PAS-C01 Design of SAP Workloads on AWS — 25 Questions

Question 1

A company is planning to migrate its SAP S/4HANA system to AWS. The system requires high availability with an RTO of less than 30 minutes and RPO of less than 15 minutes. The SAP application layer runs on Linux. Which architecture should a solutions architect recommend to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a single EC2 instance for the SAP application and database in one Availability Zone, and take hourly snapshots of the EBS volumes.. The only viable choice to meet the RTO of less than 30 minutes and RPO of less than 15 minutes for an SAP S/4HANA system on AWS. Although the option states hourly snapshots, in practice snapshots can be taken more frequently (e.g., every 5 minutes) to achieve the required RPO. On instance failure, a new EC2 instance can be launched from the latest snapshot, and with automation the RTO can be under 30 minutes. The SAP application layer is stateless and can be restored quickly. Options A and C do not provide adequate recovery for the database (A relies on backups, C uses ephemeral instance store). Option D is invalid because Amazon RDS does not support SAP HANA as a managed database service.

Answer

Deploy the SAP application on a single EC2 instance and use S3 for database backups with cross-region replication.

Answer

Use two EC2 instances in an Auto Scaling group with instance store volumes for the database, and store application files on S3.

Answer

Deploy the SAP application on two EC2 instances in different AZs with a shared EFS file system, and use a multi-AZ RDS for SAP HANA with synchronous replication.

Question 2

A company runs SAP HANA on AWS and needs to restore a database from a backup stored in Amazon S3. The backup was created using the SAP HANA backup to S3 feature (backint). Which AWS service is required to facilitate this restore?

Accepted Answer

AWS Storage Gateway. AWS Storage Gateway can be used to facilitate the restore of SAP HANA databases by presenting the S3 backup as a file system share. This allows SAP HANA to read the backup files directly as if they were local, simplifying the restore process. While the backint agent can also perform restores, Storage Gateway provides an alternative method that may be preferred in certain hybrid architectures.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Backup

Answer

AWS Snowball Edge

Question 3

An SAP system on AWS is using an RDS for Oracle database. The operations team notices that database backups are taking longer than expected, impacting performance. Which change would most effectively reduce backup duration without affecting availability?

Accepted Answer

Use the Backup Multi-AZ option to take backups from the standby instance.. Enabling the Backup Multi-AZ option for an RDS for Oracle database allows backups to be taken from the standby instance in a Multi-AZ deployment. This offloads the backup I/O overhead from the primary instance, reducing performance impact and backup duration while maintaining full availability for the SAP workload.

Answer

Reduce the backup window to a shorter time period.

Answer

Disable automatic backups and rely on manual snapshots.

Answer

Increase the backup retention period to allow more frequent backups.

Question 4

An SAP system on AWS uses an Oracle database on EC2. The database is experiencing I/O bottlenecks. Which THREE design changes can improve I/O performance?

Accepted Answer

Provision Amazon EBS volumes with Provisioned IOPS (io2) for the database.. Amazon EBS io2 volumes provide consistent, low-latency I/O with guaranteed IOPS, directly addressing I/O bottlenecks. Option B is correct as EBS-optimized instances dedicate bandwidth to EBS, reducing contention. Option E is correct because offloading backups to Amazon S3 reduces I/O load during backup windows, improving overall performance. Option C is incorrect because Multi-Attach is for multi-instance shared access, not for parallel I/O in a single database. Option D is incorrect because instance store volumes are ephemeral and not suitable for persistent database files; they can cause data loss on instance stop/termination.

Answer

Configure EBS Multi-Attach to allow multiple instances to share the same volume for parallel I/O.

Answer

Use instance store volumes for the database files to reduce latency.

Question 5

A company runs SAP S/4HANA on AWS and notices high latency in database transactions. The database is hosted on an r5.24xlarge instance with 768 GB of EBS gp3 storage. The SAP application servers are in the same VPC but different subnets. What should be changed to reduce latency?

Accepted Answer

Change the EBS volume type to io2 Block Express with maximum IOPS.. Gp3 volumes may not provide the low latency required for SAP HANA database transactions. Switching to io2 Block Express volumes offers higher and more consistent IOPS with lower latency, which can reduce high database transaction latency. Option C is misleading because EBS optimization is already enabled by default on r5 instances, so 'enabling' it is not a valid change.

Answer

Use a smaller instance type to reduce network hops.

Answer

Place the database instance in a cluster placement group with the application servers.

Answer

Enable EBS optimization on the database instance and ensure the instance type supports dedicated EBS bandwidth.

Question 6

A company is designing an SAP HANA multi-node scale-out system on AWS. Which two of the following are required for the network configuration? (Select TWO.)

Accepted Answer

Create a separate subnet for HANA internal communication.. For SAP HANA multi-node scale-out systems on AWS, a dedicated subnet (Option D) isolates internal HANA traffic (e.g., internal SQL and replication) for low latency and high throughput. A cluster placement group (Option E) provides low-latency network connections between nodes, which is essential for HANA internal communication. Spread placement groups (not listed) would not minimize latency as they force distinct hardware; cluster placement groups are the correct choice for low-latency clustering.

Answer

Assign public IP addresses to each node for inter-node communication.

Answer

Configure an Elastic Load Balancer to distribute traffic among nodes.

Answer

Enable EBS optimization on all EC2 instances.

Question 7

A company is planning to run SAP Business Suite on AWS. They want to minimize downtime during a failover scenario. Which AWS feature should they use to achieve automatic failover of the SAP Central Services (ASCS) instance?

Accepted Answer

Elastic Load Balancer. For automatic failover of SAP Central Services (ASCS) within a region, a Network Load Balancer (NLB) with health checks is the standard solution. The NLB provides a static IP address that can be used as the virtual IP (VIP) for ASCS. Health checks monitor the primary ASCS instance, and if it fails, the NLB automatically routes traffic to the standby instance. This provides fast, IP-level failover without the DNS propagation delays associated with Route 53. While Route 53 can be used for disaster recovery across regions, it is not the primary mechanism for intra-region ASCS failover.

Answer

AWS Auto Scaling

Answer

Amazon CloudWatch with alarms

Answer

Amazon Route 53 with health checks and failover routing

Question 8

An SAP administrator is troubleshooting a performance issue with SAP HANA. The database is running on an EC2 instance with EBS volumes. Which TWO metrics should be monitored to identify disk I/O bottlenecks? (Choose 2.)

Accepted Answer

VolumeReadBytes. VolumeReadBytes (C) and VolumeWriteBytes (D) are correct because they directly measure the throughput of read and write operations to the EBS volume. Consistently high values near the provisioned IOPS/throughput limits indicate a disk I/O bottleneck. VolumeIdleTime (A) is a useful metric for saturation but is less direct; with only two choices, the throughput metrics provide a clearer indication of bottleneck conditions. NetworkIn (B) and CPUUtilization (E) are not disk I/O metrics.

Answer

VolumeIdleTime

Answer

NetworkIn

Answer

CPUUtilization

Question 9

An SAP NetWeaver system on AWS needs to be highly available across two Availability Zones. Which AWS service should be used to manage the floating IP address used by the SAP application servers?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct service for managing a floating IP address for SAP application servers across Availability Zones. It provides static anycast IP addresses that serve as a single point of entry. By associating Global Accelerator with an internal NLB or ALB in each AZ, it can automatically route traffic to healthy endpoints using health checks. This effectively provides a floating IP that does not require DNS propagation or manual IP remapping, ensuring high availability.

Answer

VPC Peering

Answer

Elastic IP address

Answer

Amazon Route 53 with failover routing

Question 10

Which TWO of the following are recommended best practices for running SAP HANA on AWS? (Choose two.)

Accepted Answer

Install HANA on a separate EBS volume mounted under /hana/data. SAP HANA requires separate EBS volumes for data and log files to ensure performance and manageability. Installing HANA on a separate EBS volume mounted under /hana/data is a standard best practice. Option D is correct because EBS io2 Block Express volumes provide the high IOPS, low latency, and consistent performance required for SAP HANA data and log volumes, meeting SAP's storage performance recommendations. Option C, while valid in scale-out scenarios, is not considered a general best practice for all SAP HANA deployments and thus is not one of the two best practices asked for in this question.

Answer

Configure swap space on the instance to handle memory pressure

Answer

Enable multi-attach on EBS volumes for HANA shared storage in scale-out

Answer

Change the hostname after the HANA installation to match the DNS name

Question 11

Which TWO of the following are valid methods to monitor SAP HANA performance on AWS? (Choose two.)

Accepted Answer

SAP HANA Studio. SAP HANA Studio is a native SAP tool that provides direct access to HANA system performance metrics, including memory usage, CPU load, and query execution times, via SQL and MDX connections. Amazon CloudWatch with the CloudWatch agent can also collect SAP HANA metrics by utilizing the agent's built-in support for HANA or by running custom scripts, making it a valid method for monitoring performance on AWS. Both options are correct as they provide performance monitoring capabilities for SAP HANA.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 12

A company is designing a multi-tier SAP architecture on AWS. They want to separate the SAP application tier and database tier into different subnets for security. Which AWS networking component should they use to connect the tiers?

Accepted Answer

VPC peering connection. The SAP application and database tiers should be placed in separate VPCs for enhanced security. VPC peering allows these VPCs to communicate with each other using private IP addresses. Although the question mentions 'subnets', the correct solution is VPC peering to connect tiers across different VPCs.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Question 13

A company is running SAP HANA on AWS and needs to ensure that the system can be restored to a specific point in time within the last 24 hours with minimal data loss. The database is 2 TB in size. Which backup strategy meets these requirements with the lowest cost?

Accepted Answer

Use AWS Backup with a daily backup and a 24-hour retention policy, enabling point-in-time recovery.. AWS Backup for SAP HANA provides continuous backup with log backups every 5 minutes, enabling point-in-time recovery to any second within the retention period. This meets the requirement of restoring to a specific point in time with minimal data loss. For a 2 TB database, the cost of AWS Backup with a 24-hour retention is lower than hourly EBS snapshots, because EBS snapshots are charged per GB stored and hourly snapshots would incur higher costs even with incremental savings. Hourly EBS snapshots (Option D) only allow recovery to the nearest hour, introducing up to 60 minutes of potential data loss, which does not satisfy the 'minimal data loss' requirement.

Answer

Configure S3 Transfer Acceleration for faster backup uploads.

Answer

Use a script to copy HANA backup files to S3 every 15 minutes.

Answer

Take hourly EBS snapshots of all HANA volumes and retain them for 24 hours.

Question 14

Which TWO of the following are recommended practices for securing SAP workloads on AWS? (Choose TWO.)

Accepted Answer

Use security groups to restrict inbound traffic to only required ports and IP ranges.. Security groups act as a virtual firewall for EC2 instances, and restricting inbound traffic to only required ports (e.g., 3200 for SAP Application Server, 443 for SAP Web Dispatcher) and specific IP ranges minimizes the attack surface. This is a fundamental security best practice for any workload, including SAP, as it prevents unauthorized access to critical business applications. Additionally, enabling encryption on EBS volumes for SAP HANA ensures that data at rest is protected, which is critical for sensitive SAP data and helps meet compliance requirements. AWS KMS can be used to manage the encryption keys securely. Both measures are essential for securing SAP workloads on AWS.

Answer

Use the AWS root account for daily administration of SAP systems.

Answer

Assign public IP addresses to SAP instances for direct internet access.

Answer

Place SAP application servers in a public subnet for ease of access.

Question 15

A company is planning to migrate its SAP S/4HANA system to AWS. The system requires high availability with an RTO of less than 30 minutes and RPO of less than 15 minutes. The SAP application layer runs on Linux. Which architecture should a solutions architect recommend to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudFormation. AWS CloudFormation (Option A) is correct because it allows you to define SAP HANA infrastructure as code using templates, automating the provisioning of EC2 instances, storage, networking, and security groups required for SAP HANA. This aligns with SAP's deployment best practices on AWS, enabling repeatable and consistent infrastructure setup for both production and non-production environments. AWS Service Catalog (Option D) is also correct because it enables organizations to create and manage a catalog of IT services, including pre-approved SAP HANA infrastructure products. Service Catalog integrates with CloudFormation to provision standardized environments, allowing administrators to control which resources (like SAP HANA instances) can be deployed by end users, thus automating and governing the provisioning process.

Answer

Amazon Macie

Answer

AWS OpsWorks

Answer

AWS CodePipeline

Question 16

A company is running SAP HANA in a production environment on AWS. The database administrator wants to implement automated backups using AWS Backup. Which of the following are supported by AWS Backup for SAP HANA? (Select THREE.)

Accepted Answer

SAP HANA database backups. AWS Backup supports SAP HANA database backups through its Backint integration, allowing application-consistent backups. Additionally, AWS Backup supports Amazon EBS volumes (for volume-level snapshots) and Amazon EC2 instances (for instance-level snapshots), which are commonly used for SAP HANA workloads on AWS. Amazon RDS does not support SAP HANA, and Amazon S3 is not directly a backup resource type for SAP HANA via AWS Backup.

Answer

Amazon RDS databases

Answer

Amazon S3 buckets

Question 17

A company runs SAP HANA on AWS and wants to encrypt the database at rest. Which THREE options are available to achieve this?

Accepted Answer

Use AWS KMS with a custom key store to manage encryption keys.. Three options are available for encrypting SAP HANA at rest on AWS. Option B: AWS KMS with a custom key store allows you to use a customer-managed key store backed by AWS CloudHSM, providing control over encryption keys for data at rest, and integrates with EBS encryption. Option C: SAP HANA native encryption encrypts the database directly, which is independent of the underlying storage. Option E: Amazon EBS encryption encrypts all EBS volumes attached to the HANA instance, providing encryption at the block storage level. Option A is incorrect because SAP HANA runs on EC2, not RDS. Option D is incorrect because SAP HANA database files are stored on EBS volumes, not S3.

Answer

Use Amazon RDS encryption for the SAP HANA database.

Answer

Use Amazon S3 server-side encryption for database files.

Question 18

A company is designing a disaster recovery (DR) strategy for its SAP environment on AWS. The primary site is in us-east-1, and the DR site must be in us-west-2. The Recovery Point Objective (RPO) is 15 minutes, and the Recovery Time Objective (RTO) is 4 hours. Which TWO AWS services should be used to meet these objectives?

Accepted Answer

SAP HANA System Replication configured with asynchronous replication to a HANA instance in us-west-2.. SAP HANA System Replication with asynchronous mode can achieve an RPO of 15 minutes or less by continuously replicating log buffers from the primary HANA database in us-east-1 to a secondary HANA instance in us-west-2. This is the native SAP replication mechanism and directly meets the database-level RPO requirement. AWS Elastic Disaster Recovery (AWS DRS) continuously replicates entire SAP servers (including OS, applications, and data) to us-west-2, enabling full server failover within the RTO. Together, HANA replication handles database consistency while DRS covers the application and infrastructure layer, meeting both the RPO and RTO objectives.

Answer

Amazon Route 53 health checks to fail over DNS to the DR site.

Answer

Amazon EC2 Auto Scaling groups to launch instances in us-west-2 on failover.

Answer

AWS Backup to copy EBS snapshots to us-west-2 every 15 minutes.

Question 19

An SAP NetWeaver system on AWS is configured with a shared file system between the application servers. Which AWS storage service should be used for this shared file system?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances, making it ideal for SAP NetWeaver application servers that require a common file system for shared data such as transport directories, logs, and profile files. EFS supports the NFSv4.1 and NFSv4.0 protocols, ensuring POSIX-compliant file locking and consistency across the cluster.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon S3

Answer

Amazon EBS with multi-attach

Question 20

A company is migrating an SAP ECC system to AWS and needs to ensure low-latency connectivity between the application server and the database server. Both servers will be in the same VPC but different subnets. Which configuration best minimizes latency?

Accepted Answer

Place the servers in the same placement group and the same Availability Zone. Placing both the SAP application server and database server in the same placement group and the same Availability Zone ensures they are physically close together within a single data center, minimizing network latency. This configuration leverages the low-latency, high-bandwidth network connectivity provided by a cluster placement group, which is critical for SAP ECC workloads that require rapid database transactions.

Answer

Place the servers in different placement groups but the same Availability Zone

Answer

Use a cluster placement group spanning two Availability Zones

Answer

Place the servers in different Availability Zones but within the same region