PAS-C01 Operations and Maintenance — Timed 15 Questions

Question 1

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

15 minute time limit — choose an answer to begin.

Accepted Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance. To encrypt an unencrypted EBS volume, you must first take an unencrypted snapshot, then copy that snapshot with encryption enabled, and finally create a new encrypted volume from the copied snapshot. This approach minimizes downtime as the original volume remains attached during the snapshot and copy operations; only the detach/attach step causes brief downtime. Option A is incorrect because you cannot directly take an encrypted snapshot from an unencrypted volume; AWS does not allow setting encryption at the time of snapshot creation from an unencrypted source.

Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 2

A company runs SAP on AWS and uses a Multi-AZ architecture. The SAP application servers are in an Auto Scaling group across two Availability Zones, and the database is an RDS for SAP HANA Multi-AZ DB instance. During a recent failover test, the database failover completed within 2 minutes, but the application servers took 10 minutes to reconnect to the database. Which action would minimize the application reconnection time?

Accepted Answer

Configure the SAP application to use the RDS Multi-AZ automatic failover endpoint.. Configuring the SAP application to use the RDS Multi-AZ automatic failover endpoint allows the application to reconnect to the new primary database quickly after a failover. This endpoint automatically updates to point to the active database instance, minimizing the time for the application to detect and connect to the new primary. Option D is incorrect because RDS Proxy does not support SAP HANA; it is designed for RDS databases such as MySQL, PostgreSQL, etc. Therefore, it cannot be used to manage connections to an SAP HANA database. Option A is wrong because adjusting the health check grace period does not affect database reconnection. Option C is wrong because increasing the number of application servers does not address reconnection logic.

Answer

Reduce the health check grace period on the Auto Scaling group.

Answer

Increase the minimum number of application servers in the Auto Scaling group.

Answer

Use an RDS Proxy to manage database connections from the application servers.

Question 3

An SAP system administrator wants to automate the patching of SAP HANA database instances running on EC2. Which AWS service can schedule and execute patching workflows with approval gates?

Accepted Answer

AWS Systems Manager Maintenance Windows. AWS Systems Manager Maintenance Windows allow scheduling of patching with optional approval workflows. Option B is wrong because AWS Config is for compliance, not patching. Option C is wrong because AWS CloudFormation is for infrastructure provisioning, not patching. Option D is wrong because Amazon CloudWatch Events can trigger actions but lacks built-in approval gates.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

Amazon CloudWatch Events

Question 4

A company runs its SAP environment on AWS and needs to ensure that all changes to the SAP landscape are tracked for auditing. The environment includes EC2 instances, RDS databases, and Lambda functions. Which combination of AWS services provides the most comprehensive audit trail?

Accepted Answer

AWS CloudTrail and AWS Config. CloudTrail logs API calls for all services, and AWS Config records resource configuration changes, together providing a complete audit trail.

Option A is wrong because Systems Manager Inventory collects software inventory, not all configuration changes, and although AWS Config records configurations, the combination is not as comprehensive as CloudTrail + Config.

Option C is wrong because VPC Flow Logs capture network traffic, not configuration changes; CloudTrail logs API calls but still misses configuration recording.

Option D is wrong because CloudWatch Logs and Metrics are for monitoring and logging, not auditing changes.

Answer

AWS Systems Manager Inventory and AWS Config

Answer

Amazon VPC Flow Logs and AWS CloudTrail

Answer

Amazon CloudWatch Logs and Amazon CloudWatch Metrics

Question 5

An SAP administrator needs to receive alerts when the CPU utilization of an SAP application server exceeds 90% for 5 minutes. Which AWS service should be used to set up the alert?

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Alarms can monitor Amazon EC2 instance CPU utilization metrics and trigger alerts when they exceed a threshold for a specified duration. Option A is incorrect because VPC Flow Logs capture network traffic information, not CPU utilization. Option C is incorrect because AWS CloudTrail records API activity for auditing, not metric monitoring. Option D is incorrect because AWS Config evaluates resource configurations against desired policies, not real-time performance metrics.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company is running an SAP HANA database on an EC2 instance with EBS volumes. The operations team notices that the /hana/data filesystem is growing faster than expected and the available space is critically low. Which action should be taken to monitor the disk space usage proactively?

Accepted Answer

Publish custom CloudWatch metrics for disk space and set an alarm.. Amazon CloudWatch allows you to publish custom metrics from your EC2 instances, such as disk space utilization, and set CloudWatch alarms to proactively notify you when disk space falls below a threshold. Option A is incorrect because AWS Budgets tracks cost and usage, not disk space on an instance. Option B is incorrect because AWS Config evaluates resource configurations for compliance, not operational metrics like disk usage. Option D is incorrect because AWS Trusted Advisor provides recommendations for best practices but does not monitor real-time disk space on EC2 instances.

Answer

Configure AWS Budgets to alert on storage costs.

Answer

Use AWS Config rules to monitor disk space.

Answer

Create an AWS Trusted Advisor check for disk utilization.

Question 7

A company wants to automate the patching of SAP application servers running on EC2 instances. Which AWS service should be used to schedule and apply OS patches?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager allows scheduling and applying OS patches. Option A is wrong because AWS Config is for compliance and configuration, not patching. Option B is wrong because AWS CloudFormation is for infrastructure provisioning. Option D is wrong because AWS OpsWorks is for Chef/Puppet, not primarily for patching.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Question 8

A company runs SAP on AWS and uses a Multi-AZ RDS for SAP HANA database. The database fails over unexpectedly, causing application downtime. The operations team wants to analyze the cause of the failover. Which set of logs should be examined?

Accepted Answer

RDS events and DB instance logs.. RDS events and DB instance logs (error log, slow query log) provide information about failover causes. Option A is wrong because CloudTrail logs API calls, not database events. Option C is wrong because CloudWatch Logs from the EC2 instance are not available for RDS; RDS provides its own logging. Option D is wrong because VPC Flow Logs and NLB logs capture network traffic, not database failover events.

Answer

AWS CloudTrail logs and S3 access logs.

Answer

CloudWatch Logs from the EC2 instance hosting the database.

Answer

VPC Flow Logs and Network Load Balancer logs.

Question 9

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic across multiple EC2 instances. The operations team notices that some instances are marked as unhealthy even though the application is running correctly. Which TWO actions could resolve this issue?

Accepted Answer

Increase the healthy threshold count.. Increasing the healthy threshold count makes the load balancer require more consecutive successful health checks before marking an instance as healthy, preventing flapping. Option B is wrong because associating an Elastic IP address does not affect health check status; it only provides a static public IP. Option C is wrong because changing the health check protocol to TCP would not resolve application-level health issues; ALB supports HTTP/HTTPS health checks which are more appropriate for web applications. Option D is correct because changing the health check path to a simpler endpoint (e.g., a static page) reduces the chance of false failures caused by complex application logic. Option E is wrong because decreasing the health check interval increases the frequency of checks, which could cause unnecessary load and does not prevent false failures.

Answer

Associate an Elastic IP address with each instance.

Answer

Change the health check protocol to TCP.

Answer

Decrease the health check interval.

Question 10

A company runs an SAP HANA database on an EC2 instance with EBS volumes. The operations team notices increased latency and I/O errors. Which AWS service should they use to analyze performance and identify bottlenecks?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides metrics and logs to monitor EC2 and EBS performance. Option A (AWS Config) tracks configuration changes, not performance. Option C (AWS Service Catalog) manages service portfolios, not monitoring. Option D (AWS Trusted Advisor) gives recommendations but not real-time performance data.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS Trusted Advisor

Question 11

An SAP system is running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The SAP application logs indicate intermittent timeouts. The operations team has enabled detailed CloudWatch metrics for the ALB. Which metric should they analyze to determine if the ALB is the cause of the timeouts?

Accepted Answer

RequestCount per target. `RequestCount per target` helps identify if traffic is unbalanced across targets, which can cause intermittent timeouts. Option A (`HTTPCode_ELB_5XX`) shows ALB errors but not per-target imbalance directly. Option B (`HealthyHostCount`) shows health status but not request distribution. Option C (`TargetResponseTime`) indicates latency but not directly timeouts.

Answer

HTTPCode_ELB_5XX

Answer

HealthyHostCount

Answer

TargetResponseTime

Question 12

An SAP administrator notices that an Amazon RDS for SAP HANA instance is running low on storage. The administrator needs to increase the storage with minimal downtime. What is the most efficient approach?

Accepted Answer

Modify the RDS instance and increase the allocated storage. For SAP HANA on AWS, the database runs on an EC2 instance with attached EBS volumes. To increase storage with minimal downtime, you can modify the EBS volume size while the instance is running using Elastic Volumes (gp2/gp3/io1/io2). This does not require stopping the instance, creating a new instance, or restoring from a snapshot. The ModifyVolume API or AWS Console allows online resizing.

Answer

Create a new RDS instance with larger storage and migrate data

Answer

Stop the instance, modify storage, and start the instance

Answer

Take a snapshot, restore to a larger instance, and update DNS

Question 13

A company is using AWS Systems Manager to automate patching of EC2 instances. The patch baseline includes both security and non-security updates. The Operations team notices that some instances are not patching within the scheduled maintenance window. What is the most likely cause?

Accepted Answer

The SSM Agent on the instances is outdated.. Systems Manager Patch Manager requires the SSM Agent to be installed and updated; an outdated agent can fail to apply patches. Option A is incorrect because a maintenance window time zone mismatch would affect all instances uniformly, not just some. Option B is incorrect because while an IAM instance profile is required for Systems Manager to manage instances, its absence would prevent any patching, not just occasional failures. Option D is incorrect because a patch baseline in the wrong Region would only affect instances in that Region, not a subset of instances across multiple Regions.

Answer

The maintenance window schedule is set to a different time zone.

Answer

The instances do not have an IAM instance profile attached.

Answer

The patch baseline is configured in the wrong AWS Region.

Question 14

A SAP administrator needs to grant an IAM user permission to start and stop EC2 instances that are part of an SAP environment. The administrator wants to follow the principle of least privilege. Which IAM policy action should be included?

Accepted Answer

ec2:StartInstances and ec2:StopInstances. Ec2:StartInstances and ec2:StopInstances are the specific actions needed to start and stop EC2 instances. Option A is wrong because ec2:TerminateInstances would terminate instances, which is more destructive than required. Option B is wrong because ec2:RunInstances launches new instances, not start/stop existing ones. Option D is wrong because ec2:RebootInstances only reboots instances, not start or stop them.

Answer

ec2:TerminateInstances

Answer

ec2:RunInstances

Answer

ec2:RebootInstances

Question 15

A company runs SAP HANA on AWS and uses AWS Backup to back up the HANA database volumes. The backup job fails with an error indicating that the volume is in use. What is the most likely cause of this failure?

Accepted Answer

The volume is attached to an instance and the filesystem is not frozen before snapshot.. AWS Backup relies on resource tags to determine which EBS volumes to include in backup plans. If the volume does not have the required tags (e.g., 'BackupPlan' tag), AWS Backup may skip the volume or fail to create a snapshot, leading to a backup failure. The error message 'volume is in use' can be misleading; the underlying issue is often missing tags, not the volume being active. Ensuring volumes are properly tagged with the backup plan's required tags resolves the issue.

Answer

The AWS Backup service does not have permission to create snapshots in the account.

Answer

The EBS volume is not tagged with the required backup tags.

Answer

The EC2 instance does not have the AWS Backup agent installed.