PAS-C01 Design of SAP Workloads on AWS Practice Test 32 — 15 Questions

Question 1

An SAP administrator created the IAM policy shown in the exhibit to allow an EC2 instance to back up to an S3 bucket. However, the backup fails with an access denied error. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not grant permissions on the bucket itself.. The IAM policy shown in the exhibit grants permissions on individual objects within the S3 bucket (using the `arn:aws:s3:::bucket-name/*` resource ARN) but does not grant any permissions on the bucket itself (using `arn:aws:s3:::bucket-name`). For backup operations, the EC2 instance typically needs to list the bucket or check its existence before writing objects, which requires `s3:ListBucket` or similar actions on the bucket resource. Without these bucket-level permissions, the backup fails with an access denied error.

Answer

The actions specified are insufficient for backup operations.

Answer

The resource ARN is incorrectly formatted.

Answer

The bucket is in a different region than the EC2 instance.

Question 2

An SAP HANA database is running on an r5.8xlarge instance. The administrator notices high swap usage and suspects memory pressure. Which AWS metric should be monitored to confirm memory utilization?

Accepted Answer

CWAgent namespace metrics. The CWAgent namespace metrics are correct because the CloudWatch agent, when installed on the EC2 instance, can capture detailed OS-level memory utilization metrics (such as `mem_used_percent` and `mem_available_percent`) that are not available in the default EC2 or EBS namespaces. This allows the administrator to directly confirm memory pressure causing high swap usage on the SAP HANA database.

Answer

AWS/Lambda namespace metrics

Answer

EC2 namespace metrics

Answer

EBS namespace metrics

Question 3

A company is migrating an SAP ECC system to AWS and needs to ensure low-latency connectivity between the application server and the database server. Both servers will be in the same VPC but different subnets. Which configuration best minimizes latency?

Accepted Answer

Place the servers in the same placement group and the same Availability Zone. Placing both the SAP application server and database server in the same placement group and the same Availability Zone ensures they are physically close together within a single data center, minimizing network latency. This configuration leverages the low-latency, high-bandwidth network connectivity provided by a cluster placement group, which is critical for SAP ECC workloads that require rapid database transactions.

Answer

Place the servers in different placement groups but the same Availability Zone

Answer

Use a cluster placement group spanning two Availability Zones

Answer

Place the servers in different Availability Zones but within the same region

Question 4

An SAP administrator is setting up an S3 bucket to store SAP HANA backup files. The backups must be encrypted at rest using an AWS KMS customer managed key. Which bucket policy condition key should be used to enforce that only requests using KMS encryption with that specific key are allowed?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that only requests using a specific AWS KMS customer managed key for server-side encryption are permitted. This key is evaluated against the `x-amz-server-side-encryption-aws-kms-key-id` header in the request, ensuring that backups are encrypted with the exact KMS key ID specified in the bucket policy.

Answer

kms:EncryptionContext

Answer

s3:ServerSideEncryption

Answer

s3:x-amz-server-side-encryption

Question 5

A company is running SAP Business Suite on AWS and wants to implement a disaster recovery (DR) strategy with a Recovery Time Objective (RTO) of less than 2 hours and a Recovery Point Objective (RPO) of less than 15 minutes. The primary and DR sites are in different AWS regions. Which solution meets these requirements?

Accepted Answer

Use SAP HANA System Replication in asynchronous mode across regions with EBS snapshots every 15 minutes. SAP HANA System Replication in asynchronous mode across regions meets the RPO of less than 15 minutes because it continuously replicates log data with minimal latency, and the RTO of less than 2 hours is achievable by taking over the replicated HANA database in the DR region. EBS snapshots every 15 minutes provide an additional layer for persistent storage consistency, but the primary mechanism for meeting the RPO is the asynchronous log replication, which typically achieves sub-minute RPO.

Answer

Use EBS snapshots replicated to the DR region with S3 cross-region replication

Answer

Use AWS Backup with continuous backups

Answer

Use SAP HANA System Replication in synchronous mode across regions

Question 6

An SAP administrator notices that the SAP HANA database is running out of disk space on the /hana/data volume. The volume is an EBS gp3 volume with 2000 GB size. The administrator wants to increase the size without downtime. Which action should be taken?

Accepted Answer

Use the modify-volume API to increase the size of the existing volume. AWS EBS gp3 volumes support online resizing via the modify-volume API without requiring downtime. The SAP HANA /hana/data volume can be increased in size while the instance remains running, as EBS volumes can be modified dynamically. After the modification, the administrator must extend the file system to recognize the new space, but no volume detachment or data migration is needed.

Answer

Detach the volume, create a snapshot, create a larger volume from the snapshot, and attach it

Answer

Create a new larger volume and copy data using rsync

Answer

Increase the IOPS of the volume to improve performance

Question 7

Which THREE of the following are best practices for securing SAP systems on AWS?

Accepted Answer

Enable AWS CloudTrail to log all API calls. Option A is correct because AWS CloudTrail records all API calls made in the AWS account, providing the audit trail and change visibility needed to detect unauthorized or suspicious activity against SAP infrastructure. Option B is correct because enabling encryption at rest with AWS KMS for SAP HANA data volumes protects sensitive business data and complies with SAP and regulatory requirements for data-at-rest protection. Option C is correct because security groups act as stateful virtual firewalls that restrict inbound and outbound traffic to SAP application servers, limiting exposure to only required ports and trusted sources. Option D is not a best practice because SAP system users should be authenticated through SAP's own mechanisms (such as SAP NetWeaver AS ABAP/Java authentication or SSO), not AWS IAM, which is designed for AWS resource access. Option E is not a best practice because hardcoding SAP credentials in application source code exposes secrets to anyone with repository access; credentials should be stored in AWS Secrets Manager or Systems Manager Parameter Store instead.

Answer

Use IAM users to authenticate SAP system users

Answer

Store SAP system credentials in application source code

Question 8

An SAP administrator runs the above CLI command to find the public IP of an m5.2xlarge instance. The output is null. Which of the following is the most likely reason?

Accepted Answer

The instance does not have a public IP address assigned. The CLI command `aws ec2 describe-instances --instance-ids <id> --query 'Reservations[0].Instances[0].PublicIpAddress'` returns null because the instance does not have a public IP address assigned. In AWS, a public IP is only assigned to an instance if it is launched in a subnet that auto-assigns public IPv4 addresses, or if an Elastic IP is attached. The command itself is syntactically correct and will output null (or an empty string) when no public IP exists, not an error.

Answer

The security group blocks the public IP

Answer

The CLI command has a syntax error

Answer

The instance type m5.2xlarge does not support public IP addresses

Question 9

An SAP administrator runs the df command on an SAP HANA server and sees the output above. The /hana/data filesystem is 96% full. Which action should be taken to prevent the database from running out of space?

Accepted Answer

Increase the size of the EBS volume and extend the filesystem. The correct action is to increase the size of the EBS volume and extend the filesystem because the /hana/data filesystem is 96% full, and SAP HANA requires sufficient free space for data growth and savepoint operations. Simply increasing the EBS volume size without extending the filesystem (e.g., using resize2fs or xfs_growfs) would not make the additional space available to the operating system. This approach directly addresses the capacity issue without unnecessary changes to performance or instance type.

Answer

Increase the IOPS of the EBS volume

Answer

Delete old database logs to free up space

Answer

Migrate the database to a larger instance type

Question 10

A company is migrating its SAP ERP system to AWS and needs to choose a storage option for the SAP HANA database. Which AWS storage service is most suitable for SAP HANA data volumes?

Accepted Answer

Amazon EBS io2 Block Express volumes. Amazon EBS io2 Block Express volumes are the most suitable for SAP HANA data volumes because they provide the highest level of performance, durability, and consistency required for SAP HANA's demanding I/O workloads. io2 Block Express volumes offer up to 256,000 IOPS per volume and sub-millisecond latency, meeting SAP's certification requirements for production SAP HANA deployments on AWS. This storage type ensures the low-latency, high-throughput, and consistent performance that SAP HANA's in-memory database requires for its data and log volumes.

Answer

Amazon S3

Answer

Amazon EBS gp3 volumes

Answer

Amazon EFS

Question 11

A company runs SAP Business Suite on AWS. They plan to use the SAP Landscape Management (LaMa) connector to automate system copy and relocation. What is a prerequisite for using the AWS LaMa connector?

Accepted Answer

An IAM role with permissions for EC2, EBS, and CloudFormation actions. The AWS LaMa connector automates SAP system copy and relocation by orchestrating EC2, EBS, and CloudFormation actions. An IAM role with permissions for these services is required so that LaMa can programmatically manage infrastructure resources (e.g., stop/start instances, snapshot volumes, create CloudFormation stacks) without manual intervention. This role is assumed by the LaMa connector when executing workflows.

Answer

An EC2 Auto Scaling group configured for the SAP application tier

Answer

AWS Systems Manager managed instances for all SAP servers

Answer

SSH keys for all SAP instances to allow LaMa to connect

Question 12

A company is designing an SAP S/4HANA deployment on AWS with high availability. They want to use a shared file system for the SAP transport directory. Which AWS service should they use for this shared file system?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, which is exactly what an SAP transport directory requires. The SAP transport directory (e.g., /usr/sap/trans) must be accessible from all SAP application servers in the high-availability cluster, and EFS supports the necessary file locking and consistency semantics for SAP's transport management system (TMS).

Answer

Amazon FSx for Windows File Server

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 13

An SAP HANA system on AWS is experiencing performance degradation. The administrator suspects that the EBS volumes are not providing consistent IOPS. Which AWS tool can be used to monitor the performance of EBS volumes at the volume level?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides detailed metrics for EBS volumes, including `VolumeReadOps`, `VolumeWriteOps`, `VolumeQueueLength`, and `VolumeIdleTime`, which allow administrators to monitor IOPS performance at the individual volume level. By setting CloudWatch alarms on these metrics, you can detect when an EBS volume is not delivering the provisioned IOPS, which is critical for SAP HANA workloads that require consistent, high-throughput storage.

Answer

AWS X-Ray

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 14

An SAP administrator is planning a Disaster Recovery (DR) strategy for SAP HANA on AWS. The DR site is in a different AWS Region. Which AWS service can replicate SAP HANA data to the DR region with low Recovery Point Objective (RPO)?

Accepted Answer

SAP HANA System Replication with log shipping. SAP HANA System Replication with log shipping is the correct choice because it provides near-synchronous or synchronous replication of HANA data and transaction logs to a secondary system in another AWS Region, enabling a Recovery Point Objective (RPO) of seconds or even zero data loss. This native HANA feature is optimized for SAP workloads and integrates directly with HANA's persistence layer, making it the most suitable DR method for low RPO requirements.

Answer

Amazon EBS snapshots copied to the DR region

Answer

AWS Database Migration Service (DMS) with ongoing replication

Answer

Amazon S3 cross-region replication

Question 15

A company runs SAP NetWeaver on AWS and needs to ensure that the SAP application server instances are evenly distributed across two Availability Zones. Which AWS service should be used to distribute traffic?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as SAP application servers, in different Availability Zones. By registering SAP instances in two AZs and enabling cross-zone load balancing, the ALB ensures even distribution of traffic across both zones, which is critical for high availability and balanced resource utilization in SAP NetWeaver deployments.

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Answer

Amazon Route 53 weighted routing