PAS-C01 Technology Practice Test 15 — 15 Questions

Question 1

An SAP system administrator is troubleshooting an issue where an application cannot connect to an SAP HANA database running on an EC2 instance. The security group for the HANA instance allows inbound traffic on port 39013 (SQL) from the application server's security group. The network ACLs for the subnet allow all traffic. What could be the cause of the connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACL for the HANA instance's subnet is missing an outbound rule to allow return traffic on ephemeral ports.. Network ACLs are stateless, meaning return traffic must be explicitly allowed by an outbound rule on the subnet where the response originates. In this scenario, the HANA instance's subnet NACL must allow outbound traffic on ephemeral ports (1024-65535) so that responses to the application server's requests can leave the subnet. Even though the inbound rule on port 39013 is allowed, the return traffic will be blocked if the outbound ephemeral port range is not permitted.

Answer

The security group for the HANA instance does not allow inbound traffic on port 39013 from the application server's IP address.

Answer

The network ACL for the application server's subnet does not allow outbound traffic on port 39013.

Answer

The security group for the application server does not allow outbound traffic on port 39013.

Question 2

A company is designing a disaster recovery (DR) strategy for its SAP HANA database on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO actions are required to enable HANA System Replication (HSR) across AWS Regions? (Choose 2)

Accepted Answer

Set up a VPN or Direct Connect connection between the Regions for secure, low-latency communication.. Option B is correct because HSR requires network connectivity between the primary and secondary HANA hosts, and across AWS Regions this is provided by an inter-Region link such as AWS Site-to-Site VPN or AWS Direct Connect (often with Transit Gateway), which gives the secure, low-latency, high-bandwidth path needed for replication traffic. Option C is correct because HSR across Regions must use asynchronous replication mode, since synchronous mode would impose WAN latency on every commit and is only supported for hosts within a low-latency distance (typically the same Region/AZ). Option A is not required: EBS snapshot cross-Region copy is a backup/restore mechanism, not a component of live HSR replication. Option D is wrong because S3 Cross-Region Replication copies objects in S3, not the HANA data/log volumes that HSR replicates. Option E is wrong because an Application Load Balancer distributes application traffic and plays no role in establishing HSR between HANA database instances.

Answer

Enable cross-Region replication of EBS snapshots.

Answer

Use S3 Cross-Region Replication to copy HANA data files.

Answer

Deploy an Application Load Balancer in front of the HANA instances in both Regions.

Question 3

An SAP system administrator is planning to migrate an on-premises SAP ERP system to AWS. The system uses Oracle Database. Which THREE AWS services can be used to migrate the Oracle database to Amazon RDS for Oracle with minimal downtime? (Choose 3)

Accepted Answer

AWS Schema Conversion Tool (SCT). Options C and D are the correct AWS services for migrating an Oracle database to Amazon RDS for Oracle with minimal downtime. Option A (Oracle Data Guard) is not an AWS service; it is an Oracle database feature and does not meet the requirement of being an AWS service. Option B (AWS Snowball Edge) is for offline data transfer, not live migration. Option E (AWS CloudEndure Migration) is for server migration, not database migration. AWS Schema Conversion Tool (SCT) ensures schema compatibility, and AWS Database Migration Service (DMS) performs continuous replication to minimize downtime.

Answer

Oracle Data Guard

Answer

AWS Snowball Edge

Answer

AWS CloudEndure Migration

Question 4

A company runs its SAP HANA database on an EC2 instance with EBS volumes. The database requires consistent high IOPS and low latency. The system is currently using EBS gp2 volumes, but performance is inconsistent during peak loads. Which TWO steps should the administrator take to improve storage performance? (Choose 2)

Accepted Answer

Configure multiple EBS volumes in a RAID 0 stripe set.. Option C is correct because striping multiple EBS volumes in a RAID 0 set aggregates their IOPS and throughput, which is a standard way to meet SAP HANA's demand for consistent high IOPS and low latency on EC2. Option D is correct because io2 Block Express volumes deliver provisioned IOPS with sub-millisecond latency and higher durability, directly addressing the inconsistent performance of gp2 during peak loads. Option A is not ideal because gp2 baseline IOPS scales only 3 IOPS per GiB (with burst credits), so resizing is an inefficient and capped way to reach the required sustained IOPS. Option B is wrong because EBS snapshots are for backup and durability, not for improving live volume performance. Option E is wrong because EBS-optimized is enabled by default on most modern EC2 instances and only dedicates network bandwidth to EBS; it does not raise the IOPS ceiling of gp2 volumes.

Answer

Increase the size of the existing gp2 volumes to increase baseline IOPS.

Answer

Take regular EBS snapshots to improve performance.

Answer

Enable EBS-optimized on the EC2 instance.

Question 5

An SAP administrator executed the AWS CLI command shown in the exhibit. The EC2 instance i-0abcd1234efgh5678 is a SAP HANA database server. Which statement about the storage configuration is correct?

Accepted Answer

The data volume (/dev/sdf) will persist after instance termination.. /dev/sdf has DeleteOnTermination set to false, meaning it will not be deleted when the instance is terminated, preserving the data. Option A is incorrect because /dev/xvda will be deleted. Option B is incorrect because /dev/sdf is an EBS volume, not an instance store volume. Option D is incorrect because the command only shows block device mappings, not the root device type.

Answer

The root volume (/dev/xvda) will persist after instance termination.

Answer

The volume /dev/sdf is an instance store volume.

Answer

The instance is booting from an instance store volume.

Question 6

An SAP administrator runs the AWS CLI command shown in the exhibit. What does the output indicate about the RDS instance my-sap-db?

Accepted Answer

The database CPU utilization spiked to 85.3% at 00:10 UTC.. The data points show CPU utilization averages over 5-minute intervals. The second point shows 85.3%, indicating a spike. Option A is incorrect because the command does not show memory metrics. Option B is incorrect because the command does not show connections. Option D is incorrect because the data shows CPU utilization, not database activity.

Answer

The database is idle because CPU utilization is low.

Answer

The database experienced high memory usage.

Answer

The database had a high number of connections.

Question 7

An SAP administrator created the IAM policy shown above to control access to an S3 bucket used for SAP HANA backups. The policy is attached to an IAM role used by an EC2 instance. The instance fails to upload backups. What is the cause?

Accepted Answer

The 'aws:SecureTransport' condition in the Deny statement is incorrectly using 'BoolIfExists' instead of 'Bool'.. The Deny statement uses the condition operator BoolIfExists with aws:SecureTransport. BoolIfExists evaluates to true if the key is missing, meaning requests that do not include the aws:SecureTransport key (or where it is absent) will match the Deny and be blocked. The correct operator is Bool, which only matches when the key is present and equals the specified value. This misconfiguration causes legitimate HTTPS uploads to be denied.

Answer

The policy does not allow encryption (SSE-S3) which is required for backups.

Answer

The VPC endpoint ID in the policy does not match the actual endpoint.

Answer

The Deny statement overrides the Allow statement for all actions.

Question 8

A company is migrating its SAP system to AWS and wants to use AWS Backup to manage backups of SAP HANA databases running on EC2 instances. What is the prerequisite for this integration?

Accepted Answer

The HANA database must be registered as a resource in AWS Backup using the Backint agent.. AWS Backup integrates with SAP HANA by using the SAP HANA Backint API, which requires the AWS Backint agent to be installed and configured on the EC2 instance running SAP HANA. The HANA database must then be registered as a resource in AWS Backup, allowing AWS Backup to manage backups via the Backint interface. This integration enables AWS Backup to orchestrate backups of SAP HANA databases, leveraging the Backint agent to communicate with the database.

Answer

The HANA database must be configured to use in-memory backups.

Answer

The HANA database must not use EBS snapshots for backup.

Answer

The EC2 instance must be running on a Dedicated Host.

Question 9

A company runs its SAP system on AWS and uses a Multi-AZ RDS for Oracle database for the SAP Central Services (SCS) instance. The SCS instance is currently on a single EC2 instance in one Availability Zone. The company wants to ensure high availability for the SCS service. What should they do?

Accepted Answer

Implement an SAP ASCS/ERS cluster using two EC2 instances and a shared file system.. To achieve high availability for the SAP SCS instance on AWS, the recommended approach is to implement an SAP ASCS/ERS cluster using two EC2 instances across Availability Zones, with a shared file system (e.g., Amazon EFS or FSx for Windows) for the SAP global files. This provides automatic failover and meets SAP's HA requirements for the central services.

Answer

Place the SCS instance on a larger EC2 instance and use EBS snapshots for recovery.

Answer

Use an Application Load Balancer to distribute traffic to multiple SCS instances.

Answer

Configure the SCS instance on the existing RDS for Oracle database.

Question 10

An SAP system uses AWS Direct Connect to connect to on-premises networks. The SAP application servers are in a private subnet with a NAT gateway for outbound internet. The SAProuter instance is behind an Internet-facing Network Load Balancer (NLB). Connections from SAP support to the SAProuter timeout. What is the likely cause?

Accepted Answer

The security group for the SAProuter instance does not allow inbound traffic from the NLB.. The SAProuter instance sits behind an Internet-facing NLB, so inbound traffic from SAP support reaches the NLB first and is then forwarded to the SAProuter target. If the SAProuter's security group does not permit inbound traffic from the NLB's subnet or from the NLB itself, the connection will time out. Security groups are stateful and must explicitly allow the NLB as a source, typically by referencing the NLB's security group or the client IP range.

Answer

The NLB target group is configured with the wrong protocol or port for SAProuter.

Answer

The Direct Connect virtual interface is not advertising the SAProuter's IP address.

Answer

The NAT gateway does not allow inbound traffic from the internet.

Question 11

An SAP administrator is troubleshooting a performance issue on an SAP HANA database running on AWS. The HANA data volume is an EBS io1 volume with 10,000 provisioned IOPS. The administrator notices that the average queue length is consistently above 10, and the average latency is 20 ms. Which TWO actions will most likely improve performance?

Accepted Answer

Increase the provisioned IOPS on the io1 volume to 20,000.. Options B and C are correct. Increasing provisioned IOPS on the io1 volume (Option B) directly addresses the high queue length and latency by providing more I/O capacity. Moving the database to a larger EC2 instance type (Option C) increases the dedicated EBS bandwidth, removing a potential throughput bottleneck at the instance level. Option A (NVMe instance store) is not suitable for persistent SAP HANA data. Option D (RAID 0) can increase IOPS but adds complexity and does not fix insufficient provisioned IOPS or instance bandwidth. Option E (gp3 with 10,000 IOPS) does not increase IOPS compared to the current io1 volume.

Answer

Migrate the volume to an instance with NVMe instance store.

Answer

Configure multiple EBS volumes in a RAID 0 stripe to increase IOPS.

Answer

Change the volume type to gp3 with 10,000 IOPS.

Question 12

A company is designing a disaster recovery (DR) strategy for its SAP system on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The system uses SAP HANA as the database. Which THREE components must be configured to enable a successful DR failover?

Accepted Answer

SAP HANA system replication across regions.. Option A is correct because SAP HANA system replication is the native mechanism that continuously ships redo logs from the primary HANA database in us-east-1 to a secondary HANA instance in us-west-2, enabling a takeover with minimal data loss (RPO) and recovery time (RTO) during a regional failover. Option B is correct because Amazon Route 53 DNS failover (with health checks and failover routing policies) is required to redirect SAP application clients and front-end endpoints from the failed us-east-1 site to the us-west-2 DR site automatically. Option C is correct because AWS Backup cross-region backup copy ensures a restorable copy of the HANA database exists in us-west-2, providing a recovery path if system replication is unavailable or the replica is corrupted, which is a standard DR requirement. Option D is not required because S3 Cross-Region Replication for transport files is a convenience for moving change requests, not a mandatory component for a HANA-based SAP DR failover. Option E is not required because AWS Transit Gateway peering only provides network connectivity between regions and is not itself a DR failover component; connectivity can be achieved through other means such as VPC peering or VPN.

Answer

S3 Cross-Region Replication for SAP transport files.

Answer

AWS Transit Gateway peering between the two regions.

Question 13

An SAP system is running on AWS with a production HANA database. The database administrator wants to ensure that backups are consistent and can be restored. Which TWO approaches should be used together for a robust backup strategy?

Accepted Answer

AWS Backup with a backup plan that includes both EBS snapshots and Backint.. Option A is correct because AWS Backup supports SAP HANA workloads on AWS through a backup plan that orchestrates both EBS snapshots (for the underlying volumes) and Backint-based backups (for the HANA database), giving a coordinated, consistent, and restorable strategy. Option E is correct because SAP HANA Backint integration with AWS Backup uses the native HANA Backint API to produce application-consistent database backups that can be restored via HANA Studio or SQL commands, which is essential for a production HANA database. Option B is not sufficient on its own because EBS snapshots capture block-level volume state but do not guarantee HANA application consistency unless coordinated with Backint or a freeze mechanism. Option C is incorrect because EC2 Auto Scaling is for scaling compute capacity, not for creating backup instances. Option D is incorrect because AWS DMS is a migration and replication service, not a backup solution for SAP HANA consistency and restore.

Answer

Regular EBS snapshots of the data volume.

Answer

Amazon EC2 Auto Scaling to create backup instances.

Answer

AWS Database Migration Service (DMS) for continuous replication.

Question 14

A company runs its SAP ERP system on AWS with an SAP HANA database on an EC2 instance. The database is configured with multiple EBS io1 volumes striped in a RAID 0. Recently, the company implemented a new backup process using AWS Backup with the Backint agent. However, during the backup window, the database performance degrades significantly, causing application timeouts. The database administrator checks CloudWatch metrics and sees that the EBS write latency spikes to over 50 ms during backups. The backup target is an S3 bucket in the same region. The EC2 instance type is r5.4xlarge with EBS-optimized enabled. What is the MOST likely cause of the performance degradation?

Accepted Answer

The Backint agent is consuming CPU and I/O resources, causing contention.. The Backint agent runs on the SAP HANA database instance and consumes CPU and I/O resources to read the database, compress the data, and stream it to S3. On an r5.4xlarge with 16 vCPUs, the agent's CPU usage competes with HANA's workload, and its read operations compete with HANA's I/O, causing write latency to spike. This resource contention is the most likely cause of the performance degradation during backups.

Answer

The EBS volumes have reached the provisioned IOPS limit of 20,000 IOPS.

Answer

The S3 bucket is in a different region, causing network latency.

Answer

The EC2 instance type does not match the requirements for Backint.

Question 15

An SAP system uses AWS Direct Connect to connect to on-premises systems. The SAP application servers are in a private subnet, and the HANA database is in a separate private subnet. Both subnets are in the same VPC. The application servers can connect to the HANA database, but the application servers cannot connect to an on-premises file server via the Direct Connect. The on-premises network team confirms that the file server is reachable from other on-premises resources. The VPC route tables have a route for the on-premises CIDR pointing to the Direct Connect virtual gateway. The security groups allow all outbound traffic. What is the MOST likely cause of the issue?

Accepted Answer

The route table associated with the application subnet does not have a route to the on-premises CIDR via the virtual gateway.. The route table associated with the application subnet must have a route to the on-premises CIDR via the Direct Connect virtual gateway. Even though the VPC route tables have such a route, the application subnet may be associated with a different route table that lacks this route. In AWS, each subnet is explicitly associated with one route table, and if the application subnet's route table does not include the on-premises CIDR pointing to the virtual gateway, traffic from the application servers will not be routed to the Direct Connect connection. This is the most likely cause because the HANA database connectivity works (likely within the same VPC or via a different route table), but on-premises access fails specifically for the application subnet.

Answer

The network ACL for the application subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The on-premises file server is not reachable because it requires VPN instead of Direct Connect.

Answer

The Direct Connect virtual interface is in a 'down' state.