PAS-C01 Operations and Maintenance Practice Test 7 — 15 Questions

Question 1

An SAP system administrator needs to perform a backup of an SAP HANA database running on EC2. Which TWO AWS services can be used together to create consistent backups? (Choose TWO.)

Accepted Answer

Amazon EBS snapshots. Amazon EBS snapshots (B) are correct because they capture point-in-time, crash-consistent copies of the EBS volumes that back the SAP HANA database on EC2, and HANA supports storage-level snapshots as a valid backup method when coordinated with the database. AWS Backup (C) is correct because it centrally orchestrates and automates EBS snapshot creation for EC2-hosted SAP HANA, applying schedules, retention, and lifecycle policies to produce consistent backups. Together, EBS snapshots provide the underlying volume-level backup mechanism while AWS Backup manages and automates it. Amazon S3 (A) is object storage and cannot snapshot EBS volumes directly, AWS CloudFormation (D) is an infrastructure-as-code provisioning service rather than a backup tool, and AWS Storage Gateway (E) provides hybrid file/volume/tape gateway access to AWS storage, not native consistent EBS backup orchestration for EC2.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Storage Gateway

Question 2

Which TWO actions should be taken to ensure high availability for an SAP NetWeaver system on AWS? (Choose TWO.)

Accepted Answer

Assign Elastic IP addresses to the instances for failover. Option A is correct because assigning Elastic IP addresses to the instances enables rapid failover: an EIP is a static public IPv4 address that can be programmatically remapped to a standby EC2 instance in another subnet/Availability Zone, so clients and SAP application servers keep reaching the ASCS or other single-point-of-failure component without DNS changes. Option E is correct because Amazon RDS Multi-AZ maintains a synchronous standby replica in a second Availability Zone and performs automatic failover of the database endpoint, which removes the DB tier as a single point of failure for the SAP NetWeaver system. Option B is wrong because placing all EC2 instances in one Availability Zone concentrates risk, so an AZ outage takes down the whole system. Option C is wrong because Spot Instances can be reclaimed by AWS with a two-minute interruption notice, which is unsuitable for the always-on ASCS or database tiers of a highly available SAP system. Option D is wrong because an Auto Scaling group is designed to launch and terminate identical, stateless instances, whereas the ASCS is a stateful single point of failure that requires a clustered failover mechanism (e.g., Windows Failover Clustering or Linux Pacemaker/Corosync with an overlay IP), not horizontal scaling.

Answer

Place all EC2 instances in a single Availability Zone

Answer

Use Amazon EC2 Spot Instances for cost savings

Answer

Deploy the ASCS instance in an Auto Scaling group

Question 3

An SAP Basis administrator is troubleshooting a performance issue on an SAP application server running on an Amazon EC2 instance. The administrator notices high CPU utilization. Which AWS tool can provide detailed insights into the CPU usage at the process level without installing additional agents?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Inventory collects metadata about instances but not process-level CPU. EC2 Instance Connect is for shell access. CloudWatch metrics provide aggregate CPU, not per-process. Systems Manager Run Command can execute scripts to gather process data, but the question asks for a tool that provides the information directly without agents; however, Systems Manager with default agent can run commands to get process-level data, which is more direct than the others. CloudWatch does not provide process-level CPU without custom metrics.

Answer

AWS Systems Manager Inventory

Answer

Amazon CloudWatch CPU Utilization metric

Answer

Amazon EC2 Instance Connect

Question 4

An SAP system on AWS is configured with a multi-AZ deployment for high availability. During a failover test, the secondary instance does not take over as expected. The administrator checks the AWS Management Console and sees that the Elastic IP address is still attached to the primary instance. What is the most likely cause?

Accepted Answer

The Elastic IP is not reassigned during the failover process. In a multi-AZ SAP deployment on AWS, failover typically involves reassigning the Elastic IP (EIP) from the primary to the secondary instance. If the EIP remains attached to the primary instance after a failover test, the most likely cause is that the failover process did not reassign the EIP — either the automation script failed, or the failover was not triggered correctly. The EIP must be explicitly moved; it does not automatically follow the secondary instance.

Answer

The secondary instance's root volume is not attached

Answer

The security group of the secondary instance blocks incoming traffic

Answer

The route tables are not updated to point to the secondary instance

Question 5

An SAP administrator notices that an Amazon RDS for SAP HANA instance is running low on storage. The administrator needs to increase the storage with minimal downtime. What is the most efficient approach?

Accepted Answer

Modify the RDS instance and increase the allocated storage. For SAP HANA on AWS, the database runs on an EC2 instance with attached EBS volumes. To increase storage with minimal downtime, you can modify the EBS volume size while the instance is running using Elastic Volumes (gp2/gp3/io1/io2). This does not require stopping the instance, creating a new instance, or restoring from a snapshot. The ModifyVolume API or AWS Console allows online resizing.

Answer

Create a new RDS instance with larger storage and migrate data

Answer

Stop the instance, modify storage, and start the instance

Answer

Take a snapshot, restore to a larger instance, and update DNS

Question 6

An SAP system running on AWS uses a shared file system via Amazon EFS. Recently, the file system has become slow. The administrator suspects that the burst credits are exhausted. What metric should the administrator check in Amazon CloudWatch to confirm this?

Accepted Answer

BurstCreditBalance. EFS has a BurstCreditBalance metric that tracks available burst credits. When exhausted, throughput drops. PercentIOLimit is not a valid metric. Throughput is the actual throughput, not credit balance. PermittedThroughput is not a metric.

Answer

PermittedThroughput

Answer

Throughput

Answer

PercentIOLimit

Question 7

Which TWO AWS services can be used to monitor the performance of an SAP HANA database running on an EC2 instance? (Choose TWO.)

Accepted Answer

AWS Systems Manager. Amazon CloudWatch (E) is correct because it collects and tracks metrics such as CPU, memory, disk, and custom SAP HANA metrics from the EC2 instance, and can trigger alarms on thresholds. AWS Systems Manager (D) is correct because it provides operational monitoring and management capabilities, including Run Command, Automation, and Inventory, which can be used to gather OS-level and application performance data for SAP HANA on EC2. AWS Trusted Advisor (A) only offers best-practice checks and recommendations, not ongoing performance monitoring of a database. AWS CloudTrail (B) records API activity and audit events, not performance metrics. AWS Config (C) tracks resource configuration changes and compliance, not runtime performance.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

Refer to the exhibit. An SAP administrator has attached the IAM policy above to an IAM role used by an EC2 instance for S3 backup operations. The backup process fails with 'Access Denied' when trying to upload a backup file. What is the most likely cause?

Accepted Answer

The policy does not include kms:GenerateDataKey and kms:Encrypt. If the S3 bucket uses SSE-KMS encryption (which is common for SAP backups), the uploading principal needs kms:GenerateDataKey and kms:Encrypt permissions in addition to s3:PutObject. The policy grants s3:PutObject but omits the KMS permissions, so the upload fails with Access Denied when S3 tries to encrypt the object.

Answer

The policy does not include s3:ListBucket permission

Answer

The policy allows kms:Decrypt on all resources, which is too permissive

Answer

The policy uses s3:PutObject but the bucket policy denies uploads

Question 9

Refer to the exhibit. An SAP administrator receives reports that an application server is slow. The administrator checks the CloudWatch alarm for high CPU but it shows 'OK' state. The get-metric-statistics output shows CPU utilization around 90-95%. What is the most likely reason the alarm is not triggering?

Accepted Answer

The alarm is configured to evaluate based on a longer period than the data shown. CloudWatch alarms evaluate metrics over a specified period and use a statistic (Average, Maximum, etc.) across that period. If the alarm's period is longer than the interval shown in get-metric-statistics (e.g., alarm period is 1 hour but data shows 5-minute spikes), the averaged value over the longer period may fall below the threshold, keeping the alarm in OK state despite short bursts of high CPU.

Answer

The alarm is disabled or the action is not configured

Answer

The alarm threshold is set to 95% and the average is exactly 95%

Answer

The alarm threshold is set to 90% and the evaluation period is 1 hour

Question 10

A company is using AWS Systems Manager to automate patching of EC2 instances. The patch baseline includes both security and non-security updates. The Operations team notices that some instances are not patching within the scheduled maintenance window. What is the most likely cause?

Accepted Answer

The SSM Agent on the instances is outdated.. An outdated SSM Agent on the instances is the most likely cause, because Systems Manager patching via maintenance windows depends on the SSM Agent being able to execute the AWS-RunPatchBaseline document and report status; older agent versions can lack required capabilities or fail to register properly with Systems Manager, causing instances to miss patch runs. While an IAM instance profile is required for SSM, its absence would typically prevent the instance from appearing as a managed node at all rather than selectively missing patches. A maintenance window time zone setting (A) would shift the schedule uniformly, not cause only some instances to fail patching, and a patch baseline being in the wrong Region (D) would affect baseline availability/selection rather than the agent's ability to run patching on otherwise managed instances.

Answer

The maintenance window schedule is set to a different time zone.

Answer

The instances do not have an IAM instance profile attached.

Answer

The patch baseline is configured in the wrong AWS Region.

Question 11

A company runs SAP HANA on an m5.24xlarge EC2 instance. The instance has an EBS-optimized attachment and a high-performance EBS volume for data. The database team reports that write latency to the data volume is consistently above 5 ms during peak hours. Which action would most effectively reduce write latency?

Accepted Answer

Provision the data volume as an io2 Block Express volume with higher IOPS.. The write latency issue on an EBS volume attached to an m5.24xlarge instance is best addressed by using an io2 Block Express volume with higher IOPS (A). io2 Block Express volumes are designed for high-performance, low-latency workloads, offering sub-millisecond latency and high durability. They support up to 256,000 IOPS and 4,000 MB/s throughput per volume, which can significantly reduce write latency compared to other EBS types. This is the most effective action because it directly targets the storage performance bottleneck.

Answer

Use an Elastic Fabric Adapter (EFA) for storage traffic.

Answer

Change the data volume type to gp3.

Answer

Enable EBS optimization on the instance.

Question 12

An organization runs SAP ERP on a single EC2 instance with a separate RDS for Oracle database. The Operations team needs to patch the operating system of the EC2 instance without causing downtime for the SAP application. What is the most effective approach?

Accepted Answer

Create an AMI of the instance, launch a new instance from the AMI, and patch it.. For a single EC2 instance running SAP with a separate RDS database, the most effective way to patch the OS without downtime is to create an AMI of the instance, launch a new instance from that AMI, patch the new instance, and then cut over. This blue/green approach keeps the original instance running until the patched replacement is validated, minimizing downtime. It also avoids in-place patching that could require a reboot.

Answer

Use an Auto Scaling group with a launch template that references a patched AMI, and perform a rolling update.

Answer

Apply patches using AWS Systems Manager Patch Manager during a maintenance window.

Answer

Use AWS Systems Manager to run a script that patches the OS without rebooting.

Question 13

Which TWO actions should be taken to securely manage database credentials for an SAP system running on Amazon RDS for Oracle? (Choose 2)

Accepted Answer

Use IAM database authentication to manage access without passwords.. Option C is correct because IAM database authentication for Amazon RDS for Oracle lets you authenticate to the database using an IAM-generated authentication token instead of a static password, so there are no long-lived database credentials to store or leak. Option D is correct because AWS Secrets Manager is purpose-built to store database credentials and can automatically rotate the RDS for Oracle master/user passwords on a schedule using a Lambda rotation function, keeping secrets encrypted with KMS and retrievable programmatically. Option A is not appropriate because an S3 object, even with server-side encryption, is not a credential-management service and provides no automatic rotation or fine-grained secret access controls. Option B is not the best fit because Parameter Store SecureString parameters are encrypted with KMS but do not natively provide automatic rotation of RDS database passwords. Option E is incorrect because AWS CloudHSM is a hardware security module for key and cryptographic operations, not a service for storing and rotating database credentials.

Answer

Store the credentials as an S3 object with server-side encryption.

Answer

Use AWS Systems Manager Parameter Store with a secure string parameter.

Answer

Store the credentials in AWS CloudHSM.

Question 14

A company runs its SAP HANA database on an EC2 instance with multiple EBS volumes striped using LVM. The operations team notices increased latency and wants to ensure consistent I/O performance. What is the MOST effective way to monitor the average queue length of the EBS volumes?

Accepted Answer

Monitor the `VolumeQueueLength` CloudWatch metric for each EBS volume.. CloudWatch provides the `VolumeQueueLength` metric for EBS volumes, which is the best indicator of I/O queue depth.

Answer

Enable detailed monitoring on the EC2 instance to get per-minute metrics.

Answer

Create a custom CloudWatch metric using the `QueueDepth` performance counter from the OS.

Answer

Use the `iostat` command on the EC2 instance to monitor device queue length.

Question 15

An SAP system is running on EC2 instances in an Auto Scaling group. The operations team needs to ensure that when a new instance is launched, it is automatically registered with the SAP Application Server's load balancer. Which approach should be used?

Accepted Answer

Use a lifecycle hook with a Lambda function that runs a script to register the instance with the SAP load balancer.. Lifecycle hooks pause the instance during the 'pending:wait' state, allowing a Lambda function to run custom registration logic (such as calling the SAP load balancer's registration API or updating a target group) before the instance transitions to 'pending:proceed'. This is the AWS-recommended pattern for executing custom actions at launch time that cannot be baked into the AMI, because it guarantees registration happens before the instance is marked InService.

Answer

Modify the AMI to include a startup script that registers the instance with the SAP load balancer.

Answer

Configure the Auto Scaling group to use an Elastic Load Balancer target group, and set health checks.

Answer

Use an AWS Lambda function triggered by a CloudWatch Events rule for EC2 instance state changes to register the instance.