PAS-C01 Technology Practice Test 31 — 15 Questions

Question 1

An SAP system administrator needs to store application logs for a minimum of 3 years for compliance. The logs are currently stored in Amazon S3 Standard and are accessed infrequently after 30 days. Which lifecycle policy should the administrator implement to minimize costs while meeting compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 1 year, and delete after 3 years.. Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 1 year, and expire after 3 years. Option A is incorrect because S3 One Zone-IA is not durable enough for compliance logs (only 99.99% durability) and risks data loss in a single AZ failure. Option B is incorrect because transitioning directly to S3 Glacier after 30 days incurs high retrieval costs and minimum storage charges; it is more cost-effective to use Standard-IA first. Option C is incorrect because deleting logs after 30 days violates the 3-year compliance requirement.

Answer

Transition to S3 One Zone-IA after 30 days and delete after 3 years.

Answer

Transition to S3 Glacier after 30 days and delete after 3 years.

Answer

Delete logs after 30 days to save costs.

Question 2

An IAM policy is attached to a user who manages SAP HANA volumes. The policy is shown in the exhibit. What is the effect of this policy?

Accepted Answer

The user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume.. The first statement allows ec2:AttachVolume and ec2:DetachVolume only if the volume has tag Environment=production. The second statement denies ec2:DeleteVolume for all volumes. Therefore, the user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume. Option A is incorrect because attach/detach are allowed only with the condition. Option B is incorrect because delete is denied for all volumes. Option D is incorrect because the allow statement is conditional on the specific tag value, not just the production environment.

Answer

The user can attach and detach any volume regardless of tags.

Answer

The user can delete any volume.

Answer

The user can attach and detach any volume in the production environment.

Question 3

A company runs its SAP HANA database on an EC2 instance (r5.8xlarge) with 8 EBS gp2 volumes (1 TB each) in a RAID 0 stripe. The database is critical and requires high availability. The current architecture uses a single EC2 instance in one Availability Zone. The company wants to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. The DR site must be in a different AWS Region. The SAP HANA database size is 4 TB. The company has a 1 Gbps Direct Connect connection between the primary and DR Regions. The database workload is write-intensive with an average write throughput of 200 MB/s. Which solution meets the RPO and RTO requirements?

Accepted Answer

Set up HANA System Replication (HSR) in asynchronous mode from the primary to a secondary EC2 instance in the DR Region. Use the same instance type and EBS configuration. In case of failure, perform a HSR takeover.. HANA System Replication (HSR) in asynchronous mode continuously ships redo log entries from the primary to the secondary instance, giving an RPO typically measured in seconds to low minutes — well within the 15-minute requirement. Because the secondary EC2 instance is pre-provisioned with the same instance type and EBS RAID 0 layout, a takeover can complete in minutes, satisfying the 4-hour RTO. HSR is SAP's native HA/DR mechanism and is the only option that provides continuous, near-real-time replication of the 4 TB database across Regions.

Answer

Take EBS snapshots of the RAID array every 15 minutes and replicate them to the DR Region using EBS snapshot copy. In the DR Region, restore the snapshots to new volumes and attach them to a new EC2 instance.

Answer

Back up the HANA database to Amazon S3 every 15 minutes using the HANA backup tool, and set up cross-Region replication for the S3 bucket. In the DR Region, restore the latest backup to a new EC2 instance.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate changes to a target HANA database in the DR Region.

Question 4

A company runs an SAP HANA database on an EC2 instance with a single EBS volume. The database is experiencing high I/O latency during peak hours. Which solution would provide consistent, low-latency performance without downtime?

Accepted Answer

Replace the existing volume with an EBS io2 Block Express volume.. Replacing the existing volume with an EBS io2 Block Express volume provides consistent, low-latency performance with high IOPS and throughput, specifically designed for I/O-intensive workloads like SAP HANA. This can be done without downtime by using features such as EBS multi-attach or logical volume mirroring to migrate data while the instance runs. Option C is incorrect because the Elastic Fabric Adapter (EFA) is a network interface for HPC inter-instance communication, not a storage I/O offload solution; it does not directly reduce storage latency. Option A (migrating to instance store) would require data migration and potential downtime. Option D (switching to gp3) may not offer the same level of consistent low latency and high IOPS as io2 Block Express.

Answer

Migrate the database to an instance with NVMe instance store volumes.

Answer

Attach an Elastic Fabric Adapter (EFA) to the instance to offload storage I/O.

Answer

Switch the volume type to EBS gp3 with maximum throughput.

Question 5

An SAP administrator notices that the SAP application server is unable to establish an RFC connection to the SAP HANA database. The database is running on an EC2 instance in the same VPC. Security groups and NACLs allow all traffic. What is the most likely cause?

Accepted Answer

The application server is configured to connect to the wrong port number.. SAP application servers connect to SAP HANA using the SQL port, which by default is 3<instance_number>15 (for example, 30015 for instance 00). If the application server's connection string or profile points to the wrong port, the RFC/SQL connection will fail even though security groups and NACLs permit all traffic. Since the question states network ACLs and security groups allow all traffic and the instances are in the same VPC, the most likely cause is a misconfigured port number in the application server's connection parameters.

Answer

The VPC has overlapping CIDR blocks with the on-premises network.

Answer

The application server uses TCP instead of the required UDP protocol.

Answer

The HANA database instance was rebooted for maintenance.

Question 6

An SAP system running on AWS uses a shared file system via Amazon EFS for transport directories. The system administrator notices that file operations are slow across multiple application servers. The EFS file system is configured with Bursting Throughput mode. What is the most effective way to improve performance?

Accepted Answer

Switch the file system to Provisioned Throughput mode and set a higher throughput value.. Provisioned Throughput mode allows you to specify a higher throughput level for your Amazon EFS file system, providing consistent performance independent of burst credits. Option B is incorrect: using EFS Access Points does not affect throughput, they enforce access permissions. Option C is incorrect: reducing operations during off-peak hours may conserve burst credits but does not directly increase performance; significant improvement requires Provisioned Throughput. Option D is incorrect: additional mount targets in each AZ do not increase throughput as they share the same file system throughput.

Answer

Use EFS Access Points to enforce a different UID/GID for each application server.

Answer

Increase the burst credit balance by reducing file operations during off-peak hours.

Answer

Create additional mount targets in each Availability Zone to distribute load.

Question 7

An SAP administrator runs the commands above to inspect the volumes attached to an EC2 instance that hosts an SAP HANA database. The database log files are stored on /dev/sdf. What is a potential issue with this configuration?

Accepted Answer

The log volume uses gp3, which may not provide enough IOPS for HANA log writes.. SAP HANA log volumes require sustained high IOPS and low write latency because every transaction commit is written to the log before being acknowledged. gp3 volumes start at a baseline of 3,000 IOPS and only reach higher IOPS if provisioned separately, which is typically insufficient for production HANA log writes. SAP-certified HANA log volumes generally require io2 Block Express or provisioned-IOPS gp3 with sufficient IOPS, making gp3 with default settings a real performance risk.

Answer

The log volume is attached as /dev/sdf, which is not a standard device name for HANA.

Answer

The root volume will be deleted on termination, causing data loss.

Answer

The log volume is not encrypted.

Question 8

A company is deploying SAP S/4HANA on AWS and needs to choose the storage for the HANA data volume. Which EBS volume type provides the highest consistent IOPS for this workload?

Accepted Answer

EBS io2 Block Express. EBS io2 Block Express is designed for mission-critical applications like SAP HANA, offering the highest consistent IOPS of any EBS volume type, with up to 256,000 IOPS. Option B (gp3) provides baseline performance but lower maximum IOPS than io2 Block Express. Option C (io1) is an older provisioned IOPS type with lower maximum IOPS (up to 64,000) compared to io2 Block Express. Option D (st1) is throughput-optimized and not suitable for high IOPS workloads.

Answer

EBS gp3

Answer

EBS io1

Answer

EBS st1

Question 9

A company is migrating its SAP environment to AWS and wants to use SAP HANA as a Service on AWS (HANA database on AWS). The SAP application tier will run on EC2 instances behind an Application Load Balancer. The company requires high availability for the database with automatic failover in case of an AZ failure. Which architecture should the company implement?

Accepted Answer

Set up HANA System Replication between two EC2 instances in different AZs with automatic failover.. HANA System Replication configured between two EC2 instances in different Availability Zones (AZs) with automatic failover ensures high availability and resilience against an AZ failure. Option A is incorrect because replicating HANA to Amazon S3 is meant for backups and point-in-time recovery, not for real-time automatic failover. Option C is incorrect because synchronous replication within the same AZ does not protect against an AZ failure; it only provides protection against instance or host failure. Option D is incorrect because a single HANA database instance in one AZ, even with regular backups to S3, cannot provide automatic failover if the AZ fails; it would require manual recovery.

Answer

Configure HANA replication to Amazon S3 for point-in-time recovery.

Answer

Use HANA System Replication with a synchronous secondary in the same AZ.

Answer

Deploy a single HANA database on a large EC2 instance in one AZ with regular backups to S3.

Question 10

A company runs its SAP application on EC2 instances in a private subnet. The SAP application needs to access an on-premises database through a VPN connection. The company wants to improve network performance and reduce latency between the SAP application and the on-premises database. Which action should the company take?

Accepted Answer

Set up AWS Direct Connect between the VPC and on-premises data center.. AWS Direct Connect provides a dedicated, private network connection between on-premises and AWS that bypasses the public internet, offering more consistent latency, higher bandwidth, and lower jitter than a VPN. For an SAP application accessing an on-premises database, Direct Connect significantly improves network performance and reduces latency compared to a VPN tunnel over the internet.

Answer

Increase the VPN tunnel bandwidth to 10 Gbps.

Answer

Create a VPC Peering connection to the on-premises network.

Answer

Add a NAT Gateway to the private subnet.

Question 11

During an SAP migration to AWS, the migration team faces a challenge with the Transport Management System (TMS). The SAP system landscape includes development, quality assurance, and production systems running on separate EC2 instances. The TMS is configured with transport routes between these systems. After migration, transports fail with errors related to missing files on the transport directory. What should the team do to ensure the TMS works correctly?

Accepted Answer

Set up an Amazon EFS file system and mount it as the transport directory on all SAP instances.. SAP TMS requires a shared transport directory (/usr/sap/trans) accessible by all systems in the landscape, because transport files (data and cofiles) are written by the source system and read by target systems during import. Amazon EFS provides a POSIX-compliant, shared NFS file system that can be mounted on all EC2 instances across AZs, replicating the on-premises shared /sap/trans behavior.

Answer

Create an EBS volume for each SAP system and copy transport files manually.

Answer

Store the transport directory in an S3 bucket and mount it using S3FS.

Answer

Use AWS Storage Gateway with SMB file share to host the transport directory.

Question 12

A company is using AWS Systems Manager to automate patching of SAP application servers. The patching process should run during a maintenance window every Sunday at 2 AM. Which Systems Manager capability should be used to schedule the patching?

Accepted Answer

Maintenance Windows. Maintenance Windows (option D) is the correct capability because it is the Systems Manager feature specifically designed to schedule recurring operational tasks, such as patching, at defined times like every Sunday at 2 AM. It lets you register targets and tasks (for example, running Patch Manager or Automation documents) and executes them only within the specified window. Patch Manager (B) performs the actual patching but does not itself provide the cron-style scheduling; Automation (A) runs runbooks but is not the scheduling mechanism; and State Manager (C) enforces a persistent desired state on instances rather than scheduling time-bound maintenance tasks.

Answer

Automation

Answer

Patch Manager

Answer

State Manager

Question 13

A company is planning to migrate its SAP environment to AWS. The SAP landscape includes development, test, and production systems. The company wants to ensure data security and compliance. Which THREE AWS services should the company use to achieve this?

Accepted Answer

AWS Key Management Service (KMS) for encryption of EBS volumes and S3 buckets.. AWS KMS enables encryption of EBS volumes and S3 buckets, ensuring data at rest is secure. Option B is correct because IAM provides user and role management to enforce least privilege access. Option D is correct because CloudTrail records API activity for auditing and compliance. Option C is wrong because Direct Connect is a network connectivity service, not a security service. Option E is wrong because Elastic Load Balancing is for traffic distribution, not security.

Answer

AWS Direct Connect for dedicated network connection.

Answer

Elastic Load Balancing for distributing traffic.

Question 14

A company runs its SAP ERP system on AWS. The SAP application servers are in an Auto Scaling group across two Availability Zones. The SAP HANA database runs on a single EC2 instance in us-east-1a. The database instance has an Elastic IP and uses EBS io1 volumes with 5000 provisioned IOPS. During a recent deployment, the company experienced a complete outage when the Availability Zone us-east-1a became unavailable due to a power failure. The database was unavailable for 6 hours until the zone recovered. The company wants to implement a highly available architecture that can automatically recover from an AZ failure with minimal data loss. The Recovery Point Objective (RPO) is 15 minutes and Recovery Time Objective (RTO) is 30 minutes. What should the company do?

Accepted Answer

Set up HANA System Replication with synchronous replication to a secondary instance in us-east-1b and configure automatic takeover.. HANA System Replication with synchronous replication to a secondary instance in another AZ provides automatic failover with an RPO of zero (no data loss) and RTO within minutes, meeting the 15-minute RPO and 30-minute RTO. This is the standard SAP-certified HA solution on AWS. It ensures the database remains available if the primary AZ fails.

Answer

Take EBS snapshots every 15 minutes and copy them to another region.

Answer

Move the HANA database to a larger instance in the same Availability Zone and increase IOPS to 10000.

Answer

Migrate the HANA database to Amazon RDS for SAP HANA with Multi-AZ enabled.

Question 15

A company uses SAP BusinessObjects (BO) on AWS. The BO servers run on EC2 instances in a private subnet. Users access the BI Launch Pad through an Application Load Balancer (ALB) in a public subnet. The company recently received a security audit finding that the ALB is accessible from the internet on port 443, but the security group allows inbound traffic from 0.0.0.0/0. The audit requires that only the company's corporate IP range (203.0.113.0/24) should be allowed. Additionally, the company wants to reduce the attack surface by blocking traffic from other IPs. What should the company do to meet the security requirement?

Accepted Answer

Modify the security group attached to the ALB to allow only inbound traffic from 203.0.113.0/24 on port 443.. Security groups act as virtual firewalls for the ALB and control inbound traffic at the instance/ENI level. Modifying the ALB's security group to allow only 203.0.113.0/24 on port 443 directly restricts access to the corporate IP range, meeting the audit requirement and reducing attack surface without architectural changes.

Answer

Deploy AWS WAF on the ALB and create a rule to allow only the corporate IP range.

Answer

Replace the security group with a network ACL on the ALB subnet to allow only the corporate IP range.

Answer

Move the ALB to a private subnet and use a VPN for user access.