PAS-C01 Operations and Maintenance Practice Test 6 — 15 Questions

Question 1

A company runs SAP on AWS and uses a Multi-AZ RDS for SAP HANA database. The database fails over unexpectedly, causing application downtime. The operations team wants to analyze the cause of the failover. Which set of logs should be examined?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RDS events and DB instance logs.. RDS events and DB instance logs (error log, slow query log) provide information about failover causes. Option A is wrong because CloudTrail logs API calls, not database events. Option C is wrong because CloudWatch Logs from the EC2 instance are not available for RDS; RDS provides its own logging. Option D is wrong because VPC Flow Logs and NLB logs capture network traffic, not database failover events.

Answer

AWS CloudTrail logs and S3 access logs.

Answer

CloudWatch Logs from the EC2 instance hosting the database.

Answer

VPC Flow Logs and Network Load Balancer logs.

Question 2

A company runs SAP on AWS and wants to reduce costs by stopping non-production instances during off-hours. Which AWS service can automatically start and stop EC2 instances on a schedule?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a solution (built on AWS Lambda and DynamoDB) that automates starting and stopping EC2 instances on a schedule, typically to reduce costs during off-hours. It is designed exactly for the use case of stopping non-production SAP instances at night and on weekends and starting them again in the morning. It supports tags and schedules to target specific instances.

Answer

AWS Systems Manager Maintenance Windows

Answer

Amazon CloudWatch Alarms

Answer

EC2 Auto Scaling

Question 3

A company wants to ensure that its SAP system backups are stored in a different AWS Region to comply with disaster recovery requirements. Which AWS service should be used to copy EBS snapshots to another Region?

Accepted Answer

AWS Backup. AWS Backup provides a centralized, policy-driven backup service that supports cross-Region copy of EBS snapshots (and other resource types) as part of a backup plan. It is the recommended AWS service for meeting DR requirements that mandate backups in a separate Region, because it handles snapshot lifecycle, retention, and cross-Region replication natively. Configuring a copy action in the backup plan sends snapshots to the target Region automatically.

Answer

Amazon Data Lifecycle Manager

Answer

Amazon S3 Cross-Region Replication

Answer

AWS CloudFormation StackSets

Question 4

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic across multiple EC2 instances. The operations team notices that some instances are marked as unhealthy even though the application is running correctly. Which TWO actions could resolve this issue?

Accepted Answer

Increase the healthy threshold count.. Option A is correct because increasing the healthy threshold count means an instance must pass more consecutive health checks before being marked healthy, which prevents transient failures or brief latency spikes from incorrectly flagging a working instance as unhealthy. Option D is correct because if the configured health check path points to a complex or resource-intensive endpoint that returns errors or times out, switching to a simpler endpoint (such as a lightweight status page) lets the ALB accurately verify instance health. Option B is incorrect because Elastic IP addresses are unrelated to ALB target health checks; ALB targets are reached via their private IPs and health checks do not depend on public addressing. Option C is incorrect because changing the protocol to TCP would bypass HTTP-level validation and is not a valid ALB target group health check protocol (ALB supports HTTP/HTTPS only), so it would not resolve the issue. Option E is incorrect because decreasing the health check interval makes checks more frequent, which can increase false unhealthy markings rather than resolve them.

Answer

Associate an Elastic IP address with each instance.

Answer

Change the health check protocol to TCP.

Answer

Decrease the health check interval.

Question 5

A company wants to automatically recover an SAP HANA database EC2 instance if it becomes impaired due to underlying hardware issues. Which THREE components are required for this automatic recovery?

Accepted Answer

A CloudWatch alarm that monitors the StatusCheckFailed metric.. Option A is correct because EC2 automatic recovery is triggered by a CloudWatch alarm based on the StatusCheckFailed metric (which aggregates StatusCheckFailed_System and StatusCheckFailed_Instance), so this alarm is the mechanism that detects the impairment and initiates recovery. Option B is correct because the instance itself must be configured for EC2 Auto Recovery (the recover action on the alarm), which is what actually restores the instance on new hardware. Option C is correct because automatic recovery only works for instances launched in a single Availability Zone; the recovery action relaunches the instance in the same AZ, so a single-AZ deployment is required. Option D is incorrect because spreading the instance across multiple Availability Zones is not how EC2 Auto Recovery works and is not a prerequisite. Option E is incorrect because an Elastic IP address is not required for automatic recovery; the instance retains its private IP, and any public IP behavior is separate from the recovery mechanism.

Answer

Multiple Availability Zones for the instance.

Answer

An Elastic IP address associated with the instance.

Question 6

An SAP administrator is troubleshooting why a user cannot stop a production EC2 instance. The IAM policy attached to the user is shown in the exhibit. Which action is likely causing the failure?

Accepted Answer

The instance does not have the tag Environment=production.. The IAM policy likely includes a condition that requires the instance to have a specific tag, such as Environment=production, for the StopInstances action to be allowed. If the instance does not have that tag, the action is denied. The exhibit (not shown) probably contains a condition like 'StringEquals': {'ec2:ResourceTag/Environment': 'production'}, and the instance lacks that tag, causing the failure.

Answer

There is an explicit deny statement in another policy.

Answer

The policy does not allow the StopInstances action.

Answer

The policy does not include ec2:DescribeInstances action.

Question 7

An SAP administrator runs the CLI commands shown in the exhibit for a production EC2 instance. The output indicates that the instance is running but the system status is impaired. Which action should the administrator take to recover the instance?

Accepted Answer

Configure EC2 Auto Recovery and wait for recovery.. When an EC2 instance shows a system status check failure (impaired), the recommended recovery for a production instance is to configure EC2 Auto Recovery, which automatically recovers the instance to a new host when the underlying hardware fails. This preserves the instance ID, private IP, and Elastic IP, and is the least disruptive option for SAP production workloads. Auto Recovery is designed exactly for this scenario where the instance is running but the system status check fails.

Answer

Reboot the instance using the AWS console.

Answer

Restart the SAP application services.

Answer

Stop and start the instance.

Question 8

An SAP administrator is troubleshooting connectivity between an SAP application server (security group sg-12345) and an SAP HANA database server. The inbound rule on the database security group is shown in the exhibit. Which additional configuration is required for the application server to communicate with the database?

Accepted Answer

Modify the network ACL to allow inbound traffic on port 3300.. The exhibit shows the database security group has an inbound rule referencing sg-12345, which is the application server's security group. However, security groups are stateful and only control traffic at the instance level. Network ACLs (NACLs) are stateless and control traffic at the subnet level. If the NACL associated with the database subnet does not allow inbound traffic on port 3300 (the SAP HANA SQL port), the traffic will be blocked even if the security group allows it. Therefore, the NACL must be modified to allow inbound traffic on port 3300.

Answer

Add an inbound rule allowing traffic from the application server's IP address.

Answer

Add an inbound rule to the application server's security group.

Answer

No additional rule is needed; the rule allows traffic from sg-12345.

Question 9

A company runs an SAP HANA database on an EC2 instance with EBS volumes. The operations team notices increased latency and I/O errors. Which AWS service should they use to analyze performance and identify bottlenecks?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides metrics and logs to monitor EC2 and EBS performance. Option A (AWS Config) tracks configuration changes, not performance. Option C (AWS Service Catalog) manages service portfolios, not monitoring. Option D (AWS Trusted Advisor) gives recommendations but not real-time performance data.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS Trusted Advisor

Question 10

An SAP system is running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The SAP application logs indicate intermittent timeouts. The operations team has enabled detailed CloudWatch metrics for the ALB. Which metric should they analyze to determine if the ALB is the cause of the timeouts?

Accepted Answer

RequestCount per target. `RequestCount per target` helps identify if traffic is unbalanced across targets, which can cause intermittent timeouts. Option A (`HTTPCode_ELB_5XX`) shows ALB errors but not per-target imbalance directly. Option B (`HealthyHostCount`) shows health status but not request distribution. Option C (`TargetResponseTime`) indicates latency but not directly timeouts.

Answer

HTTPCode_ELB_5XX

Answer

HealthyHostCount

Answer

TargetResponseTime

Question 11

A company is migrating an SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS service is best suited for this?

Accepted Answer

Amazon Route 53 weighted routing policy. Amazon Route 53 weighted routing policy is correct because it allows you to distribute traffic across multiple ASCS instances in different Availability Zones, enabling high availability. By assigning weights, you can direct traffic to a primary ASCS and fail over to a secondary if the primary becomes unavailable. This is a common pattern for SAP ASCS high availability on AWS, often combined with an overlay IP or a cluster solution. Route 53 health checks can automatically remove unhealthy endpoints from DNS responses, ensuring seamless failover.

Answer

Amazon RDS Multi-AZ deployment

Answer

EC2 Auto Scaling group

Answer

Amazon S3 cross-region replication

Question 12

An SAP on AWS environment uses a shared file system with Amazon EFS. The operations team reports slow performance during peak hours. Which configuration change would most likely improve throughput?

Accepted Answer

Increase provisioned throughput. Increasing provisioned throughput on Amazon EFS is a direct configuration change that raises the throughput limit, which most reliably improves performance during peak hours. Bursting throughput is the default mode and cannot be 'enabled' as a change; it automatically allows bursting based on stored data, but during sustained peak usage, provisioned throughput is needed to guarantee higher throughput. Option A (encryption at rest) does not affect performance. Option C (Enable Bursting Throughput) is misleading because bursting is already enabled by default and cannot be turned on as a new configuration; it also does not provide sustained throughput improvement. Option D (Max I/O performance mode) optimizes for high I/O operations but does not directly increase throughput.

Answer

Enable encryption at rest

Answer

Enable Bursting Throughput

Answer

Change the performance mode to Max I/O

Question 13

An SAP system is running on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers be encrypted in transit. Which solution meets this requirement with minimal latency?

Accepted Answer

Use security groups to allow traffic only between the instances, with IPsec configured. It uses IPsec to encrypt traffic directly between the EC2 instances, which operates at the network layer (Layer 3) and adds minimal overhead compared to other solutions. Security groups are used to restrict traffic to only the necessary instances, but the encryption is provided by IPsec, which is efficient and does not introduce additional network hops. This approach meets the requirement for encryption in transit with minimal latency because it avoids the need for additional services like VPNs or load balancers.

Answer

Use an AWS Site-to-Site VPN connection between the tiers

Answer

Use an Application Load Balancer with TLS termination in front of the database tier

Answer

Install TLS certificates on each EC2 instance and enable HTTPS

Question 14

An SAP HANA database is experiencing high memory utilization. The operations team needs to determine if the database is using more memory than allocated. Which CloudWatch metric should they monitor?

Accepted Answer

MemoryUtilization. (MemoryUtilization) is correct because the SAP HANA agent in CloudWatch publishes the 'MemoryUtilization' metric, which directly shows the percentage of memory used by the HANA database. Option D (HANA_Memory_Usage) is not a standard CloudWatch metric name. Option B (SwapUsage) is for swap, not memory. Option C (CPUUtilization) is for CPU usage.

Answer

SwapUsage

Answer

CPUUtilization

Answer

HANA_Memory_Usage

Question 15

An SAP system uses a large Amazon RDS for Oracle instance. The operations team wants to minimize downtime during a major version upgrade. Which strategy should they use?

Accepted Answer

Create a read replica, upgrade it, and then promote it to the primary. Using a read replica allows you to upgrade the replica and then promote it, minimizing downtime. Option A (taking a snapshot and restoring) has downtime. Option C (modifying the DB instance) causes downtime. Option D (using AWS DMS) requires complex setup and may introduce latency.

Answer

Take a snapshot of the database and restore it as a new instance with the upgraded version

Answer

Modify the DB instance and apply the upgrade immediately

Answer

Use AWS Database Migration Service (DMS) to migrate to a new instance