PAS-C01 Technology Practice Test 10 — 15 Questions

Question 1

Which TWO of the following are required components for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared? (Choose two.)

Accepted Answer

Amazon EFS file system. Amazon EFS is required for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared because it provides a fully managed, POSIX-compliant NFS file system that can be mounted concurrently across multiple EC2 instances. SAP HANA scale-out nodes require a shared file system for /hana/shared to exchange configuration and log data, and EFS supports the necessary NFSv4 protocol with the required throughput and latency characteristics for this workload.

Answer

EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 2

Which THREE of the following are valid methods to automate the installation of SAP HANA on AWS? (Choose three.)

Accepted Answer

AWS Launch Wizard for SAP. AWS Launch Wizard for SAP (Option B) is a valid method to automate SAP HANA installation because it provides a guided, automated deployment experience that collects input for infrastructure sizing, configuration, and software installation, then orchestrates the provisioning of AWS resources and the SAP HANA software setup. It reduces manual effort by automating the deployment of SAP HANA on AWS, making it a correct choice for this question.

Answer

AWS Systems Manager Automation

Answer

AWS OpsWorks

Question 3

Which TWO of the following are best practices for securing an SAP system on AWS? (Choose two.)

Accepted Answer

Use security groups to restrict inbound traffic to SAP application ports. Security groups act as a virtual firewall for EC2 instances, allowing you to control inbound and outbound traffic. Restricting inbound traffic to only the necessary SAP application ports (e.g., 3200 for SAP GUI, 443 for SAP Web Dispatcher) minimizes the attack surface and is a fundamental security best practice.

Answer

Store database credentials in plaintext in application configuration files

Answer

Disable AWS CloudTrail to reduce logs

Answer

Allow all inbound traffic from 0.0.0.0/0 for easy access

Question 4

An SAP administrator created an IAM policy to allow an EC2 instance to upload backups to an S3 bucket. The policy is shown in the exhibit. However, the backup job fails with an access denied error. What is the most likely cause?

Accepted Answer

The policy requires server-side encryption with KMS, but the backup job does not include the required encryption header. The IAM policy includes the `s3:x-amz-server-side-encryption` condition key set to `aws:kms`, which enforces server-side encryption with KMS (SSE-KMS) for all `s3:PutObject` requests. If the backup job does not include the `x-amz-server-side-encryption: aws:kms` header in its PUT request, S3 will deny the request with an access denied error, even if the IAM role has the necessary permissions.

Answer

The KMS key policy does not grant the EC2 instance permission to use the key

Answer

The resource ARN is incorrect because it does not include the bucket name correctly

Answer

The IAM role does not have permission to call s3:PutObject

Question 5

An SAP administrator runs the AWS CLI command shown in the exhibit to check the status of a production HANA instance. The output shows the instance is running in us-east-1a. However, the SAP application team reports that the HANA database is not responding. What should the administrator check next to diagnose the issue?

Accepted Answer

The HANA database service is not running on the instance. The AWS CLI command only checks the EC2 instance state (e.g., 'running'), not the status of the HANA database service itself. Even if the instance is running, the HANA database service (hdbnameserver, hdbindexserver, etc.) may have crashed, failed to start, or been stopped. The administrator should SSH into the instance and run commands like 'systemctl status hdbindexserver' or 'sapcontrol -nr <instance_number> -function GetProcessList' to verify the HANA service status.

Answer

The EBS volumes are detached from the instance

Answer

The instance state is 'running' so no issue with the instance

Answer

The security group does not allow inbound traffic to the database port

Question 6

An SAP administrator is reviewing a CloudFormation template snippet shown in the exhibit. The template creates an EC2 instance for SAP. What is missing from the template to ensure the instance is placed in a specific subnet?

Accepted Answer

The SubnetId property is not specified in the NetworkInterface. The CloudFormation template snippet shows a NetworkInterface property being used to attach the EC2 instance to a VPC network. When you specify a NetworkInterface, you must include the SubnetId within that interface definition to place the instance in a specific subnet. Without SubnetId, the instance will be launched into the default subnet of the default VPC, which may not be the intended subnet for SAP workloads requiring specific network segmentation or latency constraints.

Answer

The InstanceType is not suitable for SAP

Answer

The ImageId is invalid

Answer

The SecurityGroup reference is missing

Question 7

A company is running a critical SAP HANA database on AWS. The database administrator wants to ensure that the SAP HANA backup files are stored in a secure, durable, and cost-effective manner. They need to retain backups for 7 years to meet compliance requirements. Which AWS service should be used for long-term backup storage?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage for long-term retention of data that is accessed infrequently, with retrieval times of 12-48 hours. For a 7-year compliance retention requirement, this service offers secure, durable (99.999999999% durability), and cost-effective storage for SAP HANA backup files, which do not need immediate access.

Answer

AWS Backup

Answer

Amazon EBS Snapshots

Answer

Amazon S3 Standard

Question 8

An SAP system running on AWS is experiencing performance issues. The operations team suspects that the Amazon EBS volumes attached to the SAP application server are not providing sufficient IOPS. Which AWS service should be used to monitor the IOPS performance of the EBS volumes?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides detailed monitoring metrics for Amazon EBS volumes, including `VolumeReadOps` and `VolumeWriteOps`, which directly measure IOPS performance. By using CloudWatch metrics, the operations team can track the actual IOPS delivered to the SAP application server and identify whether the volumes are throttled or under-provisioned.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 9

A company is migrating its SAP landscape to AWS. The SAP systems consist of multiple instances (development, quality, production) running on different EC2 instances. The company wants to automate the provisioning of these instances using infrastructure as code. Which AWS service should be used to define and provision the SAP infrastructure in a repeatable manner?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire SAP infrastructure—including EC2 instances, VPCs, security groups, and storage—as code using a JSON or YAML template. This enables repeatable, version-controlled provisioning of development, quality, and production environments, which is essential for an SAP migration requiring consistent and automated deployments.

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 10

An SAP system is running on an EC2 instance with a single Amazon EBS volume for data and log files. The database administrator wants to increase the IOPS performance without changing the instance type. Which action should be taken?

Accepted Answer

Modify the EBS volume to provisioned IOPS (io1/io2).. The correct action is to modify the EBS volume to use provisioned IOPS (io1 or io2), as this directly increases the IOPS performance of the volume without changing the instance type. The current single EBS volume is likely a gp2 or gp3 type, which has a baseline IOPS limit; switching to io1/io2 allows you to specify a higher, consistent IOPS level that meets the SAP database's performance requirements.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Change the EC2 instance type to a larger size.

Answer

Migrate the data to an instance store volume.

Question 11

A company runs SAP S/4HANA on AWS. The system is critical and requires high availability. The database is SAP HANA running on two EC2 instances in a cluster. The company wants to ensure that the secondary instance can take over quickly in case of primary failure. Which AWS service should be used to implement a floating IP address that can be moved between the instances?

Accepted Answer

Elastic IP addresses. Elastic IP addresses are static public IPv4 addresses that can be allocated to an AWS account and reassigned between EC2 instances. When a primary SAP HANA instance fails, the Elastic IP can be disassociated from the failed instance and associated with the secondary instance. This provides a floating IP that can be moved quickly, supporting high availability. Route 53 DNS failover changes DNS resolution, but does not provide a floating IP address that is directly moved between instances.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Answer

VPC Peering

Question 12

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP system are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, including the caller identity, time, source IP, and request parameters. For SAP systems requiring audit logs of AWS interactions, CloudTrail provides the necessary event history for security analysis, resource change tracking, and compliance auditing.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Question 13

A company is running SAP ERP on AWS and wants to reduce costs by right-sizing the EC2 instances. The administrator has identified that the current instances are over-provisioned for CPU and memory. Which AWS service can provide recommendations for instance type changes based on historical usage?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, I/O, network) from Amazon CloudWatch and provides actionable recommendations for right-sizing EC2 instances, including instance type changes. For SAP ERP workloads, it can identify over-provisioned instances by comparing actual usage patterns against the performance characteristics of different instance families, directly addressing the goal of reducing costs without compromising performance.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Question 14

An SAP HANA database on AWS requires a backup strategy that includes incremental backups to minimize storage costs. The database is large (2 TB) and the backup window is short. Which AWS service or feature is most suitable for performing incremental backups of SAP HANA?

Accepted Answer

Amazon EBS Snapshots. D is correct because Amazon EBS Snapshots provide native incremental backup capability at the block level, which is ideal for large SAP HANA databases (2 TB) with short backup windows. Snapshots capture only changed blocks since the last snapshot, minimizing storage costs and backup time, and can be automated via AWS Backup or custom scripts.

Answer

Amazon S3 Lifecycle policies

Answer

AWS Backup

Answer

SAP HANA backup to Amazon S3

Question 15

A company is deploying a new SAP S/4HANA system on AWS and needs to ensure that the application servers can communicate with the database servers securely and with low latency. The application servers and database servers are in different VPCs. Which AWS service should be used to connect these VPCs?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it establishes a direct network connection between two VPCs using AWS's internal infrastructure, enabling private IPv4 or IPv6 traffic with low latency and high throughput. For SAP S/4HANA, where application-to-database communication requires consistent sub-millisecond latency and avoids internet transit, VPC Peering provides the necessary Layer-3 connectivity without bandwidth bottlenecks or single points of failure. Unlike VPN or Direct Connect, VPC Peering does not introduce additional hop latency or third-party hardware, making it ideal for this intra-region, cross-VPC scenario.

Answer

AWS VPN

Answer

Amazon API Gateway

Answer

AWS Direct Connect