Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 1–75

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 22

1

MCQmedium

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

A.Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

B.Store the data in Amazon S3 and use Athena for querying

C.Refactor the application to use Amazon DynamoDB as the database

D.Replatform the application by migrating the Oracle database to Amazon RDS for Oracle

AnswerD

Migrating to RDS for Oracle preserves the existing SQL dialect and stored procedures, minimizing code changes while leveraging managed database services.

Why this answer

The company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Exam trap

The trap here is that candidates may assume any AWS-managed database service (like Aurora or DynamoDB) is automatically better, overlooking the critical requirement to minimize code changes by keeping the same database engine.

How to eliminate wrong answers

Option A is wrong because migrating to Amazon Aurora with PostgreSQL compatibility would require rewriting complex Oracle-specific stored procedures (e.g., PL/SQL) to PostgreSQL-compatible code (PL/pgSQL), which contradicts the requirement to minimize application code changes. Option B is wrong because storing data in Amazon S3 and using Athena for querying is not suitable for transactional workloads with complex stored procedures; Athena is designed for serverless ad-hoc querying of data lakes, not for OLTP operations with stored procedures. Option C is wrong because refactoring the application to use Amazon DynamoDB would require significant application code changes, including replacing SQL queries and stored procedures with NoSQL API calls, which violates the goal of minimizing changes.

Full explanation →

2

MCQmedium

A company is migrating a SAP system to AWS and needs to ensure that the SAP license is compliant. The current license is based on the number of users. What is the correct approach for SAP licensing on AWS?

A.Purchase a SAP license through AWS Marketplace that is included in the EC2 instance cost.

B.Use AWS License Manager to track the number of vCPUs and report to SAP.

C.Bring your own SAP license to AWS and ensure compliance with the user-based metric.

D.Use AWS License Manager to convert the user-based license to a processor-based license.

AnswerC

SAP allows BYOL to AWS.

Why this answer

SAP licensing on AWS follows the same model as on-premises; the customer must license the SAP software based on users or engine size. Option A is wrong because AWS does not offer bring-your-own-license for all SAP products, but it is allowed. Option B is wrong because AWS does not include SAP licenses.

Option D is wrong because AWS does not provide SAP licenses.

Full explanation →

3

MCQeasy

A company wants to automate the installation of SAP software on AWS using AWS CloudFormation. Which service is most appropriate to execute the SAP installation scripts?

A.AWS CodeDeploy.

B.AWS Lambda functions triggered by CloudFormation.

C.AWS Systems Manager Run Command.

D.AWS OpsWorks for Chef Automate.

AnswerC

Run Command can execute scripts on instances with SSM Agent.

Why this answer

AWS Systems Manager Run Command is the most appropriate service because it can execute scripts (including SAP installation scripts) on EC2 instances without requiring SSH or RDP access, and it integrates with CloudFormation via custom resources or the AWS::SSM::Document resource. This allows you to run complex, long-running installation commands that are typical for SAP software, which Lambda functions cannot handle due to time limits.

Exam trap

The trap here is that candidates often choose AWS Lambda because it is a common 'automation' service, but they overlook Lambda's 15-minute execution timeout and its inability to handle long-running, stateful installations like SAP software.

How to eliminate wrong answers

Option A is wrong because AWS CodeDeploy is designed for deploying application code and managing rolling updates, not for executing standalone installation scripts like SAP installers. Option B is wrong because AWS Lambda functions have a maximum execution timeout of 15 minutes, which is insufficient for SAP installations that often take hours, and Lambda is not designed for interactive or long-running script execution. Option D is wrong because AWS OpsWorks for Chef Automate is a configuration management service that uses Chef cookbooks, which is overkill and not the simplest or most direct way to run a one-time SAP installation script; it adds unnecessary complexity and is not the recommended approach for this task.

Full explanation →

4

Multi-Selectmedium

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and be accessible only within the VPC. Which TWO steps should the solutions architect take to meet these requirements? (Choose TWO.)

Select 2 answers

A.Attach an Internet Gateway to the VPC and configure route tables for the private subnets.

B.Place the Fargate tasks in public subnets to allow them to communicate with each other through the internet gateway.

C.Use AWS Cloud Map for service discovery and register a public DNS name for each service.

D.Use an internal Application Load Balancer to distribute traffic between services.

E.Create a VPC endpoint for Amazon ECS to allow the service to call the ECS API without internet access.

AnswersD, E

Internal ALB routes traffic within the VPC.

Why this answer

An internal Application Load Balancer (ALB) operates within a VPC and does not expose a public endpoint, ensuring that traffic between microservices remains private. It distributes incoming requests to Fargate tasks based on defined rules, enabling secure, internal communication without internet access.

Exam trap

The trap here is that candidates often confuse public subnets with the ability to communicate privately, or assume that an internet gateway is required for any inter-service communication, when in fact internal load balancers and VPC endpoints provide fully private connectivity.

Full explanation →

5

MCQeasy

An SAP HANA database administrator needs to restore a database from a backup stored in Amazon S3. The backup was taken using SAP HANA Backint. Which AWS service should be used to retrieve the backup files from S3?

A.SAP HANA Backint agent

B.Amazon S3 console

C.AWS CLI

D.AWS Backup

AnswerA

Backint handles restore directly.

Why this answer

SAP HANA Backint is the native SAP interface for integrating with third-party backup tools. When a backup is taken using Backint, the backup files are stored in Amazon S3 via the Backint agent for SAP HANA on AWS. To restore from these backups, the same Backint agent must be used because it understands the proprietary metadata and file format that Backint writes to S3, and it handles the direct S3 API calls required to retrieve the files.

Other methods like the S3 console or AWS CLI cannot interpret Backint-specific metadata or restore the database correctly.

Exam trap

The trap here is that candidates assume any AWS tool that can access S3 (like the console, CLI, or AWS Backup) can be used to restore the database, but they overlook that SAP HANA Backint requires its own agent to interpret the proprietary backup metadata and communicate with the HANA database engine.

How to eliminate wrong answers

Option B is wrong because the Amazon S3 console is a web-based interface for browsing and downloading objects, but it cannot interpret SAP HANA Backint metadata or perform a database restore; it would only provide raw files without the necessary database context. Option C is wrong because the AWS CLI can download objects from S3, but it lacks the Backint-specific logic to parse backup metadata and restore the SAP HANA database; it would require manual scripting and knowledge of the backup format. Option D is wrong because AWS Backup is a centralized backup service that supports various AWS resources, but it does not natively integrate with SAP HANA Backint backups stored in S3; it cannot restore a database from Backint-specific backup files.

Full explanation →

6

Multi-Selectmedium

Which THREE factors should be considered when selecting an AWS Region for a migration to minimize latency for users in Europe? (Choose three.)

Select 3 answers

A.Data residency and compliance requirements

B.Availability of required AWS services in that Region

C.Proximity to user base

D.Number of Availability Zones in the Region

E.Cost of data transfer between Regions

AnswersA, B, C

Data may need to stay in specific countries.

Why this answer

Data residency and compliance requirements (Option A) are critical when selecting an AWS Region for a migration to minimize latency for users in Europe because many European countries have strict data sovereignty laws (e.g., GDPR) that mandate personal data remain within the EU/EEA. Choosing a Region outside Europe would violate these regulations, regardless of latency benefits, and could result in legal penalties. Therefore, compliance directly influences which Regions are permissible, making it a primary factor in Region selection.

Exam trap

The trap here is that candidates often confuse Availability Zone count with latency optimization, but Availability Zones are designed for resilience within a Region, not for reducing user-facing latency.

Full explanation →

7

MCQeasy

A company needs to monitor the CPU utilization of SAP EC2 instances and send an alert if it exceeds 90% for 5 consecutive minutes. Which AWS service should be used?

A.AWS Config

B.Amazon CloudWatch Alarms

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerB

Amazon CloudWatch Alarms monitor Amazon CloudWatch metrics and automatically perform actions when a metric breaches a defined threshold for a specified number of evaluation periods.

Why this answer

Amazon CloudWatch Alarms (option B) monitor metrics like CPU utilization and can trigger actions such as sending alerts when a threshold is exceeded for a specified duration. Option A (AWS Config) is used for configuration compliance and inventory. Option C (AWS Trusted Advisor) provides best-practice checks.

Option D (AWS CloudTrail) is for API auditing and governance.

Full explanation →

8

MCQhard

An SAP system is experiencing slow performance. The SAP team suspects a memory bottleneck in the HANA database. The database runs on an r5.24xlarge instance with 768 GB RAM. CloudWatch metrics show the HANA memory usage is consistently above 90%. Which action should be taken first?

A.Reduce the number of HANA services.

B.Upgrade the instance to a larger memory-optimized type.

C.Increase the HANA memory allocation parameter in the global.ini file.

D.Increase the swap space on the instance.

AnswerC

Adjusting the memory allocation can reduce pressure without changing instance type.

Why this answer

The HANA database may have a memory allocation parameter that is lower than the available physical memory, causing a bottleneck even when RAM is available. Increasing this parameter in the global.ini file allows HANA to use more memory, addressing the issue without scaling up. Option A is wrong because reducing HANA services does not directly increase memory availability for the database; it may reduce workload but not the memory bottleneck.

Option B is wrong because upgrading the instance is a more disruptive and costly step that should be considered only after tuning parameters. Option D is wrong because swap space is much slower than RAM and is a temporary fix, not a solution for a persistent memory bottleneck.

Full explanation →

9

MCQeasy

A company is planning to migrate its SAP system to AWS and wants to test the migration process with a smaller system first. Which AWS service can be used to create a pre-configured SAP environment for testing?

A.AWS Service Catalog

B.AWS Quick Starts

C.AWS Launch Wizard for SAP

D.AWS CloudFormation

AnswerC

Launch Wizard provides a guided, pre-configured SAP deployment for testing.

Why this answer

AWS Launch Wizard for SAP provides a guided way to deploy SAP systems on AWS, including pre-configured environments, making it ideal for testing migrations. Option A (AWS Service Catalog) is for IT governance and not SAP-specific. Option B (AWS Quick Starts) are templates but not pre-configured for SAP.

Option D (AWS CloudFormation) is infrastructure as code but lacks SAP-specific pre-configuration.

Full explanation →

10

MCQeasy

A company wants to migrate a 10 TB SAP HANA database to AWS with minimal downtime. The network bandwidth between the on-premises data center and AWS is 1 Gbps. Which migration method is most suitable?

A.Use AWS Snowball Edge to transfer the initial data load, then use AWS DMS for ongoing replication.

B.Use SAP HANA System Replication directly over the internet.

C.Use AWS DMS with ongoing replication to migrate data incrementally.

D.Use AWS Backup to back up the database to S3 and restore to an EC2 instance.

AnswerA

Snowball Edge handles large data offline; DMS can do CDC after initial load.

Why this answer

Given the large data size and limited bandwidth, using AWS Snowball Edge for initial load reduces network dependency. AWS DMS with CDC requires a stable connection but initial load over 1 Gbps would take >22 hours. Backup/restore over network also suffers from bandwidth.

SAP HANA System Replication requires high bandwidth and low latency.

Full explanation →

11

Multi-Selecteasy

Which TWO AWS services can be used to monitor the performance of SAP NetWeaver application servers? (Choose two.)

Select 2 answers

A.AWS CloudTrail

B.AWS Trusted Advisor

C.AWS Systems Manager

D.AWS X-Ray

E.Amazon CloudWatch

AnswersC, E

Systems Manager can collect OS-level metrics and run commands.

Why this answer

AWS Systems Manager is correct because it provides the Agent-based infrastructure management capabilities needed to monitor SAP NetWeaver application servers. Specifically, Systems Manager Inventory can collect OS-level metrics like CPU, memory, and disk usage from EC2 instances running SAP, and its Run Command or State Manager can execute custom scripts to gather SAP-specific performance data (e.g., from ST03 or ST06 transactions) without requiring direct SSH access.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with performance monitoring, or assume X-Ray can monitor any application, when in fact SAP NetWeaver requires OS-level and SAP-specific metrics that only Systems Manager and CloudWatch (via custom metrics or SAP Agent) can provide.

Full explanation →

12

MCQeasy

A company is migrating its SAP HANA database to AWS. Which instance type is specifically designed for SAP HANA and certified for production workloads?

A.c5.xlarge

B.r5.xlarge

C.x1e.xlarge

D.t3.xlarge

AnswerC

x1e instances are SAP HANA certified for production.

Why this answer

The x1e.xlarge instance is part of the AWS X1e family, which is specifically designed for memory-intensive workloads like SAP HANA and is certified by SAP for production deployments. SAP HANA requires large memory footprints and high memory-to-vCPU ratios, which the X1e instances provide with up to 3,904 GiB of memory and 128 vCPUs, meeting SAP's certification requirements.

Exam trap

The trap here is that candidates often assume any memory-optimized instance (like R5) is suitable for SAP HANA, but AWS requires specific instance families (X1, X1e, high-memory) that are officially SAP-certified for production workloads.

How to eliminate wrong answers

Option A (c5.xlarge) is wrong because it belongs to the compute-optimized C5 family, which lacks the high memory capacity and SAP HANA certification required for production workloads. Option B (r5.xlarge) is wrong because while R5 instances are memory-optimized, they are not specifically certified for SAP HANA production workloads; SAP HANA certification requires instances from the X1, X1e, or high-memory families. Option D (t3.xlarge) is wrong because T3 instances are burstable general-purpose instances with limited sustained performance and no SAP HANA certification, making them unsuitable for production database workloads.

Full explanation →

13

MCQhard

A company has an SAP HANA database running on an EC2 instance with EBS volumes. The database requires 10,000 IOPS consistently. The current volume type is gp3 with 3000 IOPS. Which change should be made to meet the IOPS requirement?

A.Change the volume type to io2 Block Express and provision 10,000 IOPS.

B.Increase the volume size of the gp3 volume to automatically increase IOPS.

C.Increase the IOPS on the existing gp3 volume to 10,000.

D.Add an instance store volume and move the data to it.

AnswerA

io2 Block Express volumes support high IOPS and are suitable for SAP HANA.

Why this answer

Io2 Block Express volumes are designed for high-performance workloads and can provision up to 256,000 IOPS, easily meeting the 10,000 IOPS requirement. Option B is wrong because increasing the volume size of a gp3 volume does not automatically increase IOPS beyond the baseline; gp3 IOPS are provisioned independently of size. Option C is wrong because while gp3 can be provisioned up to 16,000 IOPS, io2 Block Express offers consistent low-latency performance needed for SAP HANA.

Option D is wrong because instance store volumes are ephemeral and data is lost on instance stop or termination, making them unsuitable for persistent database storage.

Full explanation →

14

MCQmedium

An SAP HANA database on AWS is using EBS io2 volumes. The company wants to monitor the read and write latency of the database volumes. Which CloudWatch metrics should be used?

A.VolumeIdleTime and VolumeTotalReadTime.

B.VolumeReadLatency and VolumeWriteLatency.

C.VolumeThroughputPercentage and VolumeConsumedReadWriteOps.

D.VolumeQueueLength and VolumeThroughput.

AnswerB

These metrics directly measure latency per operation.

Why this answer

CloudWatch provides the `VolumeReadLatency` and `VolumeWriteLatency` metrics specifically to monitor the average time (in seconds) for read and write I/O operations on EBS volumes. For SAP HANA on io2 volumes, these metrics directly reflect storage performance and are critical for detecting latency issues that could impact database throughput and transaction response times.

Exam trap

The trap here is that candidates confuse throughput or queue-length metrics (like `VolumeQueueLength` or `VolumeThroughput`) with latency metrics, assuming high queue length directly equals high latency, but CloudWatch provides dedicated latency metrics that are the correct and direct measure for this monitoring requirement.

How to eliminate wrong answers

Option A is wrong because `VolumeIdleTime` measures the total number of seconds the volume is idle (no I/O), and `VolumeTotalReadTime` is the total time spent on read operations, but neither directly provides per-operation latency; they are used for calculating average latency indirectly, not as direct latency metrics. Option C is wrong because `VolumeThroughputPercentage` is not a standard CloudWatch metric (the correct metric is `VolumeThroughput`), and `VolumeConsumedReadWriteOps` tracks the number of I/O operations consumed against the provisioned IOPS, not latency. Option D is wrong because `VolumeQueueLength` measures the number of pending I/O requests (indicating backpressure), and `VolumeThroughput` measures data transfer rate (MB/s), neither of which directly measure read or write latency.

Full explanation →

15

MCQeasy

A company is designing a disaster recovery (DR) strategy for its SAP environment on AWS. The primary site is in us-east-1 and the DR site in us-west-2. The SAP HANA database is 3 TB and uses HANA System Replication (HSR) in async mode. The RPO requirement is 15 minutes. What is the most cost-effective way to meet the RPO?

A.Take full database backups to Amazon S3 every 15 minutes.

B.Use EBS snapshots every 5 minutes to replicate data to DR region.

C.Use HANA System Replication in synchronous mode to ensure zero data loss.

D.Configure HANA System Replication in asynchronous mode over AWS Direct Connect.

AnswerD

Async HSR over Direct Connect provides low latency replication meeting the RPO.

Why this answer

HANA System Replication (HSR) in asynchronous mode over AWS Direct Connect provides a low-latency, reliable network path that can achieve an RPO of 15 minutes without the performance penalty of synchronous replication. Asynchronous replication sends committed transactions to the DR site without waiting for acknowledgment, which is suitable for the 3 TB HANA database and meets the RPO requirement cost-effectively by avoiding the need for expensive, high-bandwidth dedicated connections or frequent full backups.

Exam trap

The trap here is that candidates often confuse synchronous replication with zero data loss, but for cross-region DR, synchronous mode introduces unacceptable latency, making asynchronous mode the only practical choice to meet the RPO without degrading production performance.

How to eliminate wrong answers

Option A is wrong because taking full database backups to Amazon S3 every 15 minutes would incur extremely high storage costs and network bandwidth usage for a 3 TB database, and the backup process itself would likely exceed the 15-minute RPO window due to the time required to complete a full backup. Option B is wrong because EBS snapshots every 5 minutes would create massive storage overhead and cost, and EBS snapshots are crash-consistent, not application-consistent for HANA, risking data corruption or loss; additionally, replicating snapshots across regions adds latency and cost. Option C is wrong because HANA System Replication in synchronous mode requires the primary to wait for acknowledgment from the DR site before committing a transaction, which introduces significant latency over the inter-region distance (us-east-1 to us-west-2) and would severely impact production performance, making it impractical for a 3 TB database.

Full explanation →

16

MCQmedium

Refer to the exhibit. An SAP administrator has created this IAM policy for a backup user. The user can list and download backups but cannot delete them. However, the user is unable to list the objects in the bucket. What is the most likely cause?

A.The IAM policy does not include s3:ListBucket for the bucket.

B.There is an additional bucket policy that denies s3:ListBucket to this user.

C.The user needs s3:GetObjectVersion permission to list objects.

D.The Deny statement also denies s3:ListBucket because of the wildcard resource.

AnswerB

Correct. The user has the necessary IAM permissions to list, so the inability to list must be due to a bucket policy that denies s3:ListBucket.

Why this answer

The IAM policy shown grants s3:ListBucket permission on the bucket, so the user should be able to list objects. However, the user cannot list objects, indicating an additional bucket policy explicitly denies s3:ListBucket for this user. Bucket policies override IAM permissions when a Deny is present.

Option A is incorrect because the policy does include s3:ListBucket. Option C is incorrect because s3:GetObjectVersion is not required to list objects. Option D is incorrect because the Deny statement only affects s3:DeleteObject, not s3:ListBucket.

Full explanation →

17

MCQhard

An SAP Basis administrator is configuring a high availability setup for SAP HANA on AWS using HANA System Replication (HSR) with automatic failover. The architecture includes a primary HANA node in us-east-1a and a secondary in us-east-1b. The administrator uses a Network Load Balancer (NLB) with a floating IP for the HANA virtual IP address. After a failover test, the secondary node becomes primary, but client applications cannot connect to the database. What is the most likely cause?

A.The security group for the NLB does not allow inbound traffic on port 3<0xEB><0x9C><0x9D><0xEB><0x9E><0x80>13.

B.The SAP HANA client is using a DNS name that does not resolve to the NLB endpoint.

C.The NLB target group is not configured to include the secondary node's IP address.

D.The secondary HANA node is in a different subnet and not routable from the NLB.

AnswerC

Without the secondary as a target, NLB cannot route to it after failover.

Why this answer

With NLB and floating IP, the target group must be configured with the secondary's IP address as a target. If the target group only contains the primary's IP, failover breaks. Option A (security group) would affect all connections, not just after failover.

Option B (DNS) is not used because the client would use the NLB endpoint directly; if the DNS name did not resolve to the NLB, connections would fail before failover. Option D (subnet) is possible but NLB can target cross-subnet. Option C is the most specific and common misconfiguration.

Full explanation →

18

MCQmedium

A company runs SAP HANA on AWS and uses AWS Systems Manager to automate patching of the operating system. After a recent patching cycle, the SAP HANA database failed to start. The administrator checked the logs and found that the HANA service was not starting due to a missing library dependency. What should the administrator do to prevent this issue in future patching cycles?

A.Use AWS Systems Manager Patch Manager to apply patches but exclude the library in question

B.Test patches in a non-production environment and create a new AMI after successful validation

C.Create a script to reinstall the missing library after patching

D.Set up a maintenance window that stops HANA before patching and starts it after

AnswerB

Testing and creating a new AMI ensures the image is validated and includes all dependencies.

Why this answer

Testing patches in a non-production environment before applying them to production allows the administrator to identify issues like missing library dependencies. After successful validation, creating a new AMI ensures that all patches and dependencies are captured consistently, preventing the HANA database from failing to start due to missing libraries.

Full explanation →

19

MCQhard

A company is running SAP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. They have set up a cluster using Amazon Route 53 with health checks. During a failover test, the ASCS instance fails but the DNS record does not update immediately. What is the most likely cause?

A.The TTL on the DNS record is set too high

B.The health check is not configured to check the ASCS service port

C.The Route 53 record is using simple routing instead of failover

D.The Route 53 record set is not updatable

AnswerA

High TTL causes clients to cache old IPs, delaying failover.

Why this answer

The TTL (Time to Live) on the DNS record determines how long clients cache the DNS response. If the TTL is set too high, clients continue to use the old (failed) IP address even after Route 53 updates the record based on the health check. This delays failover.

Options B and C are incorrect because health checks and routing policies do affect failover, but the immediate cause of the delay is the TTL. Option D is incorrect because Route 53 record sets are updatable.

Full explanation →

20

MCQhard

An organization runs SAP ERP on a single EC2 instance with a separate RDS for Oracle database. The Operations team needs to patch the operating system of the EC2 instance without causing downtime for the SAP application. What is the most effective approach?

A.Create an AMI of the instance, launch a new instance from the AMI, and patch it.

B.Use an Auto Scaling group with a launch template that references a patched AMI, and perform a rolling update.

C.Apply patches using AWS Systems Manager Patch Manager during a maintenance window.

D.Use AWS Systems Manager to run a script that patches the OS without rebooting.

AnswerA

Correct. Creating an AMI from the running instance does not cause downtime. Launching a new instance from that AMI and patching it creates a patched copy. Then switching traffic to the new instance (e.g., via Elastic IP reassignment) achieves patching with minimal or no downtime.

Why this answer

It allows creating a patched copy of the instance without affecting the running SAP application. By creating an AMI of the running EC2 instance, you capture the current state. Launching a new instance from this AMI and patching it does not impact the original instance. Then you can redirect traffic to the new instance (e.g., by updating an Elastic IP or DNS) to complete the cutover with minimal downtime. This is a classic blue/green deployment pattern.

Option B is incorrect because a rolling update requires multiple instances in an Auto Scaling group to maintain availability. With a single instance, there is no instance to serve traffic during the update.

Option C is incorrect because AWS Systems Manager Patch Manager applies patches in-place, which typically requires a reboot, causing downtime for the SAP application.

Option D is incorrect because most operating system patches require a reboot to take effect; running a script without rebooting does not fully apply the patches, leaving the system vulnerable and potentially not in compliance.

Exam trap

Candidates may think that creating an AMI and launching a new instance requires stopping the original instance, but you can create an AMI without stopping the instance.

Full explanation →

21

MCQmedium

Refer to the exhibit. A migration engineer is setting up an IAM policy for an AWS DMS task that will replicate data from an on-premises SAP ASE database to Amazon RDS for SAP ASE. The engineer wants to ensure the DMS task can be created and started. What is missing from this policy?

A.Permissions to create DMS endpoints (dms:CreateEndpoint)

B.Permissions to describe DMS replication instances

C.Permissions to start and stop replication tasks

D.Permissions to use AWS Key Management Service (KMS) for encryption

AnswerA

Endpoints are required for replication tasks.

Why this answer

Creating endpoints is a prerequisite for running a DMS task, and the provided policy does not include 'dms:CreateEndpoint'. Option B is incorrect because the policy does not include 'dms:DescribeReplicationInstances', but that is not required to create or start the task; the issue is missing endpoint creation permissions. Option C is incorrect because the policy does include 'dms:StartReplicationTask', so starting the task is allowed once endpoints exist.

Option D is incorrect because the policy does not reference KMS actions, and encryption via KMS would require additional permissions, but that is not the immediate missing piece for creating and starting the task.

Full explanation →

22

MCQhard

An SAP Basis administrator is troubleshooting a slow-running SAP HANA query. The administrator wants to identify which SQL statements are consuming the most CPU time in the HANA database. Which SAP HANA view or tool should they query?

A.M_ACTIVE_STATEMENTS

B.M_TABLES

C.M_LOAD_HISTORY

D.M_SERVICE_REPLICATION

AnswerA

Shows currently running statements with CPU time.

Why this answer

(M_ACTIVE_STATEMENTS) is correct because this SAP HANA view provides real-time information about currently executing SQL statements, including their CPU time consumption. Option B (M_TABLES) is incorrect as it shows metadata about tables, not active queries. Option C (M_LOAD_HISTORY) is incorrect as it shows historical load data.

Option D (M_SERVICE_REPLICATION) is incorrect as it displays replication status for services.

Full explanation →

23

Multi-Selectmedium

A company is migrating a web application to AWS and wants to improve security. The application uses a classic three-tier architecture. Which TWO security measures should the company implement?

Select 2 answers

A.Allow direct internet access to the database tier

B.Use Amazon S3 Transfer Acceleration

C.Place all tiers in public subnets

D.Use AWS WAF to protect the web tier

E.Use security groups to control traffic between tiers

AnswersD, E

AWS WAF is a web application firewall that protects web applications from common exploits, making it a valid security measure.

Why this answer

Using security groups as a virtual firewall (Option E) and AWS WAF to protect against common web exploits (Option D) are both security best practices. Option A (Direct internet access for database tier) is insecure. Option B (S3 Transfer Acceleration) is for speed, not security.

Option C (Place all tiers in public subnets) is insecure.

Full explanation →

24

MCQmedium

An SAP system on AWS uses a shared file system for /sapmnt and /usr/sap/trans mounted from an EC2 instance running NFS. The NFS server experiences a failure causing downtime for all SAP application servers. The company wants a highly available shared file system with automatic failover. The budget is limited, and the company prefers a fully managed solution. Which AWS service should the company use?

A.Amazon FSx for Windows File Server

B.Amazon EFS

C.Amazon EBS with a cluster file system

D.Amazon S3 with s3fs-fuse

AnswerB

EFS is a managed NFS file system that provides high availability across AZs.

Why this answer

Amazon EFS provides a fully managed, highly available, and durable NFS file system that supports automatic failover across multiple Availability Zones. It is the ideal choice for the SAP /sapmnt and /usr/sap/trans shared file system because it eliminates the single point of failure of a self-managed NFS server, requires no manual failover configuration, and offers a pay-as-you-go model that fits a limited budget.

Exam trap

A common trap in AWS SAP exams is that candidates might choose Amazon EBS with a cluster file system (Option C) thinking it provides high availability, but they overlook that it still requires manual orchestration and is not a fully managed service, unlike Amazon EFS.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server uses the SMB protocol, not NFS, and SAP on Linux requires NFS-based shared file systems for /sapmnt and /usr/sap/trans. Option C is wrong because Amazon EBS with a cluster file system is not a fully managed solution; it requires manual configuration of a cluster (e.g., GlusterFS or Veritas) and still has a single point of failure if the EC2 instance hosting the cluster fails. Option D is wrong because Amazon S3 with s3fs-fuse is not a POSIX-compliant NFS file system; it introduces significant latency, lacks proper file locking, and is not supported by SAP for shared file system mounts.

Full explanation →

25

MCQmedium

A company is migrating an SAP HANA database to AWS. The system requires a high-performance storage solution with low latency for database files, and the storage must be scalable without downtime. Which AWS storage solution should the company use for the SAP HANA data volume?

A.Amazon S3

B.Amazon EBS st1

C.Amazon EBS io2 Block Express

D.Amazon EBS gp3

AnswerC

io2 Block Express provides up to 256000 IOPS and can be modified without downtime.

Why this answer

Amazon EBS io2 Block Express is the correct choice because it provides up to 256,000 IOPS per volume with sub-millisecond latency, meeting SAP HANA's strict performance requirements for data volumes. It also supports Elastic Volumes, allowing you to scale storage capacity and performance without downtime, which is critical for production SAP HANA systems.

Exam trap

The trap here is that candidates often choose gp3 for its lower cost and good baseline performance, overlooking that SAP HANA's certification requires io2 Block Express (or io1) for production data volumes due to the need for guaranteed high IOPS and sub-millisecond latency under sustained load.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service with higher latency and lower IOPS, unsuitable for the low-latency, high-throughput random I/O demands of SAP HANA database files. Option B is wrong because Amazon EBS st1 is a throughput-optimized HDD volume designed for sequential workloads like big data and log processing, not for the random read/write patterns and low latency required by SAP HANA. Option D is wrong because Amazon EBS gp3, while offering balanced performance, cannot match the maximum IOPS (256,000) and sub-millisecond latency of io2 Block Express, which is required for large SAP HANA deployments with high concurrency.

Full explanation →

26

MCQeasy

A company is migrating an on-premises SAP HANA database to AWS. The database is 2 TB in size, and the network link has a bandwidth of 1 Gbps with an average utilization of 40% during the migration window. They need to minimize the migration time. Which approach should they use?

A.Use AWS Snowball Edge to transfer the data physically.

B.Request a temporary bandwidth increase from the ISP.

C.Use AWS Database Migration Service (DMS) with ongoing replication to minimize downtime.

D.Use Amazon S3 Transfer Acceleration to speed up the transfer.

AnswerA

Snowball avoids network bottleneck for large data.

Why this answer

AWS Snowball Edge is the most efficient approach for large data transfers (2 TB) over a constrained network (1 Gbps at 40% utilization ≈ 400 Mbps). It physically ships the data, avoiding network bottlenecks entirely. Option A is correct.

Option B is wrong because requesting a bandwidth increase is impractical and may not be feasible. Option C is wrong: AWS DMS with ongoing replication minimizes downtime for incremental changes, but the initial full load would still be slow over the constrained network, increasing total migration time. Option D is wrong: Amazon S3 Transfer Acceleration only speeds up uploads to S3, not to SAP HANA directly, and it still relies on the network link.

Full explanation →

27

MCQeasy

A company runs SAP ERP on AWS using a single EC2 instance for the database and application. The system has been in production for two years. The SAP administrator receives a notification that the EC2 instance's underlying hardware is scheduled for retirement in two weeks. The administrator needs to minimize downtime and ensure the SAP system is available during the maintenance. Which action should the administrator take?

A.Reboot the instance to move it to healthy hardware.

B.Request an extension of the retirement date from AWS Support.

C.Create an AMI of the instance and launch a new instance from the AMI.

D.Stop the instance and then start it again to migrate to new hardware.

AnswerD

Stopping and starting the instance migrates it to healthy hardware with minimal downtime (the stop/start cycle takes a few minutes).

Why this answer

Stopping and starting the instance migrates it to new hardware with minimal downtime (the stop/start cycle takes a few minutes). Option A is wrong because rebooting does not change the underlying hardware; the instance stays on the same degraded hardware. Option B is wrong because scheduled hardware retirement events cannot be extended by requesting a delay from AWS Support.

Option C is wrong because creating an AMI and launching a new instance takes longer, may cause IP/hostname changes, and requires additional configuration, making it more disruptive than stop/start.

Full explanation →

28

Multi-Selectmedium

An organization is planning to migrate its SAP landscape to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which TWO AWS services can be used to implement a high-availability architecture for ASCS?

Select 2 answers

A.Amazon EC2 Auto Recovery

B.Amazon CloudFront

C.AWS Database Migration Service (DMS)

D.Elastic Load Balancing (ELB)

E.Amazon Route 53

AnswersA, E

Auto Recovery can recover the instance if it fails.

Why this answer

Options A and E are correct. Amazon EC2 Auto Recovery can automatically restart an ASCS instance if it fails due to underlying hardware issues, providing a basic level of high availability. Amazon Route 53 can be configured with DNS failover to route traffic to a standby ASCS instance in another Availability Zone, enabling multi-AZ resilience.

Option B (CloudFront) is a content delivery network and not designed for SAP ASCS HA. Option C (DMS) is a database migration service, irrelevant for ASCS. Option D (ELB) is typically not used for ASCS because ASCS requires a single active node with a virtual IP or DNS name, not load-balanced traffic.

Full explanation →

29

MCQeasy

A company is planning to migrate their SAP system to AWS. They need to ensure that the SAP application servers and database servers are in the same AWS Region but in different Availability Zones for high availability. The network latency between Availability Zones must be minimal. Which AWS service should be used to connect the instances?

A.Set up VPC Peering between the Availability Zones

B.Establish an AWS Direct Connect connection

C.Use the default VPC network within the same VPC spanning multiple Availability Zones

D.Use AWS Transit Gateway to connect the subnets

AnswerC

Instances in the same VPC across AZs communicate over AWS's low-latency network.

Why this answer

A single VPC can span multiple Availability Zones within the same AWS Region, and by default, instances in different AZs within the same VPC communicate over the AWS private network with low latency, typically under 1-2 ms. This meets the requirement for minimal latency between SAP application and database servers while keeping them in the same Region for high availability.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing VPC Peering or Transit Gateway, not realizing that a single VPC inherently spans multiple AZs and provides the required low-latency connectivity without additional services.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects separate VPCs, not subnets within the same VPC, and introduces unnecessary complexity and potential latency overhead compared to using a single VPC. Option B is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a service to connect instances within the same Region across Availability Zones. Option D is wrong because AWS Transit Gateway is used to interconnect multiple VPCs and on-premises networks, not to connect subnets within a single VPC, and would add unnecessary latency and cost.

Full explanation →

30

Multi-Selecthard

Which THREE of the following are valid considerations for designing SAP workloads on AWS to achieve high availability within a single AWS Region? (Choose three.)

Select 3 answers

A.Use AWS Network Load Balancer (NLB) for SAP Enqueue Replication 2 (ENSA2)

B.Use HANA scale-out with HSR across two nodes for high availability

C.Use a cluster with a shared file system (e.g., Amazon EFS or FSx) for SAP ASCS

D.Use Elastic Network Interface (ENI) failover for the SAP application server floating IP

E.Implement HANA System Replication (HSR) with automatic failover using a third instance as a quorum

AnswersC, D, E

ASCS can be made highly available with a clustered file system.

Why this answer

SAP ASCS (ABAP Central Services) requires a shared file system for the global transport directory and instance profiles to enable failover between cluster nodes. Amazon EFS or FSx for NetApp ONTAP provide the necessary NFS-based shared storage that supports the SAP enqueue replication and message server services during a failover event.

Exam trap

The PAS-C01 exam often tests the misconception that ENSA2 requires a load balancer for replication traffic, but in reality, ENSA2 uses direct peer-to-peer communication between ASCS and ERS instances without any intermediate load balancer.

Full explanation →

31

Multi-Selecthard

Which THREE factors should be considered when choosing an instance type for an SAP HANA database on AWS? (Select THREE.)

Select 3 answers

A.Memory size of the instance

B.The instance type must be certified for SAP HANA

C.Number of EBS volumes that can be attached

D.GPU capabilities of the instance

E.Network throughput of the instance

AnswersA, B, E

HANA is memory-intensive; the instance must have enough RAM.

Why this answer

Options A, B, and E are correct. Memory size (A) is critical because SAP HANA is an in-memory database. The instance must be certified for SAP HANA (B) to ensure compatibility and support.

Network throughput (E) is important for data replication and client access. Option C is incorrect because the number of attachable EBS volumes is not a primary selection criterion for SAP HANA. Option D is incorrect because GPU capabilities are not required for SAP HANA.

Full explanation →

32

Multi-Selecteasy

Which TWO services can be used to centrally manage and enforce backup policies for SAP systems on AWS? (Choose TWO.)

Select 2 answers

A.Amazon Data Lifecycle Manager

B.AWS Backup

C.AWS CloudFormation

D.AWS Config

E.Amazon S3

AnswersA, B

DLM automates creation, retention, and deletion of EBS snapshots.

Why this answer

Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. For SAP systems, you can use DLM to enforce backup policies for the underlying EBS volumes (e.g., /usr/sap, /sapmnt, data volumes) by scheduling snapshots and applying retention rules. AWS Backup provides a centralized, policy-based backup service that supports SAP HANA databases (via Backint integration) and EC2 instances, enabling you to define backup plans, assign resources, and enforce compliance across your SAP landscape.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance evaluation (which can detect missing backups) with actual backup policy enforcement, or they assume Amazon S3's storage capabilities include policy management, when in fact only DLM and AWS Backup provide the scheduling, retention, and enforcement mechanisms required for centralized backup management.

Full explanation →

33

MCQhard

A company is migrating their SAP S/4HANA system to AWS. They plan to use SAP HANA Cockpit for migration. During the pre-migration assessment, they find that the on-premises HANA system uses a mix of row and column store tables. The target AWS HANA instance is provisioned on a memory-optimized instance. They want to ensure optimal performance post-migration. Which additional step should they take?

A.Reduce the memory allocation of the HANA instance

B.Disable data compression on the target HANA instance

C.Convert row store tables to column store tables where possible

D.Increase the number of HANA index servers

AnswerC

Converting row store tables to column store where possible improves performance for analytical workloads, which is typical for S/4HANA. This is the correct additional step.

Why this answer

Converting row store tables to column store improves performance for analytical workloads, which is typical for S/4HANA. Option A is wrong because reducing memory allocation could degrade performance. Option B is wrong because disabling compression would increase storage and memory usage.

Option D is wrong because increasing parallelism may not help if the storage layout is suboptimal.

Full explanation →

34

Multi-Selecthard

Which TWO configurations are mandatory for an SAP HANA system replication setup on AWS? (Choose TWO.)

Select 2 answers

A.An Application Load Balancer in front of the HANA instances

B.A virtual IP (VIP) address for the HANA system

C.A dedicated replication network between primary and secondary

D.Encryption of data in transit using SSL

E.A separate VPC for the secondary instance

AnswersB, C

VIP is used for failover.

Why this answer

SAP HANA system replication requires a virtual IP (VIP) address to enable automatic failover and client reconnection. The VIP is managed by a cluster manager (e.g., Pacemaker with AWS Route53 or Elastic IP) and moves between primary and secondary instances during a takeover, ensuring clients can always reach the active HANA instance without manual reconfiguration. Option C is also correct because a dedicated replication network between primary and secondary is mandatory to ensure reliable and low-latency replication traffic, separate from the client-facing network.

This dedicated network is required for optimal performance and to avoid contention with other traffic.

Exam trap

The trap here is that candidates often assume an ALB is needed for high availability, but SAP HANA uses a VIP-based active/passive model rather than load balancing, and they may overlook the dedicated replication network as optional when it is actually mandatory for reliable replication performance.

Full explanation →

35

Multi-Selecthard

Which THREE actions should be taken to ensure minimal downtime during an SAP system migration to AWS using SAP HSR (HANA System Replication)?

Select 3 answers

A.Disable backups on the source system to reduce load.

B.Perform a takeover to the target system to finalize migration.

C.Pre-provision the target SAP HANA instance on AWS.

D.Manually copy data files to AWS before starting replication.

E.Configure HANA System Replication between source and target.

AnswersB, C, E

Takeover switches production to the target with minimal downtime.

Why this answer

To minimize downtime during an SAP HANA migration to AWS using HSR, it is critical to replicate data in advance. Pre-provisioning the target HANA instance on AWS ensures the infrastructure is ready (C). Configuring HANA System Replication between source and target enables ongoing data synchronization (E).

Performing a takeover to the target system finalizes the migration with a quick cutover, minimizing downtime (B). Disabling backups on the source (A) is risky and does not reduce downtime, and manually copying data files (D) is unnecessary because HSR handles the replication.

Full explanation →

36

MCQmedium

An operations team needs to ensure that all changes to AWS resources related to SAP systems are tracked and audited. Which AWS service should they use?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Config

D.AWS Trusted Advisor

AnswerA

CloudTrail logs all API activity for auditing.

Why this answer

CloudTrail records API calls for auditing. Option B is wrong because Config tracks configuration changes, not API calls. Option C is wrong because CloudWatch is for monitoring.

Option D is wrong because Trusted Advisor is for best practices.

Full explanation →

37

MCQmedium

A company is migrating an SAP S/4HANA system to AWS. The migration strategy involves using SAP HANA System Replication (HSR) to replicate the source HANA database to an EC2 instance running HANA. During the final cutover, the replication link breaks and the target database becomes inconsistent. What should the migration team do to recover?

A.Restart HSR with a delta snapshot from the source

B.Perform a full HSR initial snapshot from the source to the target

C.Restore the target database from an AWS Backup

D.Use AWS DMS to replicate remaining changes

AnswerB

Full snapshot ensures consistency and can be used to reinitialize replication.

Why this answer

When the HSR link breaks and the target becomes inconsistent during cutover, the only reliable recovery method is to perform a full HSR initial snapshot from the source. This completely reinitializes the target database, ensuring consistency. Option A (restart HSR with a delta snapshot) is incorrect because it requires a consistent state to apply changes incrementally, which does not exist.

Option C (restore from AWS Backup) is incorrect as it may not reflect the latest data and could cause data loss. Option D (use AWS DMS) is incorrect because AWS DMS does not fully support HANA-to-HANA replication for SAP workloads.

Full explanation →

38

MCQmedium

A company migrates its SAP HANA database to an EC2 instance with 1 TB of memory. The system is used for both OLTP and OLAP workloads. The performance team notices that memory utilization is high but the CPU is underutilized. Which configuration change would best improve overall system throughput?

A.Use a smaller instance type with higher CPU to memory ratio

B.Enable HANA Large Pages to reduce TLB misses and improve memory access

C.Increase the swap space on the instance store volumes

D.Disable HANA compression to reduce CPU overhead

AnswerB

Large pages improve memory access efficiency.

Why this answer

HANA Large Pages (also known as huge pages) reduce the number of Translation Lookaside Buffer (TLB) misses by mapping large contiguous memory regions with fewer page table entries. In a 1 TB memory system, the default 4 KB page size causes excessive TLB pressure, especially under OLAP workloads with large data scans. Enabling large pages improves memory access efficiency, allowing the CPU to spend less time on page walks and more time on actual processing, thereby improving overall throughput without requiring a hardware change.

Exam trap

The trap here is that candidates often assume high memory utilization means the instance is undersized and needs a different instance type, but the real bottleneck is inefficient memory access due to small page sizes, not a lack of memory capacity.

How to eliminate wrong answers

Option A is wrong because using a smaller instance type with a higher CPU-to-memory ratio would reduce the available memory, which is critical for SAP HANA's in-memory processing; this would likely cause memory pressure and degrade performance, not improve throughput. Option C is wrong because increasing swap space on instance store volumes would force the database to use disk-based paging, which is orders of magnitude slower than RAM and would severely degrade OLTP and OLAP performance. Option D is wrong because disabling HANA compression would increase the data footprint in memory, exacerbating memory utilization issues and potentially increasing CPU overhead due to more data to process, not reducing it.

Full explanation →

39

MCQhard

A company runs SAP S/4HANA on AWS. The system is deployed in a cluster across two Availability Zones using Pacemaker for high availability. The primary SAP HANA node fails, and the failover to the secondary node is successful. However, after failover, the application servers cannot connect to the database because the database IP address changed. The application servers are configured to use the IP address of the primary node. The company needs a solution that allows the application servers to connect to the active database node without reconfiguration after failover. Which solution should the company implement?

A.Use Amazon Route 53 DNS with a health check to point to the active node's IP

B.Associate an Elastic IP address to the active node using a script during failover

C.Configure a CNAME record in Route 53 that points to the primary node's DNS name

D.Deploy an internal Network Load Balancer (NLB) with a static IP and target the HANA nodes

AnswerD

An internal NLB with a static IP provides a fixed endpoint. The NLB health checks and forwards traffic to the healthy HANA node, ensuring application servers can always connect to the active database without any configuration changes.

Why this answer

An internal Network Load Balancer (NLB) with a static IP provides a stable endpoint for application servers. The NLB forwards traffic to the active HANA node, so no reconfiguration is needed after failover. Option A is incorrect because using Route 53 DNS with health checks introduces DNS caching and TTL delays, causing application servers to use stale IPs after failover.

Option B is incorrect because associating an Elastic IP via script is not seamless and may require manual intervention or scripting, and Elastic IP reassignment can have delays. Option C is incorrect because a CNAME record still points to a DNS name with TTL delays and does not automatically update to the active node's IP; it also would require the primary node's DNS name to be updated.

Full explanation →

40

Multi-Selectmedium

A company is migrating an SAP ERP system to AWS. Which AWS service should they use to set up a highly available SAP HANA database?

Select 1 answer

A.AWS Elastic Disaster Recovery (DRS)

B.Amazon EFS

C.Amazon Redshift

D.Amazon DynamoDB

E.Amazon S3

AnswersB

Amazon EFS provides shared storage essential for SAP HANA high availability (e.g., for /hana/shared).

Why this answer

Only Amazon EFS is correct for setting up a highly available SAP HANA database. Amazon EFS provides the shared storage (e.g., for /hana/shared) required for SAP HANA multi-node or scale-out configurations, which support high availability. AWS Elastic Disaster Recovery (DRS) is a disaster recovery service that enables replication and recovery to a different region or account, but it does not provide automatic failover for high availability within a single region.

Amazon Redshift is a data warehouse and cannot host SAP HANA. Amazon DynamoDB is a NoSQL database and cannot run SAP HANA. Amazon S3 is object storage, not designed for the low-latency, high-throughput requirements of SAP HANA.

Full explanation →

41

MCQhard

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

A.The SQS visibility timeout is too short; increase it.

B.The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

C.The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.

D.The reserved concurrency is set too low; increase the reserved concurrency for the function.

AnswerD

Reserved concurrency limits concurrent executions, causing throttling when exceeded.

Why this answer

Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Exam trap

The trap here is that candidates often confuse throttling with message processing failures and incorrectly focus on DLQ or visibility timeout settings, rather than recognizing that reserved concurrency directly controls the maximum number of concurrent Lambda executions and is the primary cause of throttling when set too low.

How to eliminate wrong answers

Option A is wrong because the SQS visibility timeout controls how long a message is hidden after being polled, not the cause of Lambda throttling; a short visibility timeout would cause duplicate processing, not throttling. Option B is wrong because a dead-letter queue (DLQ) captures messages that fail processing after multiple retries, but it does not prevent throttling or address the root cause of messages staying in the queue due to concurrency limits. Option C is wrong because the redrive policy's maxReceiveCount determines how many times a message can be received before being sent to a DLQ, and reducing it would send messages to the DLQ sooner, not resolve throttling issues.

Full explanation →

42

MCQhard

A company is deploying SAP S/4HANA on AWS and needs to ensure that the system can handle a sudden increase in user load during month-end closing. Which architectural change would best address this requirement?

A.Configure auto-scaling for the SAP application tier based on CPU utilization.

B.Deploy the application across multiple Availability Zones.

C.Increase the provisioned IOPS on the database EBS volumes.

D.Use a larger EC2 instance type for the application server.

AnswerA

Auto-scaling adds compute capacity automatically during high load.

Why this answer

SAP S/4HANA on AWS supports auto-scaling for the application tier (ASCS/PAS/AAS) using AWS Auto Scaling groups based on CPU utilization. This allows the system to dynamically add or remove application server instances to handle sudden spikes in user load during month-end closing, ensuring performance without manual intervention.

Exam trap

The trap here is that candidates often confuse high availability (multi-AZ) with elasticity (auto-scaling), or assume that vertical scaling (larger instance) is the only way to handle load spikes, missing the cloud-native horizontal scaling approach.

How to eliminate wrong answers

Option B is wrong because deploying across multiple Availability Zones improves high availability and fault tolerance, but does not directly address sudden increases in user load; it does not scale capacity dynamically. Option C is wrong because increasing provisioned IOPS on database EBS volumes improves disk throughput and latency, but does not add compute capacity to handle more concurrent users. Option D is wrong because using a larger EC2 instance type for the application server provides a fixed increase in capacity, but does not offer the elasticity needed to handle sudden, unpredictable load spikes; it also leads to over-provisioning during normal periods.

Full explanation →

43

Multi-Selectmedium

A company is migrating an SAP system to AWS using the SAP DMO (Database Migration Option) with system move. Which TWO prerequisites must be met before starting the migration?

Select 2 answers

A.A separate AWS account must be used for the target system.

B.The target EC2 instances and storage must be prepared in advance.

C.The source system must be running a supported SAP NetWeaver release.

D.The source database must be stopped during the entire migration.

E.A VPN or Direct Connect connection must be established.

AnswersB, C

Needed to import the system.

Why this answer

SAP DMO requires that the source system is on a supported SAP NetWeaver release and that the target AWS infrastructure (EC2, storage) is prepared. The source database does not need to be stopped; DMO can run online. A separate AWS account is not a prerequisite.

A direct network connection is recommended but not strictly required.

Full explanation →

44

MCQmedium

A company is migrating its SAP ERP system to AWS. The system requires high availability across two Availability Zones. Which AWS service should be used to manage the virtual IP address for the SAP Central Services (ASCS/ERS) cluster?

A.Elastic IP address

B.Network Load Balancer

C.AWS Global Accelerator

D.Amazon Route 53

AnswerB

Correct. A Network Load Balancer provides a virtual IP (its DNS name or static IP) and can route traffic to the active ASCS/ERS node in a multi-AZ cluster based on health checks.

Why this answer

The correct approach for managing the virtual IP address for SAP Central Services (ASCS/ERS) across two Availability Zones is to use a Network Load Balancer (NLB). AWS does not support floating IPs across AZs, so an NLB is used to front the ASCS/ERS endpoints. The NLB uses health checks to route traffic to the active node, providing a single virtual IP (the NLB's DNS name or static IP) that clients can use.

This is the recommended AWS pattern for SAP high availability. Route 53 is used for DNS failover but does not serve as a virtual IP itself; it can complement the NLB by pointing a hostname to the NLB's DNS name, but the virtual IP is managed by the NLB.

Exam trap

The trap is that candidates may think Route 53 can manage the virtual IP directly, but Route 53 only provides DNS resolution and failover. AWS does not support floating IPs across AZs, so the standard solution is an NLB that provides a static endpoint (IP or DNS name) for the SAP cluster, with health checks to direct traffic to the active node.

How to eliminate wrong answers

Option A is wrong because Elastic IP addresses are static public IPv4 addresses that cannot be moved between instances across Availability Zones without manual intervention, and they do not support automatic failover required for SAP ASCS/ERS clustering. Option B is wrong because a Network Load Balancer operates at Layer 4 and distributes traffic to multiple targets, but it cannot serve as a virtual IP for the SAP cluster's active/passive model where only one node is active at a time; NLB is typically used for SAP application tier load balancing, not for the ASCS/ERS virtual IP. Option C is wrong because AWS Global Accelerator provides static IP addresses for global traffic routing and performance optimization, but it is designed for internet-facing applications and does not manage virtual IP failover within a single region's Availability Zones for SAP cluster services.

Full explanation →

45

Multi-Selecthard

Which THREE factors are essential when planning the migration of an SAP system with near-zero downtime requirements? (Choose three.)

Select 3 answers

A.Network bandwidth between source and target

B.Data volume and change rate during migration

C.Performance testing strategy for the target system

D.Ability to perform a final delta sync before cutover

E.Choice of storage type (EBS vs. EFS)

AnswersA, B, D

Bandwidth affects the speed of data transfer for both full load and delta.

Why this answer

For near-zero downtime migration, network bandwidth (A) determines the speed of initial and delta data transfer, directly impacting the cutover window. Data volume and change rate (B) affect the feasibility of completing delta syncs within the allowed downtime. The ability to perform a final delta sync (D) is crucial to minimize the final cutover window by synchronizing only changes since the last sync.

Performance testing strategy (C) can be done post-migration and does not directly affect downtime planning. Storage type choice (E) impacts performance but not the downtime itself, as long as sufficient throughput is available.

Full explanation →

46

MCQmedium

A company is designing an SAP S/4HANA deployment on AWS with high availability. They want to use a shared file system for the SAP transport directory. Which AWS service should they use for this shared file system?

A.Amazon EFS

B.Amazon FSx for Windows File Server

C.Amazon EBS with multi-attach enabled

D.Amazon S3

AnswerA

EFS provides a scalable NFS file system that can be shared across multiple AZs.

Why this answer

Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones, which is exactly what an SAP transport directory requires. The SAP transport directory (e.g., /usr/sap/trans) must be accessible from all SAP application servers in the high-availability cluster, and EFS supports the necessary file locking and consistency semantics for SAP's transport management system (TMS).

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach (which is limited to a single AZ and a small number of instances) with a true multi-AZ shared file system, or they mistakenly think Amazon S3 can be used as a shared file system via a mount point (e.g., s3fs), which lacks the POSIX compliance and locking required for SAP transport directories.

How to eliminate wrong answers

Option B is wrong because Amazon FSx for Windows File Server uses the SMB protocol, which is not natively supported by SAP S/4HANA running on Linux (the typical deployment on AWS), and would require additional configuration or a Windows-based jump host. Option C is wrong because Amazon EBS with multi-attach is limited to a maximum of 16 Nitro-based EC2 instances in a single Availability Zone, which violates the multi-AZ high-availability requirement for SAP S/4HANA. Option D is wrong because Amazon S3 is an object storage service that does not provide a POSIX-compliant file system interface, cannot be mounted directly as a shared file system by EC2 instances, and lacks the file locking mechanisms required by SAP's transport directory.

Full explanation →

47

MCQeasy

A company needs to migrate a large amount of on-premises data to Amazon S3. The data is stored on tape backups. The migration must be completed within 2 weeks. Which AWS service should they use?

A.AWS DataSync

B.AWS Database Migration Service

C.AWS Snowball Edge

D.AWS Storage Gateway

AnswerC

Snowball Edge can physically ship devices to transfer large data quickly.

Why this answer

AWS Snowball Edge is a physical device designed for large-scale data transfers when network bandwidth is limited or transfer time is critical. For migrating petabytes of tape backup data to Amazon S3 within 2 weeks, Snowball Edge provides a cost-effective and fast solution by shipping physical storage devices. Option A (AWS DataSync) is an online data transfer service, but for large tape backups, the transfer may take longer than 2 weeks over typical internet connections.

Option B (AWS Database Migration Service) is specifically for migrating databases, not tape file data. Option D (AWS Storage Gateway) provides hybrid cloud storage but is not optimized for bulk one-time migration of tape archives.

Full explanation →

48

MCQmedium

An SAP administrator needs to ensure that all EC2 instances in the SAP landscape have the correct patches and configurations. Which AWS service can be used to automate OS patch management?

A.AWS CloudFormation

B.AWS Systems Manager Patch Manager

C.AWS OpsWorks

D.AWS Config

AnswerB

AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates.

Why this answer

AWS Systems Manager Patch Manager automates the patching of EC2 instances, making it the correct choice for OS patch management. Option A is wrong because AWS CloudFormation is used for infrastructure as code, not patching. Option C is wrong because AWS OpsWorks is for configuration management with Chef/Puppet.

Option D is wrong because AWS Config is for compliance auditing, not patching.

Full explanation →

49

MCQmedium

An SAP system running on AWS is experiencing high CPU utilization on the database server. The database is SAP HANA running on an r5.8xlarge instance. Which metric in Amazon CloudWatch would best indicate whether the CPU is being consumed by the HANA process or by other OS processes?

A.CPUUtilization metric from the EC2 instance

B.HANA CPU metric from SAP HANA CloudWatch integration

C.CPUCreditUsage metric

D.Custom metrics collected by the CloudWatch agent for the hdbindexserver process

AnswerD

The CloudWatch agent can collect per-process CPU metrics, allowing identification of HANA CPU usage.

Why this answer

The CloudWatch agent can be configured to collect custom metrics for specific processes, such as hdbindexserver (the main SAP HANA index server process). By monitoring the CPU utilization of this specific process, you can directly determine whether the HANA database process itself is consuming the CPU, as opposed to other OS-level processes like kernel threads, system daemons, or other applications. This granularity is not available from the EC2 instance-level CPUUtilization metric.

Exam trap

The trap here is that candidates assume the SAP HANA CloudWatch integration (Option B) provides CPU metrics, but it actually focuses on database-level metrics like memory, connection count, and SQL throughput, not per-process OS CPU usage.

How to eliminate wrong answers

Option A is wrong because the EC2 instance-level CPUUtilization metric aggregates all CPU usage across all processes, including both HANA and non-HANA processes, so it cannot isolate whether the CPU is consumed by the HANA process specifically. Option B is wrong because SAP HANA CloudWatch integration provides HANA-specific metrics like memory and SQL performance, but it does not expose a direct 'HANA CPU' metric that breaks down CPU usage per HANA process; the integration focuses on database-level KPIs, not OS process-level CPU. Option C is wrong because CPUCreditUsage is a metric for burstable T-series instances (e.g., t3, t2) to track CPU credit consumption, and r5.8xlarge is a standard instance type that does not use CPU credits, making this metric irrelevant.

Full explanation →

50

MCQmedium

An SAP system administrator is setting up monitoring for SAP NetWeaver on AWS. They want to send custom SAP application metrics to CloudWatch for alerting. What is the most efficient way to achieve this?

A.Use SAP Solution Manager to export metrics to CloudWatch via API

B.Use AWS Lambda to periodically query SAP and push metrics to CloudWatch

C.Install the Amazon CloudWatch Agent on the EC2 instance and configure it to collect SAP metrics

D.Configure AWS Systems Manager to collect SAP metrics

AnswerC

The CloudWatch Agent can collect custom metrics from the OS and applications, including SAP, and publish them to CloudWatch efficiently.

Why this answer

The CloudWatch Agent can collect custom metrics from the OS and applications, including SAP, and publish them to CloudWatch. AWS Lambda can be used but requires custom code and more overhead. SAP Solution Manager does not natively integrate with CloudWatch.

AWS Systems Manager is for management, not custom metric publishing.

Full explanation →

51

MCQhard

A company is migrating a legacy application to AWS. The application uses a custom TCP protocol and requires session persistence. The application runs on a fleet of EC2 instances behind a Network Load Balancer (NLB). The current configuration uses a TCP listener with 'source IP' stickiness. However, some clients are being routed to different instances mid-session, causing application errors. What is the most likely cause and solution?

A.The NLB does not support source IP stickiness; use a Classic Load Balancer instead.

B.Clients are behind a NAT gateway, so the source IP changes between requests, breaking stickiness. Use a 'stitched' cookie or switch to an Application Load Balancer.

C.The NLB has cross-zone load balancing enabled, which distributes traffic across instances in different Availability Zones.

D.The idle timeout of the NLB is too low, causing the NLB to close connections prematurely.

AnswerB

NAT changes the source IP, which defeats source IP stickiness.

Why this answer

Clients behind a NAT gateway will have their source IP address translated to the NAT gateway's public IP, which remains consistent for all requests from that gateway. However, if multiple clients share the same NAT gateway, the source IP is the same, but the NLB's source IP stickiness is based on the client's source IP as seen by the NLB. If the NAT gateway uses multiple public IPs or if clients are behind different NAT gateways, the source IP can change between requests, breaking stickiness.

The solution is to use a 'stitched' cookie or switch to an Application Load Balancer, which supports cookie-based session persistence independent of source IP.

Exam trap

The trap here is that candidates assume source IP stickiness works identically for all clients, failing to consider that NAT gateways or proxy servers can cause the source IP to change between requests, which is a common scenario in hybrid or multi-VPC architectures.

How to eliminate wrong answers

Option A is wrong because Network Load Balancers do support source IP stickiness (also known as client IP stickiness) for TCP listeners; Classic Load Balancers are legacy and not recommended for new deployments. Option C is wrong because cross-zone load balancing distributes traffic across instances in different Availability Zones but does not cause mid-session routing changes; it actually helps maintain stickiness by keeping traffic within the same target group. Option D is wrong because the idle timeout of an NLB is configurable (default 350 seconds) and affects connection persistence, but it would cause connections to drop entirely, not route to different instances mid-session.

Full explanation →

52

MCQeasy

An SAP administrator needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?

A.AWS Config

B.AWS CloudTrail

C.Amazon CloudWatch Logs

D.VPC Flow Logs

AnswerB

CloudTrail provides a record of API activity.

Why this answer

AWS CloudTrail records API calls for auditing. Option A is incorrect because AWS Config monitors configuration changes. Option C is incorrect because Amazon CloudWatch Logs is for storing log data.

Option D is incorrect because VPC Flow Logs capture network traffic information.

Full explanation →

53

Multi-Selecteasy

A company is designing an SAP S/4HANA deployment on AWS. They want to ensure high availability for the central services (ASCS and ERS) across two Availability Zones. Which TWO of the following are required components for a typical SAP high availability setup on AWS? (Choose TWO.)

Select 2 answers

A.Amazon RDS Multi-AZ deployment for the SAP HANA database.

B.AWS Network Load Balancer to route traffic to the ASCS and ERS instances.

C.Amazon EFS file system mounted on both instances for shared /sapmnt.

D.AWS Transit Gateway to connect the two Availability Zones.

E.AWS Global Accelerator to provide static anycast IP addresses.

AnswersB, C

NLB is used for SAP HA to manage virtual IPs and health checks.

Why this answer

The AWS Network Load Balancer (NLB) is required to distribute traffic to the ASCS and ERS instances across two Availability Zones. It uses health checks to detect failures and reroute traffic to the healthy instance, ensuring that the SAP central services remain available even if one AZ fails. The NLB operates at Layer 4, preserving the source IP and supporting the necessary SAP protocols like the Message Server and Enqueue Replication.

Exam trap

The trap here is that candidates often confuse the need for a shared file system (like EFS) with a database replication mechanism, but the question specifically asks for components required for central services (ASCS/ERS) HA, not the database layer.

Full explanation →

54

MCQeasy

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP system are logged for auditing purposes. Which AWS service should be enabled?

A.AWS Config

B.AWS CloudTrail

C.Amazon CloudWatch

D.VPC Flow Logs

AnswerB

CloudTrail provides a record of API activity in your account.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to AWS services, including the caller identity, time, source IP, and request parameters. For SAP systems requiring audit logs of AWS interactions, CloudTrail provides the necessary event history for security analysis, resource change tracking, and compliance auditing.

Exam trap

The trap here is that candidates often confuse AWS Config (configuration tracking) with CloudTrail (API auditing), or assume VPC Flow Logs cover all logging needs, but only CloudTrail provides the detailed API call records required for auditing AWS service interactions.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and recording resource configuration changes over time, not for logging API calls. Option C is wrong because Amazon CloudWatch is a monitoring service for metrics, logs, and alarms, but it does not natively capture API call-level audit trails. Option D is wrong because VPC Flow Logs capture IP traffic metadata at the network interface level (e.g., source/destination IP, ports, protocol), not API calls to AWS services.

Full explanation →

55

MCQhard

A company is running SAP S/4HANA on AWS with a scale-out HANA configuration. The system is experiencing performance degradation during peak hours. Monitoring shows high network throughput on the HANA nodes. Which EC2 instance family is best suited to mitigate this?

A.x2iedn instances with high network bandwidth.

B.c5 instances with placement groups.

C.r5 instances with enhanced networking.

D.m5 instances with EBS optimization.

AnswerA

x2iedn is specifically designed for SAP HANA with high network performance.

Why this answer

The x2iedn instances are specifically designed for SAP HANA scale-out configurations, offering high memory per vCPU and dedicated high network bandwidth via the Elastic Network Adapter (ENA). In a scale-out HANA setup, nodes communicate intensively over the network for data synchronization and shared storage access, so high network throughput directly mitigates the performance degradation during peak hours.

Exam trap

The trap here is that candidates may assume any memory-optimized instance (like r5) is sufficient for SAP HANA, overlooking the specific network throughput and SAP certification requirements for scale-out configurations that only x2iedn instances meet.

How to eliminate wrong answers

Option B is wrong because c5 instances are compute-optimized and lack the large memory footprint required for SAP HANA, making them unsuitable for scale-out HANA workloads. Option C is wrong because r5 instances, while memory-optimized, do not provide the dedicated high network bandwidth and SAP certification for HANA scale-out that x2iedn instances offer. Option D is wrong because m5 instances are general-purpose and not optimized for the memory-intensive and high-throughput network demands of SAP HANA scale-out, and EBS optimization alone does not address inter-node network throughput.

Full explanation →

56

MCQmedium

A company is running SAP ERP on AWS and uses SAP HANA as the database. The system administrator needs to apply an OS patch that requires a reboot. The SAP HANA database is running in a scale-out configuration across multiple EC2 instances. What is the best approach to minimize downtime?

A.Perform a rolling reboot of the HANA nodes, rebooting one node at a time.

B.Take EBS snapshots of all volumes before patching, then patch one by one.

C.Create an AMI of the master node and launch a new instance with the patch applied.

D.Stop all EC2 instances, apply the patch, and start them in sequence.

AnswerA

Correct. Performing a rolling reboot allows the HANA database to remain online by rebooting nodes sequentially, ensuring availability during patching.

Why this answer

SAP HANA scale-out supports rolling updates; rebooting one node at a time allows the database to remain operational during the patching process. Option B is wrong because taking EBS snapshots is a backup step, not a method to apply the patch with minimal downtime. Option C is wrong because creating an AMI and launching a new instance introduces unnecessary complexity and still causes downtime for the master node.

Option D is wrong because stopping all instances results in full downtime, which contradicts the goal of minimizing downtime.

Full explanation →

57

MCQmedium

A company is migrating a multi-tier application to AWS. The application includes a web tier, application tier, and database tier. To ensure security, the database tier must not be accessible from the internet. Which VPC configuration should be used?

A.Place the database tier in subnets with a NAT Gateway

B.Place the database tier in subnets with an Internet Gateway

C.Place all tiers in public subnets

D.Place the database tier in private subnets

AnswerD

Private subnets have no direct internet access.

Why this answer

Placing the database tier in private subnets ensures it is not directly accessible from the internet. Option A (subnets with a NAT Gateway) provides outbound internet access only, not inbound. Option B (subnets with an Internet Gateway) would allow direct internet access.

Option C (all tiers in public subnets) would expose all tiers to the internet. Only option D correctly restricts internet access to the database tier by placing it in private subnets.

Full explanation →

58

MCQmedium

A company is migrating a legacy SAP ERP system to AWS. The migration must be completed over a weekend to minimize business impact. The SAP application relies on a custom kernel that is not supported by the AWS SAP HANA Large Instances. What is the best approach?

A.Migrate to SAP HANA Large Instances and update the kernel

B.Contact SAP to obtain a supported kernel version

C.Use an SAP-certified EC2 instance with the existing kernel

D.Re-platform the application to use a supported kernel

AnswerC

EC2 instances can run custom kernel if certified.

Why this answer

SAP on AWS supports both HANA Large Instances and certified EC2 instances. Since the custom kernel is not supported on HANA Large Instances, the best approach is to use an SAP-certified EC2 instance that can accommodate the existing kernel. Option C is correct because it avoids the unsupported kernel issue without requiring a kernel update.

Option A is incorrect because HANA Large Instances do not support the custom kernel. Option B is incorrect because contacting SAP for a supported kernel may not be feasible within the weekend migration timeframe. Option D is incorrect because re-platforming to a supported kernel introduces additional risk and complexity.

Full explanation →

59

MCQmedium

A company is planning to migrate an SAP BusinessObjects environment to AWS. They need to ensure high availability for the Web Application Server tier. Which AWS service should they use to distribute traffic across multiple instances?

A.AWS Global Accelerator

B.Network Load Balancer (NLB)

C.Application Load Balancer (ALB)

D.Amazon Route 53

AnswerC

ALB is designed for HTTP/HTTPS traffic and is suitable for web application servers.

Why this answer

An Application Load Balancer (ALB) distributes HTTP/HTTPS traffic across targets. NLB is for TCP/UDP. Global Accelerator improves performance but not primarily for load balancing.

Route 53 is DNS.

Full explanation →

60

Multi-Selecthard

A company is running SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to SAP Web Dispatchers. The operations team notices that some requests are failing with 502 errors. Which THREE actions should be taken to troubleshoot the issue?

Select 3 answers

A.Disable cross-zone load balancing to isolate the issue.

B.Increase the idle timeout setting on the ALB.

C.Review the ALB access logs to identify the target response codes.

D.Verify the security group rules for the ALB and the target instances.

E.Check the health check configuration and target group health status.

AnswersC, D, E

Access logs provide detailed information about the requests and responses.

Why this answer

Options C, D, and E are correct actions to troubleshoot 502 errors. Option C: Reviewing ALB access logs helps identify the target response codes, which can indicate why requests are failing. Option D: Verifying security group rules ensures that the ALB and target instances can communicate properly.

Option E: Checking the health check configuration and target group health status can reveal if targets are unhealthy, causing 502 errors. Option A is incorrect because disabling cross-zone load balancing does not directly address 502 errors. Option B is incorrect because increasing the idle timeout is not a typical solution for 502 errors; idle timeouts usually affect 504 errors.

Full explanation →

61

MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 24-hour maintenance window. The migration must minimize downtime and support ongoing replication during the cutover. Which AWS service should be used for the migration?

A.AWS Snowball Edge

B.AWS Database Migration Service (DMS)

C.Amazon S3 Transfer Acceleration

D.AWS Server Migration Service (SMS)

AnswerB

AWS DMS supports continuous replication and minimal downtime for database migrations.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication from on-premises to RDS with minimal downtime, using change data capture (CDC) for continuous sync. Option A (AWS Snowball Edge) is for large data transfer but does not support ongoing replication. Option C (Amazon S3 Transfer Acceleration) speeds up uploads to S3 but does not directly migrate databases.

Option D (AWS Server Migration Service) is for server-level migrations, not database-specific replication.

Full explanation →

62

MCQmedium

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

A.The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint

B.The CodeDeploy agent on the instances is outdated

C.The instances are not registered as managed instances with the SSM ManagedInstance role

D.The instances do not have an IAM instance profile attached

AnswerA

Missing outbound HTTPS from the instance to the SSM endpoint prevents communication.

Why this answer

The error 'Unable to retrieve patch baseline' indicates that the EC2 instances cannot communicate with the AWS Systems Manager service to fetch the patch baseline configuration. Since the instances are in a private subnet with a VPC endpoint for SSM, the most likely cause is that the VPC endpoint's security group does not allow HTTPS outbound traffic (port 443) to the endpoint itself. Without this outbound rule, the SSM Agent on the instance cannot establish the TLS connection required to retrieve the patch baseline from the SSM API.

Exam trap

The trap here is that candidates often assume the error is due to missing IAM permissions (Option D) or instance registration (Option C), but the specific error message 'Unable to retrieve patch baseline' is a network connectivity error, not an authorization error, and the VPC endpoint security group misconfiguration is the classic cause in private subnet scenarios.

How to eliminate wrong answers

Option B is wrong because the CodeDeploy agent is unrelated to Systems Manager Patch Manager; the error is specific to SSM communication, not CodeDeploy. Option C is wrong because the 'SSM ManagedInstance role' is not a valid AWS concept; instances use an IAM instance profile with the AmazonSSMManagedInstanceCore policy to register as managed instances, and the error message points to a network connectivity issue, not registration. Option D is wrong because while an IAM instance profile is required for SSM operations, the error 'Unable to retrieve patch baseline' is a network-level error, not an authorization error (which would typically return 'AccessDenied' or similar).

Full explanation →

63

MCQhard

An SAP Basis team is designing a high-availability architecture for SAP NetWeaver on AWS. They plan to use a shared file system for the transport directory and SAP profiles across multiple availability zones. Which AWS storage service should they use?

A.Amazon EBS with multi-attach

B.Amazon FSx for Windows File Server

C.Amazon EFS

D.Amazon S3

AnswerC

EFS provides a shared NFS file system across AZs.

Why this answer

Amazon EFS (Elastic File System) is the correct choice because it provides a fully managed, NFS-based shared file system that is accessible from multiple EC2 instances across different Availability Zones. For SAP NetWeaver, the transport directory and SAP profiles must be concurrently accessible from all application servers in a high-availability setup, and EFS supports the required POSIX permissions and locking semantics needed by SAP.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach (option A) as a viable cross-AZ solution, but it is strictly single-AZ, making it incompatible with the multi-AZ high-availability requirement for SAP NetWeaver.

How to eliminate wrong answers

Option A is wrong because Amazon EBS with multi-attach is limited to a single Availability Zone and supports only up to 16 Nitro-based instances, making it unsuitable for cross-AZ SAP high-availability architectures. Option B is wrong because Amazon FSx for Windows File Server uses SMB protocol, which is not natively supported by SAP NetWeaver on Linux (the typical OS for SAP on AWS) and would require additional translation layers. Option D is wrong because Amazon S3 is an object storage service that does not provide a POSIX-compliant file system interface or support the file locking and concurrent access patterns required by SAP transport and profile directories.

Full explanation →

64

Multi-Selecteasy

Which TWO AWS services can be used to monitor the health of SAP application servers? (Choose 2)

Select 2 answers

A.Amazon Route 53

B.Amazon S3

C.AWS CloudTrail

D.Amazon CloudWatch

E.AWS Systems Manager

AnswersD, E

Monitors EC2 metrics and logs.

Why this answer

The correct answers are D (Amazon CloudWatch) and E (AWS Systems Manager). CloudWatch can monitor EC2 CPU/memory metrics and SAP application-specific metrics via custom metrics or the SAP Host Agent integration. Systems Manager can run custom scripts for health checks, such as checking SAP service status, and can be used with Automation or Run Command to perform health checks across multiple instances.

Option A (Route 53) is for DNS routing and basic IP health checks, not application-level SAP monitoring. Option B (S3) is object storage, not for monitoring. Option C (CloudTrail) is for API auditing, not real-time health monitoring.

Full explanation →

65

MCQhard

An SAP Basis administrator is troubleshooting a slow-performing SAP ERP system on AWS. The system uses Amazon EBS volumes with Provisioned IOPS (PIOPS) for database storage. Which metric in Amazon CloudWatch would best indicate whether the EBS volume is experiencing a performance bottleneck?

A.VolumeIdleTime

B.VolumeReadOps

C.VolumeQueueLength

D.VolumeThroughputPercentage

AnswerC

A high queue length indicates pending I/O requests, suggesting a bottleneck.

Why this answer

VolumeQueueLength measures the number of pending I/O requests waiting to be serviced by the EBS volume. A sustained high queue length (e.g., consistently above 1 per optimized IOPS) indicates that the volume is saturated and cannot keep up with the workload, which directly causes performance bottlenecks for SAP ERP database operations. This metric is the most direct indicator of a bottleneck because it reflects backpressure from the storage subsystem.

Exam trap

The trap here is that candidates confuse high I/O operations (VolumeReadOps) with a bottleneck, but a high read count alone does not indicate queuing or saturation—only VolumeQueueLength reveals whether the volume is struggling to keep up with the demand.

How to eliminate wrong answers

Option A is wrong because VolumeIdleTime measures the percentage of time the volume has no pending I/O operations; a low idle time indicates activity, not a bottleneck, and a high idle time would suggest the volume is underutilized. Option B is wrong because VolumeReadOps simply counts read operations per minute; a high value indicates heavy read activity but does not by itself indicate a bottleneck—the volume could be handling those reads efficiently. Option D is wrong because VolumeThroughputPercentage is not a standard CloudWatch metric for EBS; the correct throughput-related metric is VolumeThroughput (bytes per second), and even that does not directly indicate queuing or saturation.

Full explanation →

66

MCQhard

Refer to the exhibit. An SAP administrator runs the AWS CLI command and receives the output shown. The SAP application server (instance i-0abcd1234) is in 'running' state, but the SAP application is not reachable. The security group allows inbound traffic on port 3200. What is the MOST likely cause of the issue?

A.The network ACL for the subnet is blocking outbound traffic.

B.The instance is in a stopped state.

C.The security group inbound rule for port 3200 is not applied to the instance.

D.The operating system firewall on the instance is blocking port 3200.

AnswerD

OS firewall can block traffic even if security group allows it.

Why this answer

The instance is in 'running' state and the security group allows inbound traffic on port 3200, yet the SAP application is unreachable. This indicates a host-level firewall (e.g., iptables, firewalld, or Windows Firewall) on the SAP application server is blocking inbound connections to port 3200, which operates independently of AWS security groups and network ACLs.

Exam trap

The trap here is that candidates often assume security group rules are the sole determinant of traffic flow, forgetting that the OS firewall on the instance can independently block traffic even when AWS-level permissions are correctly configured.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and affect traffic at the subnet level, but the security group already allows inbound traffic on port 3200, and the instance is running; outbound traffic blocking would not prevent inbound connections to the instance. Option B is wrong because the AWS CLI output explicitly shows the instance is in 'running' state, not 'stopped'. Option C is wrong because the question states the security group allows inbound traffic on port 3200, and the security group is associated with the instance; if it were not applied, the instance would still be reachable via other rules or default deny, but the issue is specific to port 3200 being blocked at the OS level.

Full explanation →

67

Multi-Selectmedium

Which THREE of the following are valid disaster recovery strategies for SAP on AWS? (Choose 3)

Select 3 answers

A.Maintain a cold standby environment in another Region

B.AWS RDS Multi-AZ deployment for SAP HANA

C.SAP backup to Amazon S3 with cross-region replication

D.Cross-region Amazon EBS snapshot copy and restore

E.SAP HANA System Replication across AWS Regions

AnswersC, D, E

Ensures backup availability in another region.

Why this answer

SAP backup to Amazon S3 with cross-region replication is a valid disaster recovery strategy. By backing up SAP data (e.g., database backups, log files) to S3 and enabling cross-region replication (CRR), you automatically replicate backups to a secondary AWS Region. This ensures that backup data is available in another Region for recovery in the event of a regional disaster, providing a durable and cost-effective DR solution without requiring a running standby system.

Exam trap

The trap here is that candidates may confuse high-availability (HA) solutions like Multi-AZ or HANA System Replication within a single Region with disaster recovery (DR) across Regions, or incorrectly assume that RDS supports SAP HANA, leading them to select Option B as a valid DR strategy.

Full explanation →

68

MCQmedium

An SAP application running on an EC2 instance is experiencing high latency during peak hours. The instance is in a private subnet with a NAT Gateway for outbound internet. Which action would most effectively reduce latency for SAP users?

A.Increase the EC2 instance size to a larger type with more CPU and memory.

B.Move the instance to a public subnet and assign a public IP address.

C.Replace the NAT Gateway with an Internet Gateway.

D.Enable EBS optimization on the instance.

AnswerA

Larger instance type directly improves compute performance, reducing application latency.

Why this answer

Increasing the EC2 instance size to a larger type with more CPU and memory directly addresses the root cause of high latency during peak hours for an SAP application: resource contention. SAP is compute and memory-intensive; when the instance's vCPUs and RAM are saturated, request queuing and processing delays occur. A larger instance type provides more dedicated resources, reducing processing time per transaction and thus lowering latency for users.

Exam trap

The trap here is that candidates often confuse network latency (which NAT Gateway or subnet changes might affect) with application latency caused by resource exhaustion, leading them to incorrectly choose network-related fixes instead of scaling the instance.

How to eliminate wrong answers

Option B is wrong because moving the instance to a public subnet and assigning a public IP address does not reduce latency caused by resource saturation; it only changes network routing and exposes the instance directly to the internet, which introduces security risks without addressing CPU/memory bottlenecks. Option C is wrong because replacing the NAT Gateway with an Internet Gateway does not reduce latency for SAP users; the NAT Gateway is not the source of high latency in this scenario, and an Internet Gateway would only change outbound internet routing, not improve instance performance. Option D is wrong because enabling EBS optimization on the instance improves I/O performance between the instance and EBS volumes, but the problem is high latency due to CPU/memory exhaustion, not storage throughput; EBS optimization does not increase compute capacity.

Full explanation →

69

MCQmedium

Your company is running SAP Business Suite on Oracle on AWS. The database is hosted on an EC2 instance with EBS volumes configured as RAID 0 for performance. You are planning to migrate to SAP HANA on AWS. The new HANA database will be hosted on a single EC2 instance with EBS io2 volumes. You need to ensure minimal downtime during the migration. Which approach should you take?

A.Use SAP HANA System Replication (HSR) with DMO to replicate data while the source is running, then perform a final cutover.

B.Use AWS Database Migration Service (DMS) to continuously replicate from Oracle to HANA.

C.Use SAP Landscape Management (LaMa) to automate the migration with minimal downtime.

D.Perform a classic migration using SAP Software Update Manager (SUM) with database migration option (DMO) in a single step, stopping the source system.

AnswerA

HSR with DMO allows minimal downtime by replicating changes during the migration.

Why this answer

The correct approach is to use SAP HANA System Replication (HSR) with a Database Migration Option (DMO) migration. This allows continuous data replication from the source Oracle database to the target SAP HANA database while the source system remains operational, minimizing downtime. The final cutover is performed quickly.

Option B (AWS DMS) is not suitable because AWS DMS does not support SAP HANA as a target. Option C (SAP LaMa) is a landscape management tool that can automate some migration steps but does not in itself provide near-zero downtime replication; it would typically be used with other methods. Option D (classic DMO with SUM in a single step) requires stopping the source system, resulting in extended downtime.

Full explanation →

70

MCQmedium

An SAP application running on AWS is experiencing high latency for database write operations. The system uses SAP ASE on Amazon EC2 with gp2 EBS volumes. Which change is most likely to improve write performance?

A.Move database write logs to Amazon S3 for better throughput.

B.Migrate to io1/io2 EBS volumes with provisioned IOPS.

C.Migrate to gp3 EBS volumes with higher baseline performance.

D.Use instance store volumes for database data files.

AnswerB

Provisioned IOPS volumes are designed for consistent, low-latency database workloads.

Why this answer

SAP ASE on Amazon EC2 with gp2 EBS volumes is experiencing high latency for database write operations. gp2 volumes use a burst-bucket model that can exhaust IOPS credits under sustained heavy writes, causing throttled performance. Migrating to io1 or io2 EBS volumes with provisioned IOPS guarantees consistent, low-latency write throughput, which directly addresses the bottleneck for database write workloads.

Exam trap

The trap here is that candidates assume gp3's higher baseline performance (3000 IOPS vs gp2's 100 IOPS baseline) is sufficient for all workloads, but they overlook that provisioned IOPS volumes are the only AWS block storage option that guarantees consistent performance for latency-sensitive database writes, especially under sustained load.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service with significantly higher latency and no support for database-level write operations such as transaction logs or redo logs; it cannot replace low-latency block storage required by SAP ASE. Option C is wrong because while gp3 offers higher baseline performance than gp2, it still uses a shared resource model and does not provide the guaranteed, consistent IOPS that io1/io2 deliver for sustained write-heavy workloads like SAP database transactions. Option D is wrong because instance store volumes are ephemeral and provide temporary block storage that is not durable; using them for database data files would risk data loss on instance stop/termination, and they lack the persistent, provisioned IOPS needed for reliable SAP ASE write performance.

Full explanation →

71

MCQmedium

An SAP system is deployed on EC2 instances with EBS volumes. The operations team needs to implement a backup strategy that provides point-in-time recovery for the EBS volumes with minimal downtime. Which AWS service should they use?

A.AWS Storage Gateway

B.AWS Backup

C.Amazon EBS Snapshots

D.Amazon S3

AnswerC

EBS Snapshots are designed for point-in-time backup of EBS volumes.

Why this answer

Amazon EBS Snapshots are the correct service for point-in-time recovery of EBS volumes with minimal downtime. They capture the volume data at a specific point in time and can be taken while the volume is attached and in use, with minimal performance impact (by taking snapshots during low usage). Option A, AWS Storage Gateway, is used for hybrid cloud storage, not for direct EBS backups.

Option B, AWS Backup, is a centralized backup service that can automate EBS snapshots, but the question asks which service provides point-in-time recovery for EBS volumes directly; EBS Snapshots are the underlying mechanism. Option D, Amazon S3, is object storage and not directly for EBS volume backups.

Full explanation →

72

MCQhard

An SAP system running on AWS is experiencing intermittent connectivity issues between the application server and the database server. Both servers are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. Which AWS service can help diagnose the network path and identify packet loss?

A.AWS Direct Connect

B.VPC Flow Logs

C.AWS CloudTrail

D.AWS Site-to-Site VPN

AnswerB

VPC Flow Logs capture network traffic information for analysis.

Why this answer

VPC Flow Logs capture metadata about IP traffic within the VPC, including accepted and rejected connections. By analyzing flow logs, you can identify packet loss, rejected requests, or other connectivity issues between subnets. Option A (AWS Direct Connect) is for dedicated on-premises connectivity, not for internal VPC traffic.

Option C (AWS CloudTrail) records API calls, not network traffic. Option D (AWS Site-to-Site VPN) is for connecting remote networks, not for analyzing internal VPC paths.

Full explanation →

73

MCQeasy

A company is migrating an SAP environment to AWS and wants to automate the provisioning of infrastructure using code. Which AWS service should be used for this purpose?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS CodeDeploy

D.AWS OpsWorks

AnswerB

AWS CloudFormation enables infrastructure as code (IaC) to provision and manage AWS resources in a repeatable and automated manner, which is ideal for automating SAP environment provisioning.

Why this answer

AWS CloudFormation enables infrastructure as code (IaC) to provision and manage AWS resources in a repeatable and automated manner, which is ideal for automating SAP environment provisioning. Option A (AWS Elastic Beanstalk) is incorrect because it is a platform-as-a-service (PaaS) for deploying and scaling web applications, not for provisioning general infrastructure. Option B (AWS CloudFormation) is correct because it directly provides infrastructure as code.

Option C (AWS CodeDeploy) is incorrect because it automates application deployments to compute services, not infrastructure provisioning. Option D (AWS OpsWorks) is incorrect because it is a configuration management service using Chef/Puppet, not a direct infrastructure provisioning service like CloudFormation.

Full explanation →

74

MCQmedium

A company runs SAP HANA on AWS using a single EC2 instance with EBS volumes. The system experiences performance degradation during peak hours. Which approach would provide the MOST immediate improvement in disk I/O performance without downtime?

A.Add additional EBS volumes and configure RAID 0 across them.

B.Migrate the EC2 instance to a larger instance type.

C.Modify the EBS volume type and IOPS using Elastic Volumes.

D.Create a new EBS volume with higher performance and copy data using rsync.

AnswerC

Elastic Volumes allow online modification of volume type and IOPS without downtime.

Why this answer

EBS Elastic Volumes allow modifying the volume type (e.g., to gp3 or io2) and IOPS online without detaching the volume or stopping the instance, providing immediate I/O improvement. Option A is incorrect because adding EBS volumes and configuring RAID 0 requires downtime and reconfiguration. Option B is incorrect because migrating to a larger instance type does not directly improve disk I/O; it improves compute performance.

Option D is incorrect because creating a new volume and copying data with rsync involves downtime and does not provide immediate improvement.

Full explanation →

75

Multi-Selecteasy

An SAP administrator is setting up monitoring for an SAP HANA database. Which TWO metrics should be monitored from the HANA database using Amazon CloudWatch?

Select 2 answers

A.CPU utilization of the HANA process

B.SAPS (SAP Application Performance Standard)

C.EBS volume queue length

D.Network packet loss

E.Memory usage (used memory / total memory)

AnswersA, E

CPU utilization directly affects query performance.

Why this answer

Options A and E are correct because CPU utilization and memory usage (used memory / total memory) are critical for SAP HANA performance and are directly available from the HANA database via Amazon CloudWatch. Option B (SAPS) is an application performance standard, not a native CloudWatch metric. Option C (EBS volume queue length) is an infrastructure-level metric for storage, not HANA-specific.

Option D (Network packet loss) is a network metric not directly from HANA.

Full explanation →

Page 1 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →