PAS-C01 Technology — 25 Questions

Question 1

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. During a flash sale, the application experiences a sudden spike in traffic, but the Auto Scaling group does not scale out quickly enough, causing some requests to fail. Which solution would improve the scaling responsiveness?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a scheduled scaling action to increase capacity before the flash sale.. A scheduled scaling action proactively increases capacity before the flash sale, eliminating the lag inherent in dynamic scaling policies. Dynamic scaling reacts to metrics like average CPU utilization, which can take minutes to trigger and propagate, causing request failures during sudden spikes. By pre-scaling, the Auto Scaling group has sufficient instances ready to handle the traffic surge immediately.

Answer

Increase the cooldown period for the dynamic scaling policy.

Answer

Decrease the cooldown period for the dynamic scaling policy.

Answer

Disable scale-in to prevent the Auto Scaling group from terminating instances during the sale.

Question 2

A company is migrating a legacy application to AWS. The application uses a custom TCP protocol and requires session persistence. The application runs on a fleet of EC2 instances behind a Network Load Balancer (NLB). The current configuration uses a TCP listener with 'source IP' stickiness. However, some clients are being routed to different instances mid-session, causing application errors. What is the most likely cause and solution?

Accepted Answer

Clients are behind a NAT gateway, so the source IP changes between requests, breaking stickiness. Use a 'stitched' cookie or switch to an Application Load Balancer.. Clients behind a NAT gateway will have their source IP address translated to the NAT gateway's public IP, which remains consistent for all requests from that gateway. However, if multiple clients share the same NAT gateway, the source IP is the same, but the NLB's source IP stickiness is based on the client's source IP as seen by the NLB. If the NAT gateway uses multiple public IPs or if clients are behind different NAT gateways, the source IP can change between requests, breaking stickiness. The solution is to use a 'stitched' cookie or switch to an Application Load Balancer, which supports cookie-based session persistence independent of source IP.

Answer

The NLB does not support source IP stickiness; use a Classic Load Balancer instead.

Answer

The NLB has cross-zone load balancing enabled, which distributes traffic across instances in different Availability Zones.

Answer

The idle timeout of the NLB is too low, causing the NLB to close connections prematurely.

Question 3

A company is using AWS CloudFormation to manage infrastructure. The development team wants to deploy a new version of a stack that updates an existing RDS DB instance's DB engine version. The update requires a replacement of the database. Which CloudFormation stack policy setting allows the update to proceed while preventing other resources from being replaced or updated?

Accepted Answer

Set a stack policy that allows updates to the specific RDS DB instance resource.. A stack policy in AWS CloudFormation can be set to explicitly allow updates to a specific resource (e.g., the RDS DB instance) while denying updates to all other resources by default. Since the update requires a replacement of the database, the policy must permit the update action on that exact resource logical ID, ensuring the DB engine version change proceeds without risking unintended modifications to other stack resources.

Answer

Set a stack policy that allows updates to RDS resources only.

Answer

Set a stack policy that denies all updates.

Answer

Set a stack policy that allows all updates.

Question 4

A company is running a stateful application on EC2 instances in an Auto Scaling group. The instances store session state locally. The group uses a simple scaling policy based on network traffic. The company notices that when instances are terminated during scale-in, active sessions are lost. What is the MOST effective way to preserve session state during scaling events?

Accepted Answer

Use a lifecycle hook to gracefully drain sessions before instance termination.. A lifecycle hook is the most effective solution because it pauses the instance termination process during scale-in, allowing the application to drain active sessions (e.g., by transferring session state to a shared data store like ElastiCache or DynamoDB) before the instance is fully terminated. This preserves session continuity without requiring architectural changes to the application's stateful design.

Answer

Use a step scaling policy instead of a simple scaling policy.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Use a launch configuration that enables termination protection.

Question 5

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and be accessible only within the VPC. Which TWO steps should the solutions architect take to meet these requirements? (Choose TWO.)

Accepted Answer

Use an internal Application Load Balancer to distribute traffic between services.. An internal Application Load Balancer (ALB) operates within a VPC and does not expose a public endpoint, ensuring that traffic between microservices remains private. It distributes incoming requests to Fargate tasks based on defined rules, enabling secure, internal communication without internet access.

Answer

Attach an Internet Gateway to the VPC and configure route tables for the private subnets.

Answer

Place the Fargate tasks in public subnets to allow them to communicate with each other through the internet gateway.

Answer

Use AWS Cloud Map for service discovery and register a public DNS name for each service.

Question 6

A company is migrating a large on-premises NoSQL database that stores SAP-related data to Amazon DynamoDB as part of their AWS SAP environment. The database has tables with uneven access patterns, and some items are accessed infrequently but must be retained for compliance. The company wants to optimize costs without sacrificing performance. Which THREE strategies should the solutions architect recommend? (Choose THREE.)

Accepted Answer

Use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) to store infrequently accessed SAP HANA backup files.. The correct strategies are to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for storing infrequently accessed SAP HANA backup files, as it provides lower storage costs with fast retrieval when needed, and to use Amazon ElastiCache for Memcached to cache frequently accessed database query results, reducing read load and improving performance for the DynamoDB-backed SAP environment. Option B is incorrect because SAP HANA's TTL would prematurely delete compliance data that must be retained. Option D is incorrect because disabling auto scaling would lead to either over-provisioning (higher costs) or performance issues. Option E is incorrect because S3 lifecycle policies transition data to Glacier, but the requirement is for infrequent access with retention, not archival; Glacier is for long-term archival where retrieval times are not as critical, and the data may need to be accessed occasionally, making S3 Standard-IA a better fit. These strategies optimize costs without sacrificing performance.

Answer

Use SAP HANA's built-in TTL feature to automatically delete expired compliance data.

Answer

Disable auto scaling for the SAP HANA EC2 instances to avoid unpredictable costs.

Question 7

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent high latency, and the operations team suspects that the load balancer is not distributing traffic evenly. Which configuration should the team check to confirm or rule out uneven traffic distribution?

Accepted Answer

Verify that cross-zone load balancing is enabled on the ALB. Uneven traffic distribution across EC2 instances behind an ALB is most commonly caused by cross-zone load balancing being disabled. By default, ALBs have cross-zone load balancing enabled, which distributes traffic evenly across all registered instances in all enabled Availability Zones. If it is disabled, each ALB node distributes traffic only to instances in its own Availability Zone, leading to imbalances when instance counts or capacities differ across zones. Verifying this setting directly addresses the suspected uneven distribution.

Answer

Configure slow start on the target group

Answer

Increase the deregistration delay on the target group

Answer

Enable sticky sessions (session affinity) on the target group

Question 8

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are also in private subnets. The security group for the RDS instance allows inbound traffic on port 3306 from the security group attached to the ECS tasks. However, the application cannot connect to the database. Which solution should the company implement to resolve this issue?

Accepted Answer

Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306. When using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

Answer

Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway

Answer

Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity

Answer

Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID

Question 9

A company is designing a disaster recovery (DR) strategy for a critical application that runs on EC2 instances in a single AWS Region. The application uses an Amazon RDS MySQL Multi-AZ DB instance. The company wants to achieve a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 15 minutes for both compute and database tiers. Which TWO options should the company implement? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance in the secondary Region. A cross-Region read replica for RDS MySQL can be promoted to a standalone primary in the secondary Region within minutes, meeting the 15-minute RTO. The asynchronous replication lag is typically under 1 minute, satisfying the 1-minute RPO. This provides a managed, low-latency DR database tier without needing to restore from backups.

Answer

Use Amazon EBS snapshots of the EC2 instances and copy them to the secondary Region every minute

Answer

Migrate the database to Amazon Aurora MySQL and configure an Aurora Global Database

Answer

Enable cross-Region automated backups for the RDS Multi-AZ DB instance

Question 10

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL Multi-AZ DB instance. The security team requires that all traffic between the ALB and EC2 instances is encrypted, and that the EC2 instances can only be accessed by the ALB. Which TWO steps should be taken to meet these requirements? (Choose TWO.)

Accepted Answer

In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.. Referencing the ALB's security group in the inbound rule of the EC2 security group ensures that only traffic originating from the ALB is allowed, meeting the requirement that EC2 instances can only be accessed by the ALB. Option D is correct because configuring the target group to use HTTPS protocol ensures that traffic between the ALB and EC2 instances is encrypted using TLS, satisfying the encryption requirement.

Answer

In the EC2 security group, allow inbound HTTPS traffic from 0.0.0.0/0.

Answer

Enable encryption at rest on the EC2 instances using EBS encryption.

Answer

Configure the ALB with an HTTPS listener and upload the SSL/TLS certificate.

Question 11

A company runs a production web application on AWS using an Application Load Balancer (ALB) with a target group of EC2 instances in an Auto Scaling group. The application uses a custom Amazon Machine Image (AMI) that includes the web server and application code. The Auto Scaling group has a launch template that references the AMI. The company updates the application code weekly and creates a new AMI version. The operations team manually updates the launch template to reference the new AMI and then initiates an instance refresh. Recently, a misconfiguration caused the launch template to point to an old AMI after an instance refresh, resulting in a rollback of the application code. The company wants to automate the deployment process to ensure that new AMIs are deployed consistently and safely. Which solution meets these requirements?

Accepted Answer

Use EC2 Image Builder to create and test the new AMI, then use AWS CodePipeline to automatically update the launch template and perform a rolling instance refresh.. EC2 Image Builder automates the creation, testing, and validation of AMIs, ensuring only compliant images are produced. AWS CodePipeline can then automatically update the launch template with the new AMI ID and trigger a rolling instance refresh, eliminating manual steps and preventing misconfigurations like pointing to an old AMI.

Answer

Use AWS CodePipeline to run a script that updates the launch template with the new AMI ID and triggers an instance refresh.

Answer

Use AWS CloudFormation with a custom resource that validates the AMI and updates the Auto Scaling group.

Answer

Use AWS CodeDeploy to deploy the application code directly to the existing instances, bypassing the AMI update.

Question 12

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.. The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Answer

The S3 bucket has versioning enabled, which requires additional permissions.

Answer

The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.

Answer

The bucket policy does not grant the s3:PutObject permission to the IAM role.

Question 13

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for PostgreSQL database. The operations team reports that the application becomes unresponsive for about 30 seconds every hour at the same time. The team checks the ALB access logs and notices that during the outage, the ALB returns HTTP 504 errors. The RDS monitoring shows a spike in CPU usage and active connections during the same period. The application team confirms there are no scheduled jobs during that time. What should the team do to diagnose the root cause?

Accepted Answer

Check the RDS Enhanced Monitoring metrics for the database instance to identify resource bottlenecks such as high memory pressure or disk I/O.. The symptoms—hourly 30-second unresponsiveness, HTTP 504 errors from the ALB, and a correlated spike in RDS CPU and active connections—point to a database-side bottleneck. RDS Enhanced Monitoring provides OS-level metrics (memory, disk I/O, CPU) that can reveal resource contention or throttling events (e.g., swap usage, IOPS exhaustion) not visible in standard CloudWatch metrics, enabling precise root cause identification.

Answer

Review the security group rules for the database to ensure the application can connect.

Answer

Review the ALB target group health checks and ensure the EC2 instances are passing the health check.

Answer

Increase the EC2 instance size to handle more concurrent connections.

Question 14

Drag and drop the steps to set up an SAProuter connection between an on-premises network and AWS for SAP support access into the correct order.

Accepted Answer

Deploy EC2 instance, install and configure SAProuter, open port 3299 in security group, establish VPN/Direct Connect, configure routing.. SAProuter setup involves deploying instance, configuring SAProuter, opening port, establishing connectivity, and routing.

Answer

Establish VPN/Direct Connect, deploy EC2 instance, install and configure SAProuter, open port 3299, configure routing.

Answer

Deploy EC2 instance, install and configure SAProuter, establish VPN/Direct Connect, open port 3299, configure routing.

Answer

Deploy EC2 instance, establish VPN/Direct Connect, install and configure SAProuter, open port 3299, configure routing.

Question 15

Drag and drop the steps to optimize SAP HANA performance by moving to an SAP HANA instance on AWS EC2 into the correct order.

Accepted Answer

1. Assess current performance and requirements
2. Size the target EC2 instance
3. Migrate data using AWS DMS or similar
4. Configure EC2 parameters and settings
5. Test and validate performance. Performance optimization via EC2 migration involves assessment, sizing, data migration, configuration, and testing.

Answer

1. Size the target EC2 instance
2. Migrate data
3. Configure EC2 settings
4. Assess current performance
5. Test performance

Answer

1. Migrate data
2. Configure EC2 settings
3. Assess current performance
4. Size the target EC2 instance
5. Test performance

Answer

1. Configure EC2 settings
2. Assess current performance
3. Size the target EC2 instance
4. Migrate data
5. Test performance

Question 16

Match the AWS service to its role in SAP high availability.

Accepted Answer

Elastic Load Balancing: Distributes incoming traffic across multiple EC2 instances in multiple Availability Zones.. In SAP on AWS, Elastic Load Balancing and Route 53 are key HA services. ELB distributes traffic across healthy instances, and Route 53 provides DNS failover. Auto Scaling helps maintain capacity but does not distribute traffic, and Lambda is not a primary HA component.

Answer

Amazon EC2 Auto Scaling: Distributes traffic to healthy EC2 instances.

Answer

AWS Lambda: Manages automatic failover of SAP applications across Availability Zones.

Question 17

Match the AWS managed service to its SAP-related capability.

Accepted Answer

Amazon EFS: Provides shared file storage for SAP applications. Correct matches: Amazon EFS for shared file storage, Amazon FSx for Windows File Server for SMB storage, Amazon Route 53 for DNS, Amazon CloudWatch for monitoring. Common confusions include mistaking EFS for block storage and FSx for Lustre for SAP HANA.

Answer

Amazon EFS: Provides block storage for SAP HANA

Answer

Amazon FSx for Lustre: Provides high-performance shared storage for SAP HANA

Question 18

A company is running an SAP HANA database on an Amazon EC2 instance. The instance type is r5.4xlarge with 16 vCPUs and 128 GiB of memory. The storage is configured with a single 400 GB gp2 EBS volume for /hana/data and a separate 100 GB gp2 volume for /hana/log. The database experiences high latency during peak loads. Which change will most likely improve performance?

Accepted Answer

Change the EBS volumes to io2 Block Express volumes with provisioned IOPS.. SAP HANA on EC2 requires consistently low latency for /hana/data and /hana/log volumes, especially under peak loads. The gp2 volume's burst model can deplete credits, causing throughput throttling and high latency. io2 Block Express volumes provide consistent, provisioned IOPS performance without reliance on burst credits, directly addressing the latency issue.

Answer

Increase the instance size to r5.8xlarge.

Answer

Disable the EBS volume caching.

Answer

Create a RAID 0 stripe of multiple gp2 volumes.

Question 19

An SAP administrator is configuring high availability for SAP HANA on AWS. Which TWO components are essential for a Pacemaker-based cluster?

Accepted Answer

A quorum device (e.g., STONITH). A quorum device such as STONITH (Shoot The Other Node In The Head) is essential in a Pacemaker-based SAP HANA HA cluster because it provides fencing to prevent split-brain scenarios, ensuring that a failed or unresponsive node is reliably isolated before the surviving node takes over resources. A virtual IP (VIP) address is also essential because Pacemaker manages it as a cluster resource, allowing SAP HANA clients and applications to connect to a single, consistent address that floats to whichever node is currently active. An Application Load Balancer is not required for a Pacemaker cluster since failover is handled by the cluster software and the VIP, not by an ALB. Amazon Route 53 health checks are not essential because DNS-based failover is not how Pacemaker manages resource movement. Amazon CloudWatch alarms are useful for monitoring but are not a functional component of the Pacemaker cluster itself.

Answer

An Application Load Balancer

Answer

Amazon Route 53 health checks

Answer

Amazon CloudWatch alarms

Question 20

A company is deploying SAP S/4HANA on AWS and needs to choose instance types that are certified by SAP. Which TWO instance families are SAP-certified for production SAP HANA workloads?

Accepted Answer

R5. R5 (option A) is correct because the AWS R5 family is SAP-certified for production SAP HANA workloads, offering memory-optimized instances with high memory-to-vCPU ratios suitable for HANA in-memory processing. X1e (option C) is also correct because the X1e family is specifically designed and SAP-certified for large-scale, memory-intensive production SAP HANA deployments, supporting very high memory capacities. T3 (option B) is not certified for production HANA since it is a burstable, general-purpose family with limited and variable memory performance. M5 (option D) is a general-purpose family that, while used for some SAP application servers, is not certified for production HANA database workloads. P3 (option E) is a GPU-accelerated family intended for machine learning and graphics, not for SAP HANA production databases.

Answer

T3

Answer

M5

Answer

P3