PAS-C01 Technology Practice Test 24 — 15 Questions

Question 1

A company is running a critical SAP application on SAP HANA in an AWS Single-AZ deployment. The application has experienced downtime twice in the last month due to underlying hardware failures. What is the MOST cost-effective solution to minimize future downtime without compromising performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the SAP HANA database in a Multi-AZ configuration using SAP HANA System Replication (HSR) across Availability Zones.. Deploying SAP HANA in a Multi-AZ configuration using SAP HANA System Replication (HSR) across Availability Zones provides synchronous replication and automatic failover in case of hardware failure. This minimizes downtime without requiring a larger instance or manual intervention, and maintains performance by using the same instance type and storage configuration as the primary.

Answer

Move the SAP HANA instance to a larger instance type to improve hardware reliability.

Answer

Use Dedicated Hosts to ensure physical isolation from other AWS customers.

Answer

Implement automated snapshots of the SAP HANA data volume and restore in case of failure.

Question 2

A company runs its SAP S/4HANA system on AWS using a multi-node HANA scale-out configuration. After a recent OS update, the application layer cannot connect to the HANA database. The HANA database processes are running, but the SAP application servers report 'communication failure' errors. Initial checks show that the security group rules allow traffic on the required ports. What is the MOST likely cause of the issue?

Accepted Answer

The OS update has reset the iptables firewall rules, blocking internal HANA ports.. OS updates on Linux systems often reset or flush iptables firewall rules to their default state, which typically blocks all inbound traffic on non-essential ports. In a multi-node HANA scale-out configuration, internal HANA communication relies on specific TCP ports (e.g., 3xx01–3xx10 for internal network traffic). When iptables rules are reset, these ports become blocked, preventing the SAP application layer from connecting to the HANA database even though the database processes are running and security group rules at the AWS level are correctly configured.

Answer

The DNS resolution is misconfigured after the OS update, causing hostname lookup failures.

Answer

The NTP synchronization is off, causing time drift and authentication errors.

Answer

The SAP system is not correctly licensed for the new OS version.

Question 3

An organization wants to ensure that its SAP HANA database backups are stored in a separate AWS Region for disaster recovery. The backups are currently stored in Amazon S3 in the primary Region. Which AWS service should be used to replicate the backups to another Region automatically?

Accepted Answer

Amazon S3 Cross-Region Replication (CRR).. Amazon S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects from an S3 bucket in one AWS Region to a bucket in another Region, meeting the requirement for storing SAP HANA database backups in a separate Region for disaster recovery. CRR operates asynchronously at the object level, ensuring that backups are continuously copied without manual intervention, and it supports the same storage classes and encryption mechanisms as the source bucket.

Answer

AWS Storage Gateway with volume gateway.

Answer

AWS Backup with a cross-region backup plan.

Answer

Amazon S3 Transfer Acceleration.

Question 4

A company is planning to run SAP BusinessObjects (BOBJ) on AWS. The application servers require consistent low-latency access to a shared file system for storing reports and configuration files. Which AWS storage solution is BEST suited for this requirement?

Accepted Answer

Amazon Elastic File System (Amazon EFS).. Amazon EFS provides a fully managed, scalable, and shared file system that can be accessed concurrently by multiple EC2 instances via the NFSv4.1 protocol. For SAP BusinessObjects application servers requiring consistent low-latency access to shared reports and configuration files, EFS delivers the necessary POSIX permissions, strong consistency, and automatic scaling without provisioning overhead, making it the ideal choice.

Answer

Amazon Elastic Block Store (Amazon EBS) with a multi-attach enabled volume.

Answer

Amazon Simple Storage Service (Amazon S3).

Answer

Amazon FSx for Windows File Server.

Question 5

A company is migrating its SAP landscape to AWS and wants to ensure that all SAP systems can communicate with each other using private IP addresses only. The systems are deployed in multiple VPCs. Which AWS solution should be used to enable private connectivity between these VPCs?

Accepted Answer

VPC Peering.. VPC Peering is the correct solution because it enables direct, private IP connectivity between VPCs using the AWS global network, with no gateways or VPN connections required. Traffic stays within AWS and never traverses the public internet, satisfying the requirement for SAP systems to communicate using only private IP addresses across multiple VPCs.

Answer

VPC Endpoints.

Answer

AWS Site-to-Site VPN.

Answer

AWS Direct Connect.

Question 6

An SAP system uses a custom RFC destination to an external SOAP web service. After a recent network change, the RFC call fails with a timeout error. The SAP administrator has verified that the web service is reachable from the SAP application server using ping. What is the MOST likely cause of the timeout?

Accepted Answer

A firewall between the application server and the web service is blocking the required port.. The RFC call uses a specific port (e.g., 443 for HTTPS or 80 for HTTP) to communicate with the SOAP web service. A firewall blocking that port would cause a timeout, as the ping test (ICMP) succeeds but the TCP handshake on the required port fails. The SAP administrator's verification of reachability via ping only confirms ICMP-level connectivity, not application-layer port access.

Answer

The DNS resolution is incorrect for the web service hostname.

Answer

The SAP router configuration is blocking the connection.

Answer

The SSL certificate of the web service has expired.

Question 7

An SAP administrator runs the AWS CLI command shown in the exhibit. The SAP HANA instance is running on an r5.4xlarge in us-east-1a. The administrator wants to change the instance type to r5.8xlarge to improve performance. What must the administrator do first?

Accepted Answer

Stop the instance from the AWS Management Console.. To change the instance type of an EC2 instance, the instance must first be stopped. While stopped, you can modify the instance type via the AWS Management Console, CLI, or SDK. After the instance is stopped, the administrator can change the type from r5.4xlarge to r5.8xlarge and then start the instance again.

Answer

Create an AMI of the instance and launch a new instance with the larger type.

Answer

Detach the EBS volumes and attach them to a new instance.

Answer

Modify the instance type in the instance settings while it is running.

Question 8

A company is designing a disaster recovery (DR) strategy for SAP on AWS. The primary region is us-east-1 and the DR region is us-west-2. The SAP HANA database is 2 TB. The recovery point objective (RPO) is 15 minutes and the recovery time objective (RTO) is 4 hours. Which solution meets these requirements most cost-effectively?

Accepted Answer

HANA System Replication in asynchronous mode. HANA System Replication in asynchronous mode meets the RPO of 15 minutes and RTO of 4 hours for a 2 TB database while being more cost-effective than synchronous replication, which would introduce latency and require high-bandwidth, low-latency links. Asynchronous replication allows the secondary system to lag slightly behind the primary, which is acceptable for a 15-minute RPO, and avoids the performance impact on the primary system that synchronous mode would impose over a long-distance link.

Answer

HANA System Replication in synchronous mode

Answer

Log shipping to an S3 bucket in DR region

Answer

EBS snapshot replication to DR region using AWS Backup

Question 9

A company is running SAP on AWS and wants to implement encryption at rest for all data. The company uses AWS KMS with Customer Managed Keys (CMKs) for the EBS volumes. The SAP application servers need to access an S3 bucket that contains sensitive data. How should the company ensure that the S3 bucket is encrypted with the same CMK?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with the same CMK. SSE-KMS (Server-Side Encryption with AWS KMS) allows you to specify a Customer Managed Key (CMK) to encrypt objects in S3. By configuring the S3 bucket to use the same CMK that is already used for EBS volumes, the company ensures a unified encryption key strategy for all data at rest, meeting the requirement for consistent encryption across services.

Answer

Use client-side encryption before uploading to S3

Answer

Add a bucket policy that denies if encryption is not present

Answer

Enable default encryption on the S3 bucket with SSE-S3

Question 10

Which TWO of the following are best practices for securing an SAP system on AWS? (Choose two.)

Accepted Answer

Use security groups to restrict inbound traffic to SAP application ports. Option C is correct because security groups act as stateful virtual firewalls at the instance/ENI level, and restricting inbound rules to only the specific SAP ports required (for example, SAP GUI 3200-3299, SAP dispatcher 3200, or HTTPS 443 for Fiori/Web Dispatcher) follows the principle of least privilege and minimizes the attack surface. Option E is correct because encrypting data in transit with TLS/SSL certificates protects SAP application traffic (such as SAP GUI, RFC, HTTP/HTTPS, and database connections) from eavesdropping and man-in-the-middle attacks, which is a core AWS Well-Architected and SAP security best practice. Option A is wrong because storing database credentials in plaintext in configuration files exposes secrets to anyone with file access; AWS Secrets Manager or Systems Manager Parameter Store with encryption should be used instead. Option B is wrong because disabling AWS CloudTrail removes API activity auditing and breaks compliance and forensic capabilities; CloudTrail should be enabled across all regions. Option D is wrong because allowing all inbound traffic from 0.0.0.0/0 exposes SAP systems to the internet and violates least-privilege network access.

Answer

Store database credentials in plaintext in application configuration files

Answer

Disable AWS CloudTrail to reduce logs

Answer

Allow all inbound traffic from 0.0.0.0/0 for easy access

Question 11

An SAP administrator created an IAM policy to allow an EC2 instance to upload backups to an S3 bucket. The policy is shown in the exhibit. However, the backup job fails with an access denied error. What is the most likely cause?

Accepted Answer

The policy requires server-side encryption with KMS, but the backup job does not include the required encryption header. The IAM policy includes the `s3:x-amz-server-side-encryption` condition key set to `aws:kms`, which enforces server-side encryption with KMS (SSE-KMS) for all `s3:PutObject` requests. If the backup job does not include the `x-amz-server-side-encryption: aws:kms` header in its PUT request, S3 will deny the request with an access denied error, even if the IAM role has the necessary permissions.

Answer

The KMS key policy does not grant the EC2 instance permission to use the key

Answer

The resource ARN is incorrect because it does not include the bucket name correctly

Answer

The IAM role does not have permission to call s3:PutObject

Question 12

An SAP administrator runs the AWS CLI command shown in the exhibit to check the status of a production HANA instance. The output shows the instance is running in us-east-1a. However, the SAP application team reports that the HANA database is not responding. What should the administrator check next to diagnose the issue?

Accepted Answer

The HANA database service is not running on the instance. The AWS CLI command only checks the EC2 instance state (e.g., 'running'), not the status of the HANA database service itself. Even if the instance is running, the HANA database service (hdbnameserver, hdbindexserver, etc.) may have crashed, failed to start, or been stopped. The administrator should SSH into the instance and run commands like 'systemctl status hdbindexserver' or 'sapcontrol -nr <instance_number> -function GetProcessList' to verify the HANA service status.

Answer

The EBS volumes are detached from the instance

Answer

The instance state is 'running' so no issue with the instance

Answer

The security group does not allow inbound traffic to the database port

Question 13

A company is running a critical SAP HANA database on AWS. The database administrator wants to ensure that the SAP HANA backup files are stored in a secure, durable, and cost-effective manner. They need to retain backups for 7 years to meet compliance requirements. Which AWS service should be used for long-term backup storage?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage for long-term retention of data that is accessed infrequently, with retrieval times of 12-48 hours. For a 7-year compliance retention requirement, this service offers secure, durable (99.999999999% durability), and cost-effective storage for SAP HANA backup files, which do not need immediate access.

Answer

AWS Backup

Answer

Amazon EBS Snapshots

Answer

Amazon S3 Standard

Question 14

An SAP system running on AWS is experiencing performance issues. The operations team suspects that the Amazon EBS volumes attached to the SAP application server are not providing sufficient IOPS. Which AWS service should be used to monitor the IOPS performance of the EBS volumes?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides detailed monitoring metrics for Amazon EBS volumes, including `VolumeReadOps` and `VolumeWriteOps`, which directly measure IOPS performance. By using CloudWatch metrics, the operations team can track the actual IOPS delivered to the SAP application server and identify whether the volumes are throttled or under-provisioned.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 15

A company is migrating its SAP landscape to AWS. The SAP systems consist of multiple instances (development, quality, production) running on different EC2 instances. The company wants to automate the provisioning of these instances using infrastructure as code. Which AWS service should be used to define and provision the SAP infrastructure in a repeatable manner?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire SAP infrastructure—including EC2 instances, VPCs, security groups, and storage—as code using a JSON or YAML template. This enables repeatable, version-controlled provisioning of development, quality, and production environments, which is essential for an SAP migration requiring consistent and automated deployments.

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Answer

AWS OpsWorks