PAS-C01 Design of SAP Workloads on AWS Practice Test 27 — 15 Questions

Question 1

An SAP system on AWS needs to send alerts when the CPU utilization of the application server exceeds 90% for more than 5 minutes. Which AWS service should be used to set up this monitoring?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor CPU utilization metrics for EC2 instances and trigger alarms based on thresholds. You can configure a CloudWatch alarm to evaluate the CPUUtilization metric over a 5-minute period and send notifications via Amazon SNS when the 90% threshold is breached.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 2

Which TWO of the following are best practices for running SAP HANA on AWS? (Choose TWO.)

Accepted Answer

Use EBS-optimized instances or instances with dedicated EBS bandwidth.. Option B is correct because SAP HANA is highly I/O-intensive, so AWS best practice is to use EBS-optimized instances (or instance types with dedicated EBS bandwidth, such as the memory-optimized R5/R6i/X1/X2 families) to ensure consistent, low-latency storage throughput for the HANA data and log volumes. Option C is correct because SAP and AWS recommend running the HANA database on its own dedicated EC2 instance, separate from application servers, so that CPU, memory, and I/O resources are not shared and the database can be sized and scaled independently. Option A is not appropriate because burstable t3 instances do not meet SAP HANA's requirements for sustained high memory bandwidth, CPU performance, and certified instance types, even for non-production. Option D is wrong because SAP HANA is an in-memory database and AWS/SAP guidance is to size memory correctly and avoid relying on swap, which severely degrades performance and is not a supported practice. Option E is wrong because Amazon EFS is a shared NFS file system and is not certified or supported for HANA data volumes; HANA requires block storage such as Amazon EBS (e.g., gp3/io2) or supported instance store.

Answer

Use a burstable instance type (e.g., t3) for non-production HANA systems.

Answer

Configure a large swap space on the HANA instance to handle memory pressure.

Answer

Mount the HANA data volume using Amazon EFS for high throughput.

Question 3

Which THREE of the following are valid options for high availability of SAP HANA on AWS? (Choose THREE.)

Accepted Answer

Storage replication using NetApp Cloud Volumes ONTAP.. Option A is correct because NetApp Cloud Volumes ONTAP provides block-level storage replication (SnapMirror) that can be used to maintain a synchronized copy of SAP HANA data and enable recovery or takeover on AWS, making it a valid HA approach. Option B is correct because HANA System Replication (HSR) combined with automatic failover using an AWS Elastic IP or Route 53 DNS failover is a recognized high-availability pattern on AWS, where the overlay IP or DNS record is moved to the secondary node. Option E is correct because HANA System Replication with manual failover is also a valid HA configuration; HSR itself provides the replication, and failover can be triggered manually (e.g., via hdbnsutil -sr_takeover) rather than automatically. Option C is not correct in this context because asynchronous replication to a secondary region is a disaster-recovery (DR) strategy, not a high-availability option within a region. Option D is not correct because Amazon RDS Multi-AZ is a managed relational database service for engines like MySQL, PostgreSQL, SQL Server, and Oracle, and it does not support SAP HANA.

Answer

SAP HANA replication to a secondary region with asynchronous replication.

Answer

Amazon RDS Multi-AZ for HANA.

Question 4

Which TWO of the following are recommended practices for securing SAP workloads on AWS? (Choose TWO.)

Accepted Answer

Use security groups to restrict inbound traffic to only required ports and IP ranges.. Option A is correct because security groups act as stateful virtual firewalls at the instance/ENI level, and restricting inbound rules to only the specific ports SAP requires (for example 3200-3299 for SAP dispatcher, 3300 for the gateway, or 443/8443 for web services) and to trusted CIDR ranges minimizes the attack surface. Option E is correct because enabling EBS encryption protects SAP HANA data at rest, including data volumes, log volumes, and backups, using AWS KMS-managed keys, which is a recommended practice for sensitive in-memory database workloads. Option B is not recommended because the AWS root account should be locked away with MFA and never used for daily administration; instead, use IAM users/roles with least privilege. Option C is wrong because assigning public IPs exposes SAP instances directly to the internet; access should go through bastion hosts, VPN, or AWS Direct Connect. Option D is wrong because placing SAP application servers in a public subnet increases exposure; they belong in private subnets behind NAT gateways or load balancers.

Answer

Use the AWS root account for daily administration of SAP systems.

Answer

Assign public IP addresses to SAP instances for direct internet access.

Answer

Place SAP application servers in a public subnet for ease of access.

Question 5

An SAP workload is running on an EC2 instance in a private subnet. The application needs to access an S3 bucket for backups. Which AWS service should be used to enable private connectivity without traversing the internet?

Accepted Answer

VPC Endpoint (Gateway). A VPC Endpoint (Gateway) allows private connectivity between an EC2 instance in a private subnet and an S3 bucket without traversing the internet. It uses AWS’s internal network and route table entries to direct S3 traffic through the endpoint, ensuring data never leaves the AWS backbone. This is the correct choice for SAP workloads requiring secure, low-latency backups to S3.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Site-to-Site VPN

Question 6

A company is migrating its SAP HANA database to AWS. The database requires high I/O and low latency. Which storage option should be used for the /hana/data volume?

Accepted Answer

io2 EBS volume. The /hana/data volume for SAP HANA requires high I/O and low latency, which is best met by io2 EBS volumes. io2 volumes are provisioned IOPS SSD volumes designed for latency-sensitive transactional workloads, offering up to 64,000 IOPS per volume and 99.999% durability, making them ideal for SAP HANA data files.

Answer

gp3 EBS volume

Answer

Amazon S3

Answer

Amazon EFS

Question 7

Which AWS service is used to automate the installation and configuration of SAP applications on AWS according to best practices?

Accepted Answer

AWS Launch Wizard for SAP. AWS Launch Wizard for SAP is the correct service because it provides a guided, best-practice-based deployment experience specifically for SAP applications. It automatically provisions the necessary AWS infrastructure (EC2, EBS, VPC, etc.) and configures the SAP software according to AWS and SAP validated architectures, reducing manual effort and errors.

Answer

AWS OpsWorks

Answer

AWS CloudFormation

Answer

AWS Quick Starts

Question 8

A company runs SAP ERP on AWS. The system needs to be highly available with automatic failover in case of an Availability Zone failure. Which architecture should be used?

Accepted Answer

SAP HANA System Replication across two Availability Zones with automatic failover. SAP HANA System Replication (HSR) across two Availability Zones with automatic failover is the correct architecture because it provides synchronous or asynchronous replication of the SAP HANA database at the storage or log level, enabling automatic failover to a standby instance in a different AZ when the primary fails. This meets the requirement for high availability and automatic failover during an AZ failure, as HSR is the native SAP mechanism for database-level HA on AWS, unlike generic AWS services that do not handle SAP-specific application state or replication requirements.

Answer

Route 53 failover routing policy

Answer

Auto Scaling group with multiple EC2 instances in different AZs

Answer

AWS RDS Multi-AZ deployment

Question 9

An administrator needs to back up SAP HANA database to S3 with encryption. The backup must be encrypted at rest in S3. Which combination of actions should be taken?

Accepted Answer

Configure S3 bucket with default encryption using SSE-S3 or SSE-KMS. Configuring an S3 bucket with default encryption using SSE-S3 or SSE-KMS ensures that backups written to S3 are automatically encrypted at rest. SSE-S3 uses Amazon-managed keys with AES-256, while SSE-KMS allows you to use AWS KMS customer managed keys (CMKs) for additional control. This meets the requirement for encryption at rest in S3 without requiring additional infrastructure or manual key management.

Answer

Use AWS CloudHSM to generate keys and store them in S3

Answer

Enable S3 Versioning and use S3-managed keys

Answer

Use AWS Backup to back up to S3 with default settings

Question 10

A company is designing a disaster recovery strategy for SAP S/4HANA. The primary site is in us-east-1 and the DR site is in us-west-2. The RPO must be less than 30 minutes and RTO less than 2 hours. Which approach meets these requirements?

Accepted Answer

Configure HANA System Replication in asynchronous mode with automatic takeover. HANA System Replication in asynchronous mode with automatic takeover meets the RPO of less than 30 minutes and RTO of less than 2 hours. Asynchronous replication provides near-real-time data transfer across AWS regions with minimal impact on primary performance, and automatic takeover enables fast failover to the DR instance, satisfying the RTO requirement.

Answer

Configure HANA System Replication in synchronous mode across regions

Answer

Take nightly backups to S3 and restore in DR

Answer

Use AWS Backup to copy daily snapshots to DR region

Question 11

An administrator is troubleshooting an SAP system where the application server cannot connect to the database server. Both servers are in the same VPC but different subnets. Security groups allow traffic on the database port. What is the next step to diagnose the issue?

Accepted Answer

Check the Network ACLs for both subnets to ensure inbound/outbound rules allow the database port. Network ACLs (NACLs) are stateless, meaning they require explicit inbound and outbound rules for traffic to flow in both directions. Even if security groups allow the database port, a missing or misconfigured NACL rule on either subnet can silently drop traffic. Since the servers are in different subnets, checking NACLs is the next logical step after confirming security groups are correct.

Answer

Check the DB Subnet Group configuration

Answer

Verify route tables for the subnets

Answer

Review VPC Flow Logs for rejected traffic

Question 12

Which TWO metrics should be monitored to ensure the health of an SAP HANA database running on AWS? (Select two.)

Accepted Answer

Disk I/O (read/write throughput). Option C (Disk I/O read/write throughput) is correct because SAP HANA is an in-memory database whose performance and availability depend heavily on fast, consistent storage I/O for persistence, log writes, savepoints, and reloading column store data from disk, so monitoring read/write throughput and latency on the underlying EBS volumes is essential to detect bottlenecks that can stall transactions or crash the database. Option D (HANA System Replication Lag) is correct because HSR is the primary HA/DR mechanism for HANA on AWS, and monitoring replication lag ensures the secondary site can meet the configured RPO; excessive lag indicates network, resource, or configuration problems that would cause data loss or failed takeover during a failover event. Option A (Elastic Load Balancer Latency) does not belong because ELBs are not part of a standard SAP HANA database architecture — HANA clients connect directly to the HANA instance (or via SAP application servers), so ELB metrics are irrelevant to HANA health. Option B (S3 Bucket Size) does not belong because S3 is used for backups, not for live HANA database operations, so bucket size is not a health metric for the running database. Option E (CPU Credit Balance) does not belong because CPU credits apply only to burstable T-series instances, which are not supported or recommended for production SAP HANA workloads that require dedicated, consistent compute performance.

Answer

Elastic Load Balancer Latency

Answer

S3 Bucket Size

Answer

CPU Credit Balance

Question 13

Which THREE considerations are important when designing a SAP workload for high availability on AWS? (Select three.)

Accepted Answer

Deploy the SAP application across multiple Availability Zones. Option B is correct because deploying the SAP application across multiple Availability Zones provides fault isolation, so an AZ-level failure does not take down the entire SAP landscape. Option D is correct because Amazon S3 offers durable, scalable, and cost-effective storage for long-term backups and can be used with lifecycle policies and cross-region replication for disaster recovery. Option E is correct because SAP HANA System Replication continuously replicates data from a primary to a standby HANA instance, enabling fast failover and minimal data loss in a high-availability architecture. Option A is not appropriate because EBS Multi-Attach is limited to specific Nitro instances and cluster-aware file systems, and it is not a supported or recommended mechanism for sharing SAP data volumes across instances. Option C is not a high-availability design because running the SAP system on a single large instance creates a single point of failure with no redundancy.

Answer

Use EBS Multi-Attach to share volumes between two EC2 instances

Answer

Run the SAP system on a single large instance

Question 14

A company is migrating its SAP ERP system to AWS. The system has strict high availability requirements with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The SAP application and database (SAP HANA) must be in the same AWS Region but can be in different Availability Zones. Which architecture should the company use to meet these requirements?

Accepted Answer

Deploy SAP HANA in a Multi-AZ cluster using synchronous replication across two Availability Zones, with the SAP application servers in an Auto Scaling group across the same AZs.. It uses synchronous replication for SAP HANA across two Availability Zones, which ensures zero data loss and meets the RPO of 15 minutes. The Multi-AZ cluster with automatic failover achieves the RTO of 2 hours, while the SAP application servers in an Auto Scaling group across the same AZs provide high availability and load balancing. This architecture aligns with AWS best practices for SAP HANA HA, leveraging HANA System Replication (HSR) in sync mode.

Answer

Deploy SAP HANA in a single Availability Zone with asynchronous replication to a secondary instance in another AZ, and use manual failover.

Answer

Deploy SAP HANA on a single EC2 instance with EBS snapshots every 5 minutes, and use a secondary instance in another AZ with snapshots restored.

Answer

Deploy SAP HANA on a single EC2 instance with hourly backups to Amazon S3 and a script to restore the backup on a new instance in a different AZ.

Question 15

A company is planning to run SAP S/4HANA on AWS. They need to ensure that the SAP system can be accessed from the corporate network via a secure VPN connection. Which AWS service should be used to establish this connectivity?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates a secure IPsec tunnel between the corporate network's on-premises VPN device and a Virtual Private Gateway (VGW) attached to the VPC hosting the SAP S/4HANA system. This enables encrypted communication over the public internet, meeting the requirement for secure VPN connectivity from the corporate network to the SAP workload.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect