PAS-C01 Operations and Maintenance Practice Test 5 — 15 Questions

Question 1

An SAP system administrator notices that nightly SAP HANA backups to Amazon S3 are failing intermittently with 'Access Denied' errors. The backups are initiated by an AWS Lambda function that uses an IAM role. The role has a policy that grants s3:PutObject on the backup bucket. Which additional IAM action is most likely required to resolve the issue?

Accepted Answer

s3:PutObjectAcl. Option C is correct because S3 bucket policies often require s3:PutObjectAcl for cross-account access or when the bucket owner is different from the uploader. Option A is wrong because s3:ListBucket is for listing objects, not uploading. Option B is wrong because s3:GetObject is for reading, not writing. Option D is wrong because s3:DeleteObject is for removing objects, not uploading.

Answer

s3:ListBucket

Answer

s3:DeleteObject

Answer

s3:GetObject

Question 2

An SAP Basis administrator needs to monitor the memory usage of an SAP HANA database running on an EC2 instance. Which AWS service should be used to collect and visualize custom memory metrics from the OS?

Accepted Answer

Amazon CloudWatch with the CloudWatch Agent. Option A is correct because CloudWatch Agent can collect custom metrics from the OS and send them to CloudWatch. Option B is wrong because AWS Config is for resource configuration tracking. Option C is wrong because Systems Manager Inventory collects software inventory, not real-time memory metrics. Option D is wrong because CloudTrail logs API activity, not OS metrics.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Inventory

Answer

AWS Config

Question 3

A company runs SAP HANA on AWS using a single EC2 instance with EBS volumes. The system experiences performance degradation during peak hours. Which approach would provide the MOST immediate improvement in disk I/O performance without downtime?

Accepted Answer

Modify the EBS volume type and IOPS using Elastic Volumes.. Option B is correct because EBS elastic volumes allow modifying volume type (e.g., to gp3 or io2) and IOPS without detaching the volume or stopping the instance. Option A is wrong because migrating to a larger instance type may improve CPU but not necessarily disk I/O immediately. Option C is wrong because creating a new volume and migrating data requires downtime. Option D is wrong because adding more volumes with RAID0 requires reconfiguration and possible downtime.

Answer

Add additional EBS volumes and configure RAID 0 across them.

Answer

Migrate the EC2 instance to a larger instance type.

Answer

Create a new EBS volume with higher performance and copy data using rsync.

Question 4

An SAP administrator is troubleshooting a failed backup of SAP HANA to Amazon S3. The backup is initiated by an SAP HANA BACKUP command using the S3 backint agent. The error log shows 'HTTP 403 Forbidden' when the agent tries to upload to the S3 bucket. The bucket policy allows s3:PutObject from the VPC endpoint. What is the most likely cause?

Accepted Answer

The VPC endpoint policy for S3 does not grant the required actions to the IAM role.. Option C is correct because VPC endpoint policies are separate from bucket policies and often need to grant access explicitly. Option A is wrong because the bucket already exists. Option B is wrong because encryption settings would cause different errors (e.g., Access Denied if KMS key is missing). Option D is wrong because the error is 403, not timeout.

Answer

The S3 bucket does not exist.

Answer

The S3 bucket is not in the same AWS Region as the EC2 instance.

Answer

The S3 bucket uses server-side encryption with AWS KMS (SSE-KMS) and the IAM role lacks kms:GenerateDataKey.

Question 5

An SAP system administrator wants to automate the patching of SAP HANA database instances running on EC2. Which AWS service can schedule and execute patching workflows with approval gates?

Accepted Answer

AWS Systems Manager Maintenance Windows. Option A is correct because AWS Systems Manager Maintenance Windows allow scheduling of patching with optional approval workflows. Option B is wrong because AWS Config is for compliance, not patching. Option C is wrong because CloudWatch Events can trigger actions but lacks built-in approval gates. Option D is wrong because CloudFormation is for infrastructure provisioning, not patching.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

Amazon CloudWatch Events

Question 6

A company runs its SAP environment on AWS and needs to ensure that all changes to the SAP landscape are tracked for auditing. The environment includes EC2 instances, RDS databases, and Lambda functions. Which combination of AWS services provides the most comprehensive audit trail?

Accepted Answer

AWS CloudTrail and AWS Config. Option B is correct because CloudTrail logs API calls for all services, and AWS Config records resource configuration changes, together providing a complete audit trail. Option A is wrong because CloudWatch Logs and Metrics are for monitoring, not auditing changes. Option C is wrong because Systems Manager Inventory collects software inventory, not configuration changes. Option D is wrong because VPC Flow Logs capture network traffic, not configuration changes.

Answer

AWS Systems Manager Inventory and AWS Config

Answer

Amazon VPC Flow Logs and AWS CloudTrail

Answer

Amazon CloudWatch Logs and Amazon CloudWatch Metrics

Question 7

An SAP administrator is restoring an SAP HANA database from a backup stored in Amazon S3. The restore fails with an error indicating that the backup file is corrupt. The backup was created using the SAP HANA BACKUP command with the S3 backint agent. What could cause the backup file to be corrupt?

Accepted Answer

The multipart upload of the backup file was interrupted and not completed.. Option D is correct because multipart upload failures can result in incomplete objects that appear corrupt. Option A is wrong because S3 Versioning does not affect file integrity. Option B is wrong because S3 Transfer Acceleration improves speed, not integrity. Option C is wrong because cross-region replication results in identical copies.

Answer

S3 Transfer Acceleration was used during backup.

Answer

The S3 bucket has versioning enabled.

Answer

The backup was replicated to another AWS Region using S3 Cross-Region Replication.

Question 8

An SAP system administrator needs to restart a critical SAP application server EC2 instance that is part of a cluster. Which approach minimizes downtime?

Accepted Answer

Reboot the instance from the AWS Management Console.. Option A is correct because a reboot does not change the underlying host, and the instance retains its public and private IP addresses. Option B is wrong because stop/start changes the underlying host and may take longer. Option C is wrong because terminating and launching a new instance loses all data on instance store volumes. Option D is wrong because modifying instance type requires stop/start.

Answer

Modify the instance type in the AWS Management Console.

Answer

Stop and start the instance from the AWS Management Console.

Answer

Terminate the instance and launch a new one with the same AMI.

Question 9

A company runs SAP HANA on AWS and needs to back up the database to Amazon S3. Which TWO AWS services can be used to automate the backup process?

Accepted Answer

AWS Lambda. Options C and E are correct. AWS Backup can schedule backups with S3 as a destination, and AWS Lambda can run custom backup scripts. Option A is wrong because CloudFormation is for infrastructure provisioning. Option B is wrong because CloudTrail is for auditing. Option D is wrong because S3 Transfer Acceleration is a feature, not a service.

Answer

AWS CloudFormation

Answer

AWS CloudTrail

Answer

Amazon S3 Transfer Acceleration

Question 10

An SAP system administrator is troubleshooting an issue where SAP users cannot log in to the SAP system. The administrator checks the SAP application server logs and finds that the connection to the SAP HANA database is failing with 'connection refused'. Which THREE AWS resources should be investigated to resolve the issue?

Accepted Answer

Network ACLs for the database subnet. Options B, C, and D are correct. The security group rules for the database instance must allow traffic from the application server; the network ACLs must allow inbound/outbound traffic; and the route table must have a route to the database subnet. Option A is wrong because the Internet Gateway is not needed for internal communication between subnets. Option E is wrong because the VPC peering connection is not necessarily involved unless they are in different VPCs.

Answer

VPC peering connection

Answer

Internet Gateway

Question 11

A company uses AWS Systems Manager to automate patching of SAP application servers. Which TWO resources are required to use Systems Manager Patch Manager?

Accepted Answer

AWS Systems Manager Agent (SSM Agent) installed on the EC2 instances. Options A and B are correct. The SSM Agent must be installed on the EC2 instances to receive commands, and an IAM role with appropriate permissions must be attached to the instances. Option C is wrong because an internet gateway is not required if using VPC endpoints. Option D is wrong because a load balancer is not needed for patching. Option E is wrong because a NAT gateway is not required if using VPC endpoints.

Answer

An Application Load Balancer in front of the instances

Answer

A NAT gateway for outbound internet access

Answer

An internet gateway attached to the VPC

Question 12

A company is running a critical SAP application on AWS. The operations team receives a notification that the SAP HANA database is running low on memory. Which AWS service should be used to automatically increase memory capacity without downtime?

Accepted Answer

Amazon ElastiCache. Option C is correct because Amazon ElastiCache provides in-memory caching and can be integrated with SAP to offload data. Option A is incorrect because Auto Scaling adjusts compute capacity, not memory. Option B is incorrect because Lambda is compute, not memory. Option D is incorrect because DynamoDB is a database, not memory cache.

Answer

Amazon EC2 Auto Scaling

Answer

Amazon DynamoDB

Answer

AWS Lambda

Question 13

An SAP administrator needs to back up the SAP HANA database daily with a retention period of 30 days. The backups must be stored in a cost-effective manner and be instantly accessible for recovery. Which AWS service should be used?

Accepted Answer

Amazon S3 Standard. Option A is correct because Amazon S3 provides durable, cost-effective storage with immediate access via S3 Standard. Option B is incorrect because Glacier has retrieval delays. Option C is incorrect because EBS Snapshots are for EC2 volumes, not HANA backups. Option D is incorrect because S3 Glacier Deep Archive has very long retrieval times.

Answer

Amazon S3 Glacier

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon EBS Snapshots

Question 14

A company runs SAP on AWS and wants to monitor operating system metrics such as memory usage, disk space, and process status using Amazon CloudWatch. Which agent configuration is required on the SAP application and database servers to send these metrics to CloudWatch?

Accepted Answer

Amazon CloudWatch Agent. Option B is correct because the CloudWatch Agent can collect memory, disk, and process metrics and send them to CloudWatch. Option A is incorrect because the SSM Agent is for management, not metrics. Option C is incorrect because the X-Ray daemon is for tracing. Option D is incorrect because the EC2 launch agent is for initialization.

Answer

AWS X-Ray Daemon

Answer

EC2 Launch Agent

Answer

AWS Systems Manager Agent

Question 15

An SAP system running on AWS experiences high latency when accessing data in Amazon S3. The operations team suspects network bandwidth limitations. Which AWS service can be used to monitor the network throughput between the EC2 instances and S3?

Accepted Answer

VPC Flow Logs. Option C is correct because VPC Flow Logs capture IP traffic information and can help analyze throughput. Option A is incorrect because CloudWatch metrics for S3 are request-level, not network. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time monitoring. Option D is incorrect because Config records resource changes, not network performance.

Answer

Amazon CloudWatch S3 metrics

Answer

AWS Trusted Advisor

Answer

AWS Config