PAS-C01 Technology Practice Test 25 — 15 Questions

Question 1

An SAP system is running on an EC2 instance with a single Amazon EBS volume for data and log files. The database administrator wants to increase the IOPS performance without changing the instance type. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the EBS volume to provisioned IOPS (io1/io2).. The correct action is to modify the EBS volume to use provisioned IOPS (io1 or io2), as this directly increases the IOPS performance of the volume without changing the instance type. The current single EBS volume is likely a gp2 or gp3 type, which has a baseline IOPS limit; switching to io1/io2 allows you to specify a higher, consistent IOPS level that meets the SAP database's performance requirements.

Answer

Enable EBS optimization on the EC2 instance.

Answer

Change the EC2 instance type to a larger size.

Answer

Migrate the data to an instance store volume.

Question 2

A company runs SAP S/4HANA on AWS. The system is critical and requires high availability. The database is SAP HANA running on two EC2 instances in a cluster. The company wants to ensure that the secondary instance can take over quickly in case of primary failure. Which AWS service should be used to implement a floating IP address that can be moved between the instances?

Accepted Answer

Elastic IP addresses. Elastic IP addresses are static public IPv4 addresses that can be allocated to an AWS account and reassigned between EC2 instances. When a primary SAP HANA instance fails, the Elastic IP can be disassociated from the failed instance and associated with the secondary instance. This provides a floating IP that can be moved quickly, supporting high availability. Route 53 DNS failover changes DNS resolution, but does not provide a floating IP address that is directly moved between instances.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Answer

VPC Peering

Question 3

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP system are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, including the caller identity, time, source IP, and request parameters. For SAP systems requiring audit logs of AWS interactions, CloudTrail provides the necessary event history for security analysis, resource change tracking, and compliance auditing.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Question 4

A company is running SAP ERP on AWS and wants to reduce costs by right-sizing the EC2 instances. The administrator has identified that the current instances are over-provisioned for CPU and memory. Which AWS service can provide recommendations for instance type changes based on historical usage?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, I/O, network) from Amazon CloudWatch and provides actionable recommendations for right-sizing EC2 instances, including instance type changes. For SAP ERP workloads, it can identify over-provisioned instances by comparing actual usage patterns against the performance characteristics of different instance families, directly addressing the goal of reducing costs without compromising performance.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Question 5

Which AWS service can be used to monitor the performance of SAP HANA databases running on EC2 instances?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the primary AWS service for monitoring the performance of SAP HANA databases on EC2. It can collect custom metrics such as CPU utilization, memory usage, disk I/O, and SAP HANA-specific metrics (e.g., row store memory, column store memory) via the CloudWatch agent or monitoring scripts. The other listed services (Inspector, RDS Performance Insights, X-Ray, Config) are not designed for or capable of directly monitoring self-managed SAP HANA database performance on EC2.

Answer

Amazon Inspector

Answer

Amazon RDS Performance Insights

Answer

AWS X-Ray

Answer

AWS Config

Question 6

Refer to the exhibit. A CloudFormation template is used to launch an EC2 instance for SAP. The instance launches but the root volume is only 50 GB. The SAP installation requires at least 100 GB for the root volume. How should the template be modified?

Accepted Answer

Change VolumeSize from 50 to 100 in the BlockDeviceMapping.. The CloudFormation template explicitly defines the root volume size in the BlockDeviceMapping property. By changing VolumeSize from 50 to 100, the template will provision a new EC2 instance with a 100 GB root volume, meeting the SAP installation requirement. The BlockDeviceMapping overrides the default root volume size from the AMI, so this is the precise way to control volume size at launch.

Answer

Change the InstanceType to a larger instance.

Answer

Modify the running instance's root volume size using the AWS Management Console.

Answer

Change the ImageId to an AMI with a larger root volume.

Question 7

A company is designing a disaster recovery solution for a critical SAP HANA database running on AWS. The primary site is in us-east-1 and the recovery site must be in us-west-2. The database must have a Recovery Point Objective (RPO) of less than 15 minutes and a Recovery Time Objective (RTO) of less than 2 hours. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Configure SAP HANA System Replication (HSR) in active/standby mode between the primary and secondary regions.. SAP HANA System Replication (HSR) in active/standby mode is the native, AWS-recommended disaster recovery solution for SAP HANA databases. It provides synchronous or asynchronous replication of the entire in-memory database to a standby instance in us-west-2, enabling an RPO of less than 15 minutes (asynchronous mode) and an RTO of under 2 hours through a controlled takeover. This approach minimizes operational overhead because it is built into SAP HANA, requires no external services, and automates log shipping and data synchronization.

Answer

Use AWS Backup to take snapshots of the HANA data volume every 5 minutes and copy them to us-west-2.

Answer

Use Amazon S3 Cross-Region Replication to copy HANA data files to us-west-2.

Answer

Set up AWS Database Migration Service (DMS) with ongoing replication from the primary to a secondary HANA database.

Question 8

A company has a mission-critical SAP S/4HANA system running on AWS with a multi-node HANA database. The system must be highly available with an RPO of 0 and an RTO of less than 30 minutes. The database uses SAP HANA System Replication (HSR) with synchronous replication. Which THREE components are essential for this high-availability architecture?

Accepted Answer

An ENSA2 (Enqueue Replication 2) enqueue server.. Option C (ENSA2 enqueue server) is essential because SAP S/4HANA's lock and enqueue service must be made highly available independently of the ASCS instance; ENSA2 replicates the enqueue table to a standby enqueue server in a second node, preventing the enqueue service from becoming a single point of failure and enabling fast failover within the RTO. Option D (a secondary HANA instance in a different Availability Zone) is required because SAP HANA System Replication with synchronous mode must replicate to a standby HANA instance in a separate AZ to achieve an RPO of 0 and allow takeover if the primary AZ fails. Option E (a cluster manager such as Pacemaker) is essential to orchestrate the failover of the HANA instances, the ENSA2 enqueue server, and associated virtual IPs and resources automatically, which is necessary to meet the sub-30-minute RTO. Option A is not correct because an Application Load Balancer operates at the HTTP/HTTPS layer and is not used to distribute SAP HANA database traffic between HANA nodes; HANA clients connect directly via virtual IPs managed by the cluster. Option B is not correct because a VPN connection between Availability Zones is unnecessary and inappropriate; AWS AZs within a region are connected by low-latency private networking, and HSR uses the existing VPC network.

Answer

An Application Load Balancer to distribute traffic between HANA nodes.

Answer

A VPN connection between the two Availability Zones.

Question 9

The exhibit shows an IAM policy for an SAP backup process that uploads backups to S3. An administrator wants to ensure that all uploads are encrypted using SSE-S3. What does this policy enforce?

Accepted Answer

Any PutObject request that does not include the encryption header will be denied.. The policy uses a `Deny` effect with a `StringNotEquals` condition on the `s3:x-amz-server-side-encryption` header, requiring it to be `AES256`. This enforces that any `PutObject` request must include the `x-amz-server-side-encryption: AES256` header; otherwise, the request is denied. Option C correctly states that requests without the encryption header will be denied.

Answer

The backup process must encrypt the files before uploading them.

Answer

The backup process must use AWS KMS to encrypt the objects.

Answer

The bucket automatically encrypts objects with SSE-S3 even if the request does not specify it.

Question 10

A company runs SAP on AWS and uses a shared file system for SAP transport files. The system must support concurrent access from multiple SAP application servers and provide strong consistency. The transport files are typically small (less than 1 MB) and are frequently read and written. Which file storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS (Elastic File System) provides a fully managed, POSIX-compliant, shared file system that supports concurrent access from multiple EC2 instances (SAP application servers) with strong consistency. It uses the NFSv4.1 protocol, which ensures that read-after-write consistency is maintained across all clients, making it ideal for SAP transport files that are frequently read and written.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3

Answer

Amazon EC2 instance store

Question 11

The exhibit shows the block device mapping of an EC2 instance running SAP HANA. The root volume (/dev/xvda) has DeleteOnTermination set to true, and the data volume (/dev/sdf) has DeleteOnTermination set to false. If the instance is terminated, what happens to the data volume?

Accepted Answer

Only the root volume is deleted; the data volume remains.. The DeleteOnTermination attribute controls whether a volume is deleted when its associated EC2 instance is terminated. For the root volume (/dev/xvda), this attribute is set to true, so it will be deleted upon termination. For the data volume (/dev/sdf), it is set to false, meaning the volume will be detached from the instance and preserved in your AWS account, allowing you to reattach it to another instance or take snapshots. Therefore, only the root volume is deleted, and the data volume remains.

Answer

Only the data volume is deleted; the root volume remains.

Answer

Both volumes are detached and moved to Amazon S3.

Answer

Both volumes are deleted.

Question 12

A company is running SAP BusinessObjects on AWS. The application servers are behind an Application Load Balancer (ALB). The ALB is configured to use a single target group. The company wants to deploy a new version of the application with zero downtime. Which deployment strategy should be used?

Accepted Answer

Implement a blue/green deployment by creating a new target group and updating the ALB listener.. A blue/green deployment allows you to create a completely new target group with the new application version, then update the ALB listener rule to route all traffic from the existing target group to the new one. This ensures zero downtime because the switch is instantaneous at the listener level, and the old environment remains intact for immediate rollback if needed.

Answer

Perform a rolling update by terminating one instance at a time and launching a new one.

Answer

Create a new ALB and update the DNS record to point to the new ALB.

Answer

Use a canary release by routing 10% of traffic to the new version.

Question 13

An SAP administrator needs to provide temporary, time-limited access to an S3 bucket containing SAP backup files for an external auditor. The auditor should be able to download files from the bucket. Which method provides the most secure way to grant access?

Accepted Answer

Generate a presigned URL for each file the auditor needs to download.. Presigned URLs grant temporary, time-limited access to specific S3 objects without requiring the auditor to have AWS credentials or any permanent permissions. The SAP administrator can generate a presigned URL for each backup file, set an expiration time, and share the URL with the auditor, who can then download the file using standard HTTP GET requests. This approach follows the principle of least privilege and ensures access is revoked automatically after the URL expires.

Answer

Create an IAM user with read-only access to the bucket and share the credentials with the auditor.

Answer

Provide the auditor with the root user credentials of the AWS account.

Answer

Make the bucket publicly readable and share the bucket URL.

Question 14

A company is migrating an SAP ERP system to AWS. The system requires low-latency access to a shared file system for SAP transport directories. The file system must be accessible from multiple EC2 instances in different Availability Zones. Which storage solution meets these requirements?

Accepted Answer

Amazon EFS file system.. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, offering the low-latency access required for SAP transport directories. It automatically scales storage capacity and throughput, ensuring consistent performance for SAP workloads without manual provisioning.

Answer

Amazon EBS volumes snapshotted and shared across instances.

Answer

Instance store volumes on each EC2 instance.

Answer

Amazon S3 with Transfer Acceleration.

Question 15

A company is using SAP HANA on AWS and needs to back up the database to Amazon S3. The backup must be encrypted at rest in S3. The company already uses AWS KMS for encryption. What is the MOST secure way to configure the backup?

Accepted Answer

Use SSE-KMS with a customer managed key and restrict key usage with key policies.. Using SSE-KMS with a customer managed key allows you to enforce granular key policies, including restricting key usage to specific IAM roles or conditions, and enables audit trails via AWS CloudTrail. This provides the highest level of control and security for encrypting SAP HANA backups at rest in S3, meeting the requirement for the most secure configuration.

Answer

Use client-side encryption before uploading to S3.

Answer

Enable default S3 encryption with SSE-S3.

Answer

Use SSE-KMS with the AWS managed key for S3.