PAS-C01 Design of SAP Workloads on AWS Practice Test 24 — 15 Questions

Question 1

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP Web Dispatchers. The system is experiencing intermittent session drops. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB is not configured for sticky sessions.. The ALB operates at Layer 7 and, by default, distributes each request independently across healthy targets. SAP Web Dispatchers maintain user session state (e.g., logon tickets, application context) locally. Without sticky sessions (session affinity) enabled on the ALB, subsequent requests from the same user can be routed to a different Web Dispatcher, causing the new dispatcher to lack the session context and dropping the user's session. Enabling stickiness based on the ALB-generated cookie ensures all requests from a session are sent to the same Web Dispatcher, preventing these intermittent drops.

Answer

The ALB deletion protection is enabled.

Answer

The ALB health check interval is too short.

Answer

Cross-zone load balancing is not enabled on the ALB.

Question 2

A company is running SAP S/4HANA on AWS with a scale-out HANA configuration. The system is experiencing performance degradation during peak hours. Monitoring shows high network throughput on the HANA nodes. Which EC2 instance family is best suited to mitigate this?

Accepted Answer

x2iedn instances with high network bandwidth.. The x2iedn instances are specifically designed for SAP HANA scale-out configurations, offering high memory per vCPU and dedicated high network bandwidth via the Elastic Network Adapter (ENA). In a scale-out HANA setup, nodes communicate intensively over the network for data synchronization and shared storage access, so high network throughput directly mitigates the performance degradation during peak hours.

Answer

c5 instances with placement groups.

Answer

r5 instances with enhanced networking.

Answer

m5 instances with EBS optimization.

Question 3

A company wants to automate the installation of SAP software on AWS using AWS CloudFormation. Which service is most appropriate to execute the SAP installation scripts?

Accepted Answer

AWS Systems Manager Run Command.. AWS Systems Manager Run Command is the most appropriate service because it can execute scripts (including SAP installation scripts) on EC2 instances without requiring SSH or RDP access, and it integrates with CloudFormation via custom resources or the AWS::SSM::Document resource. This allows you to run complex, long-running installation commands that are typical for SAP software, which Lambda functions cannot handle due to time limits.

Answer

AWS CodeDeploy.

Answer

AWS Lambda functions triggered by CloudFormation.

Answer

AWS OpsWorks for Chef Automate.

Question 4

Which THREE security best practices should be implemented for SAP systems on AWS? (Choose three.)

Accepted Answer

Use security groups to restrict inbound and outbound traffic to SAP systems.. Option B is correct because security groups act as stateful virtual firewalls at the ENI level, and restricting both inbound and outbound traffic to only the required SAP ports (for example, 3200-3299 for SAP dispatcher, 3300 for the gateway, and 3600 for the message server) follows the principle of least privilege. Option D is correct because attaching an IAM role to an EC2 instance delivers temporary credentials via the instance metadata service (IMDS), eliminating the need to embed long-lived access keys in SAP application code or configuration files. Option E is correct because enabling encryption at rest on all EBS volumes used by SAP protects data, redo logs, and backups using AWS KMS-managed keys, satisfying data-protection and compliance requirements. Option A is not appropriate because disabling SSH key pairs in favor of password authentication weakens access security; key-based SSH (or AWS Systems Manager Session Manager) is the recommended practice. Option C is not a security best practice because consolidating all SAP systems into a single VPC increases the blast radius and removes network segmentation, whereas separating production, non-production, and management workloads into distinct VPCs or subnets improves isolation.

Answer

Disable SSH key pair access and use only password authentication.

Answer

Deploy all SAP systems in a single VPC for simplified management.

Question 5

An SAP administrator needs to back up the SAP HANA database daily to Amazon S3 using the Backint agent. What is the prerequisite for this integration?

Accepted Answer

Install the AWS Systems Manager Agent (SSM Agent) on the HANA host.. The AWS Backint agent for SAP HANA requires the AWS Systems Manager Agent (SSM Agent) to be installed on the HANA host. The Backint agent uses SSM Agent to securely communicate with AWS Systems Manager, which orchestrates the backup workflow and enables the agent to write backup data directly to Amazon S3. Without the SSM Agent, the Backint agent cannot authenticate or transfer data to S3, making it a mandatory prerequisite.

Answer

Create a backup vault in AWS Backup.

Answer

Mount an Amazon EFS file system to the HANA host for backup storage.

Answer

Configure AWS Database Migration Service (DMS) to replicate data to S3.

Question 6

An SAP HANA system on AWS is experiencing slow backup performance when using Backint to Amazon S3. The backup throughput is only 200 MB/s. The environment uses an m5.24xlarge instance with 25 Gbps network. What is the most likely cause and solution?

Accepted Answer

The Backint agent is configured with too few parallel streams. Increase the number of streams in the Backint configuration.. The most likely cause is that the Backint agent is configured with too few parallel streams. Backint for SAP HANA on AWS uses multiple concurrent streams to upload backup data to S3; if the stream count is too low, it cannot saturate the available network bandwidth, resulting in throughput far below the instance's 25 Gbps capacity. Increasing the number of parallel streams in the Backint configuration allows the backup to fully utilize the network and achieve higher throughput.

Answer

The network bandwidth is insufficient. Enable S3 Transfer Acceleration.

Answer

The EBS volumes are too slow. Use instance store volumes for temporary storage.

Answer

The S3 bucket is not using multipart upload. Enable multipart upload on the bucket.

Question 7

A company wants to automate the installation of SAP HANA on AWS using CloudFormation. Which AWS service can provide a Quick Start for SAP HANA?

Accepted Answer

AWS Quick Start.. AWS Quick Start is the correct service because it provides pre-built, automated reference deployments for SAP HANA on AWS, including CloudFormation templates that automate the installation and configuration of SAP HANA. This aligns directly with the requirement to use CloudFormation for automation, as Quick Starts are built on CloudFormation and include best-practice architectures.

Answer

AWS Service Catalog.

Answer

AWS OpsWorks.

Answer

Amazon Elastic Kubernetes Service (EKS).

Question 8

An SAP administrator needs to ensure high availability for SAP NetWeaver ABAP stack on AWS. Which three components should be configured in a multi-AZ active/passive cluster? (Select THREE.)

Accepted Answer

Enqueue Replication Server (ERS).. In a multi-AZ active/passive SAP NetWeaver ABAP high-availability architecture on AWS, the ASCS (option B) must be clustered because it hosts the message server and enqueue service, which are single points of failure for the ABAP stack and are protected by a failover cluster across Availability Zones. The Enqueue Replication Server (option A) is also required in the cluster because it runs on a secondary node and replicates the lock table from the ASCS enqueue server, enabling a fast, consistent failover of the enqueue service. The database instance (option C) must likewise be configured in a multi-AZ active/passive cluster (e.g., using SAP-certified HA solutions or native AWS Multi-AZ) since the database is a critical single point of failure and must fail over to a standby in another AZ. Option D (SAP Gateway) is not a separately clustered component in this scenario; it runs as part of the SAP application server instances and does not require its own active/passive cluster. Option E (Dialog instances) are typically deployed as multiple active application servers behind a load balancer and are scaled horizontally, not configured as an active/passive cluster component.

Answer

SAP Gateway.

Answer

Dialog instances.

Question 9

A company is running SAP on AWS and wants to ensure high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which architecture meets this requirement?

Accepted Answer

Deploy ASCS and ERS on separate EC2 instances in different Availability Zones, with a Network Load Balancer.. SAP Central Services (ASCS) and Enqueue Replication Server (ERS) must run on separate EC2 instances in different Availability Zones to achieve high availability. A Network Load Balancer (NLB) is used to distribute traffic and provide a single endpoint, while the enqueue replication mechanism (enrep) synchronizes the lock table between the two instances, enabling automatic failover without data loss.

Answer

Deploy ASCS and ERS on the same EC2 instance with S3 replication.

Answer

Configure Route 53 health checks to switch between two instances in the same AZ.

Answer

Use a single EC2 instance with an S3 bucket for shared storage and Lambda for failover.

Question 10

A customer is running SAP NetWeaver on AWS and wants to use Amazon EFS for shared file storage for the SAP transport directory. Which access option should be used to secure the file system?

Accepted Answer

Security group. Amazon EFS uses security groups as a stateful firewall to control NFS traffic (port 2049) at the network level. For SAP transport directories, security groups allow you to restrict access to specific EC2 instances or other AWS resources that need to mount the EFS file system, providing granular network-layer security without managing individual IP addresses.

Answer

Network ACLs

Answer

IAM role

Answer

S3 bucket policy

Question 11

An SAP system uses an Amazon RDS for SAP ASE database. The database is experiencing high connection timeouts. The SAP team notices that the RDS instance's maximum connections parameter is set to 500. What should be done to resolve the issue?

Accepted Answer

Modify the RDS parameter group to increase max_connections.. The high connection timeouts are caused by the max_connections parameter being set to 500, which is the default for many RDS for SAP ASE instances. Increasing this value in the RDS parameter group allows more concurrent connections to the database, directly resolving the timeout issue without changing the instance size or storage. This is the simplest and most effective fix because the database engine itself is capable of handling more connections if the parameter is adjusted.

Answer

Upgrade the RDS instance to a larger size with more vCPUs.

Answer

Create a read replica to offload connections.

Answer

Increase the allocated storage for the RDS instance.

Question 12

A company is running SAP on AWS and wants to use a custom AMI for SAP application servers. They need to ensure that the AMI is encrypted using AWS KMS. Which step is required to launch encrypted instances from this AMI?

Accepted Answer

Copy the AMI and specify a KMS key for encryption.. To launch encrypted instances from an unencrypted custom AMI, you must first copy the AMI and specify a KMS key for encryption during the copy process. This creates an encrypted AMI that can then be used to launch encrypted instances. AWS does not allow you to directly encrypt an existing AMI in place; the copy operation is the required mechanism.

Answer

Use an AWS Marketplace AMI that is already encrypted.

Answer

Use the AWS Management Console to modify the AMI to enable encryption.

Answer

Specify the KMS key ID in the run-instances command.

Question 13

Which THREE factors should be considered when choosing an EC2 instance type for SAP HANA? (Choose three.)

Accepted Answer

The instance must have enough memory to fit the HANA database.. SAP HANA is an in-memory database that loads the entire dataset into RAM for processing. The EC2 instance must have sufficient memory to accommodate the HANA database size, including overhead for system tables and temporary data, as specified in the SAP HANA memory sizing guidelines.

Answer

The instance should have GPU accelerators for faster query processing.

Answer

The instance must have local instance store volumes for data persistence.

Question 14

Which TWO AWS services can be used to monitor SAP system performance and send alerts? (Choose two.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch (C) is correct because it is the AWS monitoring service that collects SAP metrics (such as SAP application logs and OS-level metrics via the CloudWatch agent) and can create alarms that trigger when thresholds are breached. Amazon Simple Notification Service (A) is correct because SNS is the notification service that CloudWatch alarms target to deliver alerts to email, SMS, or other subscribers, completing the monitor-and-alert workflow. Amazon Inspector (B) is wrong because it is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a performance monitoring or alerting tool. AWS Config (D) is wrong because it records and evaluates resource configuration changes for compliance, not runtime SAP performance. AWS Trusted Advisor (E) is wrong because it provides best-practice checks and recommendations across cost, security, and limits, not SAP performance monitoring or alerting.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 15

A company is implementing SAP S/4HANA on AWS and wants to ensure that the system is backed up properly. They need to back up the HANA database and the application layer. Which approach is recommended for backing up the HANA database?

Accepted Answer

Use the AWS Backint agent to back up HANA to Amazon S3. The AWS Backint agent is the recommended and supported method for backing up SAP HANA databases on AWS. It integrates directly with SAP HANA's native backup interface (backint for SAP HANA) to stream backup data to Amazon S3, ensuring consistent, incremental, and catalog-aware backups without relying on file-system-level snapshots.

Answer

Use EBS snapshots for the HANA data volumes

Answer

Configure an S3 lifecycle policy to archive the HANA log files

Answer

Use AWS Backup with a backup plan that includes the HANA instance