PAS-C01 Design of SAP Workloads on AWS Practice Test 22 — 15 Questions

Question 1

An SAP administrator needs to monitor the disk I/O performance of EBS volumes attached to an SAP HANA instance. Which AWS service should be used to capture the average read latency and queue depth metrics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides the metrics necessary to monitor disk I/O performance, including `VolumeReadOps`, `VolumeQueueLength`, and `VolumeReadBytes` for EBS volumes. These metrics allow you to calculate average read latency (by dividing `VolumeReadBytes` by `VolumeReadOps`) and directly observe queue depth via `VolumeQueueLength`, making it the correct service for SAP HANA disk I/O monitoring.

Answer

AWS Config

Answer

AWS Health

Answer

AWS CloudTrail

Question 2

An SAP Basis team is designing a high-availability (HA) setup for SAP NetWeaver on AWS. They plan to use a shared file system for transport directories. Which storage solution provides the most cost-effective NFS share with support for automatic failover across Availability Zones?

Accepted Answer

Amazon FSx for NetApp ONTAP. Amazon FSx for NetApp ONTAP is the correct choice because it provides a fully managed, highly available NFS share that supports automatic failover across Availability Zones (AZs) using NetApp's SnapMirror and multi-AZ HA pair architecture. It is the most cost-effective solution for SAP transport directories that require a shared file system with cross-AZ failover, as it offers native NFSv3/v4.1 support, consistent performance, and lower total cost of ownership compared to alternatives for this specific SAP workload.

Answer

Amazon Elastic File System (EFS)

Answer

Amazon EBS Multi-Attach gp3 volume

Answer

Amazon S3 with AWS Storage Gateway file gateway

Question 3

An SAP HANA database is running on an r5.8xlarge instance. The administrator notices high swap usage and suspects memory pressure. Which AWS metric should be monitored to confirm memory utilization?

Accepted Answer

CWAgent namespace metrics. The CWAgent namespace metrics are correct because the CloudWatch agent, when installed on the EC2 instance, can capture detailed OS-level memory utilization metrics (such as `mem_used_percent` and `mem_available_percent`) that are not available in the default EC2 or EBS namespaces. This allows the administrator to directly confirm memory pressure causing high swap usage on the SAP HANA database.

Answer

AWS/Lambda namespace metrics

Answer

EC2 namespace metrics

Answer

EBS namespace metrics

Question 4

An SAP administrator is setting up an S3 bucket to store SAP HANA backup files. The backups must be encrypted at rest using an AWS KMS customer managed key. Which bucket policy condition key should be used to enforce that only requests using KMS encryption with that specific key are allowed?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that only requests using a specific AWS KMS customer managed key for server-side encryption are permitted. This key is evaluated against the `x-amz-server-side-encryption-aws-kms-key-id` header in the request, ensuring that backups are encrypted with the exact KMS key ID specified in the bucket policy.

Answer

kms:EncryptionContext

Answer

s3:ServerSideEncryption

Answer

s3:x-amz-server-side-encryption

Question 5

An SAP system uses a secondary IP address for the SAP application. After an instance reboot, the secondary IP address is no longer attached. What is the most likely cause?

Accepted Answer

The secondary IP address is not automatically re-attached after instance stop/start. When an EC2 instance is stopped and started, any secondary private IP addresses assigned to its primary Elastic Network Interface (ENI) are automatically released and not re-attached. The SAP application relies on this secondary IP address, so after a stop/start cycle the address is lost, requiring manual re-assignment or automation to restore it.

Answer

The Elastic IP address was not associated with the instance

Answer

The security group removed the IP address

Answer

The Elastic Network Interface (ENI) was deleted

Question 6

A company is running SAP Business Suite on AWS and wants to implement a disaster recovery (DR) strategy with a Recovery Time Objective (RTO) of less than 2 hours and a Recovery Point Objective (RPO) of less than 15 minutes. The primary and DR sites are in different AWS regions. Which solution meets these requirements?

Accepted Answer

Use SAP HANA System Replication in asynchronous mode across regions with EBS snapshots every 15 minutes. SAP HANA System Replication in asynchronous mode across regions meets the RPO of less than 15 minutes because it continuously replicates log data with minimal latency, and the RTO of less than 2 hours is achievable by taking over the replicated HANA database in the DR region. EBS snapshots every 15 minutes provide an additional layer for persistent storage consistency, but the primary mechanism for meeting the RPO is the asynchronous log replication, which typically achieves sub-minute RPO.

Answer

Use EBS snapshots replicated to the DR region with S3 cross-region replication

Answer

Use AWS Backup with continuous backups

Answer

Use SAP HANA System Replication in synchronous mode across regions

Question 7

An SAP administrator notices that the SAP HANA database is running out of disk space on the /hana/data volume. The volume is an EBS gp3 volume with 2000 GB size. The administrator wants to increase the size without downtime. Which action should be taken?

Accepted Answer

Use the modify-volume API to increase the size of the existing volume. AWS EBS gp3 volumes support online resizing via the modify-volume API without requiring downtime. The SAP HANA /hana/data volume can be increased in size while the instance remains running, as EBS volumes can be modified dynamically. After the modification, the administrator must extend the file system to recognize the new space, but no volume detachment or data migration is needed.

Answer

Detach the volume, create a snapshot, create a larger volume from the snapshot, and attach it

Answer

Create a new larger volume and copy data using rsync

Answer

Increase the IOPS of the volume to improve performance

Question 8

An SAP system is running on an EC2 instance with an instance profile that grants access to an S3 bucket. The application is unable to read a specific object from the bucket. What is the first step to troubleshoot the issue?

Accepted Answer

Check the IAM policy attached to the instance profile. The instance profile grants the EC2 instance permissions to access the S3 bucket via IAM roles. If the application cannot read a specific object, the most likely cause is that the IAM policy attached to the instance profile does not include the necessary permissions (e.g., s3:GetObject) for that object. Checking the IAM policy is the first logical step because it directly controls the identity-based access for the instance.

Answer

Check the security group associated with the instance

Answer

Check the network ACLs

Answer

Check the S3 bucket policy

Question 9

Which TWO statements are true regarding Amazon EBS volume types for SAP HANA data volumes?

Accepted Answer

io2 Block Express volumes provide up to 256,000 IOPS. Io2 Block Express volumes are designed for SAP HANA data volumes, offering up to 256,000 IOPS and 4,000 MB/s throughput per volume, which meets the high-performance requirements for SAP HANA. Option C is correct because gp3 volumes can be provisioned with up to 16,000 IOPS and 1,000 MB/s throughput, making them a cost-effective alternative for smaller SAP HANA workloads or non-production environments.

Answer

io1 volumes are the recommended choice for SAP HANA

Answer

st1 volumes are suitable for SAP HANA log volumes

Answer

sc1 volumes are cost-effective for SAP HANA data volumes

Question 10

Which ONE of the following is required to enable SAP HANA System Replication across two AWS Availability Zones?

Accepted Answer

The primary and secondary instances must be in the same AWS region. SAP HANA System Replication requires primary and secondary instances to be in the same AWS region to ensure low-latency replication; cross-region replication is not supported for synchronous replication. Option A is correct. Option B is incorrect because a Virtual Private Gateway is not needed for replication within a VPC. Option C is incorrect because SAP HANA System Replication operates at the database level and does not require shared storage or multi-attach EBS volumes. Option D is incorrect because a cluster placement group is not required for HANA System Replication; it is used for low-latency networking in scale-out scenarios. Option E is incorrect because an Application Load Balancer is not used for replication traffic; replication is handled directly between HANA instances.

Answer

A Virtual Private Gateway must be attached to the VPC

Answer

The EBS volumes must be configured for multi-attach or use a shared file system

Answer

A cluster placement group must be used

Answer

An Application Load Balancer must be configured for the replication traffic

Question 11

Which THREE of the following are best practices for securing SAP systems on AWS?

Accepted Answer

Enable AWS CloudTrail to log all API calls. AWS CloudTrail logs all API calls made to the AWS environment, including those that modify SAP infrastructure resources such as EC2 instances, security groups, and KMS keys. Enabling CloudTrail is a security best practice because it provides an immutable audit trail for governance, compliance, and operational troubleshooting of SAP workloads on AWS.

Answer

Use IAM users to authenticate SAP system users

Answer

Store SAP system credentials in application source code

Question 12

An SAP administrator created the above IAM policy for an EC2 instance that performs automated SAP HANA backups. The backup script runs successfully but fails to upload the backup files to the S3 bucket. What is the most likely cause?

Accepted Answer

The IAM policy does not include permissions for multipart upload operations. The IAM policy shown in the question (not fully displayed here) likely includes s3:PutObject but omits the required s3:PutObjectPart and s3:AbortMultipartUpload permissions. SAP HANA backups often produce large files that exceed the 5 GB single-upload limit, forcing the AWS CLI or SDK to use multipart upload. Without these permissions, the upload fails after the script runs successfully.

Answer

The S3 bucket policy denies the upload

Answer

The IAM policy does not allow s3:PutObject

Answer

The EC2 instance does not have permission to create snapshots

Question 13

An SAP administrator runs the above CLI command to find the public IP of an m5.2xlarge instance. The output is null. Which of the following is the most likely reason?

Accepted Answer

The instance does not have a public IP address assigned. The CLI command `aws ec2 describe-instances --instance-ids <id> --query 'Reservations[0].Instances[0].PublicIpAddress'` returns null because the instance does not have a public IP address assigned. In AWS, a public IP is only assigned to an instance if it is launched in a subnet that auto-assigns public IPv4 addresses, or if an Elastic IP is attached. The command itself is syntactically correct and will output null (or an empty string) when no public IP exists, not an error.

Answer

The security group blocks the public IP

Answer

The CLI command has a syntax error

Answer

The instance type m5.2xlarge does not support public IP addresses

Question 14

An SAP administrator runs the df command on an SAP HANA server and sees the output above. The /hana/data filesystem is 96% full. Which action should be taken to prevent the database from running out of space?

Accepted Answer

Increase the size of the EBS volume and extend the filesystem. The correct action is to increase the size of the EBS volume and extend the filesystem because the /hana/data filesystem is 96% full, and SAP HANA requires sufficient free space for data growth and savepoint operations. Simply increasing the EBS volume size without extending the filesystem (e.g., using resize2fs or xfs_growfs) would not make the additional space available to the operating system. This approach directly addresses the capacity issue without unnecessary changes to performance or instance type.

Answer

Increase the IOPS of the EBS volume

Answer

Delete old database logs to free up space

Answer

Migrate the database to a larger instance type

Question 15

A company is migrating its SAP ERP system to AWS and needs to choose a storage option for the SAP HANA database. Which AWS storage service is most suitable for SAP HANA data volumes?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the most suitable for SAP HANA data volumes because they provide the highest level of performance, durability, and consistency required for SAP HANA's demanding I/O workloads. io2 Block Express volumes offer up to 256,000 IOPS per volume and sub-millisecond latency, meeting SAP's certification requirements for production SAP HANA deployments on AWS. This storage type ensures the low-latency, high-throughput, and consistent performance that SAP HANA's in-memory database requires for its data and log volumes.

Answer

Amazon S3

Answer

Amazon EBS gp3 volumes

Answer

Amazon EFS