PAS-C01 Technology Practice Test 23 — 15 Questions

Question 1

Which TWO of the following are benefits of using SAP HANA System Replication (HSR) on AWS? (Choose 2.)

Accepted Answer

Supports replication across AWS Regions for disaster recovery. Option A is correct because SAP HANA System Replication supports multi-tier and multi-region topologies on AWS, allowing the secondary site to be placed in a different AWS Region so it can serve as a disaster recovery target if the primary Region fails. Option B is correct because HSR continuously ships redo log entries from the primary to the secondary system in synchronous or asynchronous mode, providing near real-time replication that keeps the secondary ready for a fast takeover and thus high availability. Option C is not a benefit of HSR, since HSR is a replication and failover mechanism, not a scale-out or workload-distribution feature; query performance improvements come from SAP HANA scale-out or read-enabled secondaries, which is a different capability. Option D is not correct because HSR does not automatically scale storage; storage sizing and growth are handled by the underlying AWS storage (for example, EBS volumes) and must be managed separately. Option E is not correct because HSR does not automatically load balance read queries between primary and secondary; read access to a secondary requires explicit configuration such as SAP HANA active/active read-enabled mode, and even then it is not automatic load balancing by HSR itself.

Answer

Improves query performance by distributing workloads

Answer

Automatically scales storage based on database growth

Answer

Automatically load balances read queries between primary and secondary

Question 2

Which THREE of the following are best practices for securing an SAP HANA database on AWS? (Choose 3.)

Accepted Answer

Enable encryption at rest for EBS volumes attached to the HANA instance. Option C is correct because enabling encryption at rest for the EBS volumes attached to the HANA instance protects the underlying storage from unauthorized access if the volumes or snapshots are compromised, using AWS KMS-managed keys. Option D is correct because SAP HANA supports data encryption for data at rest (via the HANA encryption service) and TLS/SSL for data in transit, which protects sensitive data both on disk and over the network. Option E is correct because security groups act as stateful virtual firewalls that restrict inbound traffic to only the required ports (for example, 30015 for the HANA index server and 3<instance>13 for internal communication), limiting exposure to trusted sources. Option A is incorrect because assigning a public IP address directly exposes the HANA instance to the internet, increasing attack surface; access should go through a bastion host, VPN, or AWS PrivateLink. Option B is incorrect because disabling the HANA password policy weakens authentication controls and violates security best practices; strong password policies should be enforced.

Answer

Assign a public IP address to the HANA instance for easy access

Answer

Disable the HANA password policy to simplify user access

Question 3

An SAP system administrator is troubleshooting a high CPU usage issue on an SAP application server (AS) running on an EC2 instance. The administrator suspects that a specific ABAP report is consuming excessive resources. Which AWS service can provide detailed CPU utilization metrics at the process level to confirm the suspicion?

Accepted Answer

Amazon CloudWatch agent with the 'procstat' plugin. The Amazon CloudWatch agent with the 'procstat' plugin can collect CPU and memory utilization metrics at the individual process level, including specific ABAP processes or reports by name or PID. This allows the administrator to confirm which ABAP report is causing high CPU usage on the EC2 instance running the SAP application server.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Inventory

Answer

AWS Compute Optimizer

Question 4

An SAP Basis team is implementing SAP HANA system replication across two AWS Availability Zones. The HANA primary instance uses Provisioned IOPS SSD (io2) EBS volumes. The secondary instance must be kept in sync with minimal data loss. Which networking configuration is required to ensure low-latency, high-throughput replication traffic between the instances?

Accepted Answer

Enable Enhanced Networking (ENA) on both instances.. The correct configuration is to enable Enhanced Networking (ENA) on both instances. ENA provides high throughput and low latency for SAP HANA replication traffic across Availability Zones. ClassicLink is deprecated, VPN adds unnecessary latency, and VPC peering is not needed between subnets already in the same VPC. Cluster placement groups cannot span Availability Zones.

Answer

Use ClassicLink to connect the instances.

Answer

Set up a VPN connection between the instances.

Answer

Configure VPC peering between the two subnets.

Question 5

A company runs SAP ERP on AWS with a Sybase ASE database. The database is on an EC2 instance with a single 500 GB gp2 EBS volume. The volume shows 100% credit balance consumption frequently, causing I/O throttling. What should the company do to resolve the throttling?

Accepted Answer

Migrate the volume to gp3 with appropriate IOPS and throughput settings.. The gp2 volume's credit balance is fully consumed because the workload's sustained I/O demand exceeds the baseline performance of 500 GB gp2 (1,500 IOPS). Migrating to gp3 (option B) eliminates the credit-bucket model entirely, providing a baseline of 3,000 IOPS and 125 MiB/s throughput regardless of volume size, with the ability to provision higher IOPS and throughput independently without relying on burst credits.

Answer

Increase the gp2 volume size to 1,000 GB to gain more I/O credits.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Move the database to Amazon RDS for Sybase ASE.

Question 6

An SAP system running on AWS experiences a significant performance degradation after a patching activity. The SAP application (PAS) and database (HANA) run on separate EC2 instances. The network throughput between the two instances has dropped. What is the MOST likely cause?

Accepted Answer

The instances were moved out of a cluster placement group, reducing network throughput.. A cluster placement group provides low-latency, high-bandwidth network connectivity between instances by placing them in the same high-speed, non-blocking rack. Moving instances out of a cluster placement group removes this benefit, reducing network throughput between the SAP PAS and HANA instances, which directly causes performance degradation.

Answer

The EBS-optimization feature was disabled on the database instance.

Answer

The security group rules were modified during patching, restricting traffic.

Answer

The route tables were updated, causing traffic to traverse a NAT gateway.

Question 7

A customer runs SAP HANA on an AWS Multi-AZ deployment with a primary and secondary instance. They want to ensure automatic failover in case of instance failure. What is the recommended approach?

Accepted Answer

Implement SAP HANA System Replication in a multi-AZ configuration with automatic failover using AWS services.. SAP HANA System Replication (HSR) in a multi-AZ configuration, combined with AWS services like Amazon Route 53 health checks and custom scripts for automatic failover, provides the recommended approach for ensuring automatic failover upon instance failure. HSR replicates data synchronously or asynchronously between primary and secondary HANA instances, and when integrated with AWS, you can automate the failover process without manual intervention, meeting the requirement for high availability.

Answer

Set up a Route 53 health check to redirect traffic to the secondary instance manually.

Answer

Use Amazon RDS for SAP HANA with Multi-AZ enabled.

Answer

Configure an Auto Scaling group with a lifecycle hook to launch a new HANA instance.

Question 8

An SAP environment uses Amazon CloudWatch to monitor EC2 instances. The operations team wants to receive a notification when the CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch Alarms with Amazon SNS.. Amazon CloudWatch Alarms can monitor a metric (like CPUUtilization) and trigger an action when the metric crosses a defined threshold for a specified number of consecutive evaluation periods. By setting the alarm to evaluate CPU utilization > 90% for 5 consecutive minutes (e.g., 5 periods of 1 minute each) and configuring the alarm action to publish to an Amazon SNS topic, the operations team receives a notification directly. This is the native, serverless way to react to CloudWatch metrics without additional infrastructure.

Answer

AWS Config.

Answer

Amazon CloudWatch Logs.

Answer

AWS CloudTrail.

Question 9

Which TWO of the following are valid strategies to improve the availability of an SAP HANA database on AWS?

Accepted Answer

Implement automatic failover using SAP HANA System Replication.. Option A is correct because SAP HANA System Replication (HSR) provides continuous replication of data from a primary to a secondary HANA system and, combined with a cluster manager such as Pacemaker or an AWS overlay IP, enables automatic failover so the standby takes over with minimal RTO/RPO. Option D is correct because deploying HSR across two Availability Zones places the primary and secondary nodes in physically separate data centers with independent power and networking, protecting against a full AZ outage while keeping replication synchronous or near-synchronous. Option B is not valid because Amazon RDS does not offer a HANA engine, so Multi-AZ for HANA is not a supported service. Option C is not a high-availability strategy: daily snapshots only provide point-in-time recovery with hours of potential data loss and long restore times, not continuous availability. Option E is not correct because scaling up the EC2 instance improves performance/capacity, not availability, and a single larger instance remains a single point of failure.

Answer

Use Amazon RDS for HANA with Multi-AZ deployment.

Answer

Take daily snapshots of the HANA data volume.

Answer

Use a larger EC2 instance type for the HANA server.

Question 10

Which TWO are best practices for securing SAP on AWS?

Accepted Answer

Use security groups to control traffic between SAP components.. Option C is correct because security groups act as stateful virtual firewalls at the ENI level, allowing you to restrict inbound and outbound traffic to only the specific ports and protocols SAP components require (for example, SAP dispatcher ports 3200-3299, SAProuter 3299, HANA 30013-30015), which enforces least-privilege network segmentation between the application, database, and central services tiers. Option E is correct because attaching an IAM role to an EC2 instance delivers temporary, automatically rotated credentials via the instance metadata service (IMDS), eliminating the need to embed long-lived access keys in SAP profiles or configuration files when the system accesses services such as S3, EBS, or CloudWatch. Option A is not a best practice because the default VPC uses permissive default networking and lacks the controlled subnet, route table, and NACL design expected for production SAP landscapes. Option B is not a best practice because public IP addresses expose SAP instances directly to the internet, increasing attack surface; administrative access should instead go through a bastion host, VPN, or AWS Systems Manager Session Manager. Option D is not a best practice because SSH key pairs only authenticate a user at the OS level and provide no network-layer filtering, so disabling security groups would leave all ports reachable.

Answer

Place all SAP systems in the default VPC.

Answer

Attach public IP addresses to all SAP EC2 instances for easy management.

Answer

Disable security groups and rely on SSH key pairs only.

Question 11

An SAP system on AWS uses a shared file system (e.g., /sapmnt) that must be accessible from multiple EC2 instances. Which storage solution provides the highest availability and scalability?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, NFS-based shared file system that is accessible from multiple EC2 instances across Availability Zones, offering high availability and automatic scalability. For SAP /sapmnt, EFS supports the required POSIX permissions and concurrent access patterns without single points of failure, unlike block storage or gateway solutions.

Answer

Amazon S3 with S3 File Gateway

Answer

AWS Storage Gateway file gateway

Answer

Amazon EBS with multi-attach enabled

Question 12

A company wants to ensure that their SAP HANA database backups are stored securely and can be retained for 7 years for compliance. Which AWS service should they use to archive the backups?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage class designed for long-term retention of data that is accessed infrequently, with a default retrieval time of 12 hours. This meets the 7-year compliance requirement for SAP HANA backups while minimizing storage costs, as the backups are unlikely to be accessed frequently after the initial retention period.

Answer

Amazon EBS Snapshots

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Standard

Question 13

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver and set an alarm when it exceeds 90% for 5 minutes. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides detailed monitoring of EC2 instances, including CPU utilization metrics, and allows you to set CloudWatch Alarms that trigger when a metric exceeds a specified threshold (e.g., 90%) for a given number of consecutive evaluation periods (e.g., 5 minutes). This is the native AWS service designed for performance monitoring and alerting.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 14

The following IAM trust policy is attached to a role named CrossAccountBackupRole in account 123456789012:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/SAPAdminRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

What does this policy enable?

Accepted Answer

The SAPAdminRole can assume the CrossAccountBackupRole.. The trust policy explicitly allows the IAM role SAPAdminRole (in account 111111111111) to perform sts:AssumeRole on the CrossAccountBackupRole. This enables SAPAdminRole to assume CrossAccountBackupRole and inherit its permissions. The policy does not grant direct S3 access; that would require a separate permissions policy attached to CrossAccountBackupRole.

Answer

The SAPAdminRole directly receives permissions to access S3.

Answer

The CrossAccountBackupRole can be assumed by any IAM user.

Answer

The SAPAdminRole can list S3 buckets in account 123456789012.

Question 15

Which THREE factors should be considered when choosing an EC2 instance type for an SAP HANA production system? (Choose three.)

Accepted Answer

The instance type must be certified by SAP for HANA.. Option A is correct because SAP HANA production deployments on AWS require an instance type that appears on the SAP HANA Certified and Supported Amazon EC2 Instances list (e.g., the X1, X1e, R4, or High Memory families), since SAP only supports HANA on hardware that has passed its certification and benchmark (SAPS) testing. Option D is correct because HANA is an in-memory database, so the instance must have sufficient RAM to hold the entire database in memory (plus overhead for row/column stores and computation), making memory size the primary sizing factor. Option E is correct because HANA system replication, backup/restore, and client connectivity are network-intensive, so high network bandwidth (and low latency, e.g., via cluster placement groups and ENA) is needed for reliable replication and performance. Option B is not required because HANA data persistence is provided by EBS volumes (or FSx for SAP HANA), not instance store, which is ephemeral and would lose data on stop/termination. Option C is not required because HANA is a CPU/memory-bound in-memory database and does not use GPU acceleration for its core operations.

Answer

The instance type should include instance store volumes for data persistence.

Answer

The instance must include GPU acceleration for HANA operations.