PAS-C01 Design of SAP Workloads on AWS Practice Test 27 — 15 Questions

Question 1

An SAP administrator is designing a new SAP NetWeaver system on AWS. They need to choose an EC2 instance type that is certified for SAP. Which source should they consult?

Accepted Answer

SAP Note 2235581 (SAP HANA Hardware Directory). SAP Note 2235581 is the authoritative source for the SAP HANA Hardware Directory, which lists all EC2 instance types certified for SAP HANA and SAP NetWeaver. AWS relies on SAP's own certification process, so only SAP's official directory provides the definitive list of supported instance types.

Answer

Amazon EC2 console

Answer

AWS Pricing Calculator

Answer

AWS documentation on EC2 instance types

Question 2

A company is experiencing performance issues with their SAP ERP system on AWS. The system is running on an r5.4xlarge EC2 instance with gp2 EBS volumes. The database is SAP HANA. CloudWatch metrics show high write latency on the data volume. Which change would most likely improve performance?

Accepted Answer

Change the volume type to io2 Block Express. SAP HANA is highly sensitive to storage latency, and the high write latency on the data volume indicates that gp2's burst model is insufficient for sustained write workloads. io2 Block Express provides consistent, sub-millisecond latency with provisioned IOPS up to 256,000, which directly addresses the performance bottleneck. This change aligns with AWS best practices for SAP HANA production workloads, which recommend io2 volumes for data and log volumes.

Answer

Increase the size of the gp2 volume to get more baseline IOPS

Answer

Move the database to a t3.large instance

Answer

Enable EBS optimization on the instance

Question 3

A company is planning to run SAP S/4HANA on AWS and needs to ensure that the system can automatically recover from an Availability Zone failure. They want to use SAP HANA System Replication with automatic failover. Which AWS configuration is required?

Accepted Answer

Pacemaker cluster with STONITH across two Availability Zones. SAP HANA System Replication with automatic failover requires a Pacemaker cluster with STONITH (Shoot The Other Node In The Head) configured across two Availability Zones. This setup provides the fencing mechanism necessary to prevent split-brain scenarios and ensures that the failed primary node is forcibly isolated before the secondary node takes over, enabling reliable automatic failover for SAP S/4HANA on AWS.

Answer

AWS Auto Scaling groups with lifecycle hooks

Answer

Amazon RDS Multi-AZ deployment

Answer

Amazon EFS as shared storage for HANA data

Question 4

A company wants to automate the deployment of SAP systems on AWS. Which AWS service is most appropriate for infrastructure as code (IaC) for SAP?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the most appropriate service for infrastructure as code (IaC) for SAP because it allows you to define and provision AWS infrastructure declaratively using templates. This enables repeatable, version-controlled deployments of complex SAP landscapes, including EC2 instances, networking, storage, and security groups, which is critical for SAP's strict architectural requirements.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 5

Which TWO of the following are valid considerations when designing the network for SAP workloads on AWS? (Select TWO.)

Accepted Answer

Enable jumbo frames on the VPC for SAP application tier. Enabling jumbo frames (MTU 9001) on the VPC for the SAP application tier reduces CPU overhead and improves network throughput by allowing larger payloads per packet. This is particularly beneficial for SAP's high-volume data transfers between application and database servers, as it reduces the number of packets processed and lowers latency.

Answer

Use a single subnet for all SAP tiers to simplify routing

Answer

Use a public subnet for the SAP database tier

Answer

Disable VPC Flow Logs to save costs

Question 6

Which THREE storage options are supported for SAP HANA data files on AWS? (Select THREE.)

Accepted Answer

NVMe instance store SSDs on i3en instances. I3en instances provide NVMe instance store SSDs that are directly attached to the physical server, offering very low latency and high IOPS for SAP HANA data files. These instance stores are ephemeral but are the recommended storage for SAP HANA data and log volumes when using certified instance types, as they meet the strict performance requirements for HANA's in-memory database operations.

Answer

Amazon EFS

Answer

Amazon S3

Question 7

Which TWO AWS services can be used to monitor SAP HANA database performance in real time? (Select TWO.)

Accepted Answer

AWS Systems Manager. AWS Systems Manager is correct because it provides the capability to run SAP-specific commands and scripts on EC2 instances via Run Command or State Manager, enabling real-time monitoring of SAP HANA database performance metrics such as memory usage, CPU load, and SQL query execution. It integrates with SAP HANA's built-in monitoring tools (e.g., SAP HANA Studio or SAP HANA Cockpit) to collect and report performance data without requiring additional agents. Amazon CloudWatch is also correct because it can collect and track metrics from SAP HANA by using the CloudWatch agent or custom metrics, allowing real-time monitoring of key performance indicators like CPU utilization, memory consumption, and disk I/O. CloudWatch integrates with SAP HANA via the SAP HANA CloudWatch connector or custom scripts, providing dashboards and alarms for proactive monitoring.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 8

A company is running SAP NetWeaver on AWS and wants to implement a high-availability solution for the SAP Central Services (ASCS). Which AWS service can be used to manage the virtual IP address for failover?

Accepted Answer

Amazon Route 53 with failover routing. Amazon Route 53 with failover routing is the correct choice because it can manage a virtual IP address (VIP) for SAP Central Services (ASCS) failover by using DNS health checks to detect ASCS failure and automatically update the DNS record to point to the healthy secondary instance. This aligns with the SAP on AWS high-availability pattern where a DNS-based VIP is preferred over traditional floating IPs, as AWS does not support layer 2 VIP failover across Availability Zones.

Answer

AWS Global Accelerator

Answer

Elastic Load Balancer (ELB)

Answer

Elastic IP address reassignment

Question 9

A company is migrating its SAP HANA database to AWS. The system requires high network throughput and low latency between the application and database tiers. Which AWS service should be used to achieve this?

Accepted Answer

Amazon EC2 placement group. Amazon EC2 placement groups, specifically cluster placement groups, provide low-latency, high-throughput networking by placing instances in a single Availability Zone within a logical group, ensuring they are physically close to each other. This minimizes network latency and maximizes throughput for tightly coupled workloads like SAP HANA, where application and database tiers require consistent, high-speed communication.

Answer

Amazon Route 53 latency-based routing

Answer

AWS Global Accelerator

Answer

Amazon EBS io2 Block Express volumes

Question 10

A company is running SAP on AWS and needs to ensure that its SAP HANA database is backed up daily with minimal impact on performance. The database is 2 TB in size and runs on an r5.8xlarge instance. Which backup strategy meets these requirements?

Accepted Answer

Use the SAP HANA Backint agent to back up directly to Amazon S3. The SAP HANA Backint agent integrates directly with SAP HANA to stream backup data to Amazon S3, which offloads the backup workload from the database instance's CPU and I/O. This minimizes performance impact compared to local EBS snapshots or volume-based backups, as Backint uses S3's scalable throughput without consuming instance storage bandwidth.

Answer

Perform a full backup to Amazon EBS volumes attached to the instance

Answer

Use AWS Backup to create snapshots of the entire EC2 instance

Answer

Use AWS Storage Gateway to back up to Amazon S3 Glacier

Question 11

An SAP administrator notices that the SAP HANA database is running out of memory frequently. The system is deployed on an EC2 instance with 512 GB of RAM. The HANA memory usage is peaking at 480 GB. What should the administrator do to resolve this issue?

Accepted Answer

Migrate to an instance with more memory, such as x1e.32xlarge. The HANA database is peaking at 480 GB on a 512 GB instance, indicating that memory is nearly fully utilized. Enabling memory overcommit and setting the HANA memory limit to 90% (460.8 GB) would still be below the peak usage, potentially causing out-of-memory errors. The most straightforward and reliable solution is to migrate to a larger instance type, such as x1e.32xlarge, which offers 976 GB of RAM, providing sufficient headroom for current and future peak demands. This aligns with AWS best practices for SAP HANA workloads.

Answer

Configure a swap file on the instance's root EBS volume

Answer

Enable HANA memory overcommit and set the memory limit to 90%

Answer

Reduce the number of HANA table partitions

Question 12

A company is designing a highly available SAP HANA system on AWS. They need to replicate data synchronously to a secondary site in a different Availability Zone. Which AWS service should they use?

Accepted Answer

SAP HANA System Replication (HSR). SAP HANA System Replication (HSR) is the native SAP mechanism for synchronously replicating HANA data to a secondary system. It supports synchronous replication mode, which ensures zero data loss (RPO=0) by committing transactions only after they are confirmed on the secondary site, making it the correct choice for a highly available SAP HANA system across Availability Zones.

Answer

Amazon S3 cross-region replication

Answer

AWS Database Migration Service (DMS)

Answer

Amazon RDS Multi-AZ

Question 13

An SAP application on AWS needs to access an S3 bucket containing sensitive data. Which IAM policy element should be used to enforce encryption in transit?

Accepted Answer

"Condition": {"Bool": {"aws:SecureTransport": "true"}}. The `aws:SecureTransport` condition key in an IAM policy enforces that all requests to the S3 bucket must be made over HTTPS (TLS), ensuring encryption in transit. For an SAP application handling sensitive data, this prevents data exposure during transmission over the network. The `Bool` condition evaluates to `true` only when the request uses SSL/TLS.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "AES256"}}

Answer

"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}

Answer

"Condition": {"IpAddress": {"aws:SourceIp": "10.0.0.0/8"}}

Question 14

A company is deploying SAP on AWS and wants to ensure that the SAP system can automatically recover from an EC2 instance failure. Which AWS feature should be used?

Accepted Answer

EC2 Auto Recovery with CloudWatch alarms. EC2 Auto Recovery, configured via a CloudWatch alarm based on the StatusCheckFailed metric, automatically recovers an EC2 instance by restarting it on a new host if the underlying hardware fails or becomes impaired. This is the correct AWS feature for automatic recovery from an EC2 instance failure, as it directly addresses instance-level hardware issues without requiring manual intervention or reconfiguration.

Answer

Auto Scaling group with a scheduled scaling policy

Answer

Elastic Load Balancer health checks

Answer

Manual restart of the instance from the AWS Management Console

Question 15

An SAP landscape on AWS includes several instances in a VPC. The administrator needs to ensure that SAProuter can connect to the SAP system from the internet securely. Which networking component should be used?

Accepted Answer

AWS VPN connection to the customer's network. An AWS VPN connection establishes an encrypted tunnel over the internet between the customer's on-premises network and the VPC, allowing SAProuter to connect securely to the SAP system without exposing any instance to the public internet. This aligns with the requirement for secure, authenticated connectivity from the internet while maintaining network isolation.

Answer

AWS Direct Connect with a public VIF

Answer

Internet Gateway with a public IP on the SAProuter instance

Answer

AWS CloudFront with a security group