PAS-C01 Technology Practice Test 8 — 15 Questions

Question 1

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver and set an alarm when it exceeds 90% for 5 minutes. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides detailed monitoring of EC2 instances, including CPU utilization metrics, and allows you to set CloudWatch Alarms that trigger when a metric exceeds a specified threshold (e.g., 90%) for a given number of consecutive evaluation periods (e.g., 5 minutes). This is the native AWS service designed for performance monitoring and alerting.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 2

A company is running SAP Business Suite on AWS and wants to improve the disaster recovery posture by replicating data to another AWS Region. The solution must have a recovery time objective (RTO) of less than 15 minutes and a recovery point objective (RPO) of less than 5 minutes. Which approach should they take?

Accepted Answer

Configure SAP HANA system replication with synchronous mode.. SAP HANA system replication in synchronous mode ensures that every committed transaction is replicated to the secondary region before acknowledging the commit, achieving an RPO of effectively zero (less than 5 minutes) and enabling rapid failover within seconds, meeting the RTO of under 15 minutes. This is the only native SAP solution that provides the required low-latency, consistent replication for SAP Business Suite on AWS.

Answer

Use AWS Database Migration Service for continuous replication.

Answer

Use Amazon S3 cross-Region replication for transaction logs.

Answer

Use AWS Backup to create cross-Region EBS snapshots every 5 minutes.

Question 3

An SAP system administrator needs to grant an external auditor read-only access to view EC2 instance configurations and CloudWatch logs. Which IAM policy should they use?

Accepted Answer

AWS managed policy: ReadOnlyAccess. The ReadOnlyAccess AWS managed policy grants read-only access to all AWS services and resources, including EC2 instance configurations and CloudWatch logs, without allowing any write or modify actions. This policy is the most appropriate for an external auditor who needs to view but not change any resources, as it provides the necessary read permissions across services while preventing any modifications.

Answer

AWS managed policy: SecurityAudit

Answer

AWS managed policy: AdministratorAccess

Answer

AWS managed policy: PowerUserAccess

Question 4

An SAP administrator attaches the above IAM policy to a user. What actions can the user perform?

Accepted Answer

Describe, start, and stop EC2 instances, but not terminate them.. The IAM policy explicitly allows ec2:Describe*, ec2:StartInstances, and ec2:StopInstances actions, but does not include ec2:TerminateInstances. Therefore, the user can describe, start, and stop EC2 instances, but cannot terminate them. The Deny effect on ec2:TerminateInstances is not present, but the absence of an Allow means the action is implicitly denied.

Answer

Perform all EC2 actions including terminate.

Answer

Only describe EC2 instances.

Answer

Only start and stop instances.

Question 5

An SAP administrator runs the command `aws ec2 describe-volumes --volume-id vol-0abc1234` and sees the following output:
```
{
    "Volumes": [
        {
            "VolumeId": "vol-0abc1234",
            "Size": 100,
            "VolumeType": "io2",
            "Iops": 10000,
            "State": "available",
            "MultiAttachEnabled": false,
            "Attachments": []
        }
    ]
}
```
The EC2 instance i-0a1b2c3d4e5f6g7h8 is stopped. What will happen if the administrator attempts to start the instance?

Accepted Answer

The instance will start but the volume will not attach because multi-attach is disabled.. The volume is in 'available' state, meaning it is not attached to any instance. Starting a stopped instance does not automatically attach a detached volume; the volume must be manually attached. Therefore, the instance will start successfully but the volume will not be attached, making option C correct.

Answer

The instance will fail to start because the volume type is not supported.

Answer

The instance will start successfully and the volume will be attached.

Answer

The instance will start but the volume will be read-only.

Question 6

The following IAM trust policy is attached to a role named CrossAccountBackupRole in account 123456789012:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/SAPAdminRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

What does this policy enable?

Accepted Answer

The SAPAdminRole can assume the CrossAccountBackupRole.. The trust policy explicitly allows the IAM role SAPAdminRole (in account 111111111111) to perform sts:AssumeRole on the CrossAccountBackupRole. This enables SAPAdminRole to assume CrossAccountBackupRole and inherit its permissions. The policy does not grant direct S3 access; that would require a separate permissions policy attached to CrossAccountBackupRole.

Answer

The SAPAdminRole directly receives permissions to access S3.

Answer

The CrossAccountBackupRole can be assumed by any IAM user.

Answer

The SAPAdminRole can list S3 buckets in account 123456789012.

Question 7

Which TWO AWS services can be used to create a private, low-latency network connection between an on-premises data center and an SAP environment on AWS? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet to deliver consistent low latency and high bandwidth, which is critical for SAP workloads. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, offering a private connection that can supplement Direct Connect as a backup or for lower-cost scenarios, though it introduces internet variability. Both services establish private connectivity between on-premises and AWS, meeting the requirements for low-latency SAP environments.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 8

Which TWO AWS services can be used to automate the backup of SAP HANA databases? (Choose two.)

Accepted Answer

AWS Backup. AWS Backup is a fully managed backup service that supports SAP HANA databases on Amazon EC2 through the AWS Backup Gateway and integration with the SAP HANA Backint agent. It provides centralized backup management, automated scheduling, and lifecycle policies, making it a correct choice for automating SAP HANA backups.

Answer

Amazon RDS

Answer

AWS Lambda

Answer

AWS Storage Gateway

Question 9

A company is running a critical SAP application on SAP HANA in an AWS Single-AZ deployment. The application has experienced downtime twice in the last month due to underlying hardware failures. What is the MOST cost-effective solution to minimize future downtime without compromising performance?

Accepted Answer

Deploy the SAP HANA database in a Multi-AZ configuration using SAP HANA System Replication (HSR) across Availability Zones.. Deploying SAP HANA in a Multi-AZ configuration using SAP HANA System Replication (HSR) across Availability Zones provides synchronous replication and automatic failover in case of hardware failure. This minimizes downtime without requiring a larger instance or manual intervention, and maintains performance by using the same instance type and storage configuration as the primary.

Answer

Move the SAP HANA instance to a larger instance type to improve hardware reliability.

Answer

Use Dedicated Hosts to ensure physical isolation from other AWS customers.

Answer

Implement automated snapshots of the SAP HANA data volume and restore in case of failure.

Question 10

An SAP Basis administrator needs to migrate an on-premises SAP ERP system running on Oracle to AWS. The system has a 2 TB database and requires minimal downtime (less than 1 hour). The current on-premises network bandwidth to AWS is 1 Gbps. Which migration strategy is MOST appropriate?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication from Oracle to Amazon RDS for Oracle, then perform a final cutover.. AWS DMS with ongoing replication from Oracle to Amazon RDS for Oracle is the most appropriate strategy because it supports minimal downtime (less than 1 hour) by continuously replicating changes from the source Oracle database to the target RDS instance, allowing a short final cutover window. The 1 Gbps bandwidth is sufficient for the initial full load of a 2 TB database when using DMS's optimized data transfer, and the target RDS for Oracle provides a fully managed Oracle-compatible environment suitable for SAP ERP workloads.

Answer

Export the database using SAP HANA System Replication (HSR) to an Amazon EC2 instance with HANA.

Answer

Perform a manual export/import using Oracle Data Pump and transfer the dump file via AWS Direct Connect.

Answer

Use AWS Application Migration Service (MGN) to replicate the entire server to AWS, then cut over.

Question 11

A company runs its SAP S/4HANA system on AWS using a multi-node HANA scale-out configuration. After a recent OS update, the application layer cannot connect to the HANA database. The HANA database processes are running, but the SAP application servers report 'communication failure' errors. Initial checks show that the security group rules allow traffic on the required ports. What is the MOST likely cause of the issue?

Accepted Answer

The OS update has reset the iptables firewall rules, blocking internal HANA ports.. OS updates on Linux systems often reset or flush iptables firewall rules to their default state, which typically blocks all inbound traffic on non-essential ports. In a multi-node HANA scale-out configuration, internal HANA communication relies on specific TCP ports (e.g., 3xx01–3xx10 for internal network traffic). When iptables rules are reset, these ports become blocked, preventing the SAP application layer from connecting to the HANA database even though the database processes are running and security group rules at the AWS level are correctly configured.

Answer

The DNS resolution is misconfigured after the OS update, causing hostname lookup failures.

Answer

The NTP synchronization is off, causing time drift and authentication errors.

Answer

The SAP system is not correctly licensed for the new OS version.

Question 12

An organization wants to ensure that its SAP HANA database backups are stored in a separate AWS Region for disaster recovery. The backups are currently stored in Amazon S3 in the primary Region. Which AWS service should be used to replicate the backups to another Region automatically?

Accepted Answer

Amazon S3 Cross-Region Replication (CRR).. Amazon S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects from an S3 bucket in one AWS Region to a bucket in another Region, meeting the requirement for storing SAP HANA database backups in a separate Region for disaster recovery. CRR operates asynchronously at the object level, ensuring that backups are continuously copied without manual intervention, and it supports the same storage classes and encryption mechanisms as the source bucket.

Answer

AWS Storage Gateway with volume gateway.

Answer

AWS Backup with a cross-region backup plan.

Answer

Amazon S3 Transfer Acceleration.

Question 13

A company is planning to run SAP BusinessObjects (BOBJ) on AWS. The application servers require consistent low-latency access to a shared file system for storing reports and configuration files. Which AWS storage solution is BEST suited for this requirement?

Accepted Answer

Amazon Elastic File System (Amazon EFS).. Amazon EFS provides a fully managed, scalable, and shared file system that can be accessed concurrently by multiple EC2 instances via the NFSv4.1 protocol. For SAP BusinessObjects application servers requiring consistent low-latency access to shared reports and configuration files, EFS delivers the necessary POSIX permissions, strong consistency, and automatic scaling without provisioning overhead, making it the ideal choice.

Answer

Amazon Elastic Block Store (Amazon EBS) with a multi-attach enabled volume.

Answer

Amazon Simple Storage Service (Amazon S3).

Answer

Amazon FSx for Windows File Server.

Question 14

An SAP administrator notices that the SAP HANA database performance has degraded significantly during peak hours. The HANA instance is running on an r5.8xlarge EC2 instance with EBS gp2 volumes. Monitoring shows high I/O wait times on the data volume. Which change is MOST likely to improve performance?

Accepted Answer

Use Amazon EBS io2 Block Express volumes with high IOPS.. The performance degradation is due to high I/O wait times on the data volume, indicating that the EBS volume's IOPS limit is being saturated. Amazon EBS io2 Block Express volumes provide up to 256,000 IOPS per volume with consistent sub-millisecond latency, which directly addresses the I/O bottleneck for SAP HANA workloads. In contrast, gp3 volumes are capped at 16,000 IOPS, which is insufficient for peak-hour demands on an r5.8xlarge instance.

Answer

Enable Multi-AZ deployment for SAP HANA.

Answer

Upgrade the EC2 instance to a larger size like r5.16xlarge.

Answer

Change the EBS volume type from gp2 to gp3 with 3000 IOPS.

Question 15

A company is migrating its SAP landscape to AWS and wants to ensure that all SAP systems can communicate with each other using private IP addresses only. The systems are deployed in multiple VPCs. Which AWS solution should be used to enable private connectivity between these VPCs?

Accepted Answer

VPC Peering.. VPC Peering is the correct solution because it enables direct, private IP connectivity between VPCs using the AWS global network, with no gateways or VPN connections required. Traffic stays within AWS and never traverses the public internet, satisfying the requirement for SAP systems to communicate using only private IP addresses across multiple VPCs.

Answer

VPC Endpoints.

Answer

AWS Site-to-Site VPN.

Answer

AWS Direct Connect.