PAS-C01 Design of SAP Workloads on AWS Practice Test 16 — 15 Questions

Question 1

An SAP system on AWS experiences intermittent connectivity issues between the SAP Central Services (SCS) instance and the application servers. The SCS instance is in a private subnet in us-east-1a, and the application servers are spread across us-east-1a and us-east-1b. Security groups allow traffic on all required ports. What is the MOST likely cause of the intermittent connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACLs are blocking the traffic.. Network ACLs are stateless and must explicitly allow both inbound and outbound traffic on ephemeral ports. If the outbound rules for the SCS subnet's NACL do not allow return traffic on high ports (e.g., 1024–65535), or if the application servers' subnet NACL blocks inbound traffic from the SCS instance, connections will intermittently fail. Security groups are stateful and automatically allow return traffic, but NACLs are not, making them the likely culprit for intermittent connectivity across different Availability Zones.

Answer

The route tables do not have a route for the SCS subnet.

Answer

The Internet Gateway is misconfigured.

Answer

The VPC peering connection is not established correctly.

Question 2

A company is designing an SAP HANA disaster recovery (DR) solution on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The RPO is 15 minutes, and the RTO is 2 hours. Which AWS service should be used for replicating the SAP HANA database to the DR site?

Accepted Answer

SAP HANA System Replication with log shipping using Amazon S3 or direct VPN connection.. SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for real-time database replication, capable of achieving sub-minute RPOs by continuously shipping log entries to a secondary system. When combined with a direct VPN connection or Amazon S3 as a log shipping target, it meets the 15-minute RPO and 2-hour RTO requirements for disaster recovery across AWS regions. This is the only option that provides synchronous or near-synchronous replication of the HANA database itself, not just backups or snapshots.

Answer

Amazon S3 Cross-Region Replication for database backup files.

Answer

Amazon EBS snapshots replicated to us-west-2 via Amazon Data Lifecycle Manager.

Answer

AWS Database Migration Service (DMS) with ongoing replication.

Question 3

An SAP workload on AWS uses a single Availability Zone deployment. The company wants to improve high availability without changing the existing architecture significantly. Which action should be taken?

Accepted Answer

Add a second SAP application server in a different Availability Zone and configure load balancing.. Adding a second SAP application server in a different Availability Zone and configuring load balancing provides high availability by distributing traffic across multiple AZs, ensuring that if one AZ fails, the application remains accessible. This approach aligns with SAP's recommended architecture for multi-AZ deployments without requiring significant changes to the existing single-AZ setup, as it only adds an additional application tier instance and a load balancer.

Answer

Use an Amazon EBS volume attached to multiple instances across AZs.

Answer

Increase the size of the EC2 instances to handle failover.

Answer

Enable EBS Multi-Attach on the database volume.

Question 4

A company is running SAP S/4HANA on AWS. The SAP application servers and database are in the same VPC. The security team requires encryption in transit between all SAP components. Which combination of services and configurations meets this requirement?

Accepted Answer

Enable SAP SNC with TLS certificates on all SAP instances.. SAP SNC (Secure Network Communications) with TLS certificates provides end-to-end encryption for communication between SAP components, including application servers and databases, regardless of network topology. Since all SAP components reside in the same VPC, the encryption requirement is satisfied at the application layer without relying on network-level encryption. SNC ensures that data in transit between SAP systems is encrypted using X.509 certificates, meeting the security team's mandate.

Answer

Use AWS Transit Gateway with encryption enabled.

Answer

Use AWS VPN to connect all SAP instances to a single endpoint.

Answer

Create a VPC peering connection between the application and database subnets.

Question 5

A company is migrating an SAP ERP system to AWS and wants to use SAP HANA as the database. The current on-premises database is 4 TB. Which EC2 instance type is optimized for SAP HANA workloads and provides sufficient memory?

Accepted Answer

x1e.32xlarge. The x1e.32xlarge instance is specifically optimized for SAP HANA workloads, offering 3,904 GiB of memory, which is sufficient for a 4 TB SAP HANA database when considering the 1:5 memory-to-data ratio required by SAP (4 TB data requires approximately 800 GB memory, but the x1e.32xlarge provides ample headroom for growth and workload peaks). It also supports SAP HANA certified instance types and provides high network and EBS throughput essential for HANA's performance demands.

Answer

r5.24xlarge

Answer

m5.24xlarge

Answer

c5.18xlarge

Question 6

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP application servers. The ALB is configured with a TCP listener. Users report that some sessions are terminated unexpectedly. What is the MOST likely cause?

Accepted Answer

The ALB idle timeout setting is shorter than the SAP session timeout.. The ALB's idle timeout setting controls how long the load balancer keeps a connection open without data transfer. If this timeout is shorter than the SAP session timeout, the ALB will close the connection prematurely, causing the user's session to be terminated unexpectedly. This is a common mismatch when long-running SAP transactions or background jobs do not send data within the ALB's idle timeout window.

Answer

The ALB is not configured with SSL termination.

Answer

The target group health check interval is set too low.

Answer

The ALB is configured with cross-zone load balancing disabled.

Question 7

A company runs SAP HANA on AWS and needs to ensure that the database can be restored to any point in time within the last 48 hours with minimal data loss. Which backup strategy should be used?

Accepted Answer

Schedule daily full backups and hourly incremental log backups to Amazon S3 using Backint.. SAP HANA supports Backint integration with Amazon S3 for log backups, enabling point-in-time recovery (PITR) with minimal data loss. Daily full backups combined with hourly incremental log backups ensure that any transaction committed within the last 48 hours can be restored, meeting the RPO requirement of minimal data loss.

Answer

Use Amazon EBS snapshots every 6 hours.

Answer

Use AWS Backup with a daily backup plan.

Answer

Take weekly full backups and daily differential backups to Amazon S3.

Question 8

A company is planning to deploy SAP S/4HANA on AWS with high availability. Which action should be taken to achieve high availability for the SAP Central Services (ASCS/ERS) instance?

Accepted Answer

Deploy ASCS and ERS in different Availability Zones.. The correct action is to deploy ASCS and ERS in different Availability Zones (Option D). This ensures that if one AZ fails, the instance can fail over to the other AZ, providing high availability. Option E (using a cluster placement group) is incorrect because cluster placement groups are confined to a single AZ and cannot span multiple AZs, making them incompatible with the cross-AZ requirement. Options A, B, and C all violate HA principles by placing both instances in the same AZ or same instance. Therefore, only Option D is a valid action for achieving high availability.

Answer

Deploy ASCS and ERS in the same Availability Zone.

Answer

Run both ASCS and ERS on the same EC2 instance.

Answer

Place ASCS and ERS in the same subnet.

Answer

Use a cluster placement group for ASCS and ERS instances.

Question 9

A company is migrating an SAP NetWeaver system to AWS. The system uses an on-premises shared file system (NFS). Which TWO AWS services can provide a scalable, highly available NFS share for SAP transport directories?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a scalable, fully managed NFS file system that is highly available across multiple Availability Zones, making it suitable for SAP transport directories. It supports the NFSv4 protocol required by SAP and automatically scales storage capacity as files are added or removed, eliminating the need for manual provisioning.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon Elastic Block Store (EBS) with a shared volume

Answer

Amazon S3 with S3 File Gateway

Question 10

Refer to the exhibit. An SAP administrator runs the AWS CLI command and receives the output shown. The SAP application server (instance i-0abcd1234) is in 'running' state, but the SAP application is not reachable. The security group allows inbound traffic on port 3200. What is the MOST likely cause of the issue?

Accepted Answer

The operating system firewall on the instance is blocking port 3200.. The instance is in 'running' state and the security group allows inbound traffic on port 3200, yet the SAP application is unreachable. This indicates a host-level firewall (e.g., iptables, firewalld, or Windows Firewall) on the SAP application server is blocking inbound connections to port 3200, which operates independently of AWS security groups and network ACLs.

Answer

The network ACL for the subnet is blocking outbound traffic.

Answer

The instance is in a stopped state.

Answer

The security group inbound rule for port 3200 is not applied to the instance.

Question 11

A company runs SAP S/4HANA on AWS with a production system in us-east-1 and a disaster recovery (DR) system in us-west-2. The DR system is a standby HANA system using HANA System Replication (HSR) with asynchronous replication. The primary system has a memory of 2 TB and uses x1e.16xlarge instances. The DR system uses identical instance types. Recently, the network latency between the primary and DR sites increased from 50 ms to 150 ms due to a change in the network path. The SAP Basis team notices that the replication lag has increased significantly, and the DR system is now behind by several minutes. The RPO requirement is 30 seconds. The team must resolve the issue without changing the DR site location or the bandwidth. Which action should the team take to meet the RPO?

Accepted Answer

Configure HSR to use delta_datashipping instead of log shipping.. HANA System Replication (HSR) can be configured to use delta_datashipping, which sends only the changed data blocks rather than full redo logs. This reduces the amount of data transferred per replication cycle, making it more resilient to increased network latency. With 150 ms latency, log shipping may fail to meet the 30-second RPO, but delta_datashipping can keep the DR system within the required lag by minimizing per-message payload size.

Answer

Increase the AWS Direct Connect bandwidth between the two regions.

Answer

Use Amazon S3 cross-region replication for the HANA log backups.

Answer

Change HSR to synchronous replication mode.

Question 12

A company is migrating an SAP ERP system on Oracle to SAP HANA on AWS. The migration requires near-zero downtime. The company has a test environment that can be used for the migration rehearsal. The SAP HANA database will be 3 TB. Which migration approach should the company use to achieve near-zero downtime?

Accepted Answer

Use SAP Software Update Manager (SUM) with Database Migration Option (DMO).. SAP Software Update Manager (SUM) with Database Migration Option (DMO) is the correct approach because it combines the SAP system upgrade and the migration from Oracle to SAP HANA into a single process, leveraging SAP's own tools to minimize downtime. DMO uses a trigger-based replication mechanism that can achieve near-zero downtime by keeping the source Oracle database and target SAP HANA database synchronized during the migration window, which is critical for a 3 TB database where traditional backup-restore would exceed downtime limits.

Answer

Use AWS Database Migration Service (DMS) for ongoing replication.

Answer

Perform a full backup of the Oracle database and restore to SAP HANA.

Answer

Use SAP HANA Studio to export the Oracle schema and import into HANA.

Question 13

A company is planning to migrate its SAP HANA workload to AWS. The system requires high network throughput and low latency between application and database servers. Which AWS networking feature should be used to meet these requirements?

Accepted Answer

Place the instances in a Cluster Placement Group.. A Cluster Placement Group (CPG) is a logical grouping of instances within a single Availability Zone that provides low-latency, high-throughput network connectivity by placing them in close physical proximity. For SAP HANA workloads requiring consistent high network throughput and low latency between application and database servers, a CPG ensures that all instances are co-located, minimizing network hops and jitter. This is the correct choice because it directly addresses the need for low-latency, high-bandwidth communication between tightly coupled components.

Answer

Create a VPC Peering connection between the application and database subnets.

Answer

Use Elastic Fabric Adapter (EFA) for network connectivity.

Answer

Use Enhanced Networking on all instances.

Question 14

An SAP system on AWS experiences intermittent performance issues. CloudWatch metrics show high CPU credit usage on the t3.large EC2 instance hosting the SAP application. The instance is configured as a 'standard' placement group. What is the MOST likely cause and recommended action?

Accepted Answer

The burstable instance is exhausting its CPU credits. Change to a non-burstable instance.. The t3.large is a burstable instance that earns CPU credits when idle and spends them when active. SAP applications often have sustained CPU demands that can exhaust the credit balance, causing performance throttling. Switching to a non-burstable instance (e.g., m5.large) provides consistent baseline CPU performance without credit-based limitations.

Answer

The instance size is too small. Move to a larger t3 instance.

Answer

The placement group is causing network bottlenecks. Move to a cluster placement group.

Answer

The EBS volume is not provisioned with enough IOPS. Increase the volume size.

Question 15

A company runs SAP ECC on AWS with a multi-ASCS architecture for high availability. During a failover test, the secondary ASCS instance does not take over. The cluster logs indicate that the 'aws-cluster' resource agent failed to release the Elastic IP. What is the MOST likely cause?

Accepted Answer

The Elastic IP is associated with the primary private IP address of the ENI.. In a multi-ASCS SAP cluster on AWS, the 'aws-cluster' resource agent manages Elastic IP (EIP) failover by disassociating the EIP from the primary instance and associating it with the secondary instance. If the EIP is associated with the primary private IP address of the Elastic Network Interface (ENI) rather than the ENI itself, the resource agent cannot release it because the association is at the IP level, not the ENI level. This prevents the secondary ASCS instance from acquiring the EIP, causing the failover to fail.

Answer

The Elastic IP is in a different Availability Zone than the secondary ASCS instance.

Answer

The cluster is using a NAT Gateway for outbound traffic, conflicting with the Elastic IP.

Answer

The IAM role assigned to the instances does not have permission to release the Elastic IP.