PAS-C01 Design of SAP Workloads on AWS Practice Test 13 — 15 Questions

Question 1

A company runs SAP on AWS and uses a shared Amazon EFS file system for /sapmnt and /usr/sap/trans. The administrator wants to control access to specific directories based on the source IP address of the SAP application servers. Which method should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon EFS access points with IAM policies. Amazon EFS access points can be combined with IAM policies to enforce a specific POSIX user and directory path per application, and IAM conditions can restrict access based on the source IP address of the SAP application servers. This allows fine-grained control over which EC2 instances (by IP) can access specific subdirectories like /sapmnt or /usr/sap/trans without modifying the NFS client configuration.

Answer

Configure security group rules to allow only specific IP addresses

Answer

Use Amazon S3 bucket policies with IP conditions

Answer

Use network ACLs to restrict access by IP

Question 2

Which TWO of the following are best practices for running SAP HANA on AWS? (Choose 2)

Accepted Answer

Use separate EBS volumes for HANA data and log files. Option C is correct because SAP HANA requires separate storage for data and log files to optimize I/O performance and enable independent backup, recovery, and tuning; AWS best practice is to place HANA data and log on distinct EBS volumes (often with different volume types such as gp3/io2 for data and io2 for log) to meet SAP's KPIs. Option D is correct because EBS-optimized instances provide dedicated bandwidth between the EC2 instance and EBS, which is essential for HANA's high-throughput, low-latency storage requirements and is a documented AWS/SAP prerequisite for production HANA deployments. Option A is not a best practice because stopping a production HANA instance disrupts availability and is not a supported cost-optimization approach for a running SAP system. Option B is incorrect because general-purpose burstable instances like t3 lack the memory capacity, CPU consistency, and SAP certification required for HANA, which needs memory-optimized instances (e.g., R5, X1, X2). Option E is incorrect because placement groups are used for low-latency networking between clustered instances, not for launching all HANA instances; HANA scale-out uses specific cluster placement guidance, and a single placement group for all instances is not a general best practice.

Answer

Stop HANA instances when not in use to save costs

Answer

Use general-purpose instances (e.g., t3) to reduce costs

Answer

Launch all HANA instances in a single placement group

Question 3

Which THREE of the following are valid disaster recovery strategies for SAP on AWS? (Choose 3)

Accepted Answer

SAP backup to Amazon S3 with cross-region replication. Option C is correct because backing up SAP data to Amazon S3 and enabling Cross-Region Replication (CRR) provides a durable, offsite copy that can be restored in another Region after a disaster, making it a valid DR strategy. Option D is correct because copying Amazon EBS snapshots to another Region and restoring volumes from them allows SAP systems to be rebuilt in a secondary Region, which is a standard AWS DR pattern. Option E is correct because SAP HANA System Replication (HSR) can be configured across AWS Regions to maintain a synchronized secondary HANA system that supports failover, satisfying DR requirements. Option A is not marked correct because a cold standby alone is not listed among the valid strategies here, and Option B is not marked correct because Amazon RDS Multi-AZ is not applicable to SAP HANA, which runs on EC2 rather than RDS.

Answer

Maintain a cold standby environment in another Region

Answer

AWS RDS Multi-AZ deployment for SAP HANA

Question 4

A company is designing a highly available SAP NetWeaver AS ABAP environment on AWS with a 2-node ASCS/ERS cluster. Which TWO of the following must be configured to ensure a successful failover? (Choose 2)

Accepted Answer

A shared file system (e.g., Amazon EFS) for /sapmnt. Option C is correct because in a 2-node ASCS/ERS cluster the /sapmnt directory must be shared between both nodes so that the ASCS and ERS instances can access the same SAP global files and profiles regardless of which node is active; Amazon EFS provides the required shared, highly available NFS file system. Option E is correct because the cluster must present a virtual IP address (VIP) that clients use to reach the ASCS, and on AWS this VIP is implemented by moving an Elastic IP or secondary private IP between nodes, typically orchestrated with Route 53 health checks or AWS CLI calls in the cluster's failover scripts. Option A is not a real AWS service, so it cannot be configured. Option B is wrong because EBS Multi-Attach is only supported on io1/io2 volumes in a single Availability Zone and is not used for the SAP database in this ASCS/ERS cluster design. Option D is wrong because the ASCS and ERS directories must reside on shared storage (or be replicated) so they can be taken over by the surviving node, not on node-local instance store.

Answer

An AWS ASW (Automated SAP Workload) service

Answer

Amazon EBS io1 volumes with Multi-Attach enabled for the database

Answer

Each node must have its own /usr/sap//ASCS and /usr/sap//ERS directory on instance store

Question 5

A company is running SAP HANA on AWS and needs to ensure high availability for the database. Which AWS service should be used to automatically recover the HANA primary instance in case of an instance failure?

Accepted Answer

Amazon Route 53 health checks and failover routing. Amazon Route 53 health checks and failover routing can automatically detect an instance failure and route traffic to a standby HANA primary instance. By configuring a Route 53 DNS failover record with health checks against the primary instance, DNS resolution is updated to point to the secondary instance when the primary becomes unhealthy, enabling automated recovery without manual intervention.

Answer

Amazon CloudWatch alarms

Answer

AWS CloudFormation custom resources

Answer

AWS Lambda functions

Question 6

A company is running SAP ERP on AWS and notices performance degradation during peak hours. The application servers are in an Auto Scaling group behind an Application Load Balancer. Which configuration change would best handle the increased load?

Accepted Answer

Change the Auto Scaling policy to use a target tracking policy based on CPU utilization. D is correct because SAP ERP workloads are typically CPU-bound during peak hours, and a target tracking policy based on CPU utilization automatically adjusts the Auto Scaling group to maintain a target CPU metric (e.g., 70%), ensuring the application servers scale out proactively to handle increased load without manual intervention. This approach aligns with SAP's recommended scaling strategy on AWS, as it directly addresses the performance degradation caused by high CPU demand.

Answer

Increase the minimum and maximum instance count in the Auto Scaling group

Answer

Configure a step scaling policy based on memory utilization

Answer

Replace the Application Load Balancer with a Network Load Balancer

Question 7

A company is migrating an SAP system to AWS and needs to ensure that the SAP license is compliant. The current license is based on the number of users. Which AWS pricing model is most appropriate for this scenario?

Accepted Answer

On-Demand instances. On-Demand instances are the most appropriate pricing model for this SAP migration because the SAP license is based on the number of users, not on the underlying hardware or instance type. With On-Demand instances, the company pays only for compute capacity by the hour or second, avoiding any long-term commitment that could inadvertently trigger SAP license compliance issues related to dedicated hardware or specific instance sizing. This flexibility allows the company to align AWS costs directly with the user-based SAP licensing model without additional constraints.

Answer

Spot Instances

Answer

Reserved Instances

Answer

Dedicated Hosts

Question 8

An SAP system on AWS is using an Oracle database. The company wants to implement automated backups to Amazon S3. Which AWS service should be used to orchestrate the backup process?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, policy-driven backup solution that can orchestrate backups for SAP workloads running on Amazon EC2 with Oracle databases. It integrates directly with Amazon S3 for storing backup data and supports custom backup scripts via the AWS Backup API or AWS Lambda, enabling automated, scheduled backups without manual intervention.

Answer

Amazon RDS for Oracle

Answer

Amazon S3 Lifecycle policies

Answer

AWS Database Migration Service (DMS)

Question 9

A company is designing a disaster recovery solution for SAP HANA on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO strategies can be used to replicate HANA data to the DR region? (Choose TWO.)

Accepted Answer

Use AWS Database Migration Service (DMS) for ongoing replication. Option B is correct because SAP HANA System Replication (HSR) in ASYNC mode is the native SAP mechanism for continuously shipping redo log data from a primary HANA system in us-east-1 to a secondary HANA system in us-west-2, and ASYNC mode is the appropriate choice for cross-region replication where latency would make SYNC or SYNCMEM impractical. Option A is correct because AWS DMS supports SAP HANA as a source and can perform ongoing (change data capture) replication of HANA tables to a target in another region, providing a database-level replication strategy for DR. Option C is not correct because copying EBS snapshots to another region only produces point-in-time block-level copies of volumes, not the continuous HANA-aware replication needed for a DR solution. Option D is not correct because S3 Cross-Region Replication only replicates objects stored in S3 buckets and HANA data files are not served from S3 in a standard HANA-on-EC2 deployment. Option E is not correct because AWS CloudEndure Disaster Recovery (now part of AWS Elastic Disaster Recovery) replicates block-level server data for generic servers and is not a supported or SAP-certified method for replicating HANA database data with consistency.

Answer

Copy EBS snapshots to the DR region using AWS CLI

Answer

Configure S3 Cross-Region Replication for HANA data files

Answer

Use AWS CloudEndure Disaster Recovery

Question 10

A company is designing an SAP HANA workload on AWS. They need to ensure high availability for the SAP HANA database with automatic failover in case of an instance failure. Which AWS service should they use to achieve this?

Accepted Answer

Pacemaker cluster on Amazon EC2 with EBS multi-attach. Pacemaker is a high-availability cluster resource manager that, when combined with Amazon EC2 and EBS Multi-Attach, enables automatic failover for SAP HANA. EBS Multi-Attach allows the same EBS volume to be attached to multiple EC2 instances in the same Availability Zone, which is required for SAP HANA's shared-storage-based scale-up or scale-out HA configurations. This setup supports the SAP HANA system replication or storage replication failover mechanism, ensuring automatic recovery upon instance failure.

Answer

Amazon RDS for SAP HANA

Answer

AWS Elastic Beanstalk

Answer

Amazon Route 53 health checks with DNS failover

Question 11

An SAP Basis administrator is migrating an SAP NetWeaver system from on-premises to AWS. They want to minimize downtime during the migration of the database. Which AWS service is best suited for this?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is best suited for migrating SAP NetWeaver databases with minimal downtime because it supports heterogeneous and homogeneous database migrations with ongoing replication. DMS can perform a full load of the database and then continuously replicate changes from the source to the target using change data capture (CDC), allowing the source database to remain operational until the cutover. This minimizes downtime to just the final switchover window, which is critical for SAP systems.

Answer

AWS Server Migration Service (SMS)

Answer

AWS CloudEndure Migration

Answer

AWS Snowball Edge

Question 12

A company is running SAP S/4HANA on AWS and needs to back up the SAP HANA database to Amazon S3 with the ability to perform point-in-time recovery. Which approach meets these requirements?

Accepted Answer

Use the SAP HANA BACKUP command with S3 as the backup destination via the hdbsql tool. SAP HANA natively supports backing up directly to Amazon S3 using the `BACKUP DATA` command with the `S3` destination parameter via `hdbsql`. This allows point-in-time recovery by leveraging HANA's own log backup mechanism, which writes transaction log backups to S3 continuously, enabling restore to any specific point in time without intermediate storage layers.

Answer

Configure SAP HANA backup to write to Amazon EFS, then use AWS DataSync to copy to S3

Answer

Use AWS Backup to schedule backups of the EC2 instances running SAP HANA

Answer

Attach Amazon EBS volumes and use EBS snapshots for point-in-time recovery

Question 13

A company wants to implement a disaster recovery (DR) strategy for its SAP landscape on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. They need to replicate SAP HANA database asynchronously with a Recovery Point Objective (RPO) of 15 minutes. Which AWS service should they use?

Accepted Answer

SAP HANA System Replication. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for asynchronous replication of HANA databases, capable of achieving an RPO of 15 minutes or less. It replicates at the database level using log shipping and is tightly integrated with HANA's recovery processes, making it the correct choice for this DR scenario.

Answer

AWS Elastic Disaster Recovery (DRS)

Answer

Amazon S3 cross-region replication for HANA backup files

Answer

AWS Database Migration Service (DMS) with ongoing replication

Question 14

A company is experiencing performance issues with their SAP ERP system on AWS. The system is running on an r5.4xlarge EC2 instance with gp2 EBS volumes. The database is SAP HANA. CloudWatch metrics show high write latency on the data volume. Which change would most likely improve performance?

Accepted Answer

Change the volume type to io2 Block Express. SAP HANA is highly sensitive to storage latency, and the high write latency on the data volume indicates that gp2's burst model is insufficient for sustained write workloads. io2 Block Express provides consistent, sub-millisecond latency with provisioned IOPS up to 256,000, which directly addresses the performance bottleneck. This change aligns with AWS best practices for SAP HANA production workloads, which recommend io2 volumes for data and log volumes.

Answer

Increase the size of the gp2 volume to get more baseline IOPS

Answer

Move the database to a t3.large instance

Answer

Enable EBS optimization on the instance

Question 15

Which TWO of the following are valid considerations when designing the network for SAP workloads on AWS? (Select TWO.)

Accepted Answer

Enable jumbo frames on the VPC for SAP application tier. Option A is correct because enabling jumbo frames (MTU 9001) on the VPC supports SAP's high-throughput, low-latency inter-node communication requirements, particularly for SAP application servers and HANA scale-out scenarios where larger packet sizes reduce per-packet overhead and improve network efficiency. Option D is correct because deploying SAP application servers in a cluster placement group packs instances close together within a single Availability Zone, providing the low-latency, high-throughput network performance (up to 10 Gbps or more) that SAP application-to-database traffic requires. Option B is incorrect because SAP tiers (application, database, and presentation) should be separated into distinct subnets for security, routing control, and network isolation, not consolidated into one subnet. Option C is incorrect because the SAP database tier must reside in a private subnet to prevent direct internet exposure, since databases should never be publicly accessible. Option E is incorrect because VPC Flow Logs are a valuable monitoring and troubleshooting tool for SAP workloads, and disabling them purely for cost savings sacrifices visibility into network traffic and security auditing.

Answer

Use a single subnet for all SAP tiers to simplify routing

Answer

Use a public subnet for the SAP database tier

Answer

Disable VPC Flow Logs to save costs