) is not marked because it indicates instance or system health failures (e.g., unreachable or impaired host), which would cause outages rather than the gradual high-latency condition described.

Answer

DiskReadBytes

Answer

StatusCheckFailed

Question 7

An SAP administrator notices that the application logs show repeated authentication failures from a specific IP address. The SAP application is hosted on an EC2 instance behind an Application Load Balancer. What AWS service can be used to block traffic from that IP at the network level?

Accepted Answer

Use AWS WAF to create an IP set and block rule, associated with the ALB.. AWS WAF can be associated with an Application Load Balancer and allows creation of an IP set and a block rule to deny traffic from specific IP addresses at the application layer. This directly addresses the requirement to block the offending IP before it reaches the SAP application. WAF rules are evaluated at the ALB, providing network-level blocking without modifying underlying infrastructure.

Answer

Use Amazon CloudFront with a geo-restriction to block the IP.

Answer

Update the security group of the EC2 instance to deny traffic from that IP.

Answer

Add a network ACL rule to the subnet to deny traffic from that IP.

Question 8

A company runs SAP on AWS and uses a Multi-AZ RDS for Oracle as the database. They observe that the database failover took longer than expected during a recent test. What is the most likely cause of the increased failover time?

Accepted Answer

The primary instance had a high volume of ongoing transactions that needed to be completed or rolled back before failover could proceed.. RDS Multi-AZ failover requires the primary to finish or roll back in-flight transactions and flush its state before the standby can be promoted, so a high volume of ongoing transactions directly lengthens the failover window. The standby is synchronously replicated, so it must wait for the primary's transaction state to be resolved. This makes option C the most likely cause of the observed delay.

Answer

The database had a large number of uncommitted transactions that needed to be rolled back.

Answer

The DNS TTL was set too high, causing delays in routing to the new primary.

Answer

The standby instance was not in sync because read replicas were used for reads.

Question 9

An SAP system is deployed on EC2 instances with EBS volumes. The operations team needs to implement a backup strategy that provides point-in-time recovery for the EBS volumes with minimal downtime. Which AWS service should they use?

Accepted Answer

Amazon EBS Snapshots. Amazon EBS Snapshots provide point-in-time, incremental backups of EBS volumes and can be restored quickly to create new volumes, giving point-in-time recovery with minimal downtime. Snapshots are stored in S3 behind the scenes and are the native AWS mechanism for EBS volume backup and restore.

Answer

AWS Storage Gateway

Answer

AWS Backup

Answer

Amazon S3

Question 10

An administrator needs to monitor the CPU utilization of an SAP HANA database running on an EC2 instance. The monitoring data must be stored for 15 months. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon CloudWatch Metrics. Amazon CloudWatch Metrics is the correct service for monitoring and storing CPU utilization data. It supports custom metrics with retention up to 15 months, meeting the requirement. Amazon S3 is for object storage, not metrics. AWS CloudTrail records API activity, not performance data. Amazon CloudWatch Logs is for log files, not numeric metrics.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 11

An SAP HANA database is running on an EC2 instance with multiple EBS volumes for data, log, and shared storage. The administrator needs to ensure that the volumes are backed up consistently to avoid data corruption. Which THREE measures should be taken? (Select THREE.)

Accepted Answer

Take snapshots of all volumes simultaneously using the EBS multi-volume snapshot feature.. Option B is correct because the EBS multi-volume snapshot feature (CreateSnapshots / multi-volume snapshots) initiates snapshots of all specified volumes at the same point in time, giving a crash-consistent set across data, log, and shared volumes without needing to stop the instance. Option C is correct because SAP HANA requires a specific snapshot sequence — the data volumes must be snapped before the log volumes — so that the log can replay/roll forward and the backup is recoverable; taking them in the wrong order can leave the log inconsistent with the data. Option D is correct because freezing the filesystem with xfs_freeze (or fsfreeze) quiesces I/O and flushes pending writes, ensuring the snapshot captures a consistent on-disk state rather than in-flight transactions. Option A is not appropriate here because AWS Backup application-consistent snapshots with pre/post scripts target Windows VSS or supported databases and do not natively integrate with SAP HANA's own backup/snapshot handling. Option E is unnecessary and undesirable because stopping the EC2 instance causes downtime and is not required when multi-volume snapshots plus filesystem freeze are used.

Answer

Use the application-consistent snapshot feature of AWS Backup with pre/post scripts.

Answer

Stop the EC2 instance before taking snapshots.

Question 12

Refer to the exhibit. An administrator runs the AWS CLI command shown. The instance is running Windows. Which of the following is true based on the output?

Accepted Answer

The instance is in the 'running' state, but the status of the SAP application is unknown from this output.. The AWS CLI command shown is likely `aws ec2 describe-instances` or similar, which returns EC2 instance state and metadata. The output indicates the instance is in the 'running' state, but this only reflects the EC2 instance status, not the health or status of any applications running on it, such as SAP. Therefore, the SAP application status is unknown from this output alone.

Answer

The instance is in the 'stopped' state.

Answer

The instance type is t2.micro.

Answer

The instance is running Linux.

Question 13

Refer to the exhibit. An IAM policy is attached to a user who manages SAP EC2 instances. Which of the following actions can the user perform?

Accepted Answer

Describe all EC2 instances, but start and stop only those with the tag Environment=production.. The IAM policy (as shown in the exhibit) grants DescribeInstances on all resources and StartInstances/StopInstances only on instances tagged Environment=production. Therefore the user can describe all EC2 instances but can start and stop only production-tagged instances. This matches option A exactly. The policy does not grant TerminateInstances, so termination is not allowed.

Answer

Describe, start, and stop all EC2 instances regardless of tags.

Answer

Start and stop any EC2 instance in the account.

Answer

Terminate any EC2 instance with the tag Environment=production.

Question 14

Refer to the exhibit. A CloudTrail log entry shows that the user 'sapadmin' stopped an instance. Which of the following is true based on the log?

Accepted Answer

The user 'sapadmin' stopped the instance i-0abcdef1234567890.. The CloudTrail log entry shows the StopInstances API call made by the IAM user 'sapadmin' against the EC2 instance i-0abcdef1234567890, so the accurate statement is that sapadmin stopped that specific instance. CloudTrail records the API action, the identity of the caller, the resource affected, and the result. Since the question states the log shows the instance was stopped, option C correctly reflects the event details.

Answer

The StopInstances API call failed.

Answer

The user 'sapadmin' started the instance.

Answer

The event was related to an RDS instance.

Question 15

A company runs its SAP system on AWS and uses an Application Load Balancer (ALB) to distribute traffic to SAP Web Dispatchers. The operations team reports that some users experience intermittent connectivity issues. The ALB health checks are configured to check the /sap/public/bc/icf/logon endpoint. Which configuration change would best improve the reliability of health checks?

Accepted Answer

Change the health check endpoint to a static HTML page that does not require authentication.. Health checks should target a simple, static resource that is always available and does not require authentication. The /sap/public/bc/icf/logon endpoint requires a session and may fail due to transient authentication issues, causing false health check failures. Using a static HTML page eliminates this dependency and improves reliability. Option A is incorrect because increasing the unhealthy threshold would actually delay detection of real failures, potentially allowing unhealthy instances to receive traffic longer. Option B is incorrect because HTTP/2 is a protocol enhancement for performance, not health check reliability. Option C is incorrect because replacing the ALB with a Network Load Balancer would not address the root cause; the issue is the health check endpoint itself.

Answer

Increase the unhealthy threshold count to reduce false positives.

Answer

Enable HTTP/2 support on the ALB.

Answer

Replace the ALB with a Network Load Balancer.