PAS-C01 Technology Practice Test 26 — 15 Questions

Question 1

A company is designing a disaster recovery (DR) strategy for its SAP system on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The system uses SAP HANA as the database. Which THREE components must be configured to enable a successful DR failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SAP HANA system replication across regions.. The correct three components are SAP HANA system replication across regions (A), Amazon Route53 DNS failover configuration (B), and AWS Backup cross-region backup copy for the HANA database (C). SAP HANA system replication ensures data consistency and near-synchronous replication between the primary and DR sites. Route53 DNS failover automatically redirects traffic to the DR site in case of a failure. AWS Backup cross-region copy provides an additional backup of the HANA database in the DR region, ensuring backup availability. Option D (S3 Cross-Region Replication) is not essential for HANA replication; transport files can be handled separately. Option E (AWS Transit Gateway peering) provides network connectivity but is not a DR failover component.

Answer

S3 Cross-Region Replication for SAP transport files.

Answer

AWS Transit Gateway peering between the two regions.

Question 2

An SAP system is running on AWS with a production HANA database. The database administrator wants to ensure that backups are consistent and can be restored. Which TWO approaches should be used together for a robust backup strategy?

Accepted Answer

AWS Backup with a backup plan that includes both EBS snapshots and Backint.. Options A and E are correct. AWS Backup with a backup plan that includes both EBS snapshots (crash-consistent) and Backint integration (application-consistent) provides a comprehensive backup strategy for SAP HANA on AWS. Option A ensures crash-consistent backups at the storage level, while Option E uses SAP HANA Backint to produce application-consistent backups that can be orchestrated by AWS Backup. Option B (regular EBS snapshots without coordination) lacks application consistency. Option C (Auto Scaling) is not a backup mechanism. Option D (DMS) is for database migration, not backup.

Answer

Regular EBS snapshots of the data volume.

Answer

Amazon EC2 Auto Scaling to create backup instances.

Answer

AWS Database Migration Service (DMS) for continuous replication.

Question 3

A company runs its SAP ERP system on AWS with an SAP HANA database on an EC2 instance. The database is configured with multiple EBS io1 volumes striped in a RAID 0. Recently, the company implemented a new backup process using AWS Backup with the Backint agent. However, during the backup window, the database performance degrades significantly, causing application timeouts. The database administrator checks CloudWatch metrics and sees that the EBS write latency spikes to over 50 ms during backups. The backup target is an S3 bucket in the same region. The EC2 instance type is r5.4xlarge with EBS-optimized enabled. What is the MOST likely cause of the performance degradation?

Accepted Answer

The Backint agent is consuming CPU and I/O resources, causing contention.. The Backint agent runs on the same EC2 instance as SAP HANA, consuming CPU and I/O resources during backup, causing contention and performance degradation. Option B is unlikely because with RAID 0 the aggregate IOPS is higher than the provisioned per volume limit. Option C is incorrect because the S3 bucket is in the same region as stated. Option D is incorrect because the r5.4xlarge instance supports EBS optimization and is suitable for Backint.

Answer

The EBS volumes have reached the provisioned IOPS limit of 20,000 IOPS.

Answer

The S3 bucket is in a different region, causing network latency.

Answer

The EC2 instance type does not match the requirements for Backint.

Question 4

An SAP system uses AWS Direct Connect to connect to on-premises systems. The SAP application servers are in a private subnet, and the HANA database is in a separate private subnet. Both subnets are in the same VPC. The application servers can connect to the HANA database, but the application servers cannot connect to an on-premises file server via the Direct Connect. The on-premises network team confirms that the file server is reachable from other on-premises resources. The VPC route tables have a route for the on-premises CIDR pointing to the Direct Connect virtual gateway. The security groups allow all outbound traffic. What is the MOST likely cause of the issue?

Accepted Answer

The route table associated with the application subnet does not have a route to the on-premises CIDR via the virtual gateway.. The most likely cause is that the route table associated with the application subnet does not have a route to the on-premises CIDR via the virtual gateway. Since the application servers are in a different subnet, they need an explicit route in their subnet's route table to reach the on-premises network through Direct Connect. Without this route, traffic cannot be forwarded to the virtual gateway. Option A is unlikely because the security groups allow all outbound traffic, and NACLs might be blocking, but the question states security groups allow all outbound, and typically NACLs are configured permissive by default. Option C is not indicated as the on-premises team confirms the file server is reachable from other on-premises resources, implying Direct Connect is up. Option B (VPN) is not relevant; Direct Connect is already in use.

Answer

The network ACL for the application subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The on-premises file server is not reachable because it requires VPN instead of Direct Connect.

Answer

The Direct Connect virtual interface is in a 'down' state.

Question 5

A company has deployed SAP S/4HANA on AWS using a single EC2 instance for the HANA database. The database volume is an EBS io1 volume with 5,000 provisioned IOPS. The company wants to implement a high availability (HA) solution for the database using SAP HANA System Replication (HSR) with automatic failover. They plan to use a second EC2 instance in a different Availability Zone. The database administrator is concerned about data consistency during replication. Which additional AWS service should be used to ensure data consistency and minimize data loss during failover?

Accepted Answer

Amazon Route53 with health checks to automatically redirect traffic to the standby instance.. Amazon Route53 with health checks can monitor the primary HANA instance and automatically update DNS to redirect traffic to the standby instance in a different Availability Zone during a failover. This ensures minimal disruption and data consistency with HSR. Option A (AWS Backup) is for scheduled backups, not real-time replication. Option B (DMS) is designed for database migration, not for HANA HSR. Option C (EBS snapshots) provide point-in-time backups, not continuous replication to minimize data loss.

Answer

AWS Backup to schedule backups of the HANA database.

Answer

AWS Database Migration Service (DMS) to continuously replicate data.

Answer

Amazon EBS snapshots to capture point-in-time copies of the data volume.

Question 6

A company runs a critical SAP HANA database on an m5.24xlarge EC2 instance. The database has high transaction volume and requires low latency storage. The current setup uses EBS gp2 volumes with 10,000 IOPS. During peak hours, the database performance degrades due to IOPS burst balance depletion. Which storage solution should the company use to maintain consistent performance?

Accepted Answer

Provision EBS io2 Block Express volumes with 10,000 provisioned IOPS.. EBS io2 Block Express volumes provide consistent, low-latency performance with provisioned IOPS, making them the recommended choice for SAP HANA workloads. Option A is wrong because although gp3 volumes can provision 10,000 IOPS and would eliminate burst balance depletion, io2 Block Express is specifically designed for high-performance databases like SAP HANA, offering higher durability and consistent low-latency performance. Option B is wrong because Instance Store is ephemeral and data is lost if the instance stops. Option D is wrong because EFS is a file system, not suitable for block-level database storage.

Answer

Migrate to EBS gp3 volumes with provisioned IOPS of 10,000.

Answer

Use EC2 Instance Store (NVMe SSD) for the database data and logs.

Answer

Move the database to Amazon EFS with provisioned throughput.

Question 7

A company is migrating its SAP environment to AWS and wants to use SAP HANA as a Service on AWS (HANA database on AWS). The SAP application tier will run on EC2 instances behind an Application Load Balancer. The company requires high availability for the database with automatic failover in case of an AZ failure. Which architecture should the company implement?

Accepted Answer

Set up HANA System Replication between two EC2 instances in different AZs with automatic failover.. HANA System Replication configured between two EC2 instances in different Availability Zones (AZs) with automatic failover ensures high availability and resilience against an AZ failure. Option A is incorrect because replicating HANA to Amazon S3 is meant for backups and point-in-time recovery, not for real-time automatic failover. Option C is incorrect because synchronous replication within the same AZ does not protect against an AZ failure; it only provides protection against instance or host failure. Option D is incorrect because a single HANA database instance in one AZ, even with regular backups to S3, cannot provide automatic failover if the AZ fails; it would require manual recovery.

Answer

Configure HANA replication to Amazon S3 for point-in-time recovery.

Answer

Use HANA System Replication with a synchronous secondary in the same AZ.

Answer

Deploy a single HANA database on a large EC2 instance in one AZ with regular backups to S3.

Question 8

A company runs its SAP application on EC2 instances in a private subnet. The SAP application needs to access an on-premises database through a VPN connection. The company wants to improve network performance and reduce latency between the SAP application and the on-premises database. Which action should the company take?

Accepted Answer

Set up AWS Direct Connect between the VPC and on-premises data center.. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering lower and consistent latency compared to VPN connections that traverse the internet. Option B is incorrect because increasing VPN bandwidth does not reduce latency; latency is primarily affected by distance and internet routing. Option C is incorrect because VPC Peering is used to connect two VPCs, not to connect a VPC to an on-premises network. Option D is incorrect because a NAT Gateway enables outbound internet access from private subnets and does not provide connectivity to on-premises databases.

Answer

Increase the VPN tunnel bandwidth to 10 Gbps.

Answer

Create a VPC Peering connection to the on-premises network.

Answer

Add a NAT Gateway to the private subnet.

Question 9

During an SAP migration to AWS, the migration team faces a challenge with the Transport Management System (TMS). The SAP system landscape includes development, quality assurance, and production systems running on separate EC2 instances. The TMS is configured with transport routes between these systems. After migration, transports fail with errors related to missing files on the transport directory. What should the team do to ensure the TMS works correctly?

Accepted Answer

Set up an Amazon EFS file system and mount it as the transport directory on all SAP instances.. The Transport Management System (TMS) requires a shared transport directory accessible by all SAP instances (DEV, QAS, PRD). Option B is correct because Amazon EFS provides a scalable NFS file system that can be mounted on multiple EC2 instances simultaneously, satisfying the shared storage requirement. Option A is incorrect because EBS volumes are block storage that can only be attached to a single instance; manual file copying is not feasible for ongoing TMS operations. Option C is incorrect because mounting an S3 bucket via S3FS introduces performance and consistency issues; S3 is object storage not designed for low-latency file sharing required by TMS. Option D is incorrect because AWS Storage Gateway with SMB file share adds unnecessary complexity; EFS with NFS is the standard and simpler solution for shared transport directories in SAP on AWS.

Answer

Create an EBS volume for each SAP system and copy transport files manually.

Answer

Store the transport directory in an S3 bucket and mount it using S3FS.

Answer

Use AWS Storage Gateway with SMB file share to host the transport directory.

Question 10

An SAP on AWS deployment uses an Auto Scaling group for the SAP application tier. The application is stateless and can scale out and in based on CPU utilization. Which scaling policy should be used to add new instances during peak load and remove them when the load decreases?

Accepted Answer

Target tracking scaling policy with a target CPU utilization of 70%.. A target tracking scaling policy is the simplest and most automated way to maintain a target CPU utilization. Option A is wrong because simple scaling does not adjust dynamically. Option C is wrong because step scaling requires manual configuration of steps. Option D is wrong because scheduled scaling is for predictable loads, not dynamic.

Answer

Simple scaling policy based on CPU utilization.

Answer

Step scaling policy with multiple steps for different CPU thresholds.

Answer

Scheduled scaling policy to add instances during business hours.

Question 11

A company runs SAP on AWS and uses AWS KMS for encryption of EBS volumes. The security team requires that the EBS volumes used for SAP HANA data and log files be encrypted with a customer-managed key. They also want to ensure that the key cannot be deleted. What should the security team do to protect the KMS key?

Accepted Answer

Set a key policy that prevents the kms:ScheduleKeyDeletion action.. Setting a key policy that denies the kms:ScheduleKeyDeletion action prevents the key from being deleted. This ensures that the customer-managed key used for EBS volume encryption cannot be scheduled for deletion, meeting the security requirement. Option B is incorrect because AWS managed keys cannot have custom key policies and are managed by AWS, which does not meet the requirement for a customer-managed key. Option C is incorrect because storing the key in Secrets Manager is not for deletion prevention; Secrets Manager is for secure storage of secrets, not for KMS key deletion protection. Option D is incorrect because automatic key rotation creates new cryptographic material but does not prevent key deletion; it is a security best practice for key freshness, not for deletion prevention.

Answer

Use an AWS managed key instead of a customer-managed key.

Answer

Store the key in AWS Secrets Manager.

Answer

Enable automatic key rotation.

Question 12

An SAP Basis administrator needs to apply an SAP kernel patch to the SAP Central Services (ASCS) instance running on an EC2 instance in a Multi-AZ deployment. The ASCS instance is configured with a floating IP address using Elastic IP. The administrator wants to minimize downtime during the patching process. Which approach should the administrator take?

Accepted Answer

Create a new EC2 instance with the patched kernel, associate the Elastic IP to the new instance, and terminate the old one.. It implements a blue/green deployment, allowing the patch to be applied on a new EC2 instance without affecting the running ASCS instance. After patching, associate the Elastic IP to the new instance and terminate the old one, minimizing downtime to a brief DNS propagation delay. Option A is wrong because stopping the instance causes downtime during the patch. Option C is wrong because an Application Load Balancer does not support floating IP setups like Elastic IP for ASCS. Option D is wrong because Auto Scaling rolling updates are designed for scaling groups, not a single ASCS instance, and would still cause downtime.

Answer

Stop the ASCS instance, apply the patch, and start the instance.

Answer

Add the ASCS instance to an Application Load Balancer and then perform the patch.

Answer

Use an Auto Scaling group with a rolling update to apply the patch.

Question 13

A company runs its SAP HANA database on a single EC2 instance with EBS storage. The database is critical and the company needs to ensure data durability and recoverability in case of a disaster. Which TWO actions should the company take?

Accepted Answer

Take periodic EBS snapshots and copy them to another region.. Taking periodic EBS snapshots and copying them to another region provides cross-region disaster recovery and data durability. Option C is correct: backing up the HANA database to Amazon S3 provides durable, off-site storage. Option A is incorrect because the database runs on EC2, not RDS, so Multi-AZ for RDS is not applicable. Option D is incorrect because Cross-Region Replication is for S3 buckets, not EBS volumes. Option E is incorrect because HANA System Replication to a different AZ provides high availability within a region, but does not protect against regional disasters; it is not sufficient for disaster recovery.

Answer

Enable Multi-AZ deployment for the HANA database on RDS.

Answer

Use Cross-Region Replication for the EBS volumes.

Answer

Set up HANA System Replication to a secondary instance in a different Availability Zone.

Question 14

An SAP system on AWS is experiencing performance issues during peak hours. The system includes SAP application servers and a HANA database. The CloudWatch metrics show high CPU utilization on the application servers and high disk read latency on the database EBS volumes. Which THREE actions should be taken to improve performance?

Accepted Answer

Increase the provisioned IOPS on the EBS volumes attached to the HANA database.. Increasing provisioned IOPS on the EBS volumes reduces disk read latency, addressing the high disk read latency issue. Option B is correct because upgrading the HANA database to a larger instance type provides more CPU and memory, which helps with high CPU utilization and overall performance. Option C is correct because adding more SAP application servers distributes the load, reducing high CPU utilization on existing servers. Option D is incorrect because a NAT Gateway is for outbound internet traffic and does not improve internal network performance or address CPU/disk latency. Option E is incorrect because a read replica for HANA would not help with disk read latency or CPU utilization; it is typically used for disaster recovery or offloading reporting, not for improving performance of the primary database under high write or read load.

Answer

Add a NAT Gateway to the VPC to improve network performance.

Answer

Deploy a read replica for the HANA database.

Question 15

A company is planning to migrate its SAP environment to AWS. The SAP landscape includes development, test, and production systems. The company wants to ensure data security and compliance. Which THREE AWS services should the company use to achieve this?

Accepted Answer

AWS Key Management Service (KMS) for encryption of EBS volumes and S3 buckets.. AWS KMS enables encryption of EBS volumes and S3 buckets, ensuring data at rest is secure. Option B is correct because IAM provides user and role management to enforce least privilege access. Option D is correct because CloudTrail records API activity for auditing and compliance. Option C is wrong because Direct Connect is a network connectivity service, not a security service. Option E is wrong because Elastic Load Balancing is for traffic distribution, not security.

Answer

AWS Direct Connect for dedicated network connection.

Answer

Elastic Load Balancing for distributing traffic.