PAS-C01 Technology Practice Test 22 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.. Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Answer

Use AWS Config rules to detect noncompliant buckets and send notifications.

Answer

Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.

Question 2

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Answer

Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

Answer

AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

Answer

AWS Snowball Edge to ship the data physically, then import to RDS.

Question 3

A company is migrating a legacy three-tier web application to AWS. The application uses a MySQL database and stores session data in the database. The company wants to minimize database load and improve scalability. Which TWO actions should the company take to achieve these goals?

Accepted Answer

Use Amazon ElastiCache to store session data instead of the database.. Storing session data in the database creates unnecessary write load and latency. Amazon ElastiCache (Memcached or Redis) provides an in-memory key-value store that is ideal for transient session data, reducing database load and improving application scalability by offloading session management from the persistent MySQL layer.

Answer

Configure Amazon RDS Multi-AZ for high availability.

Answer

Use Auto Scaling for the web server tier to handle variable traffic.

Answer

Use Amazon RDS read replicas to offload read traffic from the primary database.

Question 4

Drag and drop the steps to migrate an on-premises SAP system to AWS using AWS Application Migration Service (MGN) into the correct order.

Accepted Answer

Install AWS Replication Agent, then Configure replication settings, then Launch test instances and validate, then Perform cutover, then Perform post-migration steps.. MGN migration involves installing agent, configuring replication, testing, cutover, and post-migration steps.

Answer

Install AWS Replication Agent, then Launch test instances and validate, then Configure replication settings, then Perform cutover, then Perform post-migration steps.

Answer

Configure replication settings, then Install AWS Replication Agent, then Launch test instances and validate, then Perform cutover, then Perform post-migration steps.

Answer

Install AWS Replication Agent, then Configure replication settings, then Perform cutover, then Launch test instances and validate, then Perform post-migration steps.

Question 5

Match the AWS service to its primary use in an SAP environment.

Accepted Answer

Amazon EC2: Compute for SAP applications. In SAP on AWS, Amazon EC2 provides compute, Amazon EBS provides block storage, Amazon S3 is used for backup/archive, and Amazon FSx for Windows File Server provides shared file storage. Distractors swap these roles.

Answer

Amazon EC2: Persistent block storage for SAP

Answer

Amazon S3: Compute for SAP applications

Question 6

An organization uses AWS Systems Manager to run automation documents on their SAP EC2 instances. Recently, some automation runbooks have failed because the EC2 instances did not have the required SSM Agent version. The operations team wants to ensure all existing and future instances automatically have the latest SSM Agent. Which solution meets this requirement?

Accepted Answer

Create an AWS Systems Manager State Manager association that runs the AWS-UpdateSSMAgent document on the instances.. AWS Systems Manager State Manager can enforce a desired state configuration on EC2 instances. By creating an association that runs the `AWS-UpdateSSMAgent` document on a schedule, State Manager ensures that both existing and future instances (when configured with the appropriate instance profile and tags) automatically update to the latest SSM Agent version, regardless of the instance's lifecycle.

Answer

Use an automation document to update the SSM Agent and schedule it via a cron job on each instance.

Answer

Enable the 'Auto-update SSM Agent' option in the EC2 launch settings for all instances.

Answer

Configure AWS Systems Manager Patch Manager to update the SSM Agent.

Question 7

A company wants to migrate its on-premises SAP system to AWS. The system consists of an SAP NetWeaver application server and an SAP HANA database. The database requires ultra-low latency storage. Which AWS storage solution is most suitable for the SAP HANA data volume?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the most suitable storage solution for SAP HANA data volumes because they provide ultra-low latency, high durability, and up to 256,000 IOPS per volume with sub-millisecond latency. This meets the stringent performance requirements of SAP HANA, which demands consistent, low-latency storage for its in-memory database operations. io2 Block Express is certified by SAP for production HANA workloads on AWS.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EFS file system

Question 8

A company runs SAP on AWS and wants to automate the failover of their SAP HANA database across Availability Zones using a multi-AZ setup. They are using Pacemaker and STONITH fencing. Which AWS resource is commonly used as a fencing device for SAP HANA multi-AZ clusters?

Accepted Answer

Amazon CloudWatch alarm and EC2 API. STONITH (Shoot The Other Node In The Head) fencing in a multi-AZ SAP HANA cluster on AWS requires a mechanism to forcibly isolate or terminate an unresponsive node. Amazon CloudWatch alarms combined with EC2 API calls (e.g., `aws ec2 stop-instances` or `aws ec2 terminate-instances`) serve as the fencing device by triggering an API action to shut down the faulty instance, ensuring data integrity and preventing split-brain scenarios.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon RDS

Question 9

An SAP Basis administrator needs to monitor the performance of their SAP HANA database running on an EC2 instance. The administrator wants to visualize key metrics such as CPU utilization, memory usage, and disk I/O in a single dashboard. Which AWS service should be used to create this dashboard?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards is the correct service because it allows you to create custom, single-pane-of-glass views that aggregate metrics from multiple sources, including EC2 instances. For SAP HANA on EC2, you can pull CPU utilization, memory usage, and disk I/O metrics from CloudWatch (enabled via the CloudWatch Agent or EC2 detailed monitoring) and display them together on one dashboard for real-time performance monitoring.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 10

A company is deploying SAP NetWeaver on AWS and needs to ensure high availability for the ASCS instance. They plan to use a shared file system for the transport directory. Which AWS storage service is most appropriate for this shared file system?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and highly available NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. For SAP NetWeaver ASCS high availability, the transport directory (/usr/sap/trans) must be shared between the active and passive ASCS instances, and EFS supports the required NFSv4 protocol with strong consistency and POSIX permissions, making it the most appropriate choice.

Answer

Amazon EBS volumes with multi-attach

Answer

EC2 Instance Store

Answer

Amazon S3

Question 11

An administrator needs to back up an SAP HANA database running on an EC2 instance. The backup must be stored in a durable, cost-effective storage solution. Which AWS service is best suited for storing the backup files?

Accepted Answer

Amazon S3. Amazon S3 is the best choice for storing SAP HANA backup files because it offers 99.999999999% durability, is cost-effective for long-term backup storage, and integrates natively with SAP HANA via the Backint agent for direct backup to S3. S3 provides scalable object storage that can handle the large volume of SAP HANA data without requiring manual provisioning or lifecycle management.

Answer

Amazon S3 Glacier

Answer

Amazon EFS

Answer

Amazon EBS snapshots

Question 12

A company is using AWS Systems Manager to manage their SAP environment. They want to ensure that only specific users can run automation documents on production SAP instances. Which IAM policy action should be used to control access to executing automation documents?

Accepted Answer

ssm:StartAutomationExecution. The correct action is ssm:StartAutomationExecution because AWS Systems Manager Automation requires this specific permission to initiate an automation workflow. The question asks about controlling access to executing automation documents, and StartAutomationExecution is the IAM action that governs the ability to start an automation execution on a target resource, such as a production SAP instance.

Answer

ssm:SendCommand

Answer

ssm:GetParameter

Answer

ssm:ListDocuments

Question 13

A company is planning to migrate its SAP ERP system to AWS. The system uses Oracle Database as its backend. The company wants to minimize licensing costs and administrative overhead. Which AWS database service is most suitable for this migration?

Accepted Answer

Amazon RDS for Oracle. Amazon RDS for Oracle is the most suitable choice because it directly supports Oracle Database, allowing the company to migrate its existing SAP ERP system with minimal re-architecture. It reduces administrative overhead through automated backups, patching, and replication, while still using the company's existing Oracle licenses (if they choose to bring their own license) to minimize licensing costs.

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Answer

Amazon Aurora

Question 14

A company is running an SAP HANA database on an EC2 instance with an EBS gp3 volume. The workload is write-intensive and latency-sensitive. Which configuration change would provide the most consistent I/O performance?

Accepted Answer

Use an EBS io2 Block Express volume with provisioned IOPS. An SAP HANA database is extremely sensitive to I/O latency and requires consistent, high IOPS for write-intensive workloads. EBS io2 Block Express volumes provide up to 256,000 provisioned IOPS with 99.999% durability, delivering the predictable low-latency performance that gp3 volumes cannot guarantee under sustained write pressure. This makes D the correct choice for consistent I/O performance.

Answer

Switch to an EBS st1 (throughput-optimized HDD) volume

Answer

Enable EBS Multi-Attach for the gp3 volume

Answer

Increase the size of the existing gp3 volume to increase baseline throughput

Question 15

An SAP customer is using AWS Direct Connect to connect their on-premises network to AWS. They have multiple SAP systems in different VPCs. The network team wants to centralize connectivity and simplify routing. Which AWS service should they use to connect all VPCs to the on-premises network?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway. AWS Transit Gateway acts as a central hub that interconnects VPCs and on-premises networks via a Direct Connect Gateway. This allows the customer to attach multiple VPCs to a single Transit Gateway and connect that Transit Gateway to the Direct Connect Gateway, simplifying routing and eliminating the need for multiple Direct Connect Virtual Interfaces (VIFs) or complex peering arrangements.

Answer

Use a VPN connection from each VPC to the on-premises network

Answer

Use VPC Peering between each VPC and the Direct Connect VIF

Answer

Use AWS PrivateLink to connect services across VPCs