PAS-C01 Technology Practice Test 33 — 15 Questions

Question 1

A company is migrating an SAP ECC system to AWS. The SAP application servers run on Amazon EC2 instances and use Amazon Elastic File System (EFS) for shared storage of SAP transport files and interfaces. The company needs to ensure that the EFS file system provides the required performance for the SAP transport directory. Which EFS performance mode should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

General Purpose performance mode with Provisioned throughput.. SAP transport directories require low latency and consistent throughput to handle the I/O of transport files and interfaces. Amazon EFS General Purpose performance mode offers the lowest latency per operation, which is crucial for SAP. Provisioned throughput ensures that the file system has a dedicated amount of throughput regardless of its size, providing predictable performance. This combination is best suited for SAP shared storage on EFS.

Answer

Max I/O performance mode with Provisioned throughput.

Answer

Max I/O performance mode with Bursting throughput.

Answer

General Purpose performance mode with Bursting throughput.

Question 2

A company runs an SAP NetWeaver ABAP system on AWS. The SAP application servers are on EC2 instances in a private subnet, and the SAP HANA database is on a separate EC2 instance in another private subnet. The security team requires that all traffic between the application servers and the database be encrypted in transit and that the database only accepts connections from the application servers. Which combination of AWS features should the company use to meet these requirements?

Accepted Answer

Configure a security group for the database that allows inbound traffic only from the application servers' security group, and enable SAP HANA secure communication (TLS/SSL) for the database connections.. Security group referencing allows the database's security group to permit inbound traffic only from the application servers' security group, ensuring that only those instances can connect. Enabling SAP HANA secure communication (TLS/SSL) encrypts the data in transit between the application servers and the database. This combination meets both the network restriction and encryption requirements without exposing the database to the internet.

Answer

Set up a VPN connection between the application servers and the database, and use IPsec to encrypt traffic. Restrict access using a network ACL that allows only the application servers' subnet CIDR.

Answer

Use AWS PrivateLink to create an interface VPC endpoint for the SAP HANA database, and configure the application servers to connect through the endpoint. Enable encryption using AWS KMS.

Answer

Place the database in a public subnet with an Elastic IP, and use a network ACL to allow only the application servers' IP addresses. Enable encryption using AWS Certificate Manager (ACM) on the database.

Question 3

A company is running SAP HANA on AWS with system replication between two Availability Zones for high availability. They want to minimize recovery time objective (RTO) in case of a failover. Which configuration should be implemented to achieve the lowest RTO?

Accepted Answer

Configure SAP HANA system replication in sync mode with logreplay operation mode and enable automatic failover using an overlay IP address.. To minimize RTO in SAP HANA system replication, the secondary site must be able to take over quickly with minimal data loss. Sync mode ensures that all data is replicated before the primary commits, so the secondary is always up-to-date. Logreplay operation mode allows the secondary to replay logs in memory, reducing takeover time. Automatic failover using an overlay IP address (e.g., via Pacemaker) eliminates manual steps, further reducing RTO. This is the recommended configuration for high availability on AWS.

Answer

Configure SAP HANA system replication in sync mode with delta_datashipping operation mode and automatic failover using AWS Lambda.

Answer

Configure SAP HANA system replication in async mode with delta_datashipping operation mode and manual failover.

Answer

Configure SAP HANA system replication in async mode with logreplay operation mode and automatic failover using an overlay IP address.

Question 4

A company is deploying SAP S/4HANA on AWS and needs to ensure that the application servers can automatically discover and connect to the SAP HANA database. The company wants to use AWS native service discovery. Which service should be used to register the SAP HANA database and allow application servers to resolve its endpoint?

Accepted Answer

AWS Cloud Map with a private DNS namespace.. AWS Cloud Map is the appropriate service for service discovery. By creating a private DNS namespace and registering the SAP HANA database as a resource, application servers can automatically resolve the database endpoint. Cloud Map also supports health checks, enabling automatic failover in high-availability setups. Other options either expose the endpoint publicly, require manual configuration, or do not provide DNS-based discovery.

Answer

Amazon Route 53 with a public hosted zone.

Answer

Elastic Load Balancing with an Application Load Balancer.

Answer

AWS Systems Manager Parameter Store with a standard parameter.

Question 5

A company runs an SAP S/4HANA system on AWS with a primary application server (PAS) and an additional application server (AAS). The company wants to ensure that if the PAS fails, the AAS can automatically take over and continue serving users. Which AWS service should be used to achieve this automatic failover?

Accepted Answer

SUSE Linux Enterprise High Availability Extension with SAP resource agents. For automatic failover of SAP application servers, a SAP-certified high-availability cluster is required. SUSE Linux Enterprise High Availability Extension with SAP resource agents is designed for this purpose, providing monitoring and failover of SAP instances. Other options lack the SAP-specific intelligence and integration needed to manage the complex dependencies of SAP application servers, such as the message server and enqueue server.

Answer

AWS Elastic Beanstalk

Answer

Amazon EC2 Auto Scaling with a launch template

Answer

AWS Systems Manager Automation

Question 6

A company runs SAP S/4HANA on AWS with the primary HANA database on an r6i.8xlarge EC2 instance in eu-west-1a and a secondary HANA database on an r6i.8xlarge instance in eu-west-1b. The company uses an overlay IP address and a pacemaker cluster with the `fence_aws` STONITH agent. During a recent failover test, the pacemaker cluster failed to fence the primary node, causing a split-brain condition. Which action should the solutions architect take to ensure that the `fence_aws` agent can successfully fence the primary node?

Accepted Answer

Attach an IAM instance profile to the EC2 instances that grants permissions for `ec2:DescribeInstances`, `ec2:StopInstances`, and `ec2:StartInstances`.. The `fence_aws` STONITH agent requires IAM permissions to stop or start EC2 instances during failover. Without an instance profile granting `ec2:DescribeInstances`, `ec2:StopInstances`, and `ec2:StartInstances`, the agent cannot fence the failed node, leading to split-brain. Attaching the correct IAM role ensures the agent can perform its actions.

Answer

Configure the `fence_aws` agent to use the AWS CLI with credentials stored in the root user's `~/.aws/credentials` file on each node.

Answer

Enable AWS Shield Advanced on the EC2 instances to allow the `fence_aws` agent to isolate the failed node.

Answer

Modify the security group of the EC2 instances to allow inbound traffic on port 2224 from the cluster nodes, enabling the `fence_aws` agent to communicate.

Question 7

A company is running SAP NetWeaver on AWS and wants to use Amazon FSx for NetApp ONTAP for the shared file system that stores SAP transport files and global directories. The system must be highly available across two Availability Zones. Which TWO configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Mount the file system on each SAP application server using the NFS protocol.. To meet HA and shared storage requirements for SAP NetWeaver on AWS, the FSx for NetApp ONTAP file system must be deployed in a Multi-AZ configuration for automatic failover, and the application servers must mount it using NFS, which is the supported protocol for Linux-based SAP systems. SMB is for Windows, and the other options do not apply.

Answer

Create an AWS Storage Gateway file gateway to front the FSx for NetApp ONTAP file system.

Answer

Enable Amazon S3 Intelligent-Tiering for the file system's storage.

Answer

Configure the file system to use the SMB protocol for all application servers.

Question 8

A company runs SAP HANA on an Amazon EC2 instance in a single Availability Zone (AZ) and wants to add cross-AZ high availability. They plan to use an overlay IP address managed by AWS. Which TWO configurations are required to enable automatic failover of the overlay IP to the secondary instance? (Choose two.)

Accepted Answer

Assign a secondary private IP address to the primary instance's elastic network interface (ENI).. The overlay IP for SAP HANA HA is a secondary private IP address on the primary instance's ENI. During failover, automation reassigns that secondary private IP to the secondary instance's ENI using EC2 API calls. This makes the IP follow the active HANA node. Enabling source/destination check, adding route table entries, or using a Network Load Balancer do not accomplish the required IP reassignment.

Answer

Configure a Network Load Balancer with the secondary instance as the target for the overlay IP.

Answer

Create a route in the route table directing the overlay IP to the secondary instance's ENI.

Answer

Enable source/destination check on the secondary EC2 instance.

Question 9

A company is deploying SAP NetWeaver on AWS and needs to ensure that the SAP application servers can communicate with the SAP HANA database using SAP's hostname resolution. The company uses a custom DNS domain and wants to avoid manual edits to the `/etc/hosts` file on each instance. Which solution should the solutions architect implement to meet these requirements?

Accepted Answer

Create an Amazon Route 53 private hosted zone and configure the SAP instances to use the VPC DNS resolver.. A Route 53 private hosted zone associated with the VPC enables SAP instances to resolve custom hostnames without manual `/etc/hosts` edits. The VPC DNS resolver automatically handles queries for the private zone, providing centralized and scalable name resolution for SAP application servers and the HANA database.

Answer

Configure an Amazon Route 53 public hosted zone with the custom domain and create A records for each SAP instance.

Answer

Deploy an Amazon EC2 instance running BIND as a DNS server and configure all SAP instances to use it for name resolution.

Answer

Use AWS Directory Service for Microsoft Active Directory and join all SAP instances to the domain.

Question 10

A company runs an SAP NetWeaver AS ABAP system on AWS with the central services instances (ASCS and ERS) deployed in two Availability Zones for high availability. The SAP application servers and the SAP HANA database are in the same VPC. The company wants to ensure that if the primary ASCS instance fails, the ERS instance takes over automatically without manual intervention. Which configuration should they implement?

Accepted Answer

Install and configure an SAP-certified high-availability cluster solution (such as SUSE Linux Enterprise High Availability Extension or Red Hat Enterprise Linux High Availability Add-On) on both instances, with a virtual IP and SAP resource agents managing the ASCS and ERS roles.. Automatic failover of SAP central services requires an SAP-certified cluster solution that manages the ASCS and ERS instances as a resource group. The cluster monitors the ASCS instance and, upon failure, promotes the ERS instance to take over the ASCS role, moving the virtual IP address. This is the only option that provides seamless, automatic failover without manual intervention. Other options either do not provide SAP-aware failover or are intended for different use cases.

Answer

Configure an AWS Network Load Balancer with a target group containing both ASCS and ERS instances, and use a TCP listener on the SAP enqueue port.

Answer

Deploy the ASCS and ERS instances in an Auto Scaling group with a minimum capacity of one and a maximum capacity of two, and use a launch template that installs the SAP central services.

Answer

Use AWS Elastic Disaster Recovery to replicate the ASCS instance to another Availability Zone and configure a recovery plan to launch a replacement instance.

Question 11

A company is migrating an SAP ERP Central Component (ECC) system to AWS. The SAP application servers will run on Amazon EC2 instances, and the database will be SAP HANA on an EC2 instance. The company wants to minimize downtime during the migration. Which AWS service should be used to replicate the on-premises SAP system to AWS with minimal disruption?

Accepted Answer

SAP HANA system replication with a secondary instance on AWS. For minimal downtime migration of SAP HANA to AWS, SAP HANA system replication is the recommended method. It continuously replicates data from the on-premises primary to a secondary HANA instance on AWS, allowing a rapid cutover with minimal data loss. Other AWS services either do not support SAP HANA or do not provide the necessary application consistency.

Answer

AWS Database Migration Service (AWS DMS)

Answer

AWS Application Migration Service (AWS MGN)

Answer

AWS Server Migration Service (AWS SMS)

Question 12

A company is deploying SAP S/4HANA on AWS and needs to ensure that the SAP HANA database can be backed up to Amazon S3 without storing AWS credentials on the EC2 instance. The backup must be encrypted at rest. Which combination of steps should the company take?

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to the S3 bucket and enable S3 default encryption.. The most secure and operationally sound method is to attach an IAM role to the EC2 instance, which provides temporary credentials to the SAP HANA backup process. The SAP HANA backint agent can use these credentials to write directly to S3. Enabling default encryption on the S3 bucket ensures that all backup objects are encrypted at rest. This avoids storing long-term AWS credentials on the instance.

Answer

Configure SAP HANA to write backups to an Amazon EBS volume and use AWS Backup to copy to S3 with encryption.

Answer

Use AWS Storage Gateway to back up SAP HANA to S3 and enable S3 default encryption.

Answer

Store AWS access keys in an SAP HANA secure store and enable default encryption on the S3 bucket.

Question 13

A company is running SAP S/4HANA on an Amazon EC2 instance with an attached Amazon EBS volume. The database administrator reports that during peak transaction processing, write latency spikes to unacceptable levels, even though the volume's provisioned IOPS and throughput are well above the observed demand. CloudWatch metrics show sustained high queue length on the EBS volume. Which action should a solutions architect take to resolve the latency issue?

Accepted Answer

Move the database to an EC2 instance type with higher EBS-optimized bandwidth.. When EBS performance metrics show queue length saturation despite provisioned capacity exceeding demand, the limiting factor is typically the EC2 instance's EBS-optimized bandwidth. The instance cannot issue I/O fast enough to keep the volume busy. Upgrading the instance type to one with higher EBS bandwidth resolves the queue buildup and restores acceptable latency.

Answer

Increase the size of the EBS volume to gain additional baseline IOPS.

Answer

Change the EBS volume type to io2 Block Express and increase the provisioned IOPS.

Answer

Attach the EBS volume using the NVMe driver instead of the default block device driver.

Question 14

An SAP S/4HANA system runs on AWS with the application servers on Amazon EC2 and the database on an Amazon RDS for SAP HANA instance in a private subnet. A solutions architect must ensure that the application servers can reach the database without traversing the public internet, while allowing the database to initiate outbound connections only to an Amazon S3 gateway endpoint for backups. What should the architect do?

Accepted Answer

Deploy the application servers and the RDS instance in the same VPC but different subnets, use security group references to allow database access from the application security group, and attach an S3 gateway endpoint with a route table entry for the database subnet.. Placing both tiers in one VPC but separate subnets enables security-group-based segmentation, and referencing the application security group ensures only those instances can reach the database. An S3 gateway endpoint attached to the database subnet's route table provides private, endpoint-only access to Amazon S3, eliminating the need for internet or NAT egress. Together these choices satisfy both the inbound restriction and the outbound limitation without introducing unnecessary VPC peering or public exposure.

Answer

Deploy the application servers and the RDS instance in the same subnet, and use a network ACL to allow outbound traffic only to the S3 public IP address ranges.

Answer

Create a VPC peering connection between the application VPC and the database VPC, and attach an internet gateway to the database VPC for S3 access.

Answer

Place the application servers and the RDS instance in the same VPC and subnet, and rely on the default security group to control traffic.

Question 15

A company is running an SAP NetWeaver application server on an Amazon EC2 instance. The application server needs to store SAP transport files and interface files on a shared file system that is accessible from multiple EC2 instances. The company wants a fully managed, scalable, and POSIX-compliant file system that supports NFSv4.1. Which AWS service should they use?

Accepted Answer

Amazon Elastic File System (Amazon EFS). Amazon EFS is a fully managed, scalable, POSIX-compliant file system that supports NFSv4.1 and can be mounted on multiple EC2 instances. It is well-suited for shared SAP transport and interface files, providing high availability and automatic scaling. Other options either use the wrong protocol (SMB), are not POSIX-compliant (S3), or are optimized for different workloads (Lustre).

Answer

Amazon S3 with AWS Transfer Family

Answer

Amazon FSx for Lustre

Answer

Amazon FSx for Windows File Server