Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 676–750

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 10 of 22

676

MCQhard

An SAP system on AWS is configured with an Application Load Balancer (ALB) for health checks. The ALB marks all targets as unhealthy. The health check path is /sap/public/health.html, and the SAP Web Dispatcher is configured to serve this file. What is the most likely cause of the health check failure?

A.The health check path is incorrect.

B.The security group for the Web Dispatcher does not allow traffic from the ALB.

C.The health check port is wrong.

D.The ALB is in a different VPC.

AnswerB

Security groups must allow inbound traffic from the ALB.

Why this answer

ALB health checks originate from private IP addresses within the VPC. If the SAP Web Dispatcher's security group does not allow inbound traffic from the ALB's security group, the health check requests will be blocked. Path or port issues would also cause failures, but the most common cause is security group misconfiguration.

Full explanation →

677

MCQhard

An SAP system uses AWS Direct Connect to connect to on-premises networks. The SAP application servers are in a private subnet with a NAT gateway for outbound internet. The SAProuter instance is behind an Internet-facing Network Load Balancer (NLB). Connections from SAP support to the SAProuter timeout. What is the likely cause?

A.The NLB target group is configured with the wrong protocol or port for SAProuter.

B.The security group for the SAProuter instance does not allow inbound traffic from the NLB.

C.The Direct Connect virtual interface is not advertising the SAProuter's IP address.

D.The NAT gateway does not allow inbound traffic from the internet.

AnswerB

This is a possible cause, but the question asks for the most specific cause given the symptom.

Why this answer

The issue is that connections from SAP support to the SAProuter timeout. The SAProuter instance is behind an Internet-facing NLB, which distributes traffic to targets. For the NLB to forward traffic to the SAProuter instance, the instance's security group must allow inbound traffic from the NLB's source IP or security group.

Without this rule, the NLB health checks fail and traffic is not forwarded, causing timeouts. Option A (wrong protocol/port) is possible but less likely since the NLB is configured for SAProuter. Option C (Direct Connect advertising) is irrelevant because the connection is from the internet, not on-premises.

Option D (NAT gateway) is for outbound traffic only and does not affect inbound connections from the internet.

Full explanation →

678

MCQhard

A company runs SAP HANA on AWS using a scale-up configuration. The system is experiencing high CPU utilization on the HANA server during peak load. The SAP administrator wants to add more CPU resources without disruption. Which action should be taken?

A.Add an additional HANA node to create a scale-out configuration and distribute the load.

B.Enable Multi-AZ deployment for high availability.

C.Change the EC2 instance type to a larger size using the AWS Management Console.

D.Increase the provisioned IOPS on the EBS volumes.

AnswerA

Scale-out can be added online if using HANA system replication, but involves new instances. However, among options, this is the only one that adds CPU without stopping existing instance (though new instances needed).

Why this answer

Adding an additional HANA node to create a scale-out configuration allows the system to distribute the workload across multiple nodes, providing additional CPU resources without downtime. SAP HANA supports scale-out configurations where new nodes can be added online using the 'ALTER SYSTEM ADD WORKER' command, enabling CPU scaling without restarting the existing system.

Exam trap

The trap here is that candidates often confuse scaling up (changing instance type) with scaling out (adding nodes), and assume that changing the instance type can be done without disruption, but AWS requires stopping the instance for a type change, which causes downtime.

How to eliminate wrong answers

Option B is wrong because enabling Multi-AZ deployment for high availability does not add CPU resources; it only provides a standby instance in another Availability Zone for failover, which does not help with high CPU utilization during peak load. Option C is wrong because changing the EC2 instance type to a larger size requires stopping the instance, which causes disruption and downtime, contradicting the requirement for no disruption. Option D is wrong because increasing provisioned IOPS on EBS volumes improves storage performance, not CPU resources, and does not address high CPU utilization.

Full explanation →

679

MCQhard

An organization is migrating a large SAP ERP system using SAP Landscape Virtualization Management (LVM) for system copy and refresh. During the migration, they encounter an error in LVM indicating that the target host is not reachable. What is the most likely cause?

A.The S3 bucket used for backup is not accessible.

B.The IAM role assigned to the LVM instance does not have sufficient permissions.

C.The AWS Database Migration Service is not configured correctly.

D.The security groups do not allow inbound traffic from the LVM instance to the target host.

AnswerD

Security groups control traffic; if not configured, the target is unreachable.

Why this answer

Security groups controlling traffic between source and target are a common cause. IAM roles affect AWS API calls, not network connectivity. S3 permissions are irrelevant.

AWS DMS is not used.

Full explanation →

680

MCQeasy

An organization runs SAP on AWS and needs to ensure that their SAP HANA database backups are encrypted at rest. Which AWS service should they use to manage the encryption keys?

A.AWS Key Management Service (KMS)

B.AWS CloudHSM

C.AWS Identity and Access Management (IAM)

D.AWS Certificate Manager

AnswerA

KMS manages encryption keys.

Why this answer

AWS Key Management Service (KMS) is the managed service that allows you to create, control, and manage encryption keys for encrypting data at rest, including SAP HANA backups. Option B (CloudHSM) is a hardware security module for generating keys but is not the standard managed service for key management; KMS is more appropriate for this use case. Option C (IAM) is for identity and access management, not encryption key management.

Option D (ACM) is for managing SSL/TLS certificates, not encryption keys for data at rest.

Full explanation →

681

MCQhard

A company is migrating its SAP ERP system to AWS using a heterogeneous migration where the source database is Oracle and the target is SAP HANA. Which AWS service is essential for converting the Oracle schema to SAP HANA schema?

A.AWS Database Migration Service (DMS)

B.AWS DataSync

C.AWS Schema Conversion Tool (SCT)

D.AWS Server Migration Service (SMS)

AnswerC

SCT converts schemas between different database engines.

Why this answer

AWS Schema Conversion Tool (SCT) is designed to convert database schemas from one engine to another, including Oracle to SAP HANA. Option C is the correct choice. Option A (AWS DMS) migrates data but does not convert schema.

Option B (AWS DataSync) is for file transfer. Option D (AWS SMS) is for server migration.

Full explanation →

682

MCQeasy

A company is planning to migrate its SAP ERP system to AWS. The database is SAP HANA with a size of 3 TB. The company wants to minimize downtime during the migration. Which migration strategy should the company use?

A.Use HANA System Replication to replicate the database to an EC2 instance running HANA in the target AWS environment, then perform a takeover.

B.Export the HANA database to flat files using SAP HANA Studio, upload the files to Amazon S3, and import them into an EC2 HANA instance.

C.Use AWS Database Migration Service (DMS) with ongoing replication to migrate the database to Amazon RDS for SAP HANA.

D.Use AWS Backup to take a full backup of the on-premises HANA database and restore it to an EC2 instance in AWS.

AnswerA

HSR provides continuous replication with minimal downtime during the final switchover.

Why this answer

HANA System Replication (HSR) is the optimal strategy for minimizing downtime because it continuously replicates data from the on-premises HANA database to an EC2 instance running HANA in AWS. When the migration window opens, a simple takeover (failover) occurs, typically completing in minutes, which meets the requirement for minimal downtime. This approach avoids the lengthy export/import or backup/restore processes that would take hours for a 3 TB database.

Exam trap

The trap here is that candidates may assume AWS DMS or backup/restore services are suitable for SAP HANA migrations, but DMS does not support HANA as a target, and backup/restore methods cause significant downtime, whereas HANA System Replication is the only AWS-recommended approach for near-zero downtime migrations.

How to eliminate wrong answers

Option B is wrong because exporting a 3 TB HANA database to flat files via SAP HANA Studio and then importing from S3 would take many hours or days, causing significant downtime, and does not support ongoing replication to minimize the cutover window. Option C is wrong because AWS DMS does not support SAP HANA as a target for ongoing replication; Amazon RDS for SAP HANA is not a valid service (RDS supports only certain database engines like MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB, not SAP HANA). Option D is wrong because using AWS Backup to take a full backup and restore it would require the database to be offline during the backup and restore process, leading to extended downtime, and AWS Backup does not natively support SAP HANA for ongoing replication or near-zero downtime migrations.

Full explanation →

683

MCQmedium

A company is migrating an SAP application running on Windows Server to AWS. They plan to use Amazon EC2 with a Windows license included. The current application uses SQL Server Standard edition. Which migration strategy minimizes licensing costs?

A.Lift and shift to EC2 with SAP ASE BYOL on Dedicated Hosts.

B.Use EC2 with SAP ASE Standard on Dedicated Instances to ensure isolation.

C.Use Amazon RDS for SQL Server with License Included pricing.

D.Use EC2 with SAP ASE Express Edition, which is cheaper but may not support all features.

AnswerC

Amazon RDS for SAP ASE with License Included provides a managed database service where the license is included, minimizing licensing costs and reducing administrative overhead.

Why this answer

Using Amazon RDS for SQL Server with License Included pricing eliminates the need for separate SQL Server licenses, which is the most cost-effective approach for migrating the SAP application. Options A, B, and D are incorrect: A (BYOL on Dedicated Hosts) requires existing SAP ASE licenses and Dedicated Hosts add cost; B (Dedicated Instances) provides isolation but adds expense without licensing benefit; D (Express Edition) is limited in features and may not support all SAP requirements.

Exam trap

Candidates may think that Dedicated Instances or Dedicated Hosts are required for SAP isolation or compliance, but these are unnecessary for licensing cost reduction when using RDS for SQL Server with License Included.

Full explanation →

684

MCQeasy

A company needs to set up a disaster recovery solution for SAP on AWS with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which strategy is most appropriate?

A.Deploy all SAP components in a single AWS Region.

B.Use cross-region backup and restore with AWS Backup.

C.Use Multi-AZ deployment for the database.

D.Set up a pilot light environment with database replication.

AnswerB

Backups to S3 can be restored in another region within RPO/RTO.

Why this answer

Cross-region backup and restore with AWS Backup is the most appropriate strategy because it meets both the RPO of 15 minutes and RTO of 2 hours for SAP on AWS. AWS Backup supports continuous backups for SAP HANA databases with a 15-minute RPO via Backint integration, and restoring from a cross-region backup can complete within 2 hours for typical SAP workloads. This approach provides the required recovery point and time objectives while maintaining data durability across AWS Regions.

Exam trap

The trap here is that candidates often confuse Multi-AZ (Option C) as a disaster recovery solution, but it only protects against AZ failures, not regional disasters, and the question's RPO/RTO targets imply a cross-region requirement, making cross-region backup and restore the correct choice despite its higher RTO compared to pilot light.

How to eliminate wrong answers

Option A is wrong because deploying all SAP components in a single AWS Region provides no disaster recovery capability; a regional failure would result in complete data loss and downtime, failing both the RPO and RTO requirements. Option C is wrong because Multi-AZ deployment for the database only protects against an Availability Zone failure within the same Region, not a full regional disaster, and thus cannot meet the cross-region DR requirement implicit in the RPO/RTO targets. Option D is wrong because a pilot light environment with database replication typically achieves a lower RTO (minutes) but requires ongoing replication and failover orchestration; however, for SAP on AWS, pilot light often implies a warm standby with database replication that can achieve sub-15-minute RPO but may not guarantee the 2-hour RTO due to the complexity of SAP application stack startup and validation, and it is not the most appropriate strategy when cross-region backup and restore can meet the stated objectives with less operational overhead.

Full explanation →

685

Multi-Selectmedium

An SAP administrator is designing a backup strategy for an SAP HANA database on AWS. They want to use the Backint interface with Amazon S3. Which THREE components are required? (Choose three.)

Select 3 answers

A.EBS volumes for the backup catalog

B.IAM role with permissions to write to the S3 bucket

C.AWS Backint Agent for SAP HANA

D.S3 Transfer Acceleration enabled

E.An S3 bucket to store the backups

AnswersB, C, E

The EC2 instance needs an IAM role to access S3.

Why this answer

The Backint interface for SAP HANA on AWS requires an IAM role that grants the AWS Backint Agent permissions to write backup data to the designated S3 bucket. Without this IAM role, the agent cannot authenticate or perform PutObject operations against S3, making the backup fail.

Exam trap

The trap here is that candidates may assume EBS volumes are required for the backup catalog or that S3 Transfer Acceleration is mandatory for performance, but the Backint interface only needs the agent, an S3 bucket, and an IAM role with write permissions.

Full explanation →

686

MCQhard

A company runs SAP on EC2 instances in a private subnet. The instances need to download patches from the internet but must not be directly accessible from the internet. Which configuration meets these requirements?

A.Place a proxy server on a bastion host in a public subnet

B.Attach an Internet Gateway to the VPC and add a route to the private subnet

C.Use a VPN connection to the on-premises network and route internet traffic through it

D.Deploy a NAT Gateway in a public subnet and route traffic from the private subnet to it

AnswerD

NAT Gateway enables outbound internet traffic while blocking inbound.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download patches) while preventing any unsolicited inbound connections from the internet. The private subnet's route table directs 0.0.0.0/0 traffic to the NAT Gateway, which performs source network address translation (SNAT) on the outbound traffic and drops unsolicited inbound packets.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking that an Internet Gateway can be used for outbound-only access from a private subnet, when in fact an Internet Gateway enables bidirectional traffic and requires instances to have public IPs to be reachable from the internet.

How to eliminate wrong answers

Option A is wrong because a proxy server on a bastion host in a public subnet would require the EC2 instances to be explicitly configured to use the proxy, and the bastion host itself would be directly accessible from the internet, creating a management and security overhead that does not meet the requirement of the instances not being directly accessible. Option B is wrong because attaching an Internet Gateway directly to the VPC and adding a route to the private subnet would make the instances directly accessible from the internet (since the Internet Gateway enables bidirectional traffic), violating the requirement that instances must not be directly accessible. Option C is wrong because using a VPN connection to the on-premises network and routing internet traffic through it would force all internet-bound traffic to traverse the on-premises network, which is an overly complex and indirect solution that does not leverage AWS-native services; it also does not inherently prevent direct internet access to the instances unless additional firewall rules are applied.

Full explanation →

687

Multi-Selecthard

An SAP system is deployed on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers must be encrypted in transit. Which action should be taken to meet this requirement?

Select 1 answer

A.Attach an Internet Gateway to the VPC

B.Configure SSL/TLS certificates on the database and application servers

C.Restrict security group rules to only allow traffic from the application tier

D.Create a VPC Peering connection between the subnets

E.Use network ACLs to allow only database traffic

AnswersB

Configuring SSL/TLS certificates on both servers encrypts the traffic between them in transit.

Why this answer

To encrypt traffic in transit between SAP application and database tiers, SSL/TLS certificates must be configured on both servers (B). This ensures that all data exchanged is encrypted. Security group rules (C) control access but do not provide encryption themselves; they only limit which traffic reaches the database, not whether that traffic is encrypted.

No other option offers encryption. Therefore, only option B correctly fulfills the requirement of encrypting traffic in transit.

Full explanation →

688

MCQhard

An SAP administrator notices that the SAP HANA database backups to Amazon S3 are failing intermittently with timeout errors. The backup script uses the AWS CLI to copy files to an S3 bucket. What is the most likely cause and solution?

A.The S3 bucket policy is too restrictive, modify the policy

B.The S3 bucket has a lifecycle policy that deletes objects too quickly

C.The backup files are large and the CLI command does not use multipart upload; use multipart upload and increase timeout values

D.S3 Transfer Acceleration is not enabled, enable it

AnswerC

Large files need multipart upload and appropriate timeouts.

Why this answer

The intermittent timeout errors when copying large SAP HANA backup files to Amazon S3 via the AWS CLI are most likely caused by the CLI not using multipart upload for large files. The AWS CLI automatically uses multipart upload for files over a certain threshold (default 8 MB), but if the upload is timing out, the default timeout values may be insufficient for very large files. Enabling multipart upload and increasing the `--cli-read-timeout` and `--cli-connect-timeout` values resolves the issue by splitting the file into smaller parts and allowing more time for each part to complete.

Exam trap

The trap here is that candidates may assume S3 Transfer Acceleration is the solution for any slow or failing upload, but the question specifically mentions intermittent timeout errors with large files, which points to multipart upload and timeout configuration rather than acceleration.

How to eliminate wrong answers

Option A is wrong because a restrictive S3 bucket policy would cause consistent access denied errors, not intermittent timeout errors. Option B is wrong because a lifecycle policy that deletes objects too quickly would result in missing objects after upload, not timeout failures during the upload process. Option D is wrong because S3 Transfer Acceleration improves transfer speed over long distances but does not address timeout errors caused by large file uploads without multipart upload; it would not fix the underlying issue of the CLI timing out on a single large file transfer.

Full explanation →

689

Multi-Selectmedium

A company is deploying SAP S/4HANA on AWS and needs to choose a storage solution for the HANA data volume that provides high IOPS and low latency. Which TWO storage options are suitable? (Choose TWO.)

Select 2 answers

A.Amazon EBS gp2 volumes

B.Amazon EC2 instance store (NVMe SSD)

C.Amazon EBS io2 Block Express volumes

D.Amazon Elastic File System (EFS)

E.Amazon S3

AnswersB, C

Instance store provides very low latency and high IOPS, but data is ephemeral; often used for /hana/log.

Why this answer

Amazon EC2 instance store (NVMe SSD) provides very high IOPS and ultra-low latency because it is physically attached to the host server, making it ideal for SAP HANA data volumes that require consistent, sub-millisecond performance. Amazon EBS io2 Block Express volumes deliver up to 256,000 IOPS per volume with single-digit millisecond latency and 99.999% durability, meeting SAP HANA's demanding storage performance requirements.

Exam trap

The trap here is that candidates often choose gp2 volumes because they are SSD-based and cheaper, failing to recognize that gp2's burst model cannot sustain the consistent high IOPS and low latency that SAP HANA demands, and that only io2 Block Express or instance store are SAP-certified for HANA data volumes.

Full explanation →

690

MCQhard

An SAP Basis administrator notices that the SAP HANA database performance has degraded significantly after migrating to AWS. The database is running on an r5.8xlarge instance with 3.6 TB of Amazon EBS gp3 storage. The administrator checks Amazon CloudWatch metrics and finds that the Read/Write latency is consistently above 10 ms and the queue depth is averaging 32. What is the MOST likely cause of the performance degradation?

A.The EC2 instance type does not support enough EBS bandwidth for the workload.

B.The EC2 instance's EBS bandwidth is fully utilized, causing I/O queueing.

C.The gp3 volume burst credit balance is exhausted, causing throughput to drop to baseline.

D.The EBS gp3 volume size is too small, causing IOPS throttling.

AnswerB

High queue depth indicates I/O requests are waiting due to bandwidth saturation.

Why this answer

The r5.8xlarge instance provides a maximum EBS bandwidth of 4,750 Mbps and a maximum EBS IOPS of 60,000. With a queue depth averaging 32 and latency above 10 ms, the instance's EBS bandwidth is saturated, causing I/O requests to queue and wait. This is the classic symptom of hitting the instance-level EBS bandwidth limit, not a volume-level issue.

Exam trap

The trap here is that candidates confuse volume-level limits (gp3 baseline IOPS or gp2 burst credits) with instance-level EBS bandwidth limits, leading them to incorrectly select options C or D when the real bottleneck is the EC2 instance's aggregate EBS throughput capacity.

How to eliminate wrong answers

Option A is wrong because the r5.8xlarge instance type supports up to 4,750 Mbps of EBS bandwidth and 60,000 IOPS, which is more than sufficient for typical SAP HANA workloads; the problem is that this bandwidth is fully utilized, not that the instance type is insufficient. Option C is wrong because gp3 volumes do not use burst credits; they have a baseline performance of 3,000 IOPS and 125 MB/s throughput regardless of size, and burst credits are a feature of gp2, not gp3. Option D is wrong because gp3 volume IOPS are independent of volume size; you can provision up to 16,000 IOPS on any gp3 volume, and the 3.6 TB size is more than adequate to support the required IOPS without throttling.

Full explanation →

691

MCQhard

An SAP system administrator is troubleshooting a high CPU usage issue on an SAP application server (AS) running on an EC2 instance. The administrator suspects that a specific ABAP report is consuming excessive resources. Which AWS service can provide detailed CPU utilization metrics at the process level to confirm the suspicion?

A.AWS CloudTrail

B.Amazon CloudWatch agent with the 'procstat' plugin

C.AWS Systems Manager Inventory

D.AWS Compute Optimizer

AnswerB

The CloudWatch agent can collect per-process CPU, memory, and disk metrics and publish them as custom CloudWatch metrics.

Why this answer

The Amazon CloudWatch agent with the 'procstat' plugin can collect CPU and memory utilization metrics at the individual process level, including specific ABAP processes or reports by name or PID. This allows the administrator to confirm which ABAP report is causing high CPU usage on the EC2 instance running the SAP application server.

Exam trap

The trap here is that candidates may confuse CloudTrail (audit logging) with monitoring, or assume that Systems Manager Inventory provides real-time performance data, when in fact only the CloudWatch agent with the procstat plugin can deliver per-process CPU metrics.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events, not system-level CPU metrics. Option C is wrong because AWS Systems Manager Inventory collects software inventory and OS configuration data, not real-time CPU utilization per process. Option D is wrong because AWS Compute Optimizer provides rightsizing recommendations based on historical utilization patterns, not granular process-level metrics.

Full explanation →

692

MCQeasy

An SAP administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The administrator wants to receive an alert when CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should be used?

A.AWS CloudTrail

B.AWS Config

C.Amazon VPC Flow Logs

D.Amazon CloudWatch Alarms

AnswerD

CloudWatch Alarms monitor metrics and trigger alerts.

Why this answer

Amazon CloudWatch Alarms (Option D) are the correct choice because they can monitor Amazon CloudWatch metrics, such as EC2 CPU utilization, and trigger actions (e.g., SNS notifications) when a specified threshold (e.g., 90% for 5 consecutive minutes) is breached. Option A (AWS CloudTrail) is incorrect because it logs API calls for auditing, not performance metrics. Option B (AWS Config) tracks resource configuration changes, not real-time metrics.

Option C (Amazon VPC Flow Logs) captures network traffic metadata, not CPU utilization.

Full explanation →

693

MCQeasy

A company is migrating an SAP system and wants to use a storage solution that provides persistent, high-performance block storage for the SAP HANA database. Which AWS storage option should they choose?

A.Amazon EC2 Instance Store

B.Amazon Elastic File System (EFS)

C.Amazon EBS io2 Block Express

D.Amazon S3

AnswerC

io2 Block Express provides high-performance block storage for HANA.

Why this answer

Amazon EBS io2 Block Express volumes provide high performance and durability for HANA. EFS is file storage. S3 is object storage.

Instance store is ephemeral.

Full explanation →

694

MCQeasy

A company is migrating an SAP system to AWS and wants to use AWS Launch Wizard for deployment. They have an existing VPC and subnets. Launch Wizard requires the selection of a subnet for each component. What is the best practice for selecting subnets for high availability?

A.Use only private subnets without public access.

B.Select a single subnet in one Availability Zone for simplicity.

C.Create a new VPC and subnets specifically for Launch Wizard.

D.Select subnets in different Availability Zones to ensure high availability.

AnswerD

This meets best practices for SAP high availability on AWS.

Why this answer

For high availability, it is best to deploy SAP components across multiple Availability Zones by selecting subnets in different AZs. Launch Wizard supports this. Deploying all in one AZ creates a single point of failure.

Launch Wizard can use existing subnets.

Full explanation →

695

Multi-Selectmedium

Which THREE steps should be taken when recovering an SAP system from an EBS snapshot? (Choose 3.)

Select 3 answers

A.Attach the new volume to the EC2 instance

B.Terminate the existing EC2 instance

C.Mount the volume on the appropriate mount point

D.Reconfigure the S3 bucket for backup storage

E.Create an EBS volume from the snapshot

AnswersA, C, E

Attach to the original or replacement instance.

Why this answer

When recovering an SAP system from an EBS snapshot, the correct steps are: first, create a new EBS volume from the snapshot (E); then, attach that volume to the EC2 instance (A); and finally, mount the volume on the appropriate mount point (C). Option B (terminate the existing EC2 instance) is incorrect because you can attach the new volume to the running instance without terminating it. Option D (reconfigure the S3 bucket for backup storage) is unrelated to recovering from an EBS snapshot.

Full explanation →

696

MCQmedium

A company is migrating an SAP HANA database from on-premises to AWS. The current system uses 8 TB of data. The migration must be completed within a 4-hour downtime window. The network link has 1 Gbps throughput. What is the MOST efficient migration strategy?

A.Use AWS Database Migration Service (DMS) with ongoing replication

B.Use AWS Direct Connect to increase bandwidth

C.Use AWS Application Migration Service (MGN)

D.Use AWS Snowball Edge to transfer the data offline

AnswerD

Snowball Edge can transfer 8 TB offline within the required time.

Why this answer

At 1 Gbps, transferring 8 TB over the network would take approximately 18 hours (8 TB * 1024 GB/TB * 8 bits/byte / 1 Gbps = 65536 seconds = ~18 hours), exceeding the 4-hour window. AWS Snowball Edge (Option D) can transport 8 TB offline, avoiding the bandwidth constraint. Option A (AWS DMS) would not meet the time constraint.

Option B (Direct Connect) still has the same bandwidth limitation. Option C (AWS MGN) is for server migration, not database migration.

Full explanation →

697

MCQhard

A company is running SAP ERP on AWS and notices performance degradation during peak hours. The application servers are in an Auto Scaling group behind an Application Load Balancer. Which configuration change would best handle the increased load?

A.Increase the minimum and maximum instance count in the Auto Scaling group

B.Configure a step scaling policy based on memory utilization

C.Replace the Application Load Balancer with a Network Load Balancer

D.Change the Auto Scaling policy to use a target tracking policy based on CPU utilization

AnswerD

CPU utilization is a more relevant metric for SAP application server load.

Why this answer

D is correct because SAP ERP workloads are typically CPU-bound during peak hours, and a target tracking policy based on CPU utilization automatically adjusts the Auto Scaling group to maintain a target CPU metric (e.g., 70%), ensuring the application servers scale out proactively to handle increased load without manual intervention. This approach aligns with SAP's recommended scaling strategy on AWS, as it directly addresses the performance degradation caused by high CPU demand.

Exam trap

The trap here is that candidates often assume increasing instance limits (Option A) or using memory-based scaling (Option B) is sufficient, but the exam tests understanding that SAP ERP is CPU-bound and requires a dynamic, metric-driven scaling policy like target tracking to effectively handle peak loads.

How to eliminate wrong answers

Option A is wrong because simply increasing the minimum and maximum instance count does not enable dynamic scaling; it only sets static boundaries, so the Auto Scaling group will not automatically add instances in response to peak load unless a scaling policy is also configured. Option B is wrong because memory utilization is not a reliable metric for SAP ERP scaling, as SAP workloads are primarily CPU-intensive and memory pressure is less indicative of performance degradation during peak hours; moreover, step scaling policies can be less responsive than target tracking due to their threshold-based nature. Option C is wrong because replacing the Application Load Balancer with a Network Load Balancer would not help handle increased load for SAP ERP application servers, as ALB operates at Layer 7 (HTTP/HTTPS) and is better suited for routing traffic to web-based SAP applications, while NLB operates at Layer 4 and lacks the application-level awareness needed for SAP's session management and health checks.

Full explanation →

698

MCQeasy

A company is migrating its SAP system to AWS and needs to assess the current on-premises environment for compatibility. Which AWS tool should be used to collect system configuration and usage data for SAP systems?

A.AWS Application Discovery Service

B.AWS Migration Hub

C.AWS Systems Manager

D.AWS Server Migration Service (AWS SMS)

AnswerA

Application Discovery Service collects configuration and usage data to support migration planning.

Why this answer

AWS Application Discovery Service (option A) is the correct tool for collecting system configuration and usage data from on-premises environments, including SAP systems, to inform migration planning. AWS Migration Hub (option B) tracks migration progress across tools but does not perform data collection. AWS Systems Manager (option C) is for management and operations, not discovery.

AWS Server Migration Service (option D) automates server replication but does not collect configuration or usage data.

Full explanation →

699

MCQmedium

A company is migrating a large SAP HANA database to AWS. The database is 4 TB in size. They need to transfer the initial data with the least possible network usage and minimal impact on production. The data is stored on a network-attached storage (NAS) device. Which approach should they use?

A.Use AWS CLI with multipart upload over AWS Direct Connect

B.Use AWS DataSync to transfer data over the internet

C.Use AWS Database Migration Service (DMS) for continuous replication

D.Use AWS Snowball Edge to transfer data offline

AnswerD

Snowball Edge enables offline transfer, no network usage, and handles large volumes.

Why this answer

AWS Snowball Edge is a physical appliance designed for offline data transfer, making it the optimal choice for transferring a 4 TB SAP HANA database with minimal network usage. It eliminates network bandwidth consumption and avoids impacting production systems. Option A (AWS CLI with multipart upload over AWS Direct Connect) still consumes network bandwidth.

Option B (AWS DataSync over the internet) also uses network bandwidth and may be slower for large datasets. Option C (AWS DMS for continuous replication) is intended for ongoing replication and would use network resources and potentially impact production.

Full explanation →

700

MCQhard

A company is running SAP NetWeaver on AWS with a multi-ABAP application server setup. They want to implement a load balancing solution for HTTP traffic to the SAP Web Dispatcher. The solution must be highly available and support SSL termination. Which AWS service should be used?

A.Application Load Balancer (ALB)

B.Amazon CloudFront

C.Classic Load Balancer (CLB)

D.Network Load Balancer (NLB)

AnswerA

ALB supports HTTP/HTTPS, SSL termination, and health checks.

Why this answer

The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7, can route HTTP/HTTPS traffic to SAP Web Dispatchers, supports SSL termination natively, and integrates with AWS Auto Scaling and health checks to provide high availability. SAP Web Dispatcher expects HTTP-based load balancing, and ALB’s content-based routing and stickiness features align with SAP’s recommended architecture for multi-ABAP application server setups.

Exam trap

The trap here is that candidates often confuse Network Load Balancer (NLB) as the default choice for high-performance SAP workloads, but the requirement for SSL termination and HTTP-level routing makes ALB the only correct option, as NLB cannot terminate SSL or inspect application-layer traffic.

How to eliminate wrong answers

Option B (Amazon CloudFront) is wrong because it is a global content delivery network (CDN) designed for caching static and dynamic content at edge locations, not for load balancing HTTP traffic to an internal SAP Web Dispatcher in a VPC; it lacks the ability to perform health checks on backend SAP instances and does not support direct TCP/HTTP load balancing to SAP application servers. Option C (Classic Load Balancer) is wrong because it is a legacy Layer 4/7 load balancer that does not support advanced HTTP routing rules, path-based routing, or native SSL termination with SNI, and it is not recommended for modern SAP deployments due to limited feature set and deprecation risk. Option D (Network Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and cannot terminate SSL or inspect HTTP headers; while it can handle high-throughput traffic, it would require the SAP Web Dispatcher to handle SSL termination itself, defeating the requirement for SSL termination at the load balancer.

Full explanation →

701

MCQhard

A company is deploying SAP NetWeaver on AWS and needs to ensure that the SAP application servers can communicate with the SAP HANA database using the hostname. The environment uses a Windows Domain Controller for Active Directory. Which DNS resolution strategy should be used?

A.Use AWS Directory Service for Microsoft Active Directory with DNS

B.Configure DHCP option sets to use custom DNS

C.Install a DNS server on an Amazon Linux instance

D.Use Amazon Route 53 Resolver outbound endpoint

AnswerA

Provides DNS integrated with AD for hostname resolution.

Why this answer

AWS Directory Service for Microsoft Active Directory provides a managed DNS service that integrates with Active Directory. This allows SAP application servers to resolve the SAP HANA database hostname via DNS, which is essential for SAP NetWeaver's hostname-based communication. The managed service ensures automatic DNS record updates and supports Windows-native DNS resolution without requiring custom infrastructure.

Exam trap

The trap here is that candidates often assume any DNS solution (like Route 53 Resolver or a Linux DNS server) can handle Windows Active Directory hostname resolution, overlooking the need for native Windows DNS integration with dynamic updates and Kerberos authentication.

How to eliminate wrong answers

Option B is wrong because DHCP option sets can specify custom DNS servers, but they do not provide the Active Directory-integrated DNS resolution required for Windows Domain Controller environments; they only point to existing DNS servers. Option C is wrong because installing a DNS server on an Amazon Linux instance does not natively integrate with Active Directory for dynamic DNS updates and Windows authentication, leading to potential resolution failures for SAP hostnames. Option D is wrong because Amazon Route 53 Resolver outbound endpoints are used for hybrid DNS resolution between on-premises and AWS, not for providing Active Directory-integrated DNS within a VPC; they lack the Windows-specific features needed for SAP hostname resolution.

Full explanation →

702

Multi-Selecteasy

A company is planning to migrate its SAP environment to AWS. The SAP landscape includes development, test, and production systems. The company wants to ensure data security and compliance. Which THREE AWS services should the company use to achieve this?

Select 3 answers

A.AWS Key Management Service (KMS) for encryption of EBS volumes and S3 buckets.

B.AWS Identity and Access Management (IAM) for user and role management.

C.AWS Direct Connect for dedicated network connection.

D.AWS CloudTrail for auditing API calls.

E.Elastic Load Balancing for distributing traffic.

AnswersA, B, D

KMS provides encryption key management.

Why this answer

AWS KMS enables encryption of EBS volumes and S3 buckets, ensuring data at rest is secure. Option B is correct because IAM provides user and role management to enforce least privilege access. Option D is correct because CloudTrail records API activity for auditing and compliance.

Option C is wrong because Direct Connect is a network connectivity service, not a security service. Option E is wrong because Elastic Load Balancing is for traffic distribution, not security.

Full explanation →

703

MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a high transaction rate. The migration must have minimal downtime. Which AWS service should be used for the migration?

A.AWS Snowball Edge

B.AWS Server Migration Service (SMS)

C.AWS DataSync

D.AWS Database Migration Service (DMS)

AnswerD

DMS supports live migration with ongoing replication.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication from the source Oracle database to Amazon RDS for Oracle, enabling minimal downtime during migration. Option A (AWS Snowball Edge) is incorrect because it is designed for large-scale offline data transfer, not for online replication with minimal downtime. Option B (AWS Server Migration Service) is for migrating on-premises servers to AWS, not databases.

Option C (AWS DataSync) is used for file-based data transfers, not database migrations.

Full explanation →

704

MCQeasy

A company is implementing SAP HANA on AWS and needs to ensure that the storage configuration meets the required IOPS and throughput. The SAP HANA system uses a scale-out architecture with multiple worker nodes. Which type of Amazon EBS volume is recommended for the /hana/data and /hana/log volumes in a production environment?

A.Throughput Optimized HDD (st1)

B.General Purpose SSD (gp2 or gp3)

C.Provisioned IOPS SSD (io1 or io2)

D.Cold HDD (sc1)

AnswerC

Provides consistent low-latency performance required for HANA.

Why this answer

For SAP HANA production workloads on AWS, the /hana/data and /hana/log volumes require consistent, high IOPS and low latency. Provisioned IOPS SSD (io1 or io2) volumes are recommended because they allow you to specify a guaranteed IOPS rate independent of volume size, meeting SAP's strict performance requirements for scale-out architectures. General Purpose SSD volumes (gp2/gp3) cannot provide the sustained, predictable IOPS needed for critical SAP HANA operations, especially under burst conditions.

Exam trap

The trap here is that candidates often choose General Purpose SSD (gp2/gp3) thinking it is sufficient for production, but AWS and SAP documentation explicitly mandate Provisioned IOPS SSD for SAP HANA production workloads to guarantee consistent performance and meet SAP's certification requirements.

How to eliminate wrong answers

Option A is wrong because Throughput Optimized HDD (st1) is a throughput-oriented, not IOPS-oriented, volume type with high latency and inconsistent performance, making it unsuitable for SAP HANA's low-latency data and log writes. Option B is wrong because General Purpose SSD (gp2 or gp3) volumes rely on burst credits (gp2) or baseline performance that may not guarantee the sustained high IOPS required by SAP HANA in production, and they lack the ability to provision dedicated IOPS. Option D is wrong because Cold HDD (sc1) is designed for infrequently accessed, cold data with very low IOPS and high latency, which cannot support the real-time transactional demands of SAP HANA.

Full explanation →

705

MCQmedium

A company wants to implement a disaster recovery (DR) strategy for its SAP landscape on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. They need to replicate SAP HANA database asynchronously with a Recovery Point Objective (RPO) of 15 minutes. Which AWS service should they use?

A.AWS Elastic Disaster Recovery (DRS)

B.SAP HANA System Replication

C.Amazon S3 cross-region replication for HANA backup files

D.AWS Database Migration Service (DMS) with ongoing replication

AnswerB

SAP HANA System Replication is the correct method for asynchronous replication.

Why this answer

SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for asynchronous replication of HANA databases, capable of achieving an RPO of 15 minutes or less. It replicates at the database level using log shipping and is tightly integrated with HANA's recovery processes, making it the correct choice for this DR scenario.

Exam trap

The trap here is that candidates often confuse AWS-native DR services (like DRS or DMS) with SAP's own replication technology, forgetting that SAP HANA has a built-in, certified replication mechanism that is the only way to meet strict RPOs for HANA databases.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Disaster Recovery (DRS) replicates entire servers at the block level, not the HANA database log level, and cannot guarantee the sub-15-minute RPO required for HANA's transactional consistency. Option C is wrong because S3 cross-region replication for HANA backup files only copies backup artifacts, not the live database state, resulting in an RPO measured in hours or days, not 15 minutes. Option D is wrong because AWS DMS with ongoing replication is designed for heterogeneous database migrations and does not support SAP HANA as a source for continuous log-based replication; it lacks the native HANA log replay capabilities needed for DR.

Full explanation →

706

Multi-Selecthard

Which ONE of the following is required to enable SAP HANA System Replication across two AWS Availability Zones?

Select 1 answer

A.The primary and secondary instances must be in the same AWS region

B.A Virtual Private Gateway must be attached to the VPC

C.The EBS volumes must be configured for multi-attach or use a shared file system

D.A cluster placement group must be used

E.An Application Load Balancer must be configured for the replication traffic

AnswersA

Correct. The primary and secondary instances must be in the same AWS region to meet latency requirements for SAP HANA System Replication.

Why this answer

SAP HANA System Replication requires primary and secondary instances to be in the same AWS region to ensure low-latency replication; cross-region replication is not supported for synchronous replication. Option A is correct. Option B is incorrect because a Virtual Private Gateway is not needed for replication within a VPC.

Option C is incorrect because SAP HANA System Replication operates at the database level and does not require shared storage or multi-attach EBS volumes. Option D is incorrect because a cluster placement group is not required for HANA System Replication; it is used for low-latency networking in scale-out scenarios. Option E is incorrect because an Application Load Balancer is not used for replication traffic; replication is handled directly between HANA instances.

Exam trap

The trap here is that candidates confuse SAP HANA System Replication (which requires same-region AZs) with SAP HANA scale-out or backup scenarios that might use shared storage or cross-region replication, leading them to select EBS multi-attach or cross-region options incorrectly.

Full explanation →

707

MCQhard

An SAP administrator created the IAM policy shown in the exhibit for a team managing SAP HANA instances. What is the effective permission for the team regarding an EC2 instance with the tag 'Environment=Production'?

A.The team can start, stop, and terminate the instance.

B.The team cannot start, stop, or terminate the instance.

C.The team can only describe the instance.

D.The team can start and stop the instance, but cannot terminate it.

AnswerD

The Deny for TerminateInstances blocks termination.

Why this answer

The IAM policy explicitly denies the 'ec2:TerminateInstances' action for instances with the tag 'Environment=Production', while allowing 'ec2:StartInstances' and 'ec2:StopInstances' via a separate Allow statement. Since an explicit Deny overrides any Allow, the team can start and stop the instance but cannot terminate it.

Exam trap

The trap here is that candidates may overlook the explicit Deny statement and assume the Allow for start/stop/terminate applies universally, or they may forget that an explicit Deny overrides any Allow, leading them to incorrectly choose Option A or B.

How to eliminate wrong answers

Option A is wrong because the policy includes an explicit Deny for 'ec2:TerminateInstances' on Production-tagged instances, which overrides the Allow for start and stop, so termination is not permitted. Option B is wrong because the policy does allow 'ec2:StartInstances' and 'ec2:StopInstances' for Production-tagged instances, so the team can perform those actions. Option C is wrong because the policy does not restrict describing the instance; the effective permissions include start and stop, not just describe.

Full explanation →

708

MCQhard

The exhibit shows the output of the describe-replication-tasks command for an ongoing migration from SAP HANA to Amazon RDS for MySQL. The task status is 'running' but no data has been transferred after 2 hours. What is the most likely cause?

A.The replication instance has insufficient memory

B.The source endpoint is not accessible from the replication instance

C.The target endpoint is pointing to the wrong database

D.The HANA database is not configured as a target

AnswerB

If the source endpoint is not accessible from the replication instance, the task can appear as 'running' while it repeatedly tries to connect or validate the endpoint. This matches the symptom of no data transfer after 2 hours with a running status and is the most likely cause.

Why this answer

When the replication task status is 'running' but no data has been transferred after a significant period, it often indicates that the task is stuck in a preliminary validation phase. The most common reason is that the source endpoint is not accessible from the replication instance. The task may attempt to connect repeatedly without failing, hence the 'running' status.

Insufficient memory (A) would typically cause performance degradation or errors, not a complete lack of transfer. A wrong target endpoint (C) would likely result in immediate task failure. Configuring HANA as a target (D) is irrelevant because HANA is the source in this migration.

Full explanation →

709

Multi-Selecthard

A company runs SAP on AWS and needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which TWO services should be used together to achieve this?

Select 2 answers

A.Amazon S3

B.VPC Flow Logs

C.Amazon CloudWatch Logs

D.AWS Config

E.AWS CloudTrail

AnswersC, E

Amazon CloudWatch Logs can receive and store log data from AWS CloudTrail, enabling monitoring and analysis.

Why this answer

AWS CloudTrail logs all API calls made to AWS services, providing an audit trail. Amazon CloudWatch Logs can then be used to store, monitor, and analyze these logs. Together, they satisfy the auditing requirement.

Option A (Amazon S3) can store logs but does not log API calls itself. Option B (VPC Flow Logs) captures network traffic, not API calls. Option D (AWS Config) records resource configuration changes, not API calls.

Therefore, the correct combination is CloudTrail and CloudWatch Logs.

Exam trap

Candidates might think AWS Config or VPC Flow Logs are suitable for API call logging, but they serve different purposes (config changes and network traffic, respectively).

Full explanation →

710

Multi-Selecteasy

An SAP administrator needs to set up disaster recovery for an SAP system on AWS. Which TWO AWS services can be used to replicate data across regions?

Select 2 answers

A.Amazon CloudFront

B.Amazon EFS replication

C.Amazon EBS snapshots copied to another region

D.Amazon S3 Cross-Region Replication

E.Amazon RDS read replicas in another region

AnswersC, D

Snapshots can be copied cross-region for volume replication.

Why this answer

Amazon EBS snapshots can be copied to another AWS region, providing a reliable mechanism for disaster recovery of SAP systems by creating point-in-time backups of critical volumes. This allows the SAP administrator to restore the system in a different region if the primary region fails, ensuring data durability and recoverability.

Exam trap

The trap here is that candidates may confuse Amazon RDS read replicas with cross-region disaster recovery replication, but read replicas are designed for read scaling and do not support write operations or failover for SAP systems.

Full explanation →

711

MCQmedium

A company is running SAP Business Suite on AWS with a Microsoft SQL Server database. The operations team needs to implement automated database backups with point-in-time recovery. Which AWS service should be used to achieve this?

A.AWS Storage Gateway

B.AWS Backup

C.AWS Database Migration Service (DMS)

D.Amazon RDS for SQL Server

AnswerB

AWS Backup can automate backups of SQL Server on EC2 with point-in-time recovery.

Why this answer

AWS Backup (option B) is the correct service for automated database backups with point-in-time recovery for SQL Server running on EC2. It supports SQL Server databases on EC2 and provides automated backup scheduling and point-in-time recovery capabilities. Option A (AWS Storage Gateway) is for hybrid cloud storage, not database backup.

Option C (AWS DMS) is for database migration, not backup. Option D (Amazon RDS for SQL Server) is a managed database service, but since the SQL Server is on EC2, RDS does not apply.

Exam trap

Candidates often confuse AWS Backup with Amazon RDS for SQL Server. RDS is a managed service for databases that do not require EC2, while AWS Backup supports SQL Server on EC2.

Full explanation →

712

MCQeasy

An SAP system administrator needs to grant an external auditor read-only access to view EC2 instance configurations and CloudWatch logs. Which IAM policy should they use?

A.AWS managed policy: SecurityAudit

B.AWS managed policy: ReadOnlyAccess

C.AWS managed policy: AdministratorAccess

D.AWS managed policy: PowerUserAccess

AnswerB

ReadOnlyAccess provides read-only access to all services, suitable for auditors.

Why this answer

The ReadOnlyAccess AWS managed policy grants read-only access to all AWS services and resources, including EC2 instance configurations and CloudWatch logs, without allowing any write or modify actions. This policy is the most appropriate for an external auditor who needs to view but not change any resources, as it provides the necessary read permissions across services while preventing any modifications.

Exam trap

The trap here is that candidates often choose SecurityAudit because it sounds security-focused, but it lacks the broad read-only access to EC2 and CloudWatch logs required for this specific auditor scenario.

How to eliminate wrong answers

Option A is wrong because SecurityAudit is designed for security auditing and includes read-only access to security-related services like IAM, CloudTrail, and Config, but it does not grant read access to EC2 instance configurations or CloudWatch logs, which are required for this use case. Option C is wrong because AdministratorAccess grants full administrative permissions, including write and delete actions, which violates the principle of least privilege and is excessive for a read-only auditor. Option D is wrong because PowerUserAccess allows full access to AWS services and resources but does not allow management of users and groups; however, it still permits write and modify actions on EC2 and CloudWatch, which is not appropriate for read-only access.

Full explanation →

713

Multi-Selecthard

Which TWO actions should be taken to securely manage database credentials for an SAP system running on Amazon RDS for Oracle? (Choose 2)

Select 2 answers

A.Store the credentials as an S3 object with server-side encryption.

B.Use AWS Systems Manager Parameter Store with a secure string parameter.

C.Use IAM database authentication to manage access without passwords.

D.Use AWS Secrets Manager to store and automatically rotate the database passwords.

E.Store the credentials in AWS CloudHSM.

AnswersC, D

IAM database authentication allows IAM users to connect using an authentication token.

Why this answer

Options C and D are correct. IAM database authentication (C) allows you to use IAM users and roles to authenticate to your RDS database, eliminating the need for passwords. AWS Secrets Manager (D) securely stores and automatically rotates database credentials, which is a best practice for managing secrets.

Option A is incorrect because storing credentials as an S3 object lacks native rotation and is less secure than dedicated secrets management services. Option B is incorrect: although Systems Manager Parameter Store can store secure strings, it does not natively rotate RDS credentials. Option E is incorrect because AWS CloudHSM is a hardware security module for key generation and encryption, not for storing and rotating passwords.

Full explanation →

714

MCQeasy

An administrator is setting up an SAP system on AWS and needs to assign a static private IP address to the SAP application server. Which AWS resource should be used to ensure the private IP address remains the same even after an instance stop/start?

A.VPC endpoint

B.Elastic Network Interface (ENI) with a primary private IP

C.Secondary private IP address on the primary network interface

D.Elastic IP address

AnswerB

An ENI retains its private IP address even when detached or attached to a different instance.

Why this answer

An Elastic Network Interface (ENI) with a primary private IP address retains its private IP address across instance stop/start cycles because the ENI is a separate resource that persists independently of the instance lifecycle. When you attach an ENI to an SAP application server, the primary private IP (assigned from the VPC subnet) remains fixed even after the instance is stopped and started, ensuring consistent network addressing for SAP communication.

Exam trap

The trap here is that candidates confuse the persistence of an Elastic IP (which is a public IP) with the need for a static private IP, or they mistakenly think that secondary private IPs on the primary ENI survive instance stop/start, when in fact only an ENI as a standalone resource guarantees private IP persistence.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint is used to privately connect a VPC to supported AWS services (e.g., S3, DynamoDB) via the AWS network, not to assign or preserve a static private IP address for an EC2 instance. Option C is wrong because a secondary private IP address on the primary network interface is attached to the instance's default ENI, which is ephemeral and can change if the instance is stopped and started (the primary ENI is deleted and recreated). Option D is wrong because an Elastic IP address is a public IPv4 address that can be associated with an instance or ENI, but it does not provide a static private IP address; it is used for public-facing connectivity and incurs charges when not associated with a running instance.

Full explanation →

715

MCQmedium

A company is running a critical SAP application on AWS. The operations team receives a notification that the SAP HANA database is running low on memory. Which AWS service should be used to automatically increase memory capacity without downtime?

A.Amazon ElastiCache

B.Amazon EC2 Auto Scaling

C.Amazon DynamoDB

D.AWS Lambda

AnswerB

Amazon EC2 Auto Scaling can automatically launch additional EC2 instances configured as HANA worker nodes in a scale-out cluster, increasing total memory capacity without downtime. This is the correct approach for scaling memory.

Why this answer

Mazon EC2 Auto Scaling (Option B). For SAP HANA on AWS, increasing memory capacity without downtime is achieved through HANA scale-out, which adds additional nodes to the HANA cluster. Amazon EC2 Auto Scaling can automatically launch new EC2 instances configured as HANA worker nodes, thereby increasing the total available memory.

This approach allows the database to accommodate higher memory demand without restarting the existing instance. Option A (ElastiCache) provides a separate caching layer but does not increase HANA's own memory. Option C (DynamoDB) and Option D (Lambda) are irrelevant for this purpose.

Full explanation →

716

MCQeasy

An SAP system administrator needs to apply an operating system patch to an Amazon EC2 instance running SAP NetWeaver. The instance is part of an Auto Scaling group. What is the BEST approach to minimize downtime?

A.Detach the instance from the Auto Scaling group, apply the patch, and reattach.

B.Stop the instance, apply the patch, and start it.

C.Use a rolling update by updating the launch configuration and performing an instance refresh.

D.Terminate the instance and let Auto Scaling launch a new one with the patch.

AnswerC

Minimizes downtime by replacing instances gradually.

Why this answer

An instance refresh in an Auto Scaling group allows you to apply a new launch configuration (which includes the patched AMI or user data) to all instances in a rolling, controlled manner. This minimizes downtime by replacing instances one at a time or in batches, ensuring the SAP NetWeaver application remains available throughout the process. Detaching, stopping, or terminating individual instances would cause unnecessary disruption or require manual reattachment, which is not optimal for high-availability SAP landscapes.

Exam trap

The trap here is that candidates often choose Option A (detach and reattach) thinking it gives manual control, but they overlook that Auto Scaling's instance refresh is the designed, automated method for applying updates with minimal downtime, and detaching breaks the group's lifecycle management.

How to eliminate wrong answers

Option A is wrong because detaching an instance from an Auto Scaling group removes it from the group's management, and after patching, you must manually reattach it, which does not leverage Auto Scaling's automated health checks or rolling update capabilities, potentially causing longer downtime. Option B is wrong because stopping an EC2 instance for patching causes a full outage for that instance, and SAP NetWeaver typically requires high availability; stopping also does not integrate with Auto Scaling's lifecycle hooks or instance refresh mechanisms. Option D is wrong because terminating the instance and relying on Auto Scaling to launch a new one with a patched AMI is disruptive—it causes a complete loss of that instance's state and does not provide a controlled, rolling replacement, which can lead to downtime if the application is not designed for sudden instance termination.

Full explanation →

717

Multi-Selecthard

Which THREE AWS services can be used to monitor and log SAP system activities for security and compliance? (Choose three.)

Select 3 answers

A.Amazon Athena

B.Amazon VPC Flow Logs

C.Amazon CloudWatch Logs

D.AWS CloudTrail

E.AWS Config

AnswersC, D, E

Stores application and system logs.

Why this answer

Amazon CloudWatch Logs (C) stores log data from SAP systems, AWS CloudTrail (D) logs API calls for auditing, and AWS Config (E) tracks configuration changes for compliance. Amazon Athena (A) is a query service, not a logging service, and Amazon VPC Flow Logs (B) capture network traffic, not system activities.

Full explanation →

718

MCQmedium

A company runs SAP on AWS and uses AWS KMS for encryption of EBS volumes. The security team requires that the EBS volumes used for SAP HANA data and log files be encrypted with a customer-managed key. They also want to ensure that the key cannot be deleted. What should the security team do to protect the KMS key?

A.Set a key policy that prevents the kms:ScheduleKeyDeletion action.

B.Use an AWS managed key instead of a customer-managed key.

C.Store the key in AWS Secrets Manager.

D.Enable automatic key rotation.

AnswerA

A key policy can explicitly deny the deletion action.

Why this answer

Setting a key policy that denies the kms:ScheduleKeyDeletion action prevents the key from being deleted. This ensures that the customer-managed key used for EBS volume encryption cannot be scheduled for deletion, meeting the security requirement. Option B is incorrect because AWS managed keys cannot have custom key policies and are managed by AWS, which does not meet the requirement for a customer-managed key.

Option C is incorrect because storing the key in Secrets Manager is not for deletion prevention; Secrets Manager is for secure storage of secrets, not for KMS key deletion protection. Option D is incorrect because automatic key rotation creates new cryptographic material but does not prevent key deletion; it is a security best practice for key freshness, not for deletion prevention.

Full explanation →

719

MCQhard

A company is migrating an SAP ERP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The solution must use a shared file system for the SAP transport directory. Which combination of AWS services should be used?

A.Amazon FSx for Windows File Server for the transport directory

B.Amazon S3 as the transport directory with two application servers

C.Amazon EFS for the transport directory and two EC2 instances with a floating IP

D.Amazon EBS volumes attached to both ASCS and ERS instances

AnswerC

EFS provides shared NFS; floating IP enables failover for ASCS/ERS.

Why this answer

SAP ASCS and ERS require a highly available shared file system for the SAP transport directory, and Amazon EFS provides a fully managed NFS file system that can be mounted by multiple EC2 instances across Availability Zones. The floating IP (using AWS Elastic IP or a secondary private IP) allows the ASCS and ERS services to fail over transparently between the two EC2 instances, meeting the high availability requirements without relying on a single point of failure.

Exam trap

The trap here is that candidates often assume a shared file system must be block storage (like EBS) or Windows-based (like FSx), but they overlook that SAP on Linux requires NFS-based shared storage, and Amazon EFS is the native AWS NFS solution that supports multi-AZ access and high availability.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server uses SMB protocol, which is not natively supported by SAP on Linux (SAP ASCS/ERS typically run on Linux or Windows, but the question does not specify Windows; for Linux-based SAP, NFS is required). Option B is wrong because Amazon S3 is an object storage service and cannot be used as a POSIX-compliant shared file system for the SAP transport directory; it lacks the necessary file locking and low-latency access required by SAP. Option D is wrong because Amazon EBS volumes can only be attached to a single EC2 instance at a time (unless using multi-attach EBS, which is limited to specific volume types and instance families and is not designed for SAP shared file systems); attaching separate EBS volumes to ASCS and ERS would not provide a shared file system.

Full explanation →

720

MCQeasy

Refer to the exhibit. A company is migrating an SAP application server running on Windows to AWS. They launched an EC2 instance with Windows Server. After launching, they run the command and get the output shown. They need to install SAP software. What additional step is required before installing SAP?

A.Change the instance type to a memory-optimized instance

B.Stop and start the instance to initialize the Windows OS

C.Modify the security group to allow SAP-specific ports

D.Join the EC2 instance to an Active Directory domain

AnswerD

SAP on Windows typically requires domain membership.

Why this answer

SAP on Windows requires an Active Directory (AD) domain for Kerberos-based authentication, which is essential for SAP system communication. Before installing SAP software, the EC2 instance must be joined to an AD domain (e.g., via AWS Managed Microsoft AD or self-managed AD). Option A is incorrect because instance type selection should meet SAP requirements, but changing to memory-optimized is not a prerequisite for installation.

Option B is incorrect: the instance is already running and stopping/starting does not initialize the OS beyond normal boot. Option C is incorrect: security group rules for SAP ports can be configured at any time before or after installation.

Full explanation →

721

MCQhard

A large enterprise is migrating its SAP S/4HANA system to AWS. The system includes a production SAP HANA database (4 TB) and a development SAP HANA database (1 TB). The migration strategy is to use SAP HANA System Replication (HSR) for both databases to EC2 instances in the same AWS region. The company has a compliance requirement that the production database must be in a different AWS account than the development database. The network between on-premises and AWS uses AWS Direct Connect with 10 Gbps bandwidth. During the test migration, the HSR replication for the development database works, but the production database fails to establish replication. The error log shows: "HSR connection timed out." The security groups and network ACLs for the production target EC2 instance allow inbound traffic on port 30101 from the on-premises source IP. What is the most likely cause of the failure?

A.The production target EC2 instance is in a different AWS account, and there is no VPC peering or Transit Gateway between the accounts to allow connectivity.

B.The production source HANA instance is not configured to replicate to a different AWS account.

C.The production target EC2 instance is using the wrong port for HSR.

D.The security group on the production target EC2 instance does not allow inbound traffic on port 443.

AnswerA

Cross-account communication needs VPC peering or Transit Gateway.

Why this answer

HSR requires communication between the source and target HANA instances. If the target is in a different account, VPC peering or Transit Gateway is needed for cross-account connectivity. Option A is correct because cross-account communication requires VPC peering or Transit Gateway.

Option B is wrong because the port is correct. Option C is wrong because HSR does not use port 443. Option D is wrong because the source is on-premises, not in another AWS account.

Full explanation →

722

MCQmedium

A company is migrating an on-premises SAP HANA database to AWS. The database is 10 TB and requires high IOPS. Which EC2 instance type and storage configuration is most appropriate?

A.x1e.32xlarge with EBS io1 volumes

B.r5.24xlarge with EBS io1 volumes

C.x1e.32xlarge with instance store volumes

D.r5.24xlarge with EBS gp2 volumes

AnswerA

x1e is certified for HANA, io1 provides high IOPS.

Why this answer

The x1e.32xlarge instance is SAP HANA certified and provides the required memory for large HANA databases. EBS io1 volumes deliver the high IOPS needed for the 10 TB database. Option B (r5.24xlarge with io1) is incorrect because r5 instances are not HANA optimized.

Option C (x1e.32xlarge with instance store) is incorrect because instance store is ephemeral and not suitable for persistent data. Option D (r5.24xlarge with gp2) is incorrect because gp2 cannot achieve the high IOPS required for this workload.

Full explanation →

723

Multi-Selecteasy

Which TWO AWS services are commonly used to monitor the performance of SAP applications and infrastructure?

Select 2 answers

A.AWS X-Ray

B.AWS CloudTrail

C.Amazon CloudWatch

D.AWS Config

E.AWS Trusted Advisor

AnswersA, C

X-Ray helps trace and debug application performance.

Why this answer

AWS X-Ray is correct because it helps trace and analyze user requests as they travel through SAP applications, identifying performance bottlenecks and errors in distributed transactions. Amazon CloudWatch is correct because it collects and monitors metrics, logs, and alarms for SAP infrastructure resources such as EC2 instances, RDS databases, and Application Load Balancers, enabling proactive performance management.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with CloudWatch (monitoring), or assume AWS Config can monitor performance when it only tracks configuration changes.

Full explanation →

724

Multi-Selectmedium

A company is planning to migrate a large SAP HANA database to AWS using AWS Snowball Edge devices. The database size is 50 TB and the migration must be completed within a week. Which TWO actions should the company take to ensure a successful migration?

Select 2 answers

A.Use AWS Direct Connect to accelerate data transfer from Snowball Edge to AWS.

B.Order multiple Snowball Edge devices to transfer data in parallel.

C.Split the data into smaller chunks because each Snowball Edge can only hold 10 TB.

D.Copy the data directly to an Amazon S3 bucket using the Snowball Edge client.

E.Compress the HANA data files before loading them onto the Snowball Edge devices.

AnswersB, E

Parallel transfers reduce overall time.

Why this answer

Snowball Edge devices have a usable storage capacity of up to 80 TB per device, but to transfer 50 TB within a one-week window, using multiple devices in parallel significantly reduces the total transfer time. Parallel data transfer allows the company to split the workload across devices, maximizing throughput and meeting the tight migration deadline.

Exam trap

The trap here is that candidates may assume Snowball Edge devices have a 10 TB limit (confusing them with older Snowball models) or believe that Direct Connect can accelerate the physical shipping process, leading them to select incorrect options A or C.

Full explanation →

725

Multi-Selecthard

A company is migrating an SAP HANA database from on-premises to AWS using SAP HANA System Replication (HSR). They have set up the replication but the target database is not in sync. Which THREE configuration items should the migration team verify? (Choose THREE.)

Select 3 answers

A.The hostname resolution between source and target

B.The HANA version and build number are compatible

C.The SAP HANA license is activated on the target

D.The network connectivity and firewall rules allow HSR traffic

E.The storage type (SSD vs HDD) is identical

AnswersA, B, D

HSR uses hostnames; DNS or /etc/hosts must be correct.

Why this answer

HSR requires proper hostname resolution between source and target; if the target cannot resolve the source hostname, replication fails. Option B is correct because HSR requires the same major HANA version and build number; mismatches can prevent synchronization. Option C is incorrect because the SAP HANA license is not required for replication; it is tied to each system individually.

Option D is correct because network connectivity and firewall rules must allow traffic on the HSR port (typically 3<instance>01); blocked ports will stop replication. Option E is incorrect because storage type (SSD vs HDD) does not affect HSR synchronization; replication works independently of underlying storage.

Full explanation →

726

Multi-Selectmedium

Which TWO of the following are best practices for running SAP HANA on AWS? (Select TWO.)

Select 2 answers

A.Use Amazon EFS as the storage layer for HANA data files.

B.Use T3 instances for production to save costs.

C.Use Amazon RDS Multi-AZ for HANA database replication.

D.Use EBS Snapshots for backup of HANA data volumes.

E.Use EC2 instances from the SAP HANA certified instance list.

AnswersD, E

EBS Snapshots provide crash-consistent backups.

Why this answer

EBS Snapshots provide a consistent, crash-consistent backup mechanism for HANA data volumes when used with application-consistent procedures (e.g., pre-freeze/post-thaw scripts via AWS Backup or custom automation). Snapshots are block-level, incremental, and can be automated for point-in-time recovery, aligning with SAP HANA backup best practices on AWS.

Exam trap

The trap here is that candidates confuse general-purpose backup services (like EFS or RDS) with the specific storage and replication requirements of SAP HANA, leading them to select options that sound reasonable but are technically incompatible or uncertified.

Full explanation →

727

MCQeasy

A company wants to automate the deployment of SAP systems on AWS. Which AWS service is most appropriate for infrastructure as code (IaC) for SAP?

A.AWS OpsWorks

B.AWS Elastic Beanstalk

C.AWS CodeDeploy

D.AWS CloudFormation

AnswerD

CloudFormation is the standard IaC service on AWS.

Why this answer

AWS CloudFormation is the most appropriate service for infrastructure as code (IaC) for SAP because it allows you to define and provision AWS infrastructure declaratively using templates. This enables repeatable, version-controlled deployments of complex SAP landscapes, including EC2 instances, networking, storage, and security groups, which is critical for SAP's strict architectural requirements.

Exam trap

The trap here is that candidates often confuse AWS CodeDeploy or Elastic Beanstalk with IaC because they involve 'deployment,' but they are designed for application code or PaaS, not for provisioning the underlying SAP infrastructure, which requires full control over compute, storage, and networking.

How to eliminate wrong answers

Option A is wrong because AWS OpsWorks is a configuration management service based on Chef and Puppet, not a declarative IaC tool; it is designed for application configuration and lifecycle management, not for provisioning the underlying SAP infrastructure. Option B is wrong because AWS Elastic Beanstalk is a PaaS service that abstracts infrastructure management for web applications, but it does not support the custom, granular control required for SAP systems (e.g., specific instance types, HANA-specific storage, or high-availability setups). Option C is wrong because AWS CodeDeploy is a deployment automation service for application code updates, not for provisioning infrastructure; it cannot define or manage the underlying AWS resources needed for an SAP environment.

Full explanation →

728

MCQmedium

An SAP administrator receives an alert that the HANA database has switched to read-only mode. The administrator checks the disk space and finds that the /hana/data volume is 100% full. What is the most efficient way to resolve this issue?

A.Delete old HANA backup files from the volume

B.Restart the HANA database to clear temporary files

C.Create a new EC2 instance with larger disks and migrate

D.Increase the size of the EBS volume using the console or CLI

AnswerD

EBS allows live expansion without downtime, providing immediate space.

Why this answer

EBS volumes can be increased in size online without downtime using the AWS Management Console or CLI, providing immediate additional space to resolve the read-only issue. Option A is incorrect because deleting backup files may not free enough space and is not a long-term solution. Option B is incorrect because restarting the database does not add storage space.

Option C is incorrect because creating a new EC2 instance with larger disks requires migration and causes unnecessary downtime compared to simply increasing the EBS volume size.

Full explanation →

729

MCQhard

An SAP administrator notices that the SAP HANA database on an EC2 instance is experiencing high I/O latency. The instance is using EBS gp2 volumes. Which change would most effectively reduce I/O latency for the SAP HANA data volume?

A.Use instance store SSDs for the SAP HANA data volume.

B.Switch to io2 Block Express EBS volumes for the data volume.

C.Increase the size of the EBS gp2 volume to increase baseline IOPS.

D.Configure RAID 0 across multiple gp2 volumes.

AnswerB

io2 Block Express provides sub-millisecond latency and high IOPS.

Why this answer

Io2 Block Express volumes provide consistent, high-performance IOPS with sub-millisecond latency, which is critical for SAP HANA data volumes. Unlike gp2, which relies on burst credits and has variable performance, io2 Block Express delivers predictable low latency and up to 256,000 IOPS per volume, directly addressing the high I/O latency issue.

Exam trap

The trap here is that candidates may assume increasing gp2 volume size or using RAID 0 will solve latency issues, but these approaches do not address the fundamental lack of consistent low-latency performance that io2 Block Express provides.

How to eliminate wrong answers

Option A is wrong because instance store SSDs are ephemeral and do not persist data across instance stops or terminations, making them unsuitable for SAP HANA data volumes that require durability and high availability. Option C is wrong because increasing the size of a gp2 volume only raises the baseline IOPS (at a rate of 3 IOPS per GB), but gp2 still suffers from burst bucket limitations and does not guarantee the sub-millisecond latency required for SAP HANA. Option D is wrong because RAID 0 across multiple gp2 volumes increases throughput and IOPS but does not reduce latency per I/O operation; it also introduces a single point of failure if any volume fails, which is unacceptable for SAP HANA data persistence.

Full explanation →

730

MCQhard

A company has deployed SAP BusinessObjects (BO) on AWS using a multi-tier architecture with a Windows-based application server and a SQL Server database hosted on Amazon RDS. The application server is behind an Application Load Balancer (ALB) that handles HTTPS traffic. Users report that sometimes they receive a '502 Bad Gateway' error when accessing the BO web interface. The error occurs intermittently and is not reproducible on demand. The operations team checks the ALB logs and sees that the target response time occasionally exceeds 120 seconds. The BO application has a default timeout of 60 seconds. The team also notices that the ALB idle timeout is set to 60 seconds. What is the most likely cause of the 502 errors?

A.Place an Amazon CloudFront distribution in front of the ALB to cache responses and reduce load.

B.Increase the max_connections parameter in the RDS SQL Server instance.

C.Increase the idle timeout of the Application Load Balancer to 180 seconds.

D.Increase the deregistration delay on the ALB target group to 300 seconds.

AnswerC

The ALB request timeout (idle timeout) can be increased to accommodate longer application processing times, preventing premature connection closure.

Why this answer

The 502 errors occur because the ALB idle timeout (60 seconds) matches the BO application's default timeout (60 seconds), but the ALB logs show target response times occasionally exceed 120 seconds. When the ALB idle timeout expires before the backend completes its response, the ALB closes the connection and returns a 502 error. Increasing the ALB idle timeout to 180 seconds allows sufficient time for the backend to respond, preventing premature connection termination.

Exam trap

The trap here is confusing the ALB idle timeout with the deregistration delay or database connection limits, leading candidates to choose options that address unrelated bottlenecks instead of the direct cause of the 502 error.

How to eliminate wrong answers

Option A is wrong because placing a CloudFront distribution in front of the ALB would not resolve the underlying timeout issue; caching is ineffective for dynamic SAP BO sessions and does not extend the ALB's idle timeout. Option B is wrong because increasing max_connections on RDS SQL Server addresses database connection limits, not the HTTP-level timeout causing the 502 error. Option D is wrong because the deregistration delay controls how long the ALB waits for in-flight requests before removing a target from service; it does not affect the idle timeout that triggers the 502 error.

Full explanation →

731

Multi-Selecteasy

A company is migrating an SAP Business Suite system to AWS. They want to reduce storage costs by using Amazon S3 for archiving. Which TWO AWS services can be used to integrate SAP with Amazon S3 for archiving?

Select 2 answers

A.Amazon S3 Batch Operations

B.Amazon S3 Glacier

C.Amazon CloudFront

D.AWS Storage Gateway (file gateway)

E.SAP Data Archiving with S3 as the archive store

AnswersD, E

File gateway presents a file interface to S3 for SAP archiving.

Why this answer

Options D and E are correct. AWS Storage Gateway (file gateway) provides a file interface to Amazon S3, allowing SAP systems to write archive files to file shares that are backed by S3, thus integrating SAP archiving with S3. SAP Data Archiving with S3 as the archive store is a native SAP solution that directly uses S3 as a target for archiving objects.

Option A is incorrect because Amazon S3 Batch Operations performs bulk actions on existing S3 objects, not for archiving from SAP. Option B is incorrect because Amazon S3 Glacier is a storage class, not a service for integration; it can be used as a destination within S3 lifecycle policies but is not directly integrated with SAP. Option C is incorrect because Amazon CloudFront is a content delivery network (CDN) and is not designed for SAP archiving.

Full explanation →

732

MCQeasy

A company is planning to run SAP S/4HANA on AWS. The architect needs to ensure that the EC2 instances are SAP certified for the specific SAP HANA version. Where should the architect verify the instance certification?

A.SAP Support Portal

B.AWS Management Console under EC2 instance types

C.SAP Certified and Supported SAP HANA Hardware Directory

D.AWS documentation for SAP on AWS

AnswerC

This directory is the official source for SAP HANA hardware certification.

Why this answer

The SAP Certified and Supported SAP HANA Hardware Directory is the authoritative source maintained by SAP that lists all certified hardware configurations, including specific AWS EC2 instance types and their supported SAP HANA versions. This directory is the only place where SAP officially validates that an EC2 instance meets the exact hardware and firmware requirements for a given SAP HANA release, ensuring compliance with SAP's certification standards.

Exam trap

The trap here is that candidates often assume AWS documentation or the AWS Management Console would contain SAP certification details, but only the SAP Hardware Directory provides the official, legally binding certification status for SAP HANA workloads.

How to eliminate wrong answers

Option A is wrong because the SAP Support Portal is used for managing support cases, downloading software, and accessing SAP notes, but it does not contain the certified hardware directory for EC2 instance types. Option B is wrong because the AWS Management Console under EC2 instance types only shows available instance families and their specifications, not SAP-specific certification status for a particular SAP HANA version. Option D is wrong because AWS documentation for SAP on AWS provides general guidance and best practices but does not replace the official SAP-certified hardware directory, which is the sole source for verifying instance certification.

Full explanation →

733

MCQmedium

A company is running SAP HANA on AWS and needs to back up the database to Amazon S3. Which approach provides the most efficient and cost-effective backup strategy?

A.Use AWS Storage Gateway with tapes.

B.Use SAP HANA Backint agent to back up directly to S3.

C.Take EBS snapshots of the HANA data volumes.

D.Copy HANA data files to EC2 instance store.

AnswerB

Backint integrates with SAP HANA for efficient backups.

Why this answer

The SAP HANA Backint agent is the native, certified integration for backing up SAP HANA directly to Amazon S3. It leverages the SAP HANA backup API to stream data directly to S3 without intermediate storage, providing the most efficient path with minimal overhead and cost, as you only pay for S3 storage and API calls.

Exam trap

The trap here is that candidates often confuse EBS snapshots as a valid backup method for SAP HANA, but they fail to account for the need for application-consistent snapshots and the fact that EBS snapshots are not integrated with SAP HANA's backup catalog, leading to potential data loss or corruption during recovery.

How to eliminate wrong answers

Option A is wrong because AWS Storage Gateway with tapes (VTL) introduces unnecessary complexity and cost for virtual tape storage, and is not optimized for SAP HANA's native backup protocols. Option C is wrong because EBS snapshots capture the entire volume, including unused space, and are not crash-consistent for SAP HANA without additional steps like pausing I/O, leading to higher storage costs and potential data inconsistency. Option D is wrong because EC2 instance store is ephemeral and provides no durability; data is lost if the instance stops or fails, making it unsuitable for backups.

Full explanation →

734

MCQhard

A company is running SAP BusinessObjects on AWS and needs to back up the CMS database (an SAP HANA database) daily. The backup must be stored in Amazon S3 for long-term retention and must be recoverable within 4 hours. Which backup strategy meets these requirements?

A.Copy the HANA data files to an Amazon EBS volume in a different Availability Zone.

B.Configure the SAP HANA Backint agent to back up directly to Amazon S3.

C.Use AWS Backup to create application-consistent backups of the HANA database.

D.Take daily EBS snapshots of the HANA volumes.

AnswerB

Configuring the SAP HANA Backint agent to back up directly to Amazon S3 is the native and most efficient method for HANA backups. It allows direct S3 storage, supports incremental backups, and can restore within 4 hours.

Why this answer

The SAP HANA Backint agent allows direct backup to Amazon S3, providing a native and efficient method for consistent HANA backups. Option A is incorrect because copying data files to an EBS volume in another AZ does not ensure database consistency and is not a proper backup method for HANA. Option C is incorrect because AWS Backup does not natively support application-consistent backups for SAP HANA databases.

Option D is incorrect because EBS snapshots are not crash-consistent for HANA and do not guarantee point-in-time recovery for the database.

Full explanation →

735

MCQmedium

During an SAP migration, the migration team needs to ensure that all SAP system IDs (SIDs) are unique across the AWS environment. Which AWS service can be used to centrally manage and enforce this uniqueness?

A.AWS Service Catalog

B.AWS Config

C.AWS Resource Access Manager

D.AWS CloudTrail

AnswerA

Service Catalog allows creating a product with constraints that enforce unique SIDs.

Why this answer

AWS Service Catalog can define product portfolios with constraints, including preventing duplicate SIDs. Option B is wrong because AWS Config audits resources but doesn't enforce uniqueness. Option C is wrong because AWS Resource Access Manager shares resources, not manages SIDs.

Option D is wrong because AWS CloudTrail logs API calls.

Full explanation →

736

MCQmedium

A company runs SAP on AWS and uses a multi-AZ deployment for SAP HANA. The operations team notices that the secondary HANA node in the standby replica is not automatically taking over during a planned failover test. What is the most likely cause?

A.HANA system replication is not configured with 'PRIMARY' and 'SECONDARY' roles.

B.Security Groups are blocking replication traffic.

C.The secondary instance is launched in a different instance family.

D.The EBS volumes are not configured for replication across AZs.

AnswerA

Automatic failover requires proper HANA system replication configuration.

Why this answer

For automatic failover in SAP HANA system replication, the secondary node must be configured with the 'SECONDARY' role and the primary with 'PRIMARY' role. If these roles are not set, the secondary will not automatically take over during a planned failover test. Option B is incorrect because security groups can block replication traffic, but that would prevent replication altogether, not just automatic failover during a planned test.

Option C is incorrect because instance families do not affect automatic failover; HANA can run on different families but that is not a typical cause. Option D is incorrect because EBS replication is not a factor in HANA system replication; HANA uses its own replication mechanism.

Full explanation →

737

MCQhard

A company runs SAP HANA on an m5.24xlarge EC2 instance. The instance has an EBS-optimized attachment and a high-performance EBS volume for data. The database team reports that write latency to the data volume is consistently above 5 ms during peak hours. Which action would most effectively reduce write latency?

A.Provision the data volume as an io2 Block Express volume with higher IOPS.

B.Use an Elastic Fabric Adapter (EFA) for storage traffic.

C.Change the data volume type to gp3.

D.Enable EBS optimization on the instance.

AnswerA

io2 Block Express provides sub-millisecond latency and high IOPS, suitable for SAP HANA.

Why this answer

Io2 Block Express volumes are designed for high-performance workloads requiring low latency and high IOPS, which directly addresses the write latency issue. Option B is incorrect because EFA is for HPC and does not affect EBS latency. Option C is incorrect because gp3 volumes have lower performance than io2 for high-write workloads.

Option D is incorrect because the m5.24xlarge instance already supports EBS optimization, and enabling it would not reduce latency further.

Full explanation →

738

MCQeasy

Your company runs SAP Business Suite on AWS. The system has a three-tier architecture with a web dispatcher, application servers, and a HANA database. The operations team has been receiving alerts about high CPU usage on the application servers during peak hours. The application servers are currently running on m5.large instances. You need to ensure consistent performance without over-provisioning. What is the most cost-effective solution?

A.Add more application servers manually during peak hours

B.Upgrade all application servers to m5.xlarge instances

C.Use reserved instances to lower cost but keep existing instances

D.Configure Auto Scaling with a step scaling policy based on CPU utilization

AnswerD

Auto Scaling adjusts capacity dynamically based on demand, cost-effective.

Why this answer

Configuring Auto Scaling with a step scaling policy based on CPU utilization automatically adds or removes application servers in response to demand. This ensures consistent performance during peak hours without permanently over-provisioning resources, making it the most cost-effective solution. Option D is correct.

Full explanation →

739

MCQmedium

A company runs its SAP ERP system on AWS. The database is SAP HANA on an EC2 instance. The system is critical and requires a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 2 hours. Which solution meets these requirements with the LEAST operational overhead?

A.Use AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) to perform continuous backups to S3.

B.Use EBS snapshots of the root and data volumes taken every 5 minutes.

C.Set up HANA system replication across two EC2 instances in different Availability Zones with manual failover.

D.Schedule manual HANA backups to S3 using cron scripts and hdbsql commands.

AnswerA

Continuous backups provide low RPO; automated restore meets RTO with low overhead.

Why this answer

AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) provides continuous, incremental backups to Amazon S3, achieving an RPO of less than 5 minutes with automated, policy-driven backups. This solution minimizes operational overhead by eliminating manual scripting and infrastructure management, while supporting point-in-time recovery within the required RTO of under 2 hours.

Exam trap

The trap here is that candidates often overestimate the simplicity of EBS snapshots (Option B) for database workloads, not realizing that SAP HANA requires application-consistent backups and that frequent snapshots alone cannot achieve sub-5-minute RPO without significant custom orchestration.

How to eliminate wrong answers

Option B is wrong because EBS snapshots taken every 5 minutes cannot guarantee an RPO of less than 5 minutes due to snapshot initiation delays and the need to quiesce the HANA database, and they require manual or custom automation for consistency, increasing operational overhead. Option C is wrong because HANA system replication across Availability Zones with manual failover introduces significant operational overhead (manual intervention) and cannot meet the RTO of less than 2 hours reliably, as failover requires human action and coordination. Option D is wrong because scheduling manual HANA backups to S3 using cron scripts and hdbsql commands is error-prone, lacks automated monitoring, and requires custom scripting and maintenance, resulting in higher operational overhead and potential RPO/RTO gaps.

Full explanation →

740

MCQeasy

A company is designing a disaster recovery (DR) strategy for its SAP system on AWS. The primary site is in us-east-1 and the DR site in us-west-2. The RTO is 4 hours and RPO is 1 hour. Which AWS service should be used for cross-region replication of the SAP HANA database backups stored in Amazon S3?

A.AWS Backup with a cross-region backup plan.

B.Use AWS Storage Gateway to replicate backups.

C.Amazon S3 Cross-Region Replication (CRR).

D.Enable S3 Versioning on the source bucket.

AnswerC

S3 CRR automatically replicates new objects to another region, meeting RPO.

Why this answer

Amazon S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects (including SAP HANA database backups) from a source S3 bucket in us-east-1 to a destination bucket in us-west-2, meeting the 1-hour RPO by ensuring backups are available in the DR region within minutes of upload. CRR operates asynchronously at the object level, requires no additional infrastructure, and directly supports the stated requirement for cross-region replication of S3-stored backups without introducing extra latency or complexity.

Exam trap

The trap here is that candidates often confuse AWS Backup (which manages backup schedules and retention) with S3 CRR (which handles object-level replication), leading them to select AWS Backup despite it not being designed for cross-region replication of existing S3 objects.

How to eliminate wrong answers

Option A is wrong because AWS Backup with a cross-region backup plan is designed for scheduling and managing backups of AWS resources (e.g., EBS, RDS, DynamoDB) but does not natively replicate existing S3 objects; it would require creating separate backup copies, adding overhead and potentially missing the 1-hour RPO. Option B is wrong because AWS Storage Gateway is a hybrid storage service for on-premises to AWS connectivity (e.g., file, volume, or tape gateways) and is not designed for cross-region replication of S3 objects; it would introduce unnecessary complexity and latency. Option D is wrong because enabling S3 Versioning on the source bucket only preserves multiple versions of objects within the same bucket and region, providing protection against accidental deletion or overwrite, but does not replicate data to a different region, thus failing to meet the DR requirement for cross-region availability.

Full explanation →

741

Multi-Selecteasy

A company uses AWS Systems Manager to automate patching of SAP application servers. Which TWO resources are required to use Systems Manager Patch Manager?

Select 2 answers

A.An Application Load Balancer in front of the instances

B.AWS Systems Manager Agent (SSM Agent) installed on the EC2 instances

C.A NAT gateway for outbound internet access

D.An IAM role that grants Systems Manager permissions attached to the EC2 instances

E.An internet gateway attached to the VPC

AnswersB, D

SSM Agent is required for Systems Manager to communicate with instances.

Why this answer

The correct answers are B and D. AWS Systems Manager Patch Manager requires the SSM Agent to be installed on the EC2 instances (B) to receive and apply patches. Additionally, the instances must be associated with an IAM role that grants Systems Manager permissions (D) to allow the service to communicate with the instances and perform patching actions.

Options A, C, and E are not required. An Application Load Balancer (A) is not needed for patching. A NAT gateway (C) is not necessary because you can use VPC endpoints for Systems Manager instead of outbound internet access.

An internet gateway (E) is also not required if VPC endpoints are used.

Full explanation →

742

Multi-Selecteasy

A company is migrating an on-premises SAP HANA database to AWS. They want to use AWS DMS for ongoing replication. Which TWO prerequisites must be met before starting the replication? (Choose TWO.)

Select 2 answers

A.The source database must be running on an EC2 instance.

B.The source database must have binary logging enabled (for CDC).

C.The source database must be accessible from the DMS replication instance.

D.The target database must be Amazon RDS for Oracle.

E.The schema must be converted using AWS SCT first.

AnswersB, C

Binary logging is required for change data capture.

Why this answer

For ongoing replication (CDC) with AWS DMS, binary logging must be enabled on the source database (Option B). Additionally, the source database must be accessible from the DMS replication instance (Option C). Option A is incorrect because the source does not need to be running on EC2; any supported database can be used.

Option D is incorrect because the target database in this migration scenario is SAP HANA on AWS, not Amazon RDS for Oracle. Option E is incorrect because AWS Schema Conversion Tool (SCT) is used for schema conversion, not a prerequisite for DMS replication.

Full explanation →

743

MCQhard

An SAP system on AWS is experiencing performance degradation. The CloudWatch metrics show that the EBS volumes used for the HANA data files have an average queue length of 10 and average latency of 50 ms. What is the most likely cause?

A.EBS encryption is causing additional overhead.

B.EBS snapshots are being taken too frequently.

C.The EBS volume's provisioned IOPS are insufficient for the workload.

D.EBS optimization is not enabled on the instance.

AnswerC

Insufficient IOPS cause queuing and increased latency.

Why this answer

An average EBS queue length of 10 and average latency of 50 ms indicate that the volume is saturated with I/O requests. The queue length persistently exceeds the recommended threshold (typically <1 for optimal performance), and latency spikes above the 1–10 ms range for gp3 or io2 volumes. This directly points to insufficient provisioned IOPS for the SAP HANA workload, causing requests to queue up and wait for service.

Exam trap

The trap here is that candidates confuse high queue length with a snapshot or encryption issue, but AWS explicitly documents that queue length and latency are the primary indicators of IOPS exhaustion, not of background operations like snapshots or encryption.

How to eliminate wrong answers

Option A is wrong because EBS encryption uses AES-256 and is handled by the Nitro chip or instance hardware with negligible performance overhead; it does not cause queue buildup or latency spikes. Option B is wrong because EBS snapshots are incremental and taken from the control plane; they do not directly impact data-plane I/O latency or queue depth unless the volume is heavily utilized during a snapshot (which would still manifest as insufficient IOPS). Option D is wrong because EBS optimization is enabled by default on all current-generation instance types (e.g., m5, r5, x1e) and cannot be disabled; if it were missing on an older instance, it would cause a fixed bandwidth cap, not a queue-length symptom.

Full explanation →

744

MCQeasy

An organization wants to ensure that its SAP HANA database backups are stored in a separate AWS Region for disaster recovery. The backups are currently stored in Amazon S3 in the primary Region. Which AWS service should be used to replicate the backups to another Region automatically?

A.Amazon S3 Cross-Region Replication (CRR).

B.AWS Storage Gateway with volume gateway.

C.AWS Backup with a cross-region backup plan.

D.Amazon S3 Transfer Acceleration.

AnswerA

S3 CRR automatically replicates objects to another Region.

Why this answer

Amazon S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects from an S3 bucket in one AWS Region to a bucket in another Region, meeting the requirement for storing SAP HANA database backups in a separate Region for disaster recovery. CRR operates asynchronously at the object level, ensuring that backups are continuously copied without manual intervention, and it supports the same storage classes and encryption mechanisms as the source bucket.

Exam trap

The trap here is that candidates may confuse AWS Backup's cross-region copy capability with S3 CRR, but AWS Backup is a managed backup service that does not automatically replicate existing S3 objects without a backup plan, whereas CRR is a native S3 feature designed specifically for continuous, automatic object replication across Regions.

How to eliminate wrong answers

Option B (AWS Storage Gateway with volume gateway) is wrong because volume gateway provides on-premises access to cloud-backed iSCSI volumes and does not automatically replicate data across Regions; it is designed for hybrid storage, not cross-region backup replication. Option C (AWS Backup with a cross-region backup plan) is wrong because while AWS Backup can copy backups across Regions, it is a backup orchestration service that requires creating backup plans and policies, and it does not directly replicate existing S3 objects; it is more suited for managing backups of AWS services like EBS, RDS, and DynamoDB, not for continuous replication of S3-stored SAP HANA backups. Option D (Amazon S3 Transfer Acceleration) is wrong because it only speeds up uploads to S3 over long distances using AWS edge locations; it does not provide any replication or copying of data between Regions.

Full explanation →

745

MCQeasy

A company wants to use AWS Systems Manager to automate patching of SAP application servers. What is a prerequisite for Systems Manager to manage these EC2 instances?

A.Enable SSH access to the instances.

B.Assign a separate IAM role to each instance.

C.Install the SSM Agent on the EC2 instances.

D.Ensure the instances have public IP addresses.

AnswerC

SSM Agent is required for Systems Manager to communicate with instances.

Why this answer

AWS Systems Manager requires the SSM Agent to be installed and running on EC2 instances to enable communication with the Systems Manager service for patching and other management tasks. Without the agent, Systems Manager cannot send commands, initiate patching workflows, or gather inventory data from the instances. The SSM Agent is pre-installed on many Amazon Linux and Windows AMIs but must be manually installed on custom or imported images.

Exam trap

The trap here is that candidates often assume SSH or public IP addresses are required for remote management, but Systems Manager is designed to work without them, relying solely on the SSM Agent and IAM permissions over HTTPS.

How to eliminate wrong answers

Option A is wrong because SSH access is not required for Systems Manager; the service uses the SSM Agent over HTTPS (port 443) to communicate, not SSH. Option B is wrong because while an IAM role is necessary, a single IAM role can be shared across multiple instances; assigning a separate role to each instance is not a prerequisite. Option D is wrong because Systems Manager can manage instances in private subnets without public IP addresses, using VPC endpoints or Systems Manager managed instances with a NAT gateway.

Full explanation →

746

Multi-Selectmedium

Which TWO AWS services can be used to automate the patching of SAP EC2 instances? (Choose two.)

Select 2 answers

A.AWS Systems Manager Maintenance Windows

B.AWS Systems Manager Patch Manager

C.Amazon Inspector

D.AWS CloudFormation

E.AWS CodeDeploy

AnswersA, B

Schedules patching activities.

Why this answer

Options A and B are correct. AWS Systems Manager Maintenance Windows allow you to schedule patching tasks, while AWS Systems Manager Patch Manager automates the patching process. Option C is incorrect because Amazon Inspector is a vulnerability scanning service, not used for patching.

Option D is incorrect because AWS CloudFormation is an infrastructure provisioning service. Option E is incorrect because AWS CodeDeploy is an application deployment service.

Full explanation →

747

MCQmedium

A company runs SAP S/4HANA on AWS and needs to ensure that the system can automatically recover from an Availability Zone failure. The solution must use synchronous replication for zero data loss. Which AWS architecture meets these requirements?

A.EBS snapshots taken every 5 minutes

B.Multi-AZ RDS for SAP HANA

C.Cluster placement group spanning two AZs

D.SAP HANA System Replication with synchronous replication

AnswerD

Synchronous HSR provides zero RPO and automatic failover across AZs.

Why this answer

SAP HANA System Replication with synchronous replication across Availability Zones ensures zero data loss and automatic failover. Option A is incorrect because EBS snapshots are asynchronous and do not provide zero data loss. Option B is incorrect because Multi-AZ RDS is not supported for HANA.

Option C is incorrect because cluster placement groups are within a single AZ and do not provide cross-AZ failover.

Full explanation →

748

MCQhard

An SAP Basis administrator notices that the SAP application server on an EC2 instance is experiencing intermittent high latency when writing to the SAP HANA database. The HANA database is on a separate EC2 instance in the same VPC and Availability Zone. Which configuration change is most likely to resolve the issue?

A.Launch the instances in a cluster placement group

B.Enable EBS optimization on both instances

C.Change the Elastic Network Adapter (ENA) to SR-IOV

D.Enable Jumbo Frames on the network interfaces

AnswerD

Jumbo Frames reduce overhead for large packets, improving network throughput and reducing latency for HANA communication.

Why this answer

The intermittent high latency when writing to SAP HANA is likely caused by network packet fragmentation. Enabling Jumbo Frames (MTU 9001) on the network interfaces of both the SAP application server and the HANA database EC2 instances reduces the number of packets required for large data transfers, lowers CPU overhead for packet processing, and improves throughput. This is a standard recommendation for SAP on AWS to optimize network performance between application and database layers.

Exam trap

The trap here is that candidates often confuse network performance issues with compute or storage optimizations, leading them to choose EBS optimization or placement groups, when the real fix is a simple MTU adjustment to eliminate packet fragmentation overhead.

How to eliminate wrong answers

Option A is wrong because a cluster placement group is designed for low-latency, high-bandwidth communication between instances, but it does not address the underlying packet fragmentation issue; it would only help if the instances were in different AZs or needed enhanced network performance, which is not the case here. Option B is wrong because EBS optimization is a feature that dedicates bandwidth between the EC2 instance and EBS volumes, not between two EC2 instances; it would not resolve network latency between the SAP app server and HANA database. Option C is wrong because the Elastic Network Adapter (ENA) is already the default modern network interface for current-generation instances, and SR-IOV (Single Root I/O Virtualization) is an older technology (e.g., Intel 82599 VF) that is not applicable to ENA; changing to SR-IOV would not improve performance and could cause compatibility issues.

Full explanation →

749

MCQhard

An SAP administrator runs the above CloudWatch Logs Insights query on an application log group. The query returns no results even though the administrator knows there are ERROR messages in the logs. What is the most likely cause?

A.The query uses a regex pattern that is not supported by CloudWatch Logs Insights.

B.The query syntax is incorrect; the filter should use 'like' instead of '/.../'.

C.The time range is set to a period when no ERROR messages were logged.

D.The log events are not in plain text; they are in JSON format and the ERROR string is within a JSON field.

AnswerD

If logs are JSON, @message contains the entire JSON string; the filter may need to target a specific field.

Why this answer

CloudWatch Logs Insights allows filtering log events using the @message field. When logs are in JSON format, the ERROR string may be embedded within a JSON field rather than appearing as plain text in @message. A simple pattern match like /ERROR/ on @message will not match if the @message contains the entire JSON object.

To search JSON logs, parse the JSON fields and filter on the parsed fields. Option A is incorrect because CloudWatch Logs Insights supports regex patterns with the '/pattern/' syntax. Option B is incorrect because the correct filter syntax uses '/pattern/', not 'like' (which is not an operator in CloudWatch Logs Insights).

Option C is incorrect because while the time range could exclude errors, the most likely cause given that errors are known to exist is the JSON structure. Therefore, Option D is the correct answer.

Full explanation →

750

MCQmedium

Refer to the exhibit. An administrator runs the AWS CLI command shown. The instance is running Windows. Which of the following is true based on the output?

A.The instance is in the 'stopped' state.

B.The instance is in the 'running' state, but the status of the SAP application is unknown from this output.

C.The instance type is t2.micro.

D.The instance is running Linux.

AnswerB

The CLI output only shows instance metadata, not application health.

Why this answer

The AWS CLI command output shows the instance state as 'running', but it does not provide any information about the SAP application status. Therefore, we know the instance is running, but the SAP application status remains unknown from this output. Option A is incorrect because the state shown is 'running', not 'stopped'.

Option C is incorrect because the output does not include the instance type 't2.micro' (or the actual type is different). Option D is incorrect because the instance is running Windows, as indicated in the stem and likely confirmed by the output, so it is not Linux.

Full explanation →

Page 10 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →