PAS-C01 Design of SAP Workloads on AWS Practice Test 15 — 15 Questions

Question 1

A company is running SAP S/4HANA on AWS. The SAP application servers and database are in the same VPC. The security team requires encryption in transit between all SAP components. Which combination of services and configurations meets this requirement?

Accepted Answer

Enable SAP SNC with TLS certificates on all SAP instances.. Option B is correct because SAP SNC (Secure Network Communications) with TLS certificates provides end-to-end encryption for communication between SAP components, including application servers and databases, regardless of network topology. Since all SAP components reside in the same VPC, the encryption requirement is satisfied at the application layer without relying on network-level encryption. SNC ensures that data in transit between SAP systems is encrypted using X.509 certificates, meeting the security team's mandate.

Answer

Use AWS Transit Gateway with encryption enabled.

Answer

Use AWS VPN to connect all SAP instances to a single endpoint.

Answer

Create a VPC peering connection between the application and database subnets.

Question 2

A company is migrating an SAP ERP system to AWS and wants to use SAP HANA as the database. The current on-premises database is 4 TB. Which EC2 instance type is optimized for SAP HANA workloads and provides sufficient memory?

Accepted Answer

x1e.32xlarge. The x1e.32xlarge instance is specifically optimized for SAP HANA workloads, offering 3,904 GiB of memory, which is sufficient for a 4 TB SAP HANA database when considering the 1:5 memory-to-data ratio required by SAP (4 TB data requires approximately 800 GB memory, but the x1e.32xlarge provides ample headroom for growth and workload peaks). It also supports SAP HANA certified instance types and provides high network and EBS throughput essential for HANA's performance demands.

Answer

r5.24xlarge

Answer

m5.24xlarge

Answer

c5.18xlarge

Question 3

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP application servers. The ALB is configured with a TCP listener. Users report that some sessions are terminated unexpectedly. What is the MOST likely cause?

Accepted Answer

The ALB idle timeout setting is shorter than the SAP session timeout.. The ALB's idle timeout setting controls how long the load balancer keeps a connection open without data transfer. If this timeout is shorter than the SAP session timeout, the ALB will close the connection prematurely, causing the user's session to be terminated unexpectedly. This is a common mismatch when long-running SAP transactions or background jobs do not send data within the ALB's idle timeout window.

Answer

The ALB is not configured with SSL termination.

Answer

The target group health check interval is set too low.

Answer

The ALB is configured with cross-zone load balancing disabled.

Question 4

A company runs SAP HANA on AWS and needs to ensure that the database can be restored to any point in time within the last 48 hours with minimal data loss. Which backup strategy should be used?

Accepted Answer

Schedule daily full backups and hourly incremental log backups to Amazon S3 using Backint.. Option B is correct because SAP HANA supports Backint integration with Amazon S3 for log backups, enabling point-in-time recovery (PITR) with minimal data loss. Daily full backups combined with hourly incremental log backups ensure that any transaction committed within the last 48 hours can be restored, meeting the RPO requirement of minimal data loss.

Answer

Use Amazon EBS snapshots every 6 hours.

Answer

Use AWS Backup with a daily backup plan.

Answer

Take weekly full backups and daily differential backups to Amazon S3.

Question 5

A company is planning to deploy SAP S/4HANA on AWS with high availability. Which TWO actions should be taken to achieve high availability for the SAP Central Services (ASCS/ERS) instance?

Accepted Answer

Deploy ASCS and ERS in different Availability Zones.. Option D is correct because deploying ASCS and ERS in different Availability Zones (AZs) ensures that if one AZ fails, the SAP Central Services can fail over to the other AZ, maintaining high availability. This aligns with AWS best practices for SAP HANA HA, which typically uses a Pacemaker cluster across AZs with fencing and STONITH to handle failover. Option E is correct because a cluster placement group provides low-latency, high-bandwidth connectivity between the ASCS and ERS instances, which is critical for the synchronous replication and heartbeat communication required for a reliable HA cluster.

Answer

Deploy ASCS and ERS in the same Availability Zone.

Answer

Run both ASCS and ERS on the same EC2 instance.

Answer

Place ASCS and ERS in the same subnet.

Question 6

A company is migrating an SAP NetWeaver system to AWS. The system uses an on-premises shared file system (NFS). Which TWO AWS services can provide a scalable, highly available NFS share for SAP transport directories?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a scalable, fully managed NFS file system that is highly available across multiple Availability Zones, making it suitable for SAP transport directories. It supports the NFSv4 protocol required by SAP and automatically scales storage capacity as files are added or removed, eliminating the need for manual provisioning.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon Elastic Block Store (EBS) with a shared volume

Answer

Amazon S3 with S3 File Gateway

Question 7

A company runs SAP HANA on AWS and wants to encrypt the database at rest. Which THREE options are available to achieve this?

Accepted Answer

Use AWS KMS with a custom key store to manage encryption keys.. AWS KMS with a custom key store (option B) is a valid encryption option for SAP HANA on AWS because it allows you to use a customer-managed key store backed by AWS CloudHSM, giving you control over the encryption keys used to protect data at rest. This integrates with Amazon EBS encryption and other AWS services to encrypt the underlying storage volumes, ensuring compliance with key management requirements.

Answer

Use Amazon RDS encryption for the SAP HANA database.

Answer

Use Amazon S3 server-side encryption for database files.

Question 8

Refer to the exhibit. An SAP administrator runs the AWS CLI command and receives the output shown. The SAP application server (instance i-0abcd1234) is in 'running' state, but the SAP application is not reachable. The security group allows inbound traffic on port 3200. What is the MOST likely cause of the issue?

Accepted Answer

The operating system firewall on the instance is blocking port 3200.. Option D is correct because the instance is in 'running' state and the security group allows inbound traffic on port 3200, yet the SAP application is unreachable. This indicates a host-level firewall (e.g., iptables, firewalld, or Windows Firewall) on the SAP application server is blocking inbound connections to port 3200, which operates independently of AWS security groups and network ACLs.

Answer

The network ACL for the subnet is blocking outbound traffic.

Answer

The instance is in a stopped state.

Answer

The security group inbound rule for port 3200 is not applied to the instance.

Question 9

A company runs SAP S/4HANA on AWS with a production system in us-east-1 and a disaster recovery (DR) system in us-west-2. The DR system is a standby HANA system using HANA System Replication (HSR) with asynchronous replication. The primary system has a memory of 2 TB and uses x1e.16xlarge instances. The DR system uses identical instance types. Recently, the network latency between the primary and DR sites increased from 50 ms to 150 ms due to a change in the network path. The SAP Basis team notices that the replication lag has increased significantly, and the DR system is now behind by several minutes. The RPO requirement is 30 seconds. The team must resolve the issue without changing the DR site location or the bandwidth. Which action should the team take to meet the RPO?

Accepted Answer

Configure HSR to use delta_datashipping instead of log shipping.. Option A is correct because HANA System Replication (HSR) can be configured to use delta_datashipping, which sends only the changed data blocks rather than full redo logs. This reduces the amount of data transferred per replication cycle, making it more resilient to increased network latency. With 150 ms latency, log shipping may fail to meet the 30-second RPO, but delta_datashipping can keep the DR system within the required lag by minimizing per-message payload size.

Answer

Increase the AWS Direct Connect bandwidth between the two regions.

Answer

Use Amazon S3 cross-region replication for the HANA log backups.

Answer

Change HSR to synchronous replication mode.

Question 10

A company is migrating an SAP ERP system on Oracle to SAP HANA on AWS. The migration requires near-zero downtime. The company has a test environment that can be used for the migration rehearsal. The SAP HANA database will be 3 TB. Which migration approach should the company use to achieve near-zero downtime?

Accepted Answer

Use SAP Software Update Manager (SUM) with Database Migration Option (DMO).. SAP Software Update Manager (SUM) with Database Migration Option (DMO) is the correct approach because it combines the SAP system upgrade and the migration from Oracle to SAP HANA into a single process, leveraging SAP's own tools to minimize downtime. DMO uses a trigger-based replication mechanism that can achieve near-zero downtime by keeping the source Oracle database and target SAP HANA database synchronized during the migration window, which is critical for a 3 TB database where traditional backup-restore would exceed downtime limits.

Answer

Use AWS Database Migration Service (DMS) for ongoing replication.

Answer

Perform a full backup of the Oracle database and restore to SAP HANA.

Answer

Use SAP HANA Studio to export the Oracle schema and import into HANA.

Question 11

A company is planning to migrate its SAP HANA workload to AWS. The system requires high network throughput and low latency between application and database servers. Which AWS networking feature should be used to meet these requirements?

Accepted Answer

Place the instances in a Cluster Placement Group.. A Cluster Placement Group (CPG) is a logical grouping of instances within a single Availability Zone that provides low-latency, high-throughput network connectivity by placing them in close physical proximity. For SAP HANA workloads requiring consistent high network throughput and low latency between application and database servers, a CPG ensures that all instances are co-located, minimizing network hops and jitter. This is the correct choice because it directly addresses the need for low-latency, high-bandwidth communication between tightly coupled components.

Answer

Create a VPC Peering connection between the application and database subnets.

Answer

Use Elastic Fabric Adapter (EFA) for network connectivity.

Answer

Use Enhanced Networking on all instances.

Question 12

An SAP system on AWS experiences intermittent performance issues. CloudWatch metrics show high CPU credit usage on the t3.large EC2 instance hosting the SAP application. The instance is configured as a 'standard' placement group. What is the MOST likely cause and recommended action?

Accepted Answer

The burstable instance is exhausting its CPU credits. Change to a non-burstable instance.. The t3.large is a burstable instance that earns CPU credits when idle and spends them when active. SAP applications often have sustained CPU demands that can exhaust the credit balance, causing performance throttling. Switching to a non-burstable instance (e.g., m5.large) provides consistent baseline CPU performance without credit-based limitations.

Answer

The instance size is too small. Move to a larger t3 instance.

Answer

The placement group is causing network bottlenecks. Move to a cluster placement group.

Answer

The EBS volume is not provisioned with enough IOPS. Increase the volume size.

Question 13

A company runs SAP ECC on AWS with a multi-ASCS architecture for high availability. During a failover test, the secondary ASCS instance does not take over. The cluster logs indicate that the 'aws-cluster' resource agent failed to release the Elastic IP. What is the MOST likely cause?

Accepted Answer

The Elastic IP is associated with the primary private IP address of the ENI.. In a multi-ASCS SAP cluster on AWS, the 'aws-cluster' resource agent manages Elastic IP (EIP) failover by disassociating the EIP from the primary instance and associating it with the secondary instance. If the EIP is associated with the primary private IP address of the Elastic Network Interface (ENI) rather than the ENI itself, the resource agent cannot release it because the association is at the IP level, not the ENI level. This prevents the secondary ASCS instance from acquiring the EIP, causing the failover to fail.

Answer

The Elastic IP is in a different Availability Zone than the secondary ASCS instance.

Answer

The cluster is using a NAT Gateway for outbound traffic, conflicting with the Elastic IP.

Answer

The IAM role assigned to the instances does not have permission to release the Elastic IP.

Question 14

An SAP administrator wants to automate the creation of a DR environment for SAP HANA on AWS. The DR site should be in a different region and must be started only during a disaster. Which AWS service should be used to orchestrate the DR process?

Accepted Answer

AWS Elastic Disaster Recovery (DRS) to replicate and orchestrate failover.. AWS Elastic Disaster Recovery (DRS) is the correct service because it provides continuous block-level replication for SAP HANA servers and includes built-in orchestration for failover and failback. This allows the DR environment to remain stopped until a disaster occurs, minimizing costs while ensuring rapid recovery.

Answer

AWS Systems Manager Automation to run DR scripts.

Answer

AWS CloudFormation StackSets to deploy the environment in the DR region.

Answer

Amazon S3 Cross-Region Replication to replicate SAP application data.

Question 15

Which TWO are best practices for designing high availability for SAP NetWeaver on AWS? (Choose two.)

Accepted Answer

Deploy SAP ASCS and PAS instances in separate Availability Zones.. Deploying SAP ASCS (ABAP SAP Central Services) and PAS (Primary Application Server) instances in separate Availability Zones ensures that if one AZ fails, the other can continue processing, providing high availability. This aligns with AWS best practices for SAP NetWeaver, which recommend distributing critical SAP components across AZs to achieve a Recovery Time Objective (RTO) of minutes and a Recovery Point Objective (RPO) of near-zero using SAP enqueue replication and failover mechanisms.

Answer

Use T2 or T3 burstable instances for cost savings.

Answer

Use EBS Multi-Attach volumes for the SAP application data.

Answer

Configure multiple Application Load Balancers in a failover configuration.