PAS-C01 Design of SAP Workloads on AWS Practice Test 9 — 15 Questions

Question 1

An SAP HANA system on AWS is experiencing slow backup performance when using Backint to Amazon S3. The backup throughput is only 200 MB/s. The environment uses an m5.24xlarge instance with 25 Gbps network. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Backint agent is configured with too few parallel streams. Increase the number of streams in the Backint configuration.. The most likely cause is that the Backint agent is configured with too few parallel streams. Backint for SAP HANA on AWS uses multiple concurrent streams to upload backup data to S3; if the stream count is too low, it cannot saturate the available network bandwidth, resulting in throughput far below the instance's 25 Gbps capacity. Increasing the number of parallel streams in the Backint configuration allows the backup to fully utilize the network and achieve higher throughput.

Answer

The network bandwidth is insufficient. Enable S3 Transfer Acceleration.

Answer

The EBS volumes are too slow. Use instance store volumes for temporary storage.

Answer

The S3 bucket is not using multipart upload. Enable multipart upload on the bucket.

Question 2

A company wants to automate the installation of SAP HANA on AWS using CloudFormation. Which AWS service can provide a Quick Start for SAP HANA?

Accepted Answer

AWS Quick Start.. AWS Quick Start is the correct service because it provides pre-built, automated reference deployments for SAP HANA on AWS, including CloudFormation templates that automate the installation and configuration of SAP HANA. This aligns directly with the requirement to use CloudFormation for automation, as Quick Starts are built on CloudFormation and include best-practice architectures.

Answer

AWS Service Catalog.

Answer

AWS OpsWorks.

Answer

Amazon Elastic Kubernetes Service (EKS).

Question 3

An SAP administrator needs to ensure high availability for SAP NetWeaver ABAP stack on AWS. Which three components should be configured in a multi-AZ active/passive cluster? (Select THREE.)

Accepted Answer

Enqueue Replication Server (ERS).. The Enqueue Replication Server (ERS) is a critical component in an SAP NetWeaver ABAP stack active/passive cluster because it replicates the lock table from the primary ASCS instance to the standby node. In a multi-AZ setup, this ensures that if the primary ASCS fails, the standby can take over with minimal disruption, as the lock state is preserved. Without ERS, a failover would require all locked resources to be released, causing data inconsistencies or application errors.

Answer

SAP Gateway.

Answer

Dialog instances.

Question 4

A company is migrating SAP workloads to AWS and needs to choose storage for SAP HANA. Which two storage options are supported for SAP HANA data volumes? (Select TWO.)

Accepted Answer

Amazon EBS io2 Block Express volumes.. Amazon EBS io2 Block Express volumes are supported for SAP HANA data volumes because they provide high durability (99.999% durability) and sub-millisecond latency with up to 256,000 IOPS per volume, meeting SAP's performance requirements for production HANA workloads. Amazon EBS gp3 volumes are also supported for SAP HANA data volumes, offering a baseline of 3,000 IOPS and 125 MB/s throughput with the ability to scale independently, making them suitable for non-production or smaller production environments.

Answer

Amazon S3.

Answer

Amazon EFS.

Answer

Instance Store (NVMe SSD) volumes.

Question 5

An SAP administrator created the IAM policy above for an EC2 instance role used by SAP HANA Backint agent. The backup to S3 fails with access denied. What is the likely cause?

Accepted Answer

The policy grants permissions on objects but not on the bucket itself. For s3:PutObject and s3:GetObject, a bucket-level permission is also required for some operations.. The policy grants s3:PutObject and s3:GetObject on objects within the bucket (using the "arn:aws:s3:::bucket-name/*" resource), but does not include a bucket-level permission such as s3:PutObject or s3:GetObject on the bucket itself ("arn:aws:s3:::bucket-name"). For certain S3 operations, including multipart uploads and object writes that require bucket-level authorization checks, the IAM policy must explicitly allow the action on both the bucket and the object ARN. Without this, the SAP HANA Backint agent fails with access denied.

Answer

The policy does not allow s3:PutObject.

Answer

The policy does not allow ec2:CreateSnapshot.

Answer

The policy does not allow s3:ListBucket.

Question 6

An SAP HANA database is running on a Dedicated Host in us-east-1a. The system requires a disaster recovery site in us-west-2. What limitation does the use of a Dedicated Host impose on the DR setup?

Accepted Answer

The DR site requires a separate Dedicated Host in us-west-2, increasing cost.. A Dedicated Host in us-east-1a is a physical server dedicated to your use, and to set up disaster recovery in us-west-2, you must provision a separate Dedicated Host in that region. This increases costs as you are paying for two Dedicated Hosts instead of one, and the DR host cannot be shared or reserved in advance for a specific instance type without an active allocation.

Answer

The DR site must also use a Dedicated Host, which cannot be reserved in advance.

Answer

The Dedicated Host cannot be used with SAP HANA System Replication.

Answer

The HANA instance cannot be migrated to a different host, so DR is not possible.

Question 7

An SAP administrator wants to attach the EBS volume shown above to two EC2 instances running SAP HANA in a scale-out configuration. What is the issue?

Accepted Answer

The volume is gp3 type, which does not support Multi-Attach.. The gp3 volume type does not support the Multi-Attach feature, which is required to attach a single EBS volume to multiple EC2 instances simultaneously. For SAP HANA scale-out configurations, shared storage is necessary for the /hana/shared file system, and Multi-Attach is only supported on io1 and io2 block express volumes. Therefore, using a gp3 volume prevents the multi-attach capability needed for this architecture.

Answer

The volume size is too small for HANA scale-out.

Answer

SAP HANA scale-out does not support shared volumes.

Answer

The volume IOPS is insufficient.

Question 8

A company is running SAP on AWS and wants to ensure high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which architecture meets this requirement?

Accepted Answer

Deploy ASCS and ERS on separate EC2 instances in different Availability Zones, with a Network Load Balancer.. SAP Central Services (ASCS) and Enqueue Replication Server (ERS) must run on separate EC2 instances in different Availability Zones to achieve high availability. A Network Load Balancer (NLB) is used to distribute traffic and provide a single endpoint, while the enqueue replication mechanism (enrep) synchronizes the lock table between the two instances, enabling automatic failover without data loss.

Answer

Deploy ASCS and ERS on the same EC2 instance with S3 replication.

Answer

Configure Route 53 health checks to switch between two instances in the same AZ.

Answer

Use a single EC2 instance with an S3 bucket for shared storage and Lambda for failover.

Question 9

An SAP system on AWS is experiencing high write latency on the database layer. The DB is running on an r5.8xlarge instance with EBS gp2 volumes. The SAP team notices that the EBS volume write queue depth is frequently above 16. What is the MOST likely cause and what change should be made?

Accepted Answer

The volume is too small for the workload. Increase the volume size to gain baseline IOPS.. Gp2 volume baseline IOPS scales linearly with size (3 IOPS per GiB). An r5.8xlarge instance supports EBS optimization, so the bottleneck is not the instance. With a write queue depth frequently above 16, the gp2 volume is likely too small to provide sufficient baseline IOPS, causing the queue to back up. Increasing the volume size raises the baseline IOPS, reducing queue depth and write latency.

Answer

The instance type does not support EBS optimization. Switch to a network-optimized instance.

Answer

The EBS volume is not optimized for SAP. Use io1 with high provisioned IOPS.

Answer

The gp2 volume does not provide enough burst IOPS. Migrate to gp3.

Question 10

A customer wants to migrate their SAP HANA database to AWS and needs to ensure that the EBS volumes for /hana/data and /hana/log are configured for maximum throughput and low latency. Which EBS volume type should be used for /hana/data?

Accepted Answer

io2. For SAP HANA workloads on AWS, the /hana/data volume requires the highest level of IOPS and low latency to support real-time data processing. io2 Block Express volumes provide up to 256,000 IOPS and sub-millisecond latency, making them the correct choice for /hana/data. io2 volumes also offer 99.999% durability, which is critical for SAP HANA database consistency.

Answer

st1

Answer

gp3

Answer

sc1

Question 11

An SAP system on AWS is experiencing high CPU utilization on the application server during peak hours. The SAP administrator wants to add a new application server instance to distribute the load. Which AWS service should be used to automatically register the new instance with the existing SAP system's load balancer?

Accepted Answer

Auto Scaling group. An Auto Scaling group can automatically launch new EC2 instances based on scaling policies (e.g., when CPU utilization exceeds a threshold) and, when configured with a lifecycle hook or a launch template that includes a user-data script, can register the new instance with the existing SAP system's load balancer (such as an Application Load Balancer or Classic Load Balancer). This ensures the new application server is automatically added to the load balancer target group, distributing incoming traffic without manual intervention.

Answer

AWS Lambda

Answer

Amazon SQS

Answer

AWS CloudFormation

Question 12

A company is planning to run SAP S/4HANA on AWS. They need to ensure that the SAP system can be restored within 4 hours in the event of a disaster. Which AWS service should be used to achieve this recovery time objective (RTO)?

Accepted Answer

AWS Elastic Disaster Recovery. AWS Elastic Disaster Recovery (AWS DRS) is the correct service because it provides continuous replication of SAP S/4HANA workloads with sub-second RPO and supports automated recovery orchestration, enabling restoration within the 4-hour RTO. It is the direct successor to CloudEndure Disaster Recovery and is purpose-built for enterprise applications like SAP, offering non-disruptive testing and fast failover to a secondary AWS Region or Availability Zone.

Answer

EBS snapshots copied to another region

Answer

AWS CloudEndure Disaster Recovery

Answer

Amazon S3 cross-region replication

Question 13

An SAP customer is using AWS KMS to encrypt EBS volumes for an SAP HANA database. The database administrator reports that the database is slow after enabling encryption. What is the MOST likely cause?

Accepted Answer

The KMS API request rate limit is being exceeded, causing throttling.. When EBS volumes are encrypted, every I/O operation to the volume must call AWS KMS to decrypt the data key. If the database workload generates a high rate of these requests, it can exceed the KMS API request rate limit (default 5,500 requests per second per Region for symmetric keys), causing throttling and increased latency. This is the most likely cause of the observed slowdown after enabling encryption.

Answer

The KMS key is not rotated frequently enough.

Answer

The EBS volume is not using the correct instance type for encrypted volumes.

Answer

The KMS key is using a symmetric algorithm that degrades CPU performance.

Question 14

A customer is running SAP NetWeaver on AWS and wants to use Amazon EFS for shared file storage for the SAP transport directory. Which access option should be used to secure the file system?

Accepted Answer

Security group. Amazon EFS uses security groups as a stateful firewall to control NFS traffic (port 2049) at the network level. For SAP transport directories, security groups allow you to restrict access to specific EC2 instances or other AWS resources that need to mount the EFS file system, providing granular network-layer security without managing individual IP addresses.

Answer

Network ACLs

Answer

IAM role

Answer

S3 bucket policy

Question 15

An SAP system uses an Amazon RDS for SAP ASE database. The database is experiencing high connection timeouts. The SAP team notices that the RDS instance's maximum connections parameter is set to 500. What should be done to resolve the issue?

Accepted Answer

Modify the RDS parameter group to increase max_connections.. The high connection timeouts are caused by the max_connections parameter being set to 500, which is the default for many RDS for SAP ASE instances. Increasing this value in the RDS parameter group allows more concurrent connections to the database, directly resolving the timeout issue without changing the instance size or storage. This is the simplest and most effective fix because the database engine itself is capable of handling more connections if the parameter is adjusted.

Answer

Upgrade the RDS instance to a larger size with more vCPUs.

Answer

Create a read replica to offload connections.

Answer

Increase the allocated storage for the RDS instance.