PAS-C01 Technology Practice Test 8 — 15 Questions

Question 1

A company is running a business-critical SAP HANA database on an m5.24xlarge EC2 instance. The database stores 3 TB of data on EBS gp3 volumes. The system experiences high latency during peak hours. Which configuration change would most effectively reduce latency without increasing costs significantly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Migrate the EBS volumes to io2 Block Express volumes with the same capacity.. Migrating to io2 Block Express volumes provides consistent, sub-millisecond latency and higher IOPS performance than gp3, which is essential for reducing high latency in a business-critical SAP HANA database during peak hours. This change addresses the latency issue without significantly increasing costs, as io2 Block Express offers a cost-effective balance of performance and durability for mission-critical workloads.

Answer

Increase the Provisioned IOPS of the gp3 volumes to the maximum supported.

Answer

Move the database to a larger instance type like x1e.32xlarge with more memory.

Answer

Increase the gp3 volume size to 4 TB to gain more baseline IOPS.

Question 2

An SAP system running on AWS is experiencing intermittent connectivity issues between the SAP application servers and the database server. Both are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. The issue occurs only during peak hours. Which of the following is the most likely cause?

Accepted Answer

Network ACLs do not have rules to allow ephemeral ports for return traffic.. The intermittent connectivity issue during peak hours points to a resource exhaustion problem. Network ACLs are stateless, meaning they must explicitly allow both inbound and outbound traffic, including ephemeral ports (typically 1024-65535) used for return traffic. If the NACL outbound rules do not allow these ephemeral ports, return traffic from the database server to the application server will be dropped, especially under high load when many connections are established simultaneously.

Answer

Security group outbound rules are blocking return traffic.

Answer

The VPC peering connection is throttling traffic.

Answer

Security group inbound rules are misconfigured.

Question 3

An SAP Basis team is planning to migrate an SAP ERP system from on-premises to AWS. The system currently uses Oracle Database and runs on a physical server with 256 GB RAM. The team wants to minimize downtime and ensure the migration is supported by SAP. Which AWS service or feature should they use to perform the migration?

Accepted Answer

Use SAP's Software Provisioning Manager (SWPM) to perform a homogeneous system copy to AWS.. SAP explicitly supports homogeneous system copies using Software Provisioning Manager (SWPM) for migrating SAP systems to AWS. This method allows the team to perform a database-level export/import while keeping the same operating system and database platform (Oracle), minimizing downtime by using SAP's validated tools and processes. AWS provides no native service that is SAP-certified for this specific migration scenario, making SWPM the only supported approach.

Answer

Use AWS VM Import/Export to migrate the physical server as an AMI.

Answer

Use AWS CloudEndure Migration to replicate the entire server to AWS.

Answer

Use AWS Database Migration Service (DMS) to replicate the Oracle database to Amazon RDS for Oracle.

Question 4

An SAP administrator is trying to set up an AWS CLI script that queries EC2 instance metadata. The script runs on an EC2 instance with an IAM role attached. The IAM role has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the error?

Accepted Answer

The instance does not have an IAM instance profile associated, or the profile name does not match the role name.. The most likely cause is that the EC2 instance does not have an IAM instance profile associated, or the profile name does not match the role name. Without a properly attached instance profile, the AWS CLI cannot obtain temporary credentials from the instance metadata service (IMDS), so any API call—including ec2:DescribeInstances—will fail with an access denied or credential error, regardless of the IAM policy being correctly configured.

Answer

The IAM policy does not specify a resource ARN.

Answer

The IAM role does not have the ec2:DescribeInstances action allowed.

Answer

The AWS CLI is not configured with the correct region.

Question 5

A company is running SAP NetWeaver on AWS and wants to implement high availability for the ASCS instance. Which AWS service can be used to monitor and automatically restart the ASCS instance if it fails?

Accepted Answer

Amazon CloudWatch with EC2 Auto Recovery. Amazon CloudWatch with EC2 Auto Recovery is the correct choice because it monitors the health of an EC2 instance at the hypervisor level and can automatically recover a failed instance by restarting it on a new host. For SAP NetWeaver ASCS instances, which require persistent state and are typically tied to a single instance, Auto Recovery ensures the instance is restored with the same private IP, Elastic IP, and instance metadata, maintaining the SAP cluster quorum without manual intervention.

Answer

EC2 Auto Scaling group

Answer

AWS Lambda with a scheduled function

Answer

Elastic Load Balancing (ELB)

Question 6

An SAP system running on AWS is experiencing high CPU utilization on the database server. The database is SAP HANA running on an r5.8xlarge instance. Which metric in Amazon CloudWatch would best indicate whether the CPU is being consumed by the HANA process or by other OS processes?

Accepted Answer

Custom metrics collected by the CloudWatch agent for the hdbindexserver process. The CloudWatch agent can be configured to collect custom metrics for specific processes, such as hdbindexserver (the main SAP HANA index server process). By monitoring the CPU utilization of this specific process, you can directly determine whether the HANA database process itself is consuming the CPU, as opposed to other OS-level processes like kernel threads, system daemons, or other applications. This granularity is not available from the EC2 instance-level CPUUtilization metric.

Answer

CPUUtilization metric from the EC2 instance

Answer

HANA CPU metric from SAP HANA CloudWatch integration

Answer

CPUCreditUsage metric

Question 7

A company is running SAP S/4HANA on AWS and needs to ensure that the system can survive a single Availability Zone failure. The SAP HANA database is 1.5 TB in size. What is the most cost-effective high availability solution that meets SAP's support requirements?

Accepted Answer

Implement SAP HANA System Replication (HSR) with two EC2 instances in different Availability Zones.. SAP HANA System Replication (HSR) with two EC2 instances in different Availability Zones provides synchronous replication to meet SAP's support requirements for high availability (HA) while surviving a single AZ failure. This is the most cost-effective solution as it uses standard EC2 instances and does not require additional licensing or managed services, and it supports the 1.5 TB database size without the limitations of RDS for SAP HANA.

Answer

Deploy SAP HANA on Amazon RDS for SAP HANA in Multi-AZ.

Answer

Use Amazon RDS Multi-AZ for the SAP HANA database.

Answer

Use a single EC2 instance with EBS snapshots taken every 5 minutes.

Question 8

An administrator is setting up an SAP system on AWS and needs to assign a static private IP address to the SAP application server. Which AWS resource should be used to ensure the private IP address remains the same even after an instance stop/start?

Accepted Answer

Elastic Network Interface (ENI) with a primary private IP. An Elastic Network Interface (ENI) with a primary private IP address retains its private IP address across instance stop/start cycles because the ENI is a separate resource that persists independently of the instance lifecycle. When you attach an ENI to an SAP application server, the primary private IP (assigned from the VPC subnet) remains fixed even after the instance is stopped and started, ensuring consistent network addressing for SAP communication.

Answer

VPC endpoint

Answer

Secondary private IP address on the primary network interface

Answer

Elastic IP address

Question 9

A company is running SAP ERP on AWS and wants to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO AWS features should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon S3 Cross-Region Replication for database backups. Option B is correct because Amazon S3 Cross-Region Replication (CRR) asynchronously replicates database backup objects to a bucket in us-west-2, and with replication typically completing within minutes it can satisfy the 15-minute RPO for backup-based recovery of the SAP database. Option E is correct because copying EC2 AMIs to the DR region gives you pre-staged, region-specific machine images so instances can be launched quickly in us-west-2, supporting the 2-hour RTO without waiting on cross-region image transfer at failover time. Together, CRR keeps the data loss window within 15 minutes and AMI Copy keeps the rebuild time within 2 hours. Option A is not right because RDS Multi-Region replication is not a standard RDS feature name for cross-region replication of an SAP ERP database, and SAP ERP on AWS typically runs on EC2 with a database such as SAP HANA or Oracle rather than relying on RDS cross-region replication. Option C is not right because CloudEndure Disaster Recovery, while a valid DR service, is not the combination asked for here and does not by itself address the S3 backup replication requirement. Option D is not right because EBS Multi-AZ snapshots are stored regionally and replicated only within the same region, so they do not provide the cross-region protection needed between us-east-1 and us-west-2.

Answer

Amazon RDS Multi-Region replication

Answer

AWS CloudEndure Disaster Recovery

Answer

Amazon EBS Multi-AZ snapshots

Question 10

A company is planning to migrate its SAP HANA database to AWS. The database is 5 TB in size and requires high IOPS for online transaction processing (OLTP) workloads. Which THREE AWS storage options are suitable for SAP HANA data volumes? (Choose THREE.)

Accepted Answer

EC2 instance store (NVMe SSD). Option A (EC2 instance store NVMe SSD) is correct because it provides the lowest-latency, highest-IOPS storage directly attached to the host, which SAP HANA can use for data volumes where performance is critical. Option B (Amazon EBS io2 Block Express) is correct because it is a high-performance SAN-class volume supporting up to 256,000 IOPS and sub-millisecond latency, making it suitable for demanding OLTP SAP HANA workloads. Option D (Amazon EBS gp3) is correct because gp3 volumes can be provisioned with up to 16,000 IOPS and 1,000 MB/s independently of capacity, which can meet SAP HANA requirements for smaller or less extreme data volumes. Option C (Amazon S3) is not suitable because it is object storage accessed via HTTP APIs, not a block device for a database data volume. Option E (Amazon EFS) is not suitable because it is a shared NFS file system, not a block-level storage option for SAP HANA data volumes.

Answer

Amazon S3

Answer

Amazon EFS

Question 11

An organization runs SAP on AWS and wants to encrypt all data at rest for the SAP HANA database. The encryption keys must be managed by the customer and rotated annually. Which THREE AWS services can be used together to meet these requirements? (Choose THREE.)

Accepted Answer

Amazon EBS encryption. Amazon EBS encryption (B) is correct because SAP HANA on AWS stores its database and log volumes on EBS, and EBS encryption transparently encrypts those volumes at rest using a KMS key. AWS KMS (C) is correct because it lets the customer create and manage customer managed keys (CMKs), define an annual automatic key rotation schedule, and supply the key material used by EBS encryption. AWS CloudHSM (D) is correct because it provides a customer-controlled, single-tenant hardware security module that can be used as a custom key store backing KMS, giving the organization exclusive control over key material and rotation. Amazon S3 server-side encryption (A) is not appropriate because SAP HANA data at rest resides on EBS volumes, not S3 objects. AWS Certificate Manager (E) is not appropriate because ACM issues and manages TLS/SSL certificates for data in transit, not encryption keys for data at rest.

Answer

Amazon S3 server-side encryption

Answer

AWS Certificate Manager (ACM)

Question 12

A company has deployed its SAP S/4HANA system on AWS in a single Availability Zone. The system consists of a primary application server (PAS), additional application servers (AAS), and a HANA database server, all running on EC2 instances. The company is experiencing occasional performance degradation during peak hours. The CloudWatch metrics show that the database server's CPU utilization spikes to 90% during these periods, while the application servers' CPU remains below 50%. The storage is configured with two EBS io1 volumes (each 1 TB, 10,000 IOPS) for HANA data and one io1 volume (500 GB, 5,000 IOPS) for log. The network throughput is not saturated. The company wants to resolve the performance issue without increasing costs significantly. Which course of action should the company take?

Accepted Answer

Implement SAP HANA System Replication with a secondary node in the same AZ to offload read operations.. Implementing SAP HANA System Replication with a secondary node in the same Availability Zone allows read-only queries to be offloaded to the secondary node, reducing CPU load on the primary database server. This directly addresses the CPU spike during peak hours without significantly increasing costs. Option B is wrong because the performance issue is CPU-bound, not I/O-bound; increasing IOPS would add cost without resolving the CPU bottleneck. Option C is wrong because switching from io1 to gp3 may reduce storage costs but does not improve CPU performance. Option D is wrong because upgrading to a larger instance is expensive and may not be necessary if HSR can distribute the load effectively.

Answer

Increase the Provisioned IOPS on the data volumes to 20,000 each.

Answer

Switch the EBS volumes from io1 to gp3 to reduce latency.

Answer

Upgrade the database instance to a larger type, such as r5.12xlarge.

Question 13

A company is running SAP Business Suite on AWS. The system includes a central services (ASCS) instance, a primary application server (PAS), and a database server running SAP HANA. The company recently experienced an outage when the EC2 instance hosting the ASCS instance failed due to a hardware issue. The system was down for 4 hours while the IT team manually recovered the ASCS instance from an AMI. The company wants to implement a highly available ASCS instance with automatic failover and a Recovery Time Objective (RTO) of less than 15 minutes. The system is currently running in a single Availability Zone. What should the company do to meet these requirements?

Accepted Answer

Deploy a second ASCS instance in a different Availability Zone, set up SAP enqueue replication, and use a virtual IP address with Route 53 health checks for failover.. To achieve high availability for ASCS with automatic failover and RTO <15 minutes, the correct approach is to deploy a second ASCS instance in a different Availability Zone, configure SAP enqueue replication to keep the enqueue server state synchronized, and use a virtual IP address with Route 53 health checks to redirect clients to the standby instance upon failure. This is the standard SAP-certified high-availability solution for ASCS on AWS, often implemented with SIOS DataKeeper or similar clustering software.

Answer

Place the ASCS instance behind an Application Load Balancer and configure health checks.

Answer

Configure an Auto Scaling group for the ASCS instance with a minimum of 1 and maximum of 2, and use a lifecycle hook to attach an Elastic IP.

Answer

Enable CloudWatch EC2 Auto Recovery on the ASCS instance and configure it to start a new instance in a different AZ.

Question 14

A small business runs its SAP Business One on a single EC2 instance in AWS. The database is SAP HANA, and the application is also on the same instance. The company wants to ensure that in the event of an instance failure, they can quickly restore the system from backups. They take daily EBS snapshots of the root volume and the data volume. One day, the instance fails and becomes unreachable. The IT administrator attempts to launch a new instance from the most recent AMI, but the new instance does not have the same private IP address, causing connectivity issues for the company's on-premises systems that use VPN to connect to the SAP server. The company uses a Site-to-Site VPN connection to the VPC. What should the administrator do to ensure that the private IP address is preserved after recovery?

Accepted Answer

Create an Elastic Network Interface (ENI) with the desired private IP, attach it to the instance, and after failure, detach it from the old instance and attach to the new instance.. An Elastic Network Interface (ENI) can retain a fixed private IP address. By creating an ENI with the desired private IP and attaching it to the original instance, after a failure you can detach the ENI from the failed instance (or simply launch a new instance and attach the ENI) to preserve the same private IP. This ensures that the on-premises VPN connection, which relies on that IP, continues to work. Option A is incorrect because modifying the subnet's CIDR does not guarantee that the specific IP address remains available; it might still be used by another resource or cause routing issues. Option B is incorrect because creating a new AMI from the failed instance does not preserve the private IP; the new instance launched from that AMI will receive a dynamically assigned IP from the subnet unless you specify a static IP, but that is not part of the AMI process. Option C is incorrect because Elastic IP addresses are public IPs; the VPN connection between on-premises and the VPC uses private IP addresses, so using an Elastic IP would not resolve the private IP connectivity issue.

Answer

Modify the VPC subnet to use a smaller CIDR range to ensure the IP is available.

Answer

Create a new AMI from the failed instance and use that AMI to launch a new instance, specifying the same private IP in the subnet.

Answer

Assign an Elastic IP to the instance and update the VPN configuration to use the Elastic IP.

Question 15

A company is running an SAP HANA database on an r5.8xlarge EC2 instance. The database experiences high memory pressure, and they want to add more memory without downtime. What should they do?

Accepted Answer

Modify the instance type to r5.12xlarge while the instance is running.. You can modify the instance type of a running EC2 instance without stopping it, provided the new type is compatible with the current configuration. In this case, changing from r5.8xlarge to r5.12xlarge increases memory from 256 GiB to 384 GiB, and both are in the same instance family, supporting live resizing. This allows the SAP HANA database to add memory without downtime, addressing high memory pressure.

Answer

Use AWS License Manager to add more memory to the instance.

Answer

Use Amazon RDS for SAP HANA to automatically scale memory.

Answer

Stop the instance and change the instance type to u-6tb1.112xlarge.