PAS-C01 Design of SAP Workloads on AWS Practice Test 21 — 15 Questions

Question 1

An SAP administrator needs to monitor the disk I/O performance of EBS volumes attached to an SAP HANA instance. Which AWS service should be used to capture the average read latency and queue depth metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides the metrics necessary to monitor disk I/O performance, including `VolumeReadOps`, `VolumeQueueLength`, and `VolumeReadBytes` for EBS volumes. These metrics allow you to calculate average read latency (by dividing `VolumeReadBytes` by `VolumeReadOps`) and directly observe queue depth via `VolumeQueueLength`, making it the correct service for SAP HANA disk I/O monitoring.

Answer

AWS Config

Answer

AWS Health

Answer

AWS CloudTrail

Question 2

An SAP Basis team is designing a high-availability (HA) setup for SAP NetWeaver on AWS. They plan to use a shared file system for transport directories. Which storage solution provides the most cost-effective NFS share with support for automatic failover across Availability Zones?

Accepted Answer

Amazon FSx for NetApp ONTAP. Amazon FSx for NetWeaver (FSx for NetApp ONTAP) provides a fully managed NFS share with HA across AZs. Option A is wrong because EFS is a POSIX file system but not specifically optimized for SAP transport directories and may have cost implications. Option B is wrong because EBS can't be mounted across AZs. Option C is wrong because S3 is object storage, not a file system.

Answer

Amazon Elastic File System (EFS)

Answer

Amazon EBS Multi-Attach gp3 volume

Answer

Amazon S3 with AWS Storage Gateway file gateway

Question 3

An SAP HANA database is running on an r5.8xlarge instance. The administrator notices high swap usage and suspects memory pressure. Which AWS metric should be monitored to confirm memory utilization?

Accepted Answer

CWAgent namespace metrics. The CWAgent namespace includes memory metrics if the CloudWatch agent is installed and configured. Option A is wrong because the EC2 namespace does not include memory metrics by default. Option B is wrong because EBS metrics are for block storage. Option D is wrong because Lambda metrics are irrelevant.

Answer

AWS/Lambda namespace metrics

Answer

EC2 namespace metrics

Answer

EBS namespace metrics

Question 4

A company is migrating an SAP ECC system to AWS and needs to ensure low-latency connectivity between the application server and the database server. Both servers will be in the same VPC but different subnets. Which configuration best minimizes latency?

Accepted Answer

Place the servers in the same placement group and the same Availability Zone. Placing both servers in the same placement group and same Availability Zone ensures physical proximity, reducing network latency. Option A is wrong because different AZs introduce cross-AZ latency. Option C is wrong because a placement group can span AZs but that adds latency. Option D is wrong because cluster placement groups are for HPC, not necessary for SAP.

Answer

Place the servers in different placement groups but the same Availability Zone

Answer

Use a cluster placement group spanning two Availability Zones

Answer

Place the servers in different Availability Zones but within the same region

Question 5

An SAP administrator is setting up an S3 bucket to store SAP HANA backup files. The backups must be encrypted at rest using an AWS KMS customer managed key. Which bucket policy condition key should be used to enforce that only requests using KMS encryption with that specific key are allowed?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows restricting to a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only checks if encryption is enabled, not the key. Option C is wrong because kms:EncryptionContext is for KMS actions, not S3. Option D is wrong because s3:ServerSideEncryption is not a valid condition key.

Answer

kms:EncryptionContext

Answer

s3:ServerSideEncryption

Answer

s3:x-amz-server-side-encryption

Question 6

An SAP system uses a secondary IP address for the SAP application. After an instance reboot, the secondary IP address is no longer attached. What is the most likely cause?

Accepted Answer

The secondary IP address is not automatically re-attached after instance stop/start. Secondary IP addresses are not automatically re-attached after a stop/start unless configured in the ENI. Option A is wrong because Elastic IPs are not automatically detached. Option C is wrong because security groups don't affect IP addresses. Option D is wrong because the ENI itself is not deleted unless terminated.

Answer

The Elastic IP address was not associated with the instance

Answer

The security group removed the IP address

Answer

The Elastic Network Interface (ENI) was deleted

Question 7

A company is running SAP Business Suite on AWS and wants to implement a disaster recovery (DR) strategy with a Recovery Time Objective (RTO) of less than 2 hours and a Recovery Point Objective (RPO) of less than 15 minutes. The primary and DR sites are in different AWS regions. Which solution meets these requirements?

Accepted Answer

Use SAP HANA System Replication in asynchronous mode across regions with EBS snapshots every 15 minutes. SAP HANA System Replication with synchronous mode in the same region can achieve RPO < 15 minutes, but across regions asynchronous replication is needed. Option A is wrong because cross-region synchronous replication is not possible due to latency. Option B is wrong because EBS snapshots alone may not meet RPO. Option C is wrong because S3 cross-region replication is for objects, not SAP data.

Answer

Use EBS snapshots replicated to the DR region with S3 cross-region replication

Answer

Use AWS Backup with continuous backups

Answer

Use SAP HANA System Replication in synchronous mode across regions

Question 8

An SAP administrator notices that the SAP HANA database is running out of disk space on the /hana/data volume. The volume is an EBS gp3 volume with 2000 GB size. The administrator wants to increase the size without downtime. Which action should be taken?

Accepted Answer

Use the modify-volume API to increase the size of the existing volume. EBS gp3 volumes can be modified (size increased) while attached and in use, without downtime. Option A is wrong because detaching the volume would cause downtime. Option B is wrong because a new volume would require data migration and downtime. Option D is wrong because increasing IOPS alone does not increase capacity.

Answer

Detach the volume, create a snapshot, create a larger volume from the snapshot, and attach it

Answer

Create a new larger volume and copy data using rsync

Answer

Increase the IOPS of the volume to improve performance

Question 9

An SAP system is running on an EC2 instance with an instance profile that grants access to an S3 bucket. The application is unable to read a specific object from the bucket. What is the first step to troubleshoot the issue?

Accepted Answer

Check the IAM policy attached to the instance profile. Checking the IAM policy attached to the instance profile ensures the correct permissions are granted. Option B is wrong because security groups control network traffic, not S3 access. Option C is wrong because S3 bucket policies are separate from IAM. Option D is wrong because NACLs are for subnet traffic.

Answer

Check the security group associated with the instance

Answer

Check the network ACLs

Answer

Check the S3 bucket policy

Question 10

Which TWO statements are true regarding Amazon EBS volume types for SAP HANA data volumes?

Accepted Answer

io2 Block Express volumes provide up to 256,000 IOPS. Option A is correct because gp3 volumes provide baseline IOPS of 3000 and can be provisioned up to 16,000 IOPS. Option C is correct because io2 Block Express volumes offer up to 256,000 IOPS and 99.999% durability. Option B is wrong because io1 volumes are legacy and io2 Block Express is recommended. Option D is wrong because st1 volumes are throughput-optimized HDD, not suitable for SAP HANA. Option E is wrong because sc1 volumes are cold HDD, not for database workloads.

Answer

io1 volumes are the recommended choice for SAP HANA

Answer

st1 volumes are suitable for SAP HANA log volumes

Answer

sc1 volumes are cost-effective for SAP HANA data volumes

Question 11

Which TWO of the following are required to enable SAP HANA System Replication across two AWS Availability Zones?

Accepted Answer

The primary and secondary instances must be in the same AWS region. SAP HANA System Replication requires both primary and secondary instances to be in the same AWS region because the replication protocol (based on TCP/IP) relies on low-latency, synchronous or asynchronous data transfer that is only feasible within a region's Availability Zones. Cross-region replication would introduce latency exceeding SAP's recommended thresholds (typically <1 ms RTT for synchronous replication), risking data consistency and failover reliability.

Answer

A Virtual Private Gateway must be attached to the VPC

Answer

A cluster placement group must be used

Answer

An Application Load Balancer must be configured for the replication traffic

Question 12

Which THREE of the following are best practices for securing SAP systems on AWS?

Accepted Answer

Enable AWS CloudTrail to log all API calls. Option A is correct because security groups act as virtual firewalls for EC2 instances. Option C is correct because AWS KMS can be used to encrypt EBS volumes and S3 objects. Option E is correct because AWS CloudTrail provides audit logging of API calls. Option B is wrong because IAM users should not be used for SAP application authentication; instead, use SAP-specific authentication. Option D is wrong because storing secrets in source code is insecure; use AWS Secrets Manager instead.

Answer

Use IAM users to authenticate SAP system users

Answer

Store SAP system credentials in application source code

Question 13

An SAP administrator created the above IAM policy for an EC2 instance that performs automated SAP HANA backups. The backup script runs successfully but fails to upload the backup files to the S3 bucket. What is the most likely cause?

Accepted Answer

The IAM policy does not include permissions for multipart upload operations. The policy allows s3:PutObject and s3:GetObject on objects in the bucket, but does not include s3:ListBucket or s3:PutObjectAcl. However, the failure is most likely because the script uses multipart upload and the policy does not include s3:AbortMultipartUpload or s3:ListMultipartUploadParts. Option A is wrong because the policy allows PutObject. Option C is wrong because the bucket policy is not shown. Option D is wrong because ec2:CreateSnapshot is allowed.

Answer

The S3 bucket policy denies the upload

Answer

The IAM policy does not allow s3:PutObject

Answer

The EC2 instance does not have permission to create snapshots

Question 14

An SAP administrator runs the above CLI command to find the public IP of an m5.2xlarge instance. The output is null. Which of the following is the most likely reason?

Accepted Answer

The instance does not have a public IP address assigned. A null value for Association.PublicIp means the instance does not have a public IP address assigned. Option A is wrong because the instance type does not affect public IP assignment. Option C is wrong because a security group does not assign public IPs. Option D is wrong because the command syntax is correct.

Answer

The security group blocks the public IP

Answer

The CLI command has a syntax error

Answer

The instance type m5.2xlarge does not support public IP addresses

Question 15

An SAP administrator runs the df command on an SAP HANA server and sees the output above. The /hana/data filesystem is 96% full. Which action should be taken to prevent the database from running out of space?

Accepted Answer

Increase the size of the EBS volume and extend the filesystem. The filesystem is nearly full. The best action is to increase the size of the EBS volume and then extend the filesystem. Option A is wrong because deleting logs may not be sufficient and could disrupt operations. Option B is wrong because moving to a new instance requires migration. Option D is wrong because increasing IOPS does not add capacity.

Answer

Increase the IOPS of the EBS volume

Answer

Delete old database logs to free up space

Answer

Migrate the database to a larger instance type