Courseiva

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 751–825

1616 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 10

Page 11 of 22

Page 12
751
MCQhard

A company runs its SAP ERP system on AWS using a multi-tier architecture. The SAP application servers are in an Auto Scaling group across two Availability Zones, and the SAP HANA database runs on a single large EC2 instance (r5.24xlarge) with 768 GB of memory and EBS Provisioned IOPS SSD (io1) volumes. The operations team recently noticed that the database performance degrades intermittently during peak business hours. CloudWatch metrics show that the database instance's CPU utilization remains below 40%, but the ReadLatency and WriteLatency for the EBS volumes spike above 10 ms during these periods, and the VolumeQueueLength metric increases significantly. The database instance uses a single EBS volume for /hana/data and another for /hana/log. The team has already verified that there are no network bottlenecks and that the SAP application servers are not overwhelming the database with queries. What is the MOST likely cause of the latency spikes, and what action should be taken?

A.Change the EBS volume type from io1 to st1 for higher throughput.
B.Add more SAP application servers to distribute the load and reduce database contention.
C.Enable EBS encryption on the volumes to improve I/O performance.
D.Upgrade the EC2 instance to a Nitro-based instance type like r5b.24xlarge, which provides higher EBS bandwidth and lower latency.
AnswerD

Upgrading to a Nitro-based instance like r5b.24xlarge provides higher EBS bandwidth and dedicated hardware for EBS, reducing latency and queueing, which directly addresses the issue of EBS volume saturation.

Why this answer

The symptoms indicate that the EBS volumes are experiencing queueing due to insufficient I/O performance. The r5.24xlarge instance uses the Xen hypervisor, which has lower EBS bandwidth compared to Nitro-based instances like r5b.24xlarge. Upgrading to a Nitro instance provides dedicated EBS bandwidth and lower latency, addressing the latency spikes.

Option A is incorrect because st1 (throughput optimized) is not suitable for low-latency database workloads; it is designed for large sequential I/O. Option B is incorrect because adding more application servers would increase the database load, exacerbating the issue. Option C is incorrect because EBS encryption does not improve I/O performance.

Full explanation →
752
MCQeasy

A company is migrating an SAP NetWeaver system from on-premises to AWS. They plan to use the same SAP SID and keep the same hostname. The migration will be performed using SAP Software Provisioning Manager (SWPM) with the option 'System Rename' set to 'No'. What must be configured in the AWS environment to ensure the system functions correctly?

A.Ensure the same private IP address is assigned to the Amazon EC2 instance
B.Update the DNS records to point to the new public IP
C.Change the SAP SID to a new value
D.Assign a different private IP address to avoid conflicts
AnswerA

Matching IP avoids reconfiguration of application and database connections.

Why this answer

The system uses the same hostname and SAP SID. To avoid reconfiguration, the Amazon EC2 instance must have the same private IP address as the on-premises hostname resolves to, or the hostname must be resolvable via DNS or /etc/hosts. Option B is incorrect because updating DNS records to point to a new public IP is unnecessary when the same private IP is used.

Option C is incorrect because the same SAP SID is allowed and does not need to be changed. Option D is incorrect because assigning a different private IP would require updating hostname resolution, which defeats the purpose of keeping the same hostname.

Full explanation →
753
Multi-Selectmedium

A company is running SAP HANA on AWS and needs to ensure high availability for the SAP Central Services (ASCS/ERS) instance. Which TWO actions should be taken to achieve this? (Choose two.)

Select 2 answers
A.Configure ASCS and ERS on separate EC2 instances in different Availability Zones.
B.Use an Application Load Balancer to distribute traffic between ASCS and ERS instances.
C.Use a Network Load Balancer with a floating IP address for the SAP virtual hostname.
D.Deploy both ASCS and ERS on the same EC2 instance to reduce latency.
E.Place both ASCS and ERS in the same Availability Zone to minimize network latency.
AnswersA, C

Separate instances in different AZs provide high availability.

Why this answer

SAP Central Services (ASCS/ERS) must run on separate EC2 instances to avoid a single point of failure. Placing them in different Availability Zones (AZs) ensures that if one AZ fails, the other instance can take over, providing high availability. This aligns with SAP's recommendation for a multi-AZ architecture for ASCS/ERS in an SAP HANA on AWS environment.

Exam trap

The trap here is that candidates often confuse the role of load balancers, assuming an ALB can handle SAP virtual hostname failover, when in fact only an NLB with a floating IP supports the required Layer 4 static IP behavior for SAP Central Services.

Full explanation →
754
Multi-Selecteasy

Which TWO AWS services can be used to migrate on-premises virtual machines to AWS without requiring agent installation? (Choose two.)

Select 2 answers
A.AWS CloudEndure Migration
B.AWS Database Migration Service (DMS)
C.AWS Application Migration Service (MGN) with agent
D.AWS Application Migration Service (MGN) agentless mode
E.AWS Server Migration Service (SMS)
AnswersD, E

MGN supports agentless for supported hypervisors.

Why this answer

AWS Application Migration Service (MGN) supports agentless replication for VMware vSphere VMs (Option D). AWS Server Migration Service (SMS) also provides agentless migration for VMware vCenter environments (Option E). Options A (CloudEndure Migration) and C (MGN with agent) are agent-based.

Option B (DMS) is a database migration service typically requiring agents or specific configurations.

Full explanation →
755
MCQeasy

A company runs SAP on AWS and wants to back up its SAP HANA database to Amazon S3. The database is 2 TB in size. The backup must be encrypted at rest in S3 and must be cost-effective. Which approach should the company use?

A.Use AWS Backup to directly back up the SAP HANA database to S3 with SSE-S3
B.Configure a cron job to copy the SAP HANA backup files from EBS to S3 using AWS CLI
C.Install the SAP HANA Backint agent for Amazon S3 and configure it to use SSE-S3 encryption
D.Use SAP HANA Studio to export the database to a file on EBS and then manually upload to S3
AnswerC

Backint is the recommended method for backing up SAP HANA to S3 with encryption.

Why this answer

The SAP HANA Backint agent for Amazon S3 is the AWS-recommended, native integration for backing up SAP HANA databases directly to S3. It supports SSE-S3 encryption at rest, ensuring cost-effective storage without manual intervention or additional infrastructure, and is designed to handle large databases like the 2 TB workload efficiently.

Exam trap

The trap here is that candidates may confuse AWS Backup's general-purpose capabilities with SAP HANA-specific backup requirements, overlooking that only the Backint agent provides the native integration needed for consistent, encrypted, and automated backups to S3.

How to eliminate wrong answers

Option A is wrong because AWS Backup does not natively support SAP HANA database backups; it can back up EBS volumes or RDS instances but not the HANA database directly via Backint. Option B is wrong because using a cron job to copy backup files from EBS to S3 via AWS CLI is manual, error-prone, and does not integrate with HANA's backup lifecycle, risking data consistency and increasing operational overhead. Option D is wrong because exporting the database to a file on EBS via SAP HANA Studio and then manually uploading to S3 is not automated, lacks encryption at rest in S3 by default, and is inefficient for a 2 TB database, violating cost-effectiveness and reliability.

Full explanation →
756
MCQeasy

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The administrator wants to receive an alert when the CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

A.AWS CloudTrail
B.AWS Config
C.Amazon CloudWatch Logs
D.Amazon CloudWatch Alarms
AnswerD

CloudWatch Alarms can monitor CPU utilization metric.

Why this answer

Amazon CloudWatch Alarms are the correct service for monitoring EC2 instance CPU utilization and triggering alerts based on thresholds. In this scenario, the administrator needs to create an alarm that triggers when CPU utilization exceeds 80% for 5 consecutive minutes. CloudWatch Alarms can evaluate metric data against specified thresholds and perform actions such as sending notifications via SNS.

Option D is correct. Option A (AWS CloudTrail) is for auditing API activity, not metric monitoring. Option B (AWS Config) is for resource configuration compliance.

Option C (Amazon CloudWatch Logs) is for storing and monitoring log files, not for setting metric-based alarms.

Full explanation →
757
MCQmedium

Refer to the exhibit. An Application Load Balancer is configured to route traffic to an Auto Scaling group of web servers. The health check for the target group is failing. The web servers are healthy and running, but the health check endpoint is returning a 503 status code because the application cannot connect to the database. The database is an Amazon RDS instance in the same VPC. Which action should the solutions architect take to resolve the health check failure?

A.Restart the web server instances to reset the database connection.
B.Change the health check endpoint to a static page that does not require database connectivity.
C.Modify the application's health check endpoint to return a 200 OK status even when the database is unavailable.
D.Increase the health check interval to allow more time for the database to respond.
AnswerB

A static health check page will return 200 even if the database is down, allowing the instance to pass the health check.

Why this answer

The health check endpoint should validate the web server's ability to serve traffic, not the database's availability. By changing the health check to a static page (e.g., /health.html) that does not depend on database connectivity, the load balancer will correctly assess the web server's health independently. This decouples the health check from the database, preventing cascading failures where a database outage causes all web servers to be marked unhealthy and removed from the target group.

Exam trap

The trap here is that candidates may think the health check must reflect the full application stack (including database connectivity), but AWS best practice is to keep health checks lightweight and independent of external dependencies to prevent cascading failures.

How to eliminate wrong answers

Option A is wrong because restarting the web server instances does not resolve the underlying database connectivity issue; the application will still fail to connect to the database after restart, and the health check will continue to return 503. Option C is wrong because modifying the application to return a 200 OK status even when the database is unavailable would mask a real application failure, causing the load balancer to route traffic to unhealthy servers that cannot serve complete requests, leading to user-facing errors. Option D is wrong because increasing the health check interval does not fix the database connectivity problem; it only delays the detection of the failure, and the health check will still fail when it eventually runs.

Full explanation →
758
MCQeasy

Refer to the exhibit. An SAP system administrator checks disk usage on an SAP HANA instance. The /hana/log volume is at 80% usage. What is the recommended course of action to prevent issues?

A.Take a snapshot of the instance and terminate it.
B.Increase the size of the EBS volume for /hana/log and extend the filesystem.
C.Delete old backup files from /hana/log.
D.Move some data from /hana/log to /hana/data.
AnswerB

Increasing volume size provides more space for log files.

Why this answer

SAP HANA requires that the log volume have sufficient free space to avoid transaction log overflow. The best practice is to increase the size of the log volume. Deleting logs manually is risky, and moving data volumes is not appropriate.

The recommended action is to increase the EBS volume size and extend the filesystem.

Full explanation →
759
MCQmedium

An organization is migrating a legacy SAP ERP system to AWS. The current system runs on IBM AIX with Oracle Database. They plan to use SAP HANA on AWS. Which AWS service should they use to assess the source system's readiness and generate a migration plan?

A.AWS CloudEndure Migration
B.AWS Application Migration Service (AWS MGN)
C.AWS Database Migration Service (DMS)
D.AWS Schema Conversion Tool (SCT)
AnswerB

AWS MGN provides assessment, replication, and automated migration.

Why this answer

AWS Application Migration Service (AWS MGN) is the correct service for assessing source system readiness and generating a migration plan for SAP systems to AWS. It provides automated readiness checks and migration orchestration. Option A (AWS CloudEndure Migration) is a predecessor of AWS MGN and is now integrated; it is not the recommended current service.

Option C (AWS Database Migration Service - DMS) is for database migration only, not full system assessment. Option D (AWS Schema Conversion Tool - SCT) handles schema conversion, not assessment or migration planning.

Full explanation →
760
MCQhard

An SAP on AWS environment includes multiple instances across Availability Zones. The operations team needs to automatically replace an unhealthy EC2 instance that is part of an SAP application cluster. Which AWS service can automatically detect and replace the instance based on health checks?

A.Elastic Load Balancing
B.AWS Systems Manager Automation
C.Auto Scaling group
D.Amazon CloudWatch alarms
AnswerC

Auto Scaling replaces unhealthy instances based on health checks.

Why this answer

An Auto Scaling group with health checks can automatically detect and replace unhealthy EC2 instances. This is commonly used for SAP applications to maintain high availability across Availability Zones. Option A is incorrect because Elastic Load Balancing distributes traffic but does not replace instances.

Option B is incorrect because AWS Systems Manager Automation can automate maintenance tasks but does not automatically replace instances based on health checks. Option D is incorrect because Amazon CloudWatch alarms can notify on health status but do not automatically replace instances.

Full explanation →
761
MCQmedium

Refer to the exhibit. An SAP administrator has attached the IAM policy above to an IAM role used by an EC2 instance for S3 backup operations. The backup process fails with 'Access Denied' when trying to upload a backup file. What is the most likely cause?

A.The policy does not include s3:ListBucket permission
B.The policy does not include kms:GenerateDataKey and kms:Encrypt
C.The policy allows kms:Decrypt on all resources, which is too permissive
D.The policy uses s3:PutObject but the bucket policy denies uploads
AnswerB

KMS encrypted S3 operations require these permissions.

Why this answer

The policy allows s3:PutObject but missing kms:GenerateDataKey and kms:Encrypt for server-side encryption. Without those, PutObject fails if the bucket uses KMS encryption. The s3:GetObject is not needed for upload. kms:Decrypt alone is insufficient.

Full explanation →
762
MCQmedium

An administrator needs to retrieve the private IP address of an ASCS instance that was deployed via AWS CloudFormation. What is the most efficient way to get this IP address?

A.Check the CloudFormation stack events for the private IP.
B.Use the AWS CLI to describe the EC2 instance using the instance ID.
C.Use AWS Systems Manager to find the IP from the instance ID.
D.Modify the CloudFormation template to add the private IP as an output.
AnswerD

Adding the private IP as an output in the template is the most direct way to expose it via CloudFormation.

Why this answer

CloudFormation stack outputs are the intended mechanism for exposing resource attributes, such as private IP addresses, after stack creation. By modifying the template to include the private IP as an output, the administrator can retrieve it directly via the AWS CLI `describe-stacks` command without additional API calls or manual lookups, making it the most efficient and automated approach.

Exam trap

The trap here is that candidates may assume retrieving the private IP from the EC2 instance directly (via describe-instances or Systems Manager) is simpler, but they overlook that CloudFormation outputs are specifically designed to expose such values efficiently and are the recommended practice for infrastructure-as-code workflows.

How to eliminate wrong answers

Option A is wrong because CloudFormation stack events track lifecycle operations (e.g., resource creation, updates, deletions) and do not contain resource-specific data like private IP addresses. Option B is wrong because while describing the EC2 instance using the instance ID can retrieve the private IP, it requires an extra step to first obtain the instance ID from the stack, which is less efficient than using a direct stack output. Option C is wrong because AWS Systems Manager can retrieve instance metadata, but it requires the instance to have the SSM Agent installed and configured, and it introduces unnecessary complexity compared to using a native CloudFormation output.

Full explanation →
763
MCQhard

An SAP administrator is troubleshooting a failed backup of SAP HANA to Amazon S3. The backup is initiated by an SAP HANA BACKUP command using the S3 backint agent. The error log shows 'HTTP 403 Forbidden' when the agent tries to upload to the S3 bucket. The bucket policy allows s3:PutObject from the VPC endpoint. What is the most likely cause?

A.The S3 bucket does not exist.
B.The S3 bucket is not in the same AWS Region as the EC2 instance.
C.The S3 bucket uses server-side encryption with AWS KMS (SSE-KMS) and the IAM role lacks kms:GenerateDataKey.
D.The VPC endpoint policy for S3 does not grant the required actions to the IAM role.
AnswerD

VPC endpoint policies can restrict access even if bucket policy allows it.

Why this answer

The HTTP 403 Forbidden error indicates that the request was received but denied. Since the bucket policy allows s3:PutObject from the VPC endpoint, the issue is likely that the VPC endpoint policy itself does not grant the required actions to the IAM role. VPC endpoint policies act as a separate layer that can override bucket policies.

Option D is correct. Option A is wrong because the bucket exists. Option B is wrong because cross-region access would not cause a 403.

Option C is wrong because SSE-KMS would cause a 400 error, not 403.

Full explanation →
764
MCQhard

A company runs SAP HANA on AWS using a clustered environment with two EC2 instances in an active/passive configuration. The cluster uses a shared EFS file system for the SAP HANA shared volume. The operations team recently migrated the EFS file system from the previous generation to Elastic Throughput mode to improve performance. After the migration, the HANA database becomes unresponsive intermittently. The team notices that the EFS mount target is in a different Availability Zone than the active HANA instance. What is the most likely cause of the unresponsiveness?

A.The EFS file system does not provide sufficient IOPS for HANA workloads.
B.The EFS Elastic Throughput mode is throttling the HANA database traffic.
C.The EFS mount target is in a different Availability Zone than the active HANA instance, causing high latency and potential timeouts.
D.The EFS file system has reached its maximum number of concurrent connections.
AnswerC

Accessing EFS across Availability Zones increases latency, which can cause HANA to become unresponsive.

Why this answer

The most likely cause of unresponsiveness is that the EFS mount target is in a different Availability Zone than the active HANA instance. Cross-AZ access to EFS introduces higher latency and potential network timeouts, which can cause HANA database interruptions. Option A is incorrect: EFS provides adequate throughput for HANA shared volumes; IOPS is not the issue.

Option B is incorrect: Elastic Throughput mode automatically scales throughput based on workload activity, so it would not throttle unless the workload exceeds burst credit balance, but that is not indicated. Option D is incorrect: EFS does not have a hard limit on concurrent connections from two EC2 instances.

Full explanation →
765
MCQhard

A company runs SAP S/4HANA on AWS with a multi-tier landscape (DEV, QAS, PRD). The PRD system uses a clustered setup with two application servers behind an Application Load Balancer. The database is a single-node HANA on an r5.24xlarge instance. The administrator receives an alert that the PRD application is slow. CloudWatch metrics show high CPU utilization on the two application servers (average 95%) and high DB connection count. The ALB shows increased request latency. The database CPU is at 60%. The administrator suspects a SQL query performance issue. What should be the first step to identify the root cause?

A.Configure CloudWatch Logs to capture HANA trace logs and analyze them.
B.Enable detailed SQL trace in HANA to identify high-resource queries.
C.Add two more application servers to distribute the load.
D.Increase the size of the HANA database instance to reduce CPU pressure.
AnswerB

SQL trace identifies specific queries causing performance issues.

Why this answer

The symptoms (high CPU on app servers, high DB connections, increased ALB latency, DB CPU at 60%) strongly suggest a SQL query performance bottleneck, not a capacity issue. Enabling detailed SQL trace in HANA (option B) is the most direct first step to identify the specific high-resource queries causing the slowdown, as it captures execution plans, wait times, and resource consumption per query. This aligns with SAP's recommended troubleshooting methodology for HANA performance issues.

Exam trap

The trap here is that candidates may confuse high application server CPU with a scaling issue (option C) or assume high DB connections mean the database is underpowered (option D), rather than recognizing that a SQL performance problem can manifest as app-side symptoms while the DB CPU remains moderate.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs can capture HANA trace logs, but the first step should be to enable a targeted SQL trace to pinpoint problematic queries, not to passively collect general logs. Option C is wrong because adding application servers would not resolve a SQL query performance issue; it would only mask the symptom by distributing load, and the root cause (poor query) would remain. Option D is wrong because increasing the HANA database instance size would not fix a SQL query performance issue; the DB CPU is only at 60%, indicating the bottleneck is likely inefficient queries, not insufficient compute capacity.

Full explanation →
766
MCQhard

An SAP administrator created the IAM policy shown above to control access to an S3 bucket used for SAP HANA backups. The policy is attached to an IAM role used by an EC2 instance. The instance fails to upload backups. What is the cause?

A.The policy does not allow encryption (SSE-S3) which is required for backups.
B.The 'aws:SecureTransport' condition in the Deny statement is incorrectly using 'BoolIfExists' instead of 'Bool'.
C.The VPC endpoint ID in the policy does not match the actual endpoint.
D.The Deny statement overrides the Allow statement for all actions.
AnswerB

Using 'BoolIfExists' will deny requests even if the key is absent, which may deny legitimate HTTPS requests if the condition is mis-evaluated. 'Bool' should be used to explicitly check for false.

Why this answer

The policy uses 'BoolIfExists' for the 'aws:SecureTransport' condition in the Deny statement. 'BoolIfExists' evaluates the condition as true if the condition key exists and matches the specified value, OR if the key does not exist at all. This can cause unintended denials when the 'aws:SecureTransport' key is absent from the request context (e.g., certain internal AWS service calls). Using 'Bool' instead ensures the condition is evaluated only when the key is present, preventing false denials.

This mismatch between the intended behavior (deny only when explicitly false) and the actual behavior (deny also when key is missing) is the root cause of the backup upload failure.

Full explanation →
767
MCQeasy

An SAP customer has deployed SAP HANA on AWS using an r5.12xlarge instance with 16 EBS io1 volumes for data and log. The system is running in production. The operations team receives an alert that one of the EBS volumes has failed (status check failed). The volume is part of the RAID 0 stripe for the data volume. What should they do to recover the system with minimal data loss?

A.Detach the failed volume, attach a new identical volume, and rebuild the RAID array.
B.Contact AWS Support to recover the data from the failed EBS volume.
C.Increase the size of the remaining volumes to compensate for the lost capacity.
D.Restore the HANA database from the latest backup to a new set of EBS volumes.
AnswerD

Restoring from backup ensures data consistency and recovery with minimal loss.

Why this answer

Since the failed volume is part of a RAID 0 stripe, the entire stripe is compromised. Restoring from the most recent backup is the safest way to recover with minimal data loss. Option A (replace volume and rebuild RAID) may not work because RAID 0 has no redundancy.

Option B (AWS Support) may help but not recover data directly. Option C (increase volume size) does not fix the failed volume.

Full explanation →
768
MCQmedium

An SAP system administrator wants to monitor the CPU and memory usage of SAP HANA database instances. Which AWS service should be used to collect and visualize these metrics?

A.AWS CloudTrail
B.Amazon CloudWatch Agent
C.AWS Systems Manager Run Command
D.Amazon CloudWatch metrics
AnswerB

Collects memory and disk metrics from EC2 instances.

Why this answer

The Amazon CloudWatch Agent can collect memory metrics from EC2 instances, including SAP HANA databases. Option A is wrong because CloudTrail is for API auditing, not metric collection. Option C is wrong because Systems Manager Run Command is for executing scripts, not continuous monitoring.

Option D is wrong because standard CloudWatch metrics do not include memory usage by default; memory metrics require the CloudWatch Agent.

Full explanation →
769
Multi-Selecteasy

A company runs SAP on AWS and uses CloudWatch for monitoring. They want to set up an alarm that notifies the operations team when the CPU utilization of their SAP application server exceeds 90% for 5 consecutive minutes. Which THREE components are required to achieve this? (Select THREE.)

Select 3 answers
A.AWS CloudTrail to log the alarm actions.
B.A CloudWatch alarm configured with the metric and threshold.
C.An Amazon SNS topic to send the notification.
D.An AWS Lambda function to process the alarm.
E.A CloudWatch metric for CPU utilization.
AnswersB, C, E

The alarm triggers when the threshold is breached.

Why this answer

Options B, C, and E are correct. Option B: A CloudWatch alarm is required to define the threshold and trigger when CPU utilization exceeds 90% for 5 consecutive minutes. Option C: An Amazon SNS topic is needed to send notifications to the operations team.

Option E: A CloudWatch metric for CPU utilization is the data source for the alarm. Option A is incorrect because CloudTrail logs API calls, not needed for this monitoring setup. Option D is incorrect because Lambda is not required; the alarm can directly trigger SNS.

Full explanation →
770
MCQmedium

A company is migrating a legacy application to AWS. The application requires a static IP address that must not change after migration. Which networking component should be used to ensure the application's public IP remains consistent?

A.Elastic IP address
B.Internet Gateway
C.VPC Peering
D.NAT Gateway
AnswerA

An Elastic IP address is a static public IPv4 address that can be associated with an EC2 instance or a Network Load Balancer, ensuring the application's public IP remains consistent.

Why this answer

An Elastic IP address is a static public IPv4 address that can be associated with an EC2 instance or a Network Load Balancer, ensuring the application's public IP remains consistent. Option B (Internet Gateway) is used for VPC internet access but does not provide a static IP. Option C (VPC Peering) is for connecting VPCs.

Option D (NAT Gateway) is for outbound traffic.

Full explanation →
771
MCQmedium

A company runs SAP on AWS and wants to reduce costs by stopping non-production instances during off-hours. Which AWS service can automatically start and stop EC2 instances on a schedule?

A.AWS Systems Manager Maintenance Windows
B.AWS Instance Scheduler
C.Amazon CloudWatch Alarms
D.EC2 Auto Scaling
AnswerB

Instance Scheduler automates start/stop on a schedule.

Why this answer

AWS Instance Scheduler is a solution that automatically starts and stops instances on a defined schedule, reducing costs for non-production instances during off-hours. Option A is wrong because while AWS Systems Manager Maintenance Windows can schedule start/stop tasks via automation documents, AWS Instance Scheduler is the dedicated solution designed specifically for this use case, making it the best answer. Option C is wrong because Amazon CloudWatch Alarms can trigger actions based on metrics but lack built-in recurring schedule capabilities.

Option D is wrong because EC2 Auto Scaling manages instance counts based on demand, not on a time-based schedule.

Full explanation →
772
MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. They need to minimize downtime and ensure data consistency. Which AWS service should be used for the initial data load?

A.AWS Database Migration Service (AWS DMS)
B.AWS Snowball Edge
C.AWS Schema Conversion Tool (AWS SCT)
D.AWS DataSync
AnswerA

AWS DMS supports full load and ongoing replication for minimal downtime.

Why this answer

AWS DMS can perform a full load and then ongoing replication to keep the target in sync, minimizing downtime. AWS SCT helps with schema conversion but not data transfer. AWS DataSync is for file data, not databases.

AWS Snowball is for large offline data transfer but not suitable for minimal downtime with replication.

Full explanation →
773
MCQmedium

A company runs SAP on AWS and uses AWS Direct Connect for on-premises connectivity. The operations team notices that the SAP system is experiencing high latency when accessing an on-premises database. The network team confirms that the Direct Connect link is not saturated. What is the most likely cause of the high latency?

A.The traffic is traversing a transit VPC with additional NAT instances
B.The Direct Connect link is using a public VIF instead of a private VIF
C.The Direct Connect bandwidth is insufficient
D.The on-premises network is using a VPN over the Direct Connect link
AnswerA

Additional hops in a transit VPC increase latency.

Why this answer

If the Direct Connect link is not saturated, the issue could be routing inefficiency. A transit VPC with EC2 instances acting as NAT or proxy can introduce additional hops and latency. VPN over Direct Connect is not relevant.

MPLS is the underlying technology for Direct Connect. Increasing bandwidth does not reduce latency caused by routing.

Full explanation →
774
MCQmedium

A company is migrating its SAP Business Suite system from on-premises to AWS. The system uses a Sybase ASE database. The migration team has limited Sybase expertise. They want to minimize the operational overhead after migration. Which database migration approach should they choose?

A.Use AWS MGN to replicate the entire Sybase server to EC2, then perform a system upgrade to SAP HANA.
B.Use SAP Software Update Manager (SUM) with Database Migration Option (DMO) to migrate the system to SAP HANA on EC2.
C.Use AWS DataSync to copy the Sybase data files to EBS and attach to an EC2 instance running Sybase.
D.Use AWS DMS to migrate the Sybase database to Amazon RDS for Sybase.
AnswerB

DMO allows migrating from Sybase to HANA as part of a system update, reducing overhead and leveraging SAP expertise.

Why this answer

Migrating from Sybase ASE to SAP HANA is a strategic move that reduces operational overhead because HANA is a modern in-memory database with better performance and simpler management. SAP Software Update Manager (SUM) with Database Migration Option (DMO) is the official SAP tool to perform this migration while also upgrading the SAP system. This approach minimizes manual effort and leverages SAP expertise.

Option A is incorrect because AWS Application Migration Service (MGN) would replicate the entire Sybase server, keeping Sybase and not reducing overhead. Option C is incorrect because AWS DataSync is designed for file-based transfers, not database replication. Option D is incorrect because AWS DMS does not support Sybase as a target database, and Amazon RDS does not support Sybase; Sybase on AWS would require self-managed EC2, increasing overhead.

Full explanation →
775
MCQmedium

A company is migrating a SAP database to Amazon RDS. The IAM policy shown in the exhibit is attached to a user. Which action is allowed by this policy?

A.Create a new RDS instance.
B.Modify the production SAP RDS instance.
C.Delete the production SAP RDS instance.
D.Only read RDS instances.
AnswerB

Modifying the production SAP RDS instance is allowed because ModifyDBInstance is covered by rds:* and is not denied for prod-sap-db.

Why this answer

The policy allows all RDS actions (rds:*) on all resources, with an explicit deny for DeleteDBInstance on the prod-sap-db resource. This means the user can perform any RDS operation except deleting the specific production SAP RDS instance. Therefore, the user is allowed to modify the production SAP RDS instance (ModifyDBInstance), making Option B the correct answer.

Creating a new RDS instance (CreateDBInstance) is generally allowed, but it is not the action directly related to the production instance in this scenario. Option C is denied explicitly. Option D is incorrect because the policy allows write operations.

Full explanation →
776
MCQhard

A company is migrating an SAP ERP system to AWS and needs to minimize downtime during the cutover. The database is SAP ASE. Which migration strategy is most appropriate?

A.Use SAP ASE replication to replicate data to an EC2 instance running ASE, then cut over.
B.Create a nightly backup of the on-premises database, copy to AWS, and restore.
C.Perform a full database export from on-premises and import into Amazon RDS for ASE.
D.Use AWS Database Migration Service (DMS) with ongoing replication.
AnswerA

Correct. Native ASE replication provides continuous, real-time synchronization, allowing a very short cutover window by applying only final transactions.

Why this answer

SAP ASE native replication (via Sybase Replication Server) allows continuous, real-time data synchronization from the on-premises ASE database to an EC2 instance running ASE in AWS. While AWS DMS supports SAP ASE as a source, it typically performs a full load followed by ongoing replication, which can introduce higher latency and longer cutover windows. In contrast, native replication minimizes downtime by keeping the target closely synchronized, requiring only a brief pause to apply final transactions and redirect clients.

Exam trap

The trap is assuming AWS DMS is the best choice for minimizing downtime because it supports SAP ASE. However, native ASE replication provides even lower latency and a faster cutover, as it avoids the initial full data load required by DMS. The key is understanding that native replication is purpose-built for ASE-to-ASE synchronization and offers the shortest possible downtime.

How to eliminate wrong answers

Option B is wrong because nightly backups and restores require a full data transfer and restore process, which can take hours or days for large SAP ASE databases, causing unacceptable downtime during cutover. Option C is wrong because Amazon RDS for ASE is not a supported service; AWS does not offer a managed RDS engine for SAP ASE, so a full export/import to RDS is not feasible. Option D is wrong because AWS DMS does not support SAP ASE as a source for ongoing replication with transactional consistency; DMS is designed for heterogeneous migrations and lacks native SAP ASE log-based replication capabilities, making it unsuitable for minimizing downtime in this scenario.

Full explanation →
777
MCQhard

A company is migrating an SAP ERP system to AWS. The SAP application runs on a Windows Server with an MSSQL database. The migration must be completed within a strict 4-hour downtime window. The current database is 500 GB. Which migration strategy should be used to meet the downtime requirement?

A.Use SAP SWPM export/import to migrate the database
B.Use an SAP-certified backup/restore tool (e.g., Commvault) to restore to Amazon EC2 with MSSQL
C.Use AWS DMS with ongoing replication, then cutover
D.Use AWS CloudEndure Migration to replicate the entire server
AnswerB

Backup/restore can be faster and is supported for MSSQL on EC2.

Why this answer

For migrating an SAP ERP system with MSSQL database to AWS within a 4-hour downtime window, using an SAP-certified backup/restore tool (e.g., Commvault) to restore to Amazon EC2 with MSSQL is the best approach. This method leverages native MSSQL backup and restore capabilities, which are optimized for large databases and can complete within the downtime window. Option A (SAP SWPM export/import) is typically slower and may exceed 4 hours.

Option C (AWS DMS with ongoing replication) is not ideal because DMS may not fully support SAP-specific schemas and could introduce compatibility issues, and the cutover may not be faster than backup/restore. Option D (AWS CloudEndure Migration) is designed for server-level replication, not database-optimized transfer, and may not meet the strict time constraint.

Full explanation →
778
MCQhard

An SAP administrator created the IAM policy above for an EC2 instance role used by SAP HANA Backint agent. The backup to S3 fails with access denied. What is the likely cause?

A.The policy grants permissions on objects but not on the bucket itself. For s3:PutObject and s3:GetObject, a bucket-level permission is also required for some operations.
B.The policy does not allow s3:PutObject.
C.The policy does not allow ec2:CreateSnapshot.
D.The policy does not allow s3:ListBucket.
AnswerA

The resource ARN for S3 actions should include the bucket ARN for bucket-level operations.

Why this answer

The policy grants s3:PutObject and s3:GetObject on objects within the bucket (using the "arn:aws:s3:::bucket-name/*" resource), but does not include a bucket-level permission such as s3:PutObject or s3:GetObject on the bucket itself ("arn:aws:s3:::bucket-name"). For certain S3 operations, including multipart uploads and object writes that require bucket-level authorization checks, the IAM policy must explicitly allow the action on both the bucket and the object ARN. Without this, the SAP HANA Backint agent fails with access denied.

Exam trap

The trap here is that candidates assume s3:PutObject on the object ARN is sufficient, overlooking the requirement for bucket-level permissions on the same action for operations like multipart uploads or bucket-level condition checks.

How to eliminate wrong answers

Option B is wrong because the policy explicitly includes s3:PutObject on the object ARN, so the failure is not due to a missing s3:PutObject action. Option C is wrong because the question is about S3 backup failure, not EC2 snapshots; ec2:CreateSnapshot is irrelevant to the Backint agent's S3 access. Option D is wrong because s3:ListBucket is not required for the PutObject and GetObject operations used by the Backint agent; the error is caused by missing bucket-level permissions, not the ListBucket action.

Full explanation →
779
MCQeasy

An SAP system is running on AWS and needs to be accessible over the internet securely. Which AWS service should be used to provide secure remote access for administrators?

A.Set up an AWS Site-to-Site VPN connection from the corporate network
B.Use AWS Systems Manager Session Manager
C.Use Amazon WorkSpaces to provide a virtual desktop for administrators
D.Configure the EC2 instance in a public subnet with SSH access from the internet
AnswerB

Session Manager provides secure, audited shell access without opening inbound ports.

Why this answer

AWS Systems Manager Session Manager provides secure, auditable, browser-based or CLI-based remote access to EC2 instances without opening inbound ports, managing SSH keys, or using bastion hosts. It leverages the AWS SSM Agent and IAM policies to authenticate and authorize administrators, making it the most secure and operationally efficient option for SAP system administration on AWS.

Exam trap

The trap here is that candidates often assume a VPN or direct SSH access is required for secure remote administration, but AWS Systems Manager Session Manager provides a more secure and managed alternative that avoids exposing any network ports and eliminates the need for key management.

How to eliminate wrong answers

Option A is wrong because an AWS Site-to-Site VPN connection provides secure connectivity from a corporate network to the VPC, but it does not directly provide remote access for administrators to the SAP instance; it requires additional infrastructure like a bastion host or VPN client. Option C is wrong because Amazon WorkSpaces provides a virtual desktop for end users, not a secure remote access method for administrators to manage the SAP EC2 instance; it adds unnecessary complexity and cost. Option D is wrong because configuring the EC2 instance in a public subnet with SSH access from the internet exposes the management interface directly to the internet, violating security best practices and increasing the attack surface, especially for SAP workloads.

Full explanation →
780
MCQmedium

An SAP Basis administrator notices that the SAP system's response time is increasing during peak hours. The system uses an SAP NetWeaver application server on EC2 and an SAP HANA database on a separate EC2 instance. CloudWatch metrics show that the application server's CPU utilization is at 80% and the database server's CPU is at 30%. The application server is an m5.2xlarge, and the database is an r5.2xlarge. The administrator checks the SAP work process overview and sees that all dialog work processes are busy. What should the administrator do to resolve the performance issue?

A.Increase the database server's CPU capacity by changing to a larger instance type.
B.Increase the instance size of the application server to a compute-optimized type.
C.Add another application server to the system and distribute the load.
D.Increase the number of dialog work processes in the SAP application server profile.
AnswerD

Adding more work processes allows handling more concurrent requests.

Why this answer

The symptom is that all dialog work processes are busy while CPU utilization on the application server is only 80% and database CPU is only 30%. This indicates that the bottleneck is the number of dialog work processes, not CPU or memory. Increasing the number of dialog work processes in the SAP application server profile allows more concurrent users to be processed without additional hardware.

Option A is incorrect because the database CPU is low, so increasing database capacity won't help. Option B is incorrect because the application server CPU is not fully saturated; the issue is work process limits. Option C is incorrect because adding another application server may help, but it is more complex and the immediate fix is to adjust the work process count; however, the question asks for the best first step, and increasing dialog work processes is simpler and directly addresses the symptom.

Full explanation →
781
MCQmedium

A company is migrating its SAP ERP system to AWS. The system requires high availability for the SAP central services (ASCS) and must support automatic failover. Which AWS architecture should the company use to meet these requirements?

A.Configure a Network Load Balancer in front of two ASCS instances in different Availability Zones.
B.Use Amazon RDS Multi-AZ to host the SAP central services.
C.Deploy ASCS on an EC2 instance in an Auto Scaling group with a lifecycle hook that triggers a Lambda function to reattach the ASCS cluster resources.
D.Run ASCS on a single EC2 instance in a single Availability Zone with an Elastic IP address.
AnswerC

This provides automated failover and high availability for ASCS.

Why this answer

It describes a pattern for achieving automatic failover of SAP ASCS using an Auto Scaling group with a lifecycle hook. When the ASCS instance fails, the Auto Scaling group launches a new instance, and the lifecycle hook triggers a Lambda function that reattaches the cluster resources (e.g., EIP, EBS volumes, or shared file systems) to the new instance, enabling the SAP ENSA2 or ENSA1 cluster to resume operations without manual intervention.

Exam trap

The trap here is that candidates often assume a Network Load Balancer (Option A) provides automatic failover for stateful SAP services, but NLB operates at Layer 4 and cannot handle the cluster state and shared storage requirements of SAP ASCS.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) distributes traffic at the transport layer and cannot manage the stateful failover of SAP ASCS, which requires a cluster manager (e.g., Pacemaker) to handle shared resources and fencing. Option B is wrong because Amazon RDS Multi-AZ is designed for database workloads, not for SAP central services (ASCS), which are application-layer services that require shared file systems and cluster-aware failover. Option D is wrong because running ASCS on a single EC2 instance in a single Availability Zone provides no high availability or automatic failover, violating the requirement for automatic failover.

Full explanation →
782
Multi-Selecteasy

A company is migrating an SAP HANA database to AWS. Which TWO of the following are valid options for running SAP HANA on AWS? (Choose 2)

Select 2 answers
A.Amazon RDS for SAP HANA
B.Amazon EC2 instances with Amazon EBS storage
C.AWS Lambda
D.AWS Fargate
E.AWS HANA Large Instances (bare metal)
AnswersB, E

EC2 with EBS is a common deployment option.

Why this answer

SAP HANA can run on EC2 instances with EBS or on AWS HANA Large Instances. RDS for SAP HANA is not available. Lightsail is not suitable for HANA.

Fargate is for containers.

Full explanation →
783
MCQeasy

A company has deployed SAP S/4HANA on AWS using a single EC2 instance for the HANA database. The database volume is an EBS io1 volume with 5,000 provisioned IOPS. The company wants to implement a high availability (HA) solution for the database using SAP HANA System Replication (HSR) with automatic failover. They plan to use a second EC2 instance in a different Availability Zone. The database administrator is concerned about data consistency during replication. Which additional AWS service should be used to ensure data consistency and minimize data loss during failover?

A.AWS Backup to schedule backups of the HANA database.
B.AWS Database Migration Service (DMS) to continuously replicate data.
C.Amazon EBS snapshots to capture point-in-time copies of the data volume.
D.Amazon Route53 with health checks to automatically redirect traffic to the standby instance.
AnswerD

Route53 can provide DNS failover with health checks.

Why this answer

Amazon Route53 with health checks can monitor the primary HANA instance and automatically update DNS to redirect traffic to the standby instance in a different Availability Zone during a failover. This ensures minimal disruption and data consistency with HSR. Option A (AWS Backup) is for scheduled backups, not real-time replication.

Option B (DMS) is designed for database migration, not for HANA HSR. Option C (EBS snapshots) provide point-in-time backups, not continuous replication to minimize data loss.

Full explanation →
784
MCQmedium

An organization runs SAP ERP on AWS with an SAP HANA database. The database is deployed on an EC2 instance with EBS storage. The company is planning to upgrade the HANA database from version 2.0 to 2.0 SPS 05. The upgrade process requires a system copy to a new instance. The company wants to minimize the downtime during the upgrade and ensure that the existing system remains available until the new system is ready. The current HANA instance has 1 TB of data. The company has a test environment that can be used for the upgrade. Which approach should the company take to minimize downtime?

A.Use SAP HANA Studio to export the production database to a file, import it into a new instance, and upgrade. Then redirect users to the new instance.
B.Perform the upgrade directly on the production HANA instance during a maintenance window.
C.Take a full backup of the production HANA database, restore it to a new instance, and perform the upgrade on the new instance. Then switch DNS to the new instance.
D.Set up SAP HANA System Replication from the production instance to a new instance. Perform the upgrade on the replica. Once upgraded, perform a takeover to make the new instance the primary.
AnswerD

Replication allows the production system to stay online; takeover is quick.

Why this answer

SAP HANA System Replication allows you to replicate data from the production instance to a new instance in near real-time. You can then perform the upgrade on the replica while the production system remains fully available. Once the upgrade is complete and validated, a takeover operation promotes the replica to primary, minimizing downtime to just the seconds required for the takeover and DNS switch.

Exam trap

The trap here is that candidates often choose Option C (backup and restore) because it seems straightforward, but they overlook that it does not keep the new instance synchronized with ongoing production changes, resulting in longer downtime than the replication-based approach.

How to eliminate wrong answers

Option A is wrong because exporting and importing 1 TB of data via SAP HANA Studio is a slow, manual process that would cause significant downtime, not minimize it. Option B is wrong because performing the upgrade directly on the production HANA instance would require taking the system offline for the entire upgrade duration, resulting in unacceptable downtime. Option C is wrong because taking a full backup and restoring it to a new instance is time-consuming for 1 TB of data, and the restore process does not keep the new instance synchronized with ongoing changes, so the switchover would still require a final outage to apply any delta.

Full explanation →
785
Multi-Selectmedium

A company is planning to migrate a critical application to AWS using the 7 Rs migration strategy. The application is currently running on a large VMware VM. Which THREE strategies are appropriate for this migration? (Choose three.)

Select 3 answers
A.Rehost: Use AWS VM Import/Export to migrate the VM to EC2
B.Retire: Decommission the application as it is no longer needed
C.Refactor: Re-architect the application to use microservices
D.Replatform: Migrate to Amazon RDS for the database layer
E.Retain: Keep the application on-premises
AnswersA, C, D

Direct lift-and-shift of the VM.

Why this answer

Rehost (A) is appropriate because AWS VM Import/Export allows you to migrate VMware VMs directly to Amazon EC2 as AMIs, enabling a lift-and-shift migration with minimal changes. This is a core 7 Rs strategy for moving existing virtualized workloads to AWS.

Exam trap

The trap here is that candidates may confuse Retire with decommissioning an application that is still needed, or assume Retain is a valid migration strategy when the requirement is to move to AWS.

Full explanation →
786
MCQeasy

A company is designing an SAP HANA disaster recovery (DR) solution on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The RPO must be less than 15 minutes, and the RTO must be less than 2 hours. Which replication strategy meets these requirements?

A.SAP HANA log shipping to an S3 bucket in the DR region.
B.S3 cross-region replication for HANA data files.
C.SAP HANA system replication with synchronous mode and pre-provisioned DR instances.
D.EBS snapshot replication to the DR region every 15 minutes.
AnswerC

Synchronous replication meets RPO; pre-provisioned instances reduce RTO.

Why this answer

SAP HANA system replication with synchronous mode ensures that every committed transaction is replicated to the DR site before acknowledgment, meeting the <15-minute RPO. Pre-provisioned DR instances in us-west-2 allow rapid failover, enabling the <2-hour RTO by eliminating the need to provision infrastructure during recovery.

Exam trap

The PAS-C01 exam often tests the misconception that any replication method with a 15-minute interval (like EBS snapshots or S3 replication) automatically meets a <15-minute RPO, ignoring the time required for snapshot finalization, transfer, and restoration, which pushes the actual RPO beyond the requirement.

How to eliminate wrong answers

Option A is wrong because SAP HANA log shipping to an S3 bucket in the DR region introduces significant latency and does not provide automatic failover, making it impossible to achieve a <15-minute RPO and <2-hour RTO. Option B is wrong because S3 cross-region replication for HANA data files only replicates static files, not the live transaction logs or in-memory state, so it cannot meet the RPO requirement and does not support database-level recovery. Option D is wrong because EBS snapshot replication to the DR region every 15 minutes can only achieve at best a 15-minute RPO (and often longer due to snapshot finalization), and restoring from snapshots requires manual steps that exceed the 2-hour RTO.

Full explanation →
787
MCQmedium

During an SAP system migration to AWS, the team needs to ensure that the SAP application can automatically restart if the EC2 instance fails. Which combination of AWS services should they use?

A.AWS Elastic Beanstalk and Amazon RDS
B.Amazon EC2 Auto Scaling and Amazon CloudWatch
C.AWS Lambda and Amazon SQS
D.Amazon Route 53 and Elastic Load Balancing
AnswerB

Auto Scaling replaces unhealthy instances, and CloudWatch alarms can initiate recovery actions.

Why this answer

Amazon EC2 Auto Scaling can automatically replace a failed EC2 instance by launching a new one, while Amazon CloudWatch can monitor instance health and trigger the Auto Scaling recovery process. Together, they ensure the SAP application restarts on a healthy instance without manual intervention, meeting the high-availability requirement for SAP workloads.

Exam trap

The trap here is that candidates often confuse Elastic Load Balancing or Route 53 for instance recovery, but they only handle traffic distribution and DNS, not automatic instance replacement or restart.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Beanstalk is a PaaS service for web applications, not designed for SAP migrations, and Amazon RDS does not manage EC2 instance recovery for SAP applications. Option C is wrong because AWS Lambda is for serverless compute and Amazon SQS is a message queue; neither provides automatic EC2 instance restart or health monitoring for SAP. Option D is wrong because Amazon Route 53 is a DNS service and Elastic Load Balancing distributes traffic; they do not automatically restart failed EC2 instances or replace them.

Full explanation →
788
MCQmedium

An SAP system on AWS is experiencing performance issues. The system uses a shared file system (SAP transport directory) mounted from an NFS server. During migration, the team wants to improve performance and reduce complexity. Which AWS service should replace the NFS server?

A.Amazon S3 with S3FS
B.Amazon FSx for Windows File Server
C.AWS Storage Gateway (file gateway)
D.Amazon EFS
AnswerD

EFS provides a scalable, managed NFS file system that is ideal for SAP transport directories.

Why this answer

Amazon EFS provides a fully managed NFS file system that can be shared across multiple EC2 instances, making it an ideal replacement for the NFS server in SAP transport directory scenarios. Option A (Amazon S3 with S3FS) is incorrect because S3 is object storage and S3FS is a FUSE-based tool that adds complexity and can cause performance issues, not suitable for SAP transport. Option B (Amazon FSx for Windows File Server) is incorrect because it uses SMB protocol, while SAP transport directories typically require NFS and run on Linux instances.

Option C (AWS Storage Gateway file gateway) adds unnecessary complexity as it is designed for hybrid storage and caching, not as a direct NFS replacement for this use case.

Full explanation →
789
MCQmedium

Refer to the exhibit. An SAP administrator is creating an IAM policy for launching EC2 instances. Which instance type will the policy allow?

A.r5.16xlarge
B.r5.xlarge
C.r5.2xlarge
D.r5.4xlarge and r5.8xlarge
AnswerD

These are the only instance types allowed by the condition.

Why this answer

The IAM policy allows ec2:RunInstances with a condition that restricts instance types to those matching 'r5.4xlarge' or 'r5.8xlarge' via a ForAllValues:StringEquals condition on ec2:InstanceType. Since the condition uses a wildcard-free list, only the explicitly listed instance types are permitted. Options A, B, and C are not in the list, so they are denied.

Exam trap

The trap here is that candidates may think the condition allows a range of instance sizes (e.g., all r5 variants) due to the 'ForAllValues' wording, but it actually performs an exact match against the listed types, so only r5.4xlarge and r5.8xlarge are permitted.

How to eliminate wrong answers

Option A is wrong because r5.16xlarge is not listed in the ec2:InstanceType condition values, so the policy denies it. Option B is wrong because r5.xlarge is not included in the allowed list, and the condition explicitly requires a match to 'r5.4xlarge' or 'r5.8xlarge'. Option C is wrong because r5.2xlarge is not among the permitted instance types, and the ForAllValues:StringEquals condition ensures only the specified types are allowed.

Full explanation →
790
MCQeasy

An SAP administrator is reviewing a CloudFormation template snippet shown in the exhibit. The template creates an EC2 instance for SAP. What is missing from the template to ensure the instance is placed in a specific subnet?

A.The SubnetId property is not specified in the NetworkInterface
B.The InstanceType is not suitable for SAP
C.The ImageId is invalid
D.The SecurityGroup reference is missing
AnswerA

SubnetId is required to place the instance in a subnet.

Why this answer

The CloudFormation template snippet shows a NetworkInterface property being used to attach the EC2 instance to a VPC network. When you specify a NetworkInterface, you must include the SubnetId within that interface definition to place the instance in a specific subnet. Without SubnetId, the instance will be launched into the default subnet of the default VPC, which may not be the intended subnet for SAP workloads requiring specific network segmentation or latency constraints.

Exam trap

The trap here is that candidates often assume the SubnetId can be specified at the instance level even when using NetworkInterface, but AWS CloudFormation requires SubnetId to be defined inside the NetworkInterface when that property is present, and omitting it causes the instance to launch in the default subnet rather than failing with a clear error.

How to eliminate wrong answers

Option B is wrong because the InstanceType being suitable for SAP is a separate concern from subnet placement; the template snippet does not show the InstanceType value, and the question specifically asks about ensuring placement in a specific subnet, not instance sizing. Option C is wrong because the ImageId validity is unrelated to subnet placement; an invalid ImageId would cause a launch failure, but the question focuses on the missing subnet specification. Option D is wrong because the SecurityGroup reference is not required for subnet placement; security groups can be associated at the network interface level or instance level, but their presence or absence does not determine which subnet the instance is placed in.

Full explanation →
791
MCQhard

An SAP administrator is setting up an S3 bucket to store SAP HANA backup files. The backups must be encrypted at rest using an AWS KMS customer managed key. Which bucket policy condition key should be used to enforce that only requests using KMS encryption with that specific key are allowed?

A.kms:EncryptionContext
B.s3:x-amz-server-side-encryption-aws-kms-key-id
C.s3:ServerSideEncryption
D.s3:x-amz-server-side-encryption
AnswerB

This condition key checks the specific KMS key ID used for encryption.

Why this answer

The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that only requests using a specific AWS KMS customer managed key for server-side encryption are permitted. This key is evaluated against the `x-amz-server-side-encryption-aws-kms-key-id` header in the request, ensuring that backups are encrypted with the exact KMS key ID specified in the bucket policy.

Exam trap

The trap here is that candidates confuse the condition key that checks for any KMS encryption (`s3:x-amz-server-side-encryption`) with the one that enforces a specific KMS key ID (`s3:x-amz-server-side-encryption-aws-kms-key-id`), leading them to select option D instead of B.

How to eliminate wrong answers

Option A is wrong because `kms:EncryptionContext` is a KMS condition key used to control access based on encryption context in KMS API calls, not to enforce the specific KMS key ID in S3 bucket policies. Option C is wrong because `s3:ServerSideEncryption` is not a valid AWS condition key; the correct prefix for S3 condition keys is `s3:x-amz-*`. Option D is wrong because `s3:x-amz-server-side-encryption` only checks whether server-side encryption is enabled (e.g., AES256 or aws:kms), but does not enforce the use of a specific KMS customer managed key ID.

Full explanation →
792
MCQhard

A company is using AWS Database Migration Service (DMS) to migrate an SAP HANA database from on-premises to Amazon RDS for SAP HANA. The migration task fails with the error shown. Which step should the administrator take to resolve this?

A.Change the source database character set to ISO-8859-1.
B.Modify the DMS task to include character set conversion settings.
C.Create a new RDS instance with the correct character set.
D.Use AWS Server Migration Service (SMS) instead of DMS.
AnswerB

DMS supports character set conversion.

Why this answer

The error indicates a character set mismatch between the source and target databases. AWS DMS can handle character set conversion if configured correctly. By modifying the DMS task to include character set conversion settings, the administrator can resolve the mismatch without altering the source or creating a new instance.

Option A is incorrect because changing the source database character set is unnecessary and could impact other applications. Option C is incorrect because creating a new RDS instance is overkill; the issue lies in the DMS task configuration. Option D is incorrect because AWS Server Migration Service (SMS) is for server-level migration, not database migration.

Full explanation →
793
MCQeasy

An SAP administrator wants to attach the EBS volume shown above to two EC2 instances running SAP HANA in a scale-out configuration. What is the issue?

A.The volume is gp3 type, which does not support Multi-Attach.
B.The volume size is too small for HANA scale-out.
C.SAP HANA scale-out does not support shared volumes.
D.The volume IOPS is insufficient.
AnswerA

Multi-Attach is only available on io1 and io2 volumes.

Why this answer

The gp3 volume type does not support the Multi-Attach feature, which is required to attach a single EBS volume to multiple EC2 instances simultaneously. For SAP HANA scale-out configurations, shared storage is necessary for the /hana/shared file system, and Multi-Attach is only supported on io1 and io2 block express volumes. Therefore, using a gp3 volume prevents the multi-attach capability needed for this architecture.

Exam trap

The trap here is that candidates assume gp3 is a general-purpose volume that supports all features, but AWS explicitly restricts Multi-Attach to io1 and io2 block express only, making this a common pitfall in SAP workload design questions.

How to eliminate wrong answers

Option B is wrong because the volume size (e.g., 1 TiB) is actually sufficient for SAP HANA scale-out; the issue is not size but the volume type's lack of Multi-Attach support. Option C is wrong because SAP HANA scale-out does support shared volumes (specifically for /hana/shared), and this is a documented requirement for scale-out deployments on AWS. Option D is wrong because IOPS is not the limiting factor; gp3 volumes can provision adequate IOPS, but they still cannot be attached to multiple instances due to the absence of Multi-Attach.

Full explanation →
794
MCQmedium

A company has a CloudFormation stack that creates an EC2 instance with a custom AMI. The stack fails with the error 'Resource creation cancelled' during creation. The engineer checks the stack events and sees that the EC2 instance creation succeeded, but the subsequent creation of an EBS volume failed. What is the MOST likely reason for the failure?

A.The EC2 instance creation failed and then was cancelled
B.The EC2 instance had a DeletionPolicy of Retain, which prevented rollback
C.The EBS volume creation failed, causing the stack to roll back and cancel the instance
D.The EC2 instance depended on the EBS volume, and the dependency caused a timeout
AnswerC

If a subsequent resource fails, CloudFormation cancels previously created resources during rollback.

Why this answer

When an EBS volume creation fails in a CloudFormation stack, the stack initiates a rollback of all previously created resources, including the EC2 instance. The 'Resource creation cancelled' error appears for the EC2 instance because its creation was successful but then undone during the rollback, not because it failed initially.

Exam trap

The trap here is that candidates misinterpret 'Resource creation cancelled' as a creation failure of the EC2 instance itself, rather than understanding it is a rollback cancellation of a previously successful resource.

How to eliminate wrong answers

Option A is wrong because the stack events explicitly show the EC2 instance creation succeeded, so the failure is not due to the instance itself. Option B is wrong because a DeletionPolicy of Retain only affects resource deletion during stack deletion, not rollback; during rollback, CloudFormation still terminates the instance regardless of the DeletionPolicy. Option D is wrong because the EC2 instance does not depend on the EBS volume in this scenario; the EBS volume is created after the instance, and a dependency would cause the instance to wait for the volume, not cancel the instance.

Full explanation →
795
MCQeasy

An SAP HANA database is running on an EC2 instance with EBS volumes. The operations team needs to take nightly backups of the database. Which AWS service provides the most cost-effective backup solution for long-term retention?

A.Amazon S3 Glacier Deep Archive
B.Amazon EBS Snapshots
C.Amazon S3 Standard
D.AWS Backup
AnswerA

Glacier Deep Archive is the lowest cost storage for long-term backups.

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for long-term retention of backups that are accessed infrequently. Amazon EBS Snapshots are stored in S3 but cost more for long-term retention. AWS Backup is a service but does not change storage class.

Amazon S3 Standard is expensive for long-term.

Full explanation →
796
MCQhard

A company is migrating a large SAP landscape to AWS. The migration plan includes using AWS CloudEndure Migration for the application servers. However, the SAP database requires a different approach. Which database migration method is recommended for an SAP HANA database?

A.Use AWS Schema Conversion Tool (SCT) to convert the HANA schema.
B.Use AWS CloudEndure Migration for both application and database servers.
C.Use AWS DMS with Oracle as a source and HANA as target.
D.Use SAP HANA System Replication (HSR).
AnswerD

HSR is the native HANA replication method.

Why this answer

The recommended method for migrating an SAP HANA database is SAP HANA System Replication (HSR). HSR provides a database-aware, block-level replication with near-zero downtime, making it ideal for SAP HANA migrations. Option A is incorrect because AWS Schema Conversion Tool (SCT) is used for converting schemas between different database engines (e.g., Oracle to Amazon RDS), not for HANA-to-HANA migration.

Option B is incorrect because AWS CloudEndure Migration performs host-level replication and lacks database consistency features required for SAP HANA. Option C is incorrect because AWS DMS does not support SAP HANA as a target database; it is used for heterogeneous migrations to AWS database services.

Full explanation →
797
MCQmedium

An SAP administrator needs to monitor the disk I/O performance of EBS volumes attached to an SAP HANA instance. Which AWS service should be used to capture the average read latency and queue depth metrics?

A.AWS Config
B.AWS Health
C.Amazon CloudWatch
D.AWS CloudTrail
AnswerC

CloudWatch collects and provides metrics like AverageReadLatency and QueueDepth for EBS volumes.

Why this answer

Amazon CloudWatch provides the metrics necessary to monitor disk I/O performance, including `VolumeReadOps`, `VolumeQueueLength`, and `VolumeReadBytes` for EBS volumes. These metrics allow you to calculate average read latency (by dividing `VolumeReadBytes` by `VolumeReadOps`) and directly observe queue depth via `VolumeQueueLength`, making it the correct service for SAP HANA disk I/O monitoring.

Exam trap

The trap here is that candidates may confuse AWS CloudTrail (which logs API calls) with CloudWatch (which monitors performance metrics), or assume AWS Config or AWS Health provide operational performance data when they are designed for configuration auditing and service health notifications, respectively.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating, auditing, and recording configuration changes of AWS resources, not for capturing real-time performance metrics like disk latency or queue depth. Option B is wrong because AWS Health provides information about service health and events affecting your AWS infrastructure, but it does not expose granular EBS performance metrics. Option D is wrong because AWS CloudTrail records API activity and user actions for auditing and governance, not operational metrics such as I/O latency or queue depth.

Full explanation →
798
MCQmedium

An organization is migrating their SAP ERP system to AWS and needs to set up a disaster recovery (DR) site in another AWS region. They want to use AWS Elastic Disaster Recovery (DRS) for SAP HANA. The source HANA system is running on-premises on a physical server. They have installed the DRS agent on the source server. During the initial replication, they notice that the data transfer is very slow. What should they do to improve replication speed?

A.Switch to asynchronous replication mode
B.Use Amazon RDS for HANA as the DR target instead of EC2
C.Increase the size of the staging area subnet
D.Increase the number of concurrent data streams in the DRS agent configuration
AnswerD

More streams can utilize available bandwidth better.

Why this answer

AWS Elastic Disaster Recovery (DRS) allows configuring multiple concurrent data streams to increase network throughput and improve replication speed. Option A is incorrect because DRS already uses asynchronous replication by default; switching to asynchronous does not change the current mode. Option B is incorrect because Amazon RDS for HANA is a managed database service, not a DR target for DRS; DRS replicates to EC2 instances.

Option C is incorrect because the staging area subnet size affects storage capacity, not replication speed.

Full explanation →
799
MCQeasy

A company wants to automate the backup of their SAP HANA database running on an EC2 instance. The backup should be stored in Amazon S3 and retained for 30 days. Which AWS service can be used to schedule and manage these backups?

A.AWS Lambda
B.Amazon S3 Lifecycle policies
C.AWS Storage Gateway
D.AWS Backup
AnswerD

AWS Backup automates backups and can store in S3.

Why this answer

AWS Backup. AWS Backup is a fully managed backup service that can be used to automate backups of EC2 instances, including SAP HANA databases, and store backups in Amazon S3. It allows scheduling and retention policies.

Option A (AWS Lambda) can be used but requires custom code and is not the primary service for managing backups. Option B (Amazon S3 Lifecycle policies) manages object lifecycle transitions and deletions, not scheduling backups. Option C (AWS Storage Gateway) provides hybrid storage connectivity, not backup scheduling.

Full explanation →
800
Multi-Selecthard

A company is migrating a legacy application to AWS. The application requires a static IP address that does not change during instance stop/start. The application also needs to be highly available across two Availability Zones. Which THREE actions should the company take to meet these requirements?

Select 3 answers
A.Use a Network Load Balancer with an Elastic IP address
B.Allocate an Elastic IP address and associate it with the primary instance
C.Place the instances in a placement group to ensure high availability
D.Configure an Auto Scaling group across two Availability Zones
E.Use an Application Load Balancer to distribute traffic to the instances
AnswersA, B, D

NLB supports static IP via EIP and is highly available across AZs.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses by allowing you to associate an Elastic IP address with each of its Availability Zone subnets. This provides a fixed entry point that does not change when backend instances are stopped or started, meeting the requirement for a static IP. Combined with an Auto Scaling group spanning two Availability Zones, the NLB ensures high availability by distributing traffic across healthy instances in both zones.

Exam trap

The trap here is that candidates often confuse the static IP capability of a Network Load Balancer with the DNS-based routing of an Application Load Balancer, or mistakenly think that a single Elastic IP on an instance provides high availability across zones.

Full explanation →
801
MCQeasy

A company has an SAP HANA database running on an EC2 instance with a single 500 GB gp2 volume. The database is experiencing I/O bottlenecks. The operations team wants to increase IOPS without changing the volume size. Which action should they take?

A.Enable EBS optimization on the EC2 instance.
B.Change the volume type to st1 (throughput optimized).
C.Modify the volume to increase its size to 1,000 GB.
D.Attach an additional gp2 volume and use it for temporary data.
AnswerD

Attaching an additional gp2 volume for temporary data offloads I/O from the primary volume, increasing effective IOPS without altering the original volume size. This is a common technique to alleviate I/O bottlenecks.

Why this answer

Attaching an additional gp2 volume and moving temporary data to it offloads I/O from the primary HANA data volume, effectively increasing the total IOPS available to the database without changing the size of the original volume. This reduces the I/O bottleneck and improves performance.

Option A (EBS optimization) improves network bandwidth but does not increase the volume's IOPS.

Option B (st1) is throughput-optimized and unsuitable for low-latency database workloads like SAP HANA.

Option C (increasing volume size) directly violates the requirement of not changing the volume size.

Full explanation →
802
Multi-Selectmedium

A company is designing a disaster recovery plan for SAP S/4HANA on AWS. The plan must have a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. Which solutions can meet these requirements? (Choose TWO.)

Select 2 answers
A.Multi-AZ deployment of SAP HANA within the same region
B.SAP HANA log shipping to Amazon S3 every 15 minutes and restore in another region
C.Cross-Region Amazon S3 backup and restore using AWS Backup
D.Synchronous storage-level replication using EBS snapshots every 15 minutes and automated restore
E.SAP HANA system replication to a secondary region with automatic failover
AnswersB, E

Correct. SAP HANA log shipping to Amazon S3 every 15 minutes can achieve the RPO of 15 minutes. With automated restore and pre-provisioned infrastructure, RTO of 2 hours is feasible.

Why this answer

SAP HANA log shipping to Amazon S3 every 15 minutes can achieve an RPO of 15 minutes by shipping transaction logs at that interval. RTO of 2 hours is achievable if the restore process is automated and tested. Option E: SAP HANA system replication to a secondary region with automatic failover provides near-zero RPO (seconds) and RTO in minutes, clearly meeting the requirements.

Option D is incorrect because EBS snapshots are asynchronous and not a replication mechanism; they may not guarantee an RPO of 15 minutes due to snapshot scheduling delays, and restore times can exceed 2 hours, especially for large databases.

Full explanation →
803
MCQhard

A company is using SAP HANA on AWS and needs to back up the database to Amazon S3. The backup must be encrypted at rest in S3. The company already uses AWS KMS for encryption. What is the MOST secure way to configure the backup?

A.Use SSE-KMS with a customer managed key and restrict key usage with key policies.
B.Use client-side encryption before uploading to S3.
C.Enable default S3 encryption with SSE-S3.
D.Use SSE-KMS with the AWS managed key for S3.
AnswerA

Provides control and integration with existing KMS.

Why this answer

Using SSE-KMS with a customer managed key allows you to enforce granular key policies, including restricting key usage to specific IAM roles or conditions, and enables audit trails via AWS CloudTrail. This provides the highest level of control and security for encrypting SAP HANA backups at rest in S3, meeting the requirement for the most secure configuration.

Exam trap

The trap here is that candidates often assume the AWS managed key for S3 (aws/s3) is sufficient for encryption, but the question explicitly asks for the 'most secure' way, which requires customer managed keys with restrictive key policies to meet compliance and audit requirements.

How to eliminate wrong answers

Option B is wrong because client-side encryption would require the SAP HANA backup process to handle encryption before upload, adding complexity and potential key management overhead, and it does not leverage the existing AWS KMS infrastructure the company already uses. Option C is wrong because SSE-S3 uses AWS-managed keys with no ability to control key policies, rotation, or access restrictions, offering less security and auditability compared to customer managed keys. Option D is wrong because the AWS managed key for S3 (aws/s3) does not allow you to restrict key usage with custom key policies; it is shared across accounts and lacks the granular control needed for the most secure configuration.

Full explanation →
804
MCQhard

During the migration of an SAP ERP system to AWS, the SAP application team reports that after migrating the database to Amazon RDS for SAP HANA, batch jobs that previously ran in 2 hours now take 5 hours. The system uses AWS Direct Connect with adequate bandwidth. Which action is most likely to resolve this performance issue?

A.Enable Multi-AZ deployment for RDS.
B.Increase the RDS instance size and storage IOPS.
C.Reduce the automated backup retention period.
D.Increase the Direct Connect bandwidth.
AnswerB

Larger instance provides more CPU and memory for HANA.

Why this answer

The performance degradation is likely due to insufficient compute or IOPS capacity on the RDS instance compared to the original on-premises HANA system. Increasing the instance size (more vCPUs and memory) and storage IOPS directly addresses the bottleneck. Multi-AZ (Option A) provides high availability but does not improve performance.

Reducing backup retention (Option C) has no impact on query execution. Since Direct Connect bandwidth is adequate (Option D), increasing it would not help. Therefore, Option B is the most effective action.

Full explanation →
805
MCQhard

A company runs SAP BusinessObjects on AWS using multiple EC2 instances. The system uses a shared file system (EFS) for the repository and output files. Recently, users have reported that generating large reports takes much longer than usual. The SAP administrator checks the EFS metrics in CloudWatch and sees that the BurstCreditBalance is consistently near zero. The EFS file system is in General Purpose mode with default throughput settings. The current size of the file system is 500 GB. What should the administrator do to improve performance?

A.Migrate the EFS file system to EFS One Zone for better performance.
B.Enable Max I/O throughput mode on the EFS file system.
C.Switch to Provisioned Throughput mode and set a higher value.
D.Increase the size of the EFS file system by adding more data to it.
AnswerC

Correct. Provisioned Throughput mode allows setting a specific throughput value, ensuring consistent performance without relying on burst credits.

Why this answer

With BurstCreditBalance consistently near zero, the EFS file system has exhausted its burst credits. For SAP workloads that require consistent throughput and have high I/O demands, AWS recommends using Provisioned Throughput mode to ensure predictable performance. This allows the administrator to specify a higher throughput value independent of the file system size, which resolves the performance issue for large report generation.

Option B is incorrect because enabling Max I/O mode changes the performance mode, not the throughput mode. Max I/O is designed for workloads with high concurrency and does not guarantee consistent throughput; it may not provide the stable performance needed for SAP. Option A is incorrect because EFS One Zone is for cost savings in a single AZ and does not improve throughput.

Option D is incorrect because while adding data increases baseline throughput slightly, it is not an efficient or practical solution and may not provide sufficient throughput.

Exam trap

A common mistake is to assume that Max I/O mode (option B) solves burst credit exhaustion because it provides higher burst throughput. However, Max I/O is a performance mode that optimizes for high concurrency, not sustained throughput. For SAP workloads, Provisioned Throughput (option C) is the recommended solution to ensure consistent performance.

Full explanation →
806
MCQmedium

A company runs SAP BusinessObjects on AWS and needs to scale the application tier based on CPU utilization. Which AWS service should be used to automatically add or remove EC2 instances?

A.AWS Elastic Load Balancing
B.AWS Lambda
C.AWS Auto Scaling
D.AWS CloudFormation
AnswerC

Auto Scaling can adjust instance count based on CPU metrics.

Why this answer

AWS Auto Scaling can automatically adjust the number of EC2 instances based on CloudWatch alarms for CPU utilization. AWS Elastic Load Balancing distributes traffic but does not scale instances. AWS Lambda is for serverless, not EC2 scaling.

AWS CloudFormation is for infrastructure provisioning, not auto-scaling.

Full explanation →
807
MCQmedium

A company is designing an SAP HANA multi-node scale-out deployment on AWS. The system requires high bandwidth and low latency between nodes. Which AWS networking feature should be used to meet these requirements?

A.Elastic Fabric Adapter (EFA)
B.AWS Direct Connect
C.Transit Gateway
D.VPC Peering
AnswerA

EFA provides low-latency, high-bandwidth inter-instance communication required for HANA scale-out.

Why this answer

Elastic Fabric Adapter (EFA) is correct because it provides OS-bypass capabilities using the Libfabric API, enabling direct memory access (DMA) between SAP HANA nodes. This eliminates kernel overhead, delivering the high bandwidth (up to 100 Gbps per adapter) and ultra-low latency (microsecond-level) required for SAP HANA multi-node scale-out workloads, where inter-node communication is critical for table partitioning and data replication.

Exam trap

The trap here is that candidates confuse EFA with standard Elastic Network Adapters (ENA) or assume that any high-bandwidth network feature (like Direct Connect or Transit Gateway) can solve inter-node latency, when only EFA provides the OS-bypass and RDMA semantics required for SAP HANA scale-out performance.

How to eliminate wrong answers

Option B (AWS Direct Connect) is wrong because it is a dedicated network connection from on-premises to AWS, not an inter-node networking feature within a VPC; it does not reduce latency or increase bandwidth between SAP HANA compute nodes. Option C (Transit Gateway) is wrong because it is a hub-and-spoke router for connecting multiple VPCs and on-premises networks, not a high-performance, low-latency interconnect for tightly coupled compute nodes within the same VPC. Option D (VPC Peering) is wrong because it is a simple layer-3 connection between VPCs that still traverses the standard AWS network stack with kernel overhead, lacking the OS-bypass and RDMA capabilities needed for SAP HANA scale-out performance.

Full explanation →
808
MCQhard

A company runs its SAP S/4HANA system on AWS using a multi-node HANA scale-out configuration. After a recent OS update, the application layer cannot connect to the HANA database. The HANA database processes are running, but the SAP application servers report 'communication failure' errors. Initial checks show that the security group rules allow traffic on the required ports. What is the MOST likely cause of the issue?

A.The DNS resolution is misconfigured after the OS update, causing hostname lookup failures.
B.The NTP synchronization is off, causing time drift and authentication errors.
C.The OS update has reset the iptables firewall rules, blocking internal HANA ports.
D.The SAP system is not correctly licensed for the new OS version.
AnswerC

OS updates can clear iptables rules, blocking required ports even if security groups allow traffic.

Why this answer

OS updates on Linux systems often reset or flush iptables firewall rules to their default state, which typically blocks all inbound traffic on non-essential ports. In a multi-node HANA scale-out configuration, internal HANA communication relies on specific TCP ports (e.g., 3xx01–3xx10 for internal network traffic). When iptables rules are reset, these ports become blocked, preventing the SAP application layer from connecting to the HANA database even though the database processes are running and security group rules at the AWS level are correctly configured.

Exam trap

The trap here is that candidates often focus on AWS-level security groups or DNS issues, overlooking the fact that OS-level firewalls (iptables) are reset during updates and can block internal HANA ports even when security groups are correctly configured.

How to eliminate wrong answers

Option A is wrong because DNS misconfiguration would cause hostname lookup failures, but the SAP application servers report 'communication failure' errors, not 'hostname resolution' errors; moreover, the HANA database processes are running and the issue appeared immediately after an OS update, not a DNS change. Option B is wrong because NTP synchronization issues causing time drift would lead to Kerberos or SSL/TLS authentication errors, not generic 'communication failure' errors, and HANA does not rely on NTP for internal node communication in a scale-out configuration. Option D is wrong because SAP licensing is not enforced at the OS level; licensing issues would prevent the SAP system from starting or cause license expiration warnings, not block network connectivity between the application layer and the database.

Full explanation →
809
Multi-Selecteasy

An organization runs SAP BusinessObjects on AWS and wants to improve the performance of report generation. The current environment uses EBS gp2 volumes. Which TWO changes could potentially reduce report generation time?

Select 2 answers
A.Increase the size of the EBS root volume.
B.Enable EBS optimization on the instance.
C.Configure automated snapshots of the EBS volumes.
D.Switch to EBS io2 Block Express volumes with higher IOPS.
E.Add more SAP BusinessObjects application servers to distribute the workload.
AnswersD, E

Higher IOPS improves data access speed.

Why this answer

Switching to EBS io2 Block Express volumes provides higher IOPS and lower latency compared to gp2 volumes, which directly improves the I/O performance for SAP BusinessObjects report generation that often involves heavy database and file system reads. Option E is correct because adding more SAP BusinessObjects application servers distributes the report generation workload across multiple nodes, reducing the processing bottleneck on a single server and decreasing overall generation time.

Exam trap

The trap here is that candidates often confuse EBS optimization (a prerequisite for dedicated bandwidth) with a performance-tuning feature, or assume that increasing volume size (Option A) is a valid performance improvement method, when in fact switching to a higher-performance volume type like io2 Block Express is the correct storage-level optimization.

Full explanation →
810
MCQmedium

A company is deploying SAP on AWS and wants to ensure that the SAP system can automatically recover from an EC2 instance failure. Which AWS feature should be used?

A.Auto Scaling group with a scheduled scaling policy
B.Elastic Load Balancer health checks
C.EC2 Auto Recovery with CloudWatch alarms
D.Manual restart of the instance from the AWS Management Console
AnswerC

Auto Recovery automatically recovers the instance.

Why this answer

EC2 Auto Recovery, configured via a CloudWatch alarm based on the StatusCheckFailed metric, automatically recovers an EC2 instance by restarting it on a new host if the underlying hardware fails or becomes impaired. This is the correct AWS feature for automatic recovery from an EC2 instance failure, as it directly addresses instance-level hardware issues without requiring manual intervention or reconfiguration.

Exam trap

The trap here is that candidates often confuse Elastic Load Balancer health checks with instance recovery, but ELB only manages traffic distribution and does not perform any recovery action on the instance itself.

How to eliminate wrong answers

Option A is wrong because an Auto Scaling group with a scheduled scaling policy is designed for predictable scaling based on time, not for automatic recovery from an EC2 instance failure; it does not react to instance health status. Option B is wrong because Elastic Load Balancer health checks only detect and route traffic away from unhealthy instances, but they do not recover or restart the failed instance itself. Option D is wrong because a manual restart from the AWS Management Console requires human intervention and does not provide automatic recovery, which is the key requirement in the question.

Full explanation →
811
MCQeasy

During an SAP migration, the team needs to transfer a large number of small files (SAP transport requests) from on-premises to AWS. Which AWS service is most cost-effective for this transfer?

A.AWS Transfer Family (SFTP)
B.AWS Snowmobile
C.AWS DataSync
D.AWS Snowcone
AnswerC

AWS DataSync is optimized for efficient transfer of millions of small files using parallel network transfers and is cost-effective for most volumes, making it the best choice here.

Why this answer

AWS DataSync is optimized for efficiently transferring millions of small files, such as SAP transport requests, over the network, and is cost-effective for most data volumes without network constraints. It uses parallel threading and metadata handling to accelerate small-file transfers. In contrast, option D (AWS Snowcone) incurs shipping costs and device rental fees, making it less cost-effective for this type of transfer.

Full explanation →
812
MCQmedium

An SAP administrator is setting up an SAP HANA system replication across two AWS Availability Zones (AZs). The primary and secondary instances use EBS volumes for data and log storage. What is the best practice for ensuring data consistency and minimizing data loss during a failover?

A.Take frequent EBS snapshots of the primary volume and restore them on the secondary.
B.Enable synchronous replication mode in SAP HANA.
C.Use asynchronous replication mode for better performance.
D.Configure the EBS volumes as Multi-Attach to allow both instances to access the same volume.
AnswerB

Synchronous replication ensures data consistency and minimal data loss.

Why this answer

SAP HANA synchronous replication mode ensures that a transaction is committed on both the primary and secondary instances before an acknowledgment is sent to the application. This guarantees zero data loss (RPO=0) during a failover, because the secondary always has an identical copy of the committed data. For cross-AZ deployments, this is the best practice to maintain data consistency while still providing high availability.

Exam trap

The trap here is that candidates often choose asynchronous replication (Option C) because they mistakenly prioritize performance over data consistency, failing to recognize that SAP HANA synchronous replication is the only mode that guarantees zero data loss across AZs in a system replication configuration.

How to eliminate wrong answers

Option A is wrong because EBS snapshots are point-in-time backups, not real-time replication; they introduce significant lag and cannot guarantee data consistency at the moment of failover, leading to potential data loss. Option C is wrong because asynchronous replication, while offering better performance, allows the secondary to lag behind the primary, which can result in data loss (RPO > 0) during a failover. Option D is wrong because EBS Multi-Attach does not support attaching a single volume to instances in different Availability Zones, and it does not provide the log-shipping or synchronization logic required for SAP HANA system replication.

Full explanation →
813
MCQmedium

A company is migrating its SAP Business Warehouse (BW) system from on-premises to AWS. The system uses IBM DB2 as the database and is 2 TB in size. The company wants to use the SAP BW/4HANA version on AWS. The migration must be completed within a 72-hour window. The company has a 1 Gbps AWS Direct Connect connection. The migration team decides to use the SAP Software Update Manager (SUM) with the Database Migration Option (DMO) to migrate and upgrade to BW/4HANA. During the migration, they encounter an error that the source DB2 database has a tablespace that uses automatic storage and is larger than 2 TB. The SUM DMO tool stops with an error indicating insufficient space in the target SAP HANA database. The target SAP HANA system is provisioned with 1 TB of memory and 2 TB of disk storage. The team needs to proceed with the migration. Which action should the team take to resolve this issue?

A.Use AWS Database Migration Service (AWS DMS) to migrate the data directly to SAP HANA, bypassing SUM DMO.
B.Increase the disk storage of the SAP HANA instance to at least 2.5 TB to accommodate the migrated data.
C.Compress the DB2 database on the source side to reduce its size before migration.
D.Split the migration into two phases: migrate the data using AWS DMS first, then use SUM for the upgrade.
AnswerB

Increasing disk storage provides the necessary space for the migration.

Why this answer

The error occurs because the source DB2 database's tablespace using automatic storage exceeds the target SAP HANA's disk capacity of 2 TB. The SUM DMO tool requires enough space to store the migrated data during the conversion process. Increasing the disk storage of the SAP HANA instance to at least 2.5 TB (or larger to accommodate the full 2 TB source plus overhead) resolves the space issue and allows the migration to proceed.

Option A is incorrect because AWS DMS does not support SAP HANA as a target for direct migration. Option C is incorrect because DB2 compression reduces storage but does not address the automatic storage tablespace size limitation that causes the SUM error. Option D is incorrect because splitting the migration into DMS and SUM phases is not supported for DB2 to HANA; SUM DMO is the recommended tool for this combined migration and upgrade.

Full explanation →
814
Multi-Selectmedium

Which TWO actions are recommended to ensure high availability for SAP NetWeaver on AWS? (Choose 2).

Select 2 answers
A.Use an Application Load Balancer with health checks to distribute traffic.
B.Use a single Availability Zone to reduce latency.
C.Take frequent EBS snapshots to ensure data durability.
D.Deploy SAP application instances in different Availability Zones.
E.Use t2 instance types to reduce cost.
AnswersA, D

ALB with health checks can route traffic away from unhealthy instances.

Why this answer

To ensure high availability for SAP NetWeaver on AWS, it is recommended to use an Application Load Balancer (ALB) with health checks to distribute traffic (Option A). The ALB automatically reroutes traffic away from unhealthy instances, improving fault tolerance. Additionally, deploying SAP application instances in different Availability Zones (Option D) provides redundancy if an entire AZ fails, which is a core HA practice.

Option B is incorrect because a single Availability Zone introduces a single point of failure. Option C is incorrect: EBS snapshots provide data durability and backup, not high availability; they do not maintain service continuity. Option E is incorrect because t2 instances are burstable and not suitable for production SAP workloads due to performance limitations and lack of EBS-optimized support.

Full explanation →
815
MCQeasy

A company plans to migrate its SAP ERP system to AWS. The system currently runs on IBM Db2 and uses a large amount of memory. The architect needs to choose an EC2 instance type that is SAP certified and provides high memory. Which instance family should the architect select?

A.c5.18xlarge
B.x1e.32xlarge
C.r5.24xlarge
D.i3.16xlarge
AnswerB

x1e instances are SAP-certified with up to 3,904 GiB of memory, suitable for large SAP systems.

Why this answer

The x1e.32xlarge instance is SAP-certified for high-memory workloads and is specifically designed for large in-memory databases like IBM Db2. It offers up to 3,904 GiB of memory, making it suitable for SAP ERP systems that require a large memory footprint. Other instance families like C5, R5, and I3 are not SAP-certified for high-memory SAP workloads or lack the necessary memory capacity.

Exam trap

The trap here is that candidates often confuse memory-optimized families (like R5) with SAP-certified high-memory families (like X1e), not realizing that SAP certification requires specific instance types that have passed SAP's validation for large memory configurations and database compatibility.

How to eliminate wrong answers

Option A is wrong because the C5 instance family is compute-optimized and not SAP-certified for high-memory workloads; it lacks the memory capacity required for large SAP ERP systems on Db2. Option C is wrong because the R5 instance family is memory-optimized but not SAP-certified for the high-memory requirements of this scenario; it offers less memory per vCPU compared to the X1e family and is not listed in the SAP AWS certified instances for large memory configurations. Option D is wrong because the I3 instance family is storage-optimized for high I/O workloads (e.g., NVMe SSD) and is not designed for high-memory SAP applications; it is not SAP-certified for memory-intensive ERP systems.

Full explanation →
816
MCQmedium

A company runs SAP on AWS and wants to reduce costs for non-production environments that are used only during business hours (8 AM to 6 PM). Which action should the administrator take to minimize costs without losing data?

A.Convert the instances to Reserved Instances
B.Terminate the instances after business hours
C.Downsize the instance types to the smallest available
D.Stop the instances during non-business hours and use Amazon EBS snapshots for backup
AnswerD

Stopping instances preserves data on EBS volumes and eliminates compute charges while stopped. Using EBS snapshots provides additional backup and data protection.

Why this answer

Stopping instances when not in use eliminates compute costs while preserving data via Amazon EBS snapshots. Option A (Reserved Instances) is wrong because Reserved Instances are intended for steady-state usage and do not provide savings for intermittent usage; the idea of reducing instance size is not relevant to this option. Option B (Terminate) would lose data unless snapshots are taken, and the question specifies 'without losing data.' Option C (Downsize) could reduce costs but still incurs compute charges 24/7, whereas stopping completely eliminates compute costs during non-business hours.

Full explanation →
817
MCQmedium

A company runs a production application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. The operations team notices that during a recent deployment, a small percentage of instances failed health checks and were replaced, causing a brief increase in error rates. What is the MOST effective way to reduce deployment-related errors?

A.Use a lifecycle hook to delay instance registration until a script completes.
B.Increase the health check interval on the ALB to reduce rapid replacements.
C.Configure the Auto Scaling group with a warm-up time in the instance refresh settings.
D.Increase the desired capacity of the Auto Scaling group to absorb failures.
AnswerC

Warm-up time ensures new instances pass health checks before receiving traffic.

Why this answer

Configuring a warm-up time in the Auto Scaling group's instance refresh settings ensures that newly launched instances are fully initialized and pass health checks before they start receiving traffic. This prevents brief error spikes during deployments by allowing instances to stabilize before being marked as healthy and added to the ALB target group.

Exam trap

The trap here is that candidates often confuse lifecycle hooks (which handle initialization before registration) with warm-up times (which control the gradual introduction of traffic after registration), leading them to pick Option A instead of the correct C.

How to eliminate wrong answers

Option A is wrong because lifecycle hooks delay instance registration until a script completes, but they do not control the rate at which instances are replaced during a deployment or provide a gradual ramp-up of traffic; they only ensure initialization before registration. Option B is wrong because increasing the health check interval on the ALB would slow down the detection of genuinely unhealthy instances, potentially increasing error rates rather than reducing them, and does not address the root cause of premature traffic routing during deployment. Option D is wrong because increasing the desired capacity of the Auto Scaling group does not prevent deployment-related errors; it only adds more instances, which could mask the problem but not fix the underlying issue of instances being marked healthy before they are ready.

Full explanation →
818
MCQeasy

An SAP administrator is creating an IAM policy for an automation script that needs to start and stop a specific SAP HANA EC2 instance. The policy is shown in the exhibit. However, the script fails with an authorization error when trying to start the instance. What is the most likely cause?

A.The policy is missing an effect for the specific instance.
B.The policy does not include ec2:DescribeInstances action.
C.The ARN in the resource element does not match the actual instance ID.
D.The script does not have the correct region specified.
AnswerC

The instance ID in the policy is likely different from the actual instance.

Why this answer

The policy uses a resource ARN that specifies a particular instance ID. If the ARN does not match the actual instance ID of the SAP HANA EC2 instance, the `ec2:StartInstances` action will fail with an authorization error because IAM evaluates the resource ARN against the instance being started. AWS IAM policies require an exact match between the resource ARN in the policy and the instance ID for actions that operate on specific resources.

Exam trap

The trap here is that candidates often overlook the exact ARN matching requirement and assume the error is due to missing permissions or region misconfiguration, rather than a simple mismatch in the instance ID within the resource element.

How to eliminate wrong answers

Option A is wrong because the policy already includes an 'Allow' effect for the `ec2:StartInstances` and `ec2:StopInstances` actions, so adding another effect is unnecessary. Option B is wrong because `ec2:DescribeInstances` is a read-only action that is not required for starting or stopping instances; the `ec2:StartInstances` and `ec2:StopInstances` actions are sufficient for the automation script. Option D is wrong because the region is specified in the ARN (e.g., `us-east-1`) and the script's region configuration does not affect IAM policy evaluation; the error is due to the instance ID mismatch, not the region.

Full explanation →
819
Multi-Selectmedium

A company runs SAP HANA on AWS using an r5.8xlarge instance with 3.8 TB of EBS gp3 storage. The HANA data volume is 2 TB. The system is experiencing performance issues, and the database administrator suspects that the storage I/O is the bottleneck. Which TWO actions should be taken to improve I/O performance?

Select 2 answers
A.Increase the size of the log volume to improve write performance.
B.Change the data volume type from gp3 to io2 Block Express with higher IOPS.
C.Enable HANA delta merge operations to run more frequently.
D.Upgrade the instance to a larger size with higher network bandwidth.
E.Increase the provisioned IOPS on the HANA data volume.
AnswersB, E

io2 provides consistent low-latency performance.

Why this answer

Io2 Block Express provides up to 256,000 IOPS per volume with sub-millisecond latency, which is essential for SAP HANA's demanding I/O patterns. The current gp3 volume, while offering baseline performance, cannot match the consistent low-latency and high-IOPS capabilities required for HANA data volumes under heavy write workloads. Option E is also correct because increasing provisioned IOPS on the existing gp3 volume directly addresses the I/O bottleneck by raising the performance ceiling, though gp3 has a maximum of 16,000 IOPS per volume, which may still be insufficient for large HANA deployments.

Exam trap

The trap here is that candidates may confuse increasing volume size with improving performance, or assume that network bandwidth upgrades affect storage I/O, when in fact EBS performance is independent of instance network bandwidth and governed by volume type and IOPS provisioning.

Full explanation →
820
MCQeasy

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

A.CloudFrontFullAccess
B.AdministratorAccess
C.AmazonS3ReadOnlyAccess
D.A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.
AnswerD

These are the minimum permissions needed to upload files to S3.

Why this answer

The CodePipeline service role needs permissions to write objects to the S3 bucket and list its contents to verify the upload. A custom policy with s3:PutObject and s3:ListBucket on the target bucket grants exactly these required actions, resolving the 'Access Denied' error during the Deploy stage.

Exam trap

The trap here is that candidates often choose a broad managed policy like AdministratorAccess or CloudFrontFullAccess, overlooking that the minimal custom policy with specific S3 actions is the correct and secure solution for the 'Access Denied' error.

How to eliminate wrong answers

Option A is wrong because CloudFrontFullAccess grants permissions to manage CloudFront distributions, not to write to S3 buckets, and does not address the S3 upload failure. Option B is wrong because AdministratorAccess is overly permissive and violates the principle of least privilege; it would work but is not the best practice or the minimal required policy. Option C is wrong because AmazonS3ReadOnlyAccess only allows read operations (e.g., GetObject, ListBucket) and explicitly denies write actions like s3:PutObject, so it cannot resolve the upload failure.

Full explanation →
821
MCQeasy

An administrator needs to monitor the CPU utilization of an SAP HANA database running on an EC2 instance. The monitoring data must be stored for 15 months. Which AWS service should be used to meet this requirement?

A.Amazon S3
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.Amazon CloudWatch Metrics
AnswerD

CloudWatch metrics can be retained for up to 15 months.

Why this answer

Amazon CloudWatch Metrics is the correct service for monitoring and storing CPU utilization data. It supports custom metrics with retention up to 15 months, meeting the requirement. Amazon S3 is for object storage, not metrics.

AWS CloudTrail records API activity, not performance data. Amazon CloudWatch Logs is for log files, not numeric metrics.

Full explanation →
822
MCQmedium

A company is running SAP HANA on AWS and needs to perform a backup to S3 using the SAP HANA BACKUP command. The backup fails with an error indicating that the S3 bucket cannot be accessed. The EC2 instance has an IAM role assigned with the necessary S3 permissions. What is the most likely cause of the failure?

A.The S3 bucket is in a different region.
B.The instance does not have internet access.
C.The IAM role does not have the correct trust policy.
D.The S3 bucket policy denies access from the instance's VPC.
AnswerD

A bucket policy can explicitly deny access even if IAM allows.

Why this answer

SAP HANA backup to S3 requires a properly configured S3 bucket and the backup tool must be able to write to it. The error is likely due to the bucket policy blocking the request. IAM role permissions are correct, but bucket policies can override them.

Full explanation →
823
MCQmedium

An SAP administrator is troubleshooting a high CPU utilization issue on an SAP application server running on an Amazon EC2 instance. The administrator suspects a specific ABAP program is consuming excessive resources. Which AWS service can be used to capture detailed performance metrics and identify the process?

A.AWS CloudTrail
B.Amazon CloudWatch Agent
C.AWS Config
D.Amazon VPC Flow Logs
AnswerB

The Amazon CloudWatch Agent collects detailed OS-level metrics, including per-process CPU utilization.

Why this answer

The Amazon CloudWatch Agent can be installed on an EC2 instance to collect detailed OS-level metrics, including CPU utilization per process, which can help identify the specific ABAP program consuming excessive resources. Option A is incorrect: AWS CloudTrail records API activity, not performance metrics. Option C is incorrect: AWS Config monitors configuration changes and compliance, not CPU usage.

Option D is incorrect: Amazon VPC Flow Logs capture network traffic metadata, not CPU utilization.

Full explanation →
824
Multi-Selectmedium

Which TWO tasks require the use of AWS Systems Manager Session Manager? (Choose TWO.)

Select 2 answers
A.Transfer files between on-premises and AWS
B.Execute a one-time command on an EC2 instance interactively
C.Establish a secure shell session to an EC2 instance without using SSH keys
D.Store database connection strings securely
E.Apply operating system patches to a fleet of EC2 instances
AnswersB, C

Session Manager allows interactive command execution.

Why this answer

Options B and C are correct. Session Manager allows you to execute one-time commands interactively on an EC2 instance (B) and establish a secure shell session without requiring SSH keys (C). Option A is incorrect because file transfers are not a direct feature of Session Manager; it can be used to tunnel SCP but not directly transfer files.

Option D is incorrect because storing secrets is done via AWS Systems Manager Parameter Store, not Session Manager. Option E is incorrect because patching is typically done via Systems Manager Patch Manager, not Session Manager.

Full explanation →
825
MCQmedium

An SAP administrator has created the IAM policy shown in the exhibit and attached it to an IAM role used by an EC2 instance running SAP HANA. The instance needs to download backup files from the S3 bucket 'sap-backup-bucket' and then stop itself after the backup is complete. However, the backup script fails with an access denied error when trying to list the bucket. What is the most likely cause? (Note: This question is reused from above but with correct exhibit now. I need to change the exhibit to have a mistake. Let me fix: remove the bucket ARN from the Resource list for S3 actions, so only the object ARN is present. That will cause the list operation to fail.)

A.The S3 bucket is encrypted and the policy does not allow kms:Decrypt
B.The instance does not have an internet gateway to reach S3
C.The policy does not include the ec2:StopInstances permission
D.The policy does not allow the s3:ListBucket action on the bucket ARN
AnswerD

The policy allows s3:ListBucket but the Resource array only includes the object ARN (sap-backup-bucket/*), not the bucket ARN. The ListBucket action requires the bucket ARN as resource.

Full explanation →
Page 10

Page 11 of 22

Page 12

All pages

12345678910111213141516171819202122

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWSTechnologyMigrationOperations and Maintenance
See all domains with question counts →