Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 826–900

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 12 of 22

826

MCQeasy

A company plans to migrate its SAP ERP system from an on-premises environment to AWS. The system uses an Oracle database. Which AWS service provides the most cost-effective and high-performance storage for the Oracle data files?

A.Amazon EBS io2 Block Express volumes

B.EC2 Instance Store

C.Amazon EFS

D.Amazon S3

AnswerA

Provides high performance for databases.

Why this answer

Amazon EBS io2 Block Express volumes provide the highest performance and durability for Oracle database workloads on AWS, offering up to 256,000 IOPS per volume and sub-millisecond latency. They are the most cost-effective choice for SAP ERP Oracle data files because they deliver consistent, high-throughput performance required for SAP's demanding I/O patterns, while allowing you to pay only for provisioned capacity without upfront costs. io2 volumes also support multi-attach and are designed for mission-critical databases, making them the optimal storage for Oracle data files in SAP on AWS.

Exam trap

The trap here is that candidates often confuse Amazon EFS or S3 as viable database storage options due to their scalability and durability, but they fail to recognize that Oracle databases require block-level storage with consistent low latency and high IOPS, which only EBS io2 Block Express provides for SAP workloads.

How to eliminate wrong answers

Option B (EC2 Instance Store) is wrong because instance store volumes are ephemeral and data is lost when the instance is stopped or terminated, making them unsuitable for persistent Oracle database storage. Option C (Amazon EFS) is wrong because it is a file-level NFS storage service that does not provide the block-level access or consistent low-latency performance required for Oracle database data files, and it is not optimized for high IOPS database workloads. Option D (Amazon S3) is wrong because it is an object storage service with higher latency and no direct block-level access, making it unsuitable for hosting live Oracle database files that require synchronous I/O operations.

Full explanation →

827

Multi-Selectmedium

A company is migrating its SAP ERP system to AWS and wants to minimize downtime during the migration. Which THREE strategies should be considered? (Choose three.)

Select 3 answers

A.Use Amazon S3 Transfer Acceleration to speed up data transfer.

B.Shut down the source system and perform a full database export to S3.

C.Perform a full export and import of the SAP system during a maintenance window.

D.Use SAP Landscape Transformation (SLT) to replicate data in real-time to the target system.

E.Set up AWS Database Migration Service (DMS) for ongoing replication after initial load.

AnswersA, D, E

S3 Transfer Acceleration speeds up data transfer, reducing migration window.

Why this answer

Amazon S3 Transfer Acceleration is correct because it uses AWS edge locations to accelerate uploads to S3 over long distances, leveraging optimized network paths and the TCP protocol to reduce latency and improve throughput. For large SAP database exports, this can significantly reduce the time required for the initial data transfer to AWS, thereby minimizing overall migration downtime.

Exam trap

The AWS SAP on AWS Specialty exam often tests the misconception that shutting down the source system or using a maintenance window is acceptable for minimizing downtime, when in fact these approaches increase downtime. The trap is that candidates confuse 'minimizing downtime' with 'scheduling downtime' and overlook real-time replication (SLT, DMS) and acceleration technologies (S3 Transfer Acceleration).

Full explanation →

828

MCQeasy

An administrator needs to back up an SAP HANA database running on an EC2 instance. The backup must be stored in a durable, cost-effective storage solution. Which AWS service is best suited for storing the backup files?

A.Amazon S3

B.Amazon S3 Glacier

C.Amazon EFS

D.Amazon EBS snapshots

AnswerA

S3 is durable, scalable, and cost-effective for backup files.

Why this answer

Amazon S3 is the best choice for storing SAP HANA backup files because it offers 99.999999999% durability, is cost-effective for long-term backup storage, and integrates natively with SAP HANA via the Backint agent for direct backup to S3. S3 provides scalable object storage that can handle the large volume of SAP HANA data without requiring manual provisioning or lifecycle management.

Exam trap

The trap here is that candidates confuse Amazon S3 Glacier as a primary backup target due to its low cost, overlooking that SAP HANA backups require immediate accessibility for restoration, which S3 Glacier's retrieval delays cannot satisfy.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Glacier is designed for archival storage with retrieval times ranging from minutes to hours, making it unsuitable for regular SAP HANA backups that may need quick restoration. Option C is wrong because Amazon EFS is a file-level storage service that is more expensive than S3 for backup use cases and does not support the Backint integration that SAP HANA requires for direct backup. Option D is wrong because Amazon EBS snapshots are block-level backups tied to a specific EC2 instance and Availability Zone, lacking the durability, cost-efficiency, and cross-region capabilities of S3 for long-term backup storage.

Full explanation →

829

MCQhard

An SAP system on AWS is experiencing high read latency from the SAP HANA database. The system uses Provisioned IOPS EBS volumes. Which action would most likely improve read latency?

A.Change the EBS volume type to gp2.

B.Disable write caching on the EBS volumes.

C.Move the HANA data to instance store volumes.

D.Increase the provisioned IOPS on the EBS volumes.

AnswerD

Increasing provisioned IOPS directly raises the I/O throughput limit, reducing read latency under load. This is the correct action.

Why this answer

Increasing the provisioned IOPS on the EBS volumes directly addresses high read latency by raising the I/O performance ceiling for the SAP HANA database. Since the system already uses Provisioned IOPS (io1/io2) volumes, higher IOPS reduces queue depth and read latency under heavy workloads. Other options are incorrect: changing to gp2 reduces IOPS, disabling write caching does not improve read latency, and instance store volumes are ephemeral and not recommended for HANA data persistence.

Exam trap

The trap here is that candidates may think increasing IOPS always helps, but the key nuance is that the system already uses Provisioned IOPS, so the correct action is to increase the provisioned IOPS value, not change volume types or rely on ephemeral storage.

How to eliminate wrong answers

Option A is wrong because changing to gp2 (general purpose SSD) would likely reduce performance, as gp2 offers lower and burstable IOPS compared to Provisioned IOPS volumes, worsening latency under sustained SAP HANA loads. Option B is wrong because disabling write caching on EBS volumes does not improve read latency; write caching affects write operations, and EBS volumes do not support configurable read caching at the volume level. Option C is wrong because instance store volumes are ephemeral and not suitable for SAP HANA data, which requires persistent, durable storage; moving data there would risk data loss on instance stop/termination and does not guarantee lower read latency.

Full explanation →

830

MCQhard

A company is using AWS Systems Manager to manage their SAP environment. They want to ensure that only specific users can run automation documents on production SAP instances. Which IAM policy action should be used to control access to executing automation documents?

A.ssm:SendCommand

B.ssm:GetParameter

C.ssm:StartAutomationExecution

D.ssm:ListDocuments

AnswerC

This action permits starting automation documents.

Why this answer

The correct action is ssm:StartAutomationExecution because AWS Systems Manager Automation requires this specific permission to initiate an automation workflow. The question asks about controlling access to executing automation documents, and StartAutomationExecution is the IAM action that governs the ability to start an automation execution on a target resource, such as a production SAP instance.

Exam trap

The trap here is that candidates confuse the Run Command capability (ssm:SendCommand) with Automation execution, because both involve running commands on instances, but they use different IAM actions and APIs.

How to eliminate wrong answers

Option A is wrong because ssm:SendCommand is used to send a Run Command (a different Systems Manager capability) to managed instances, not to start an automation document execution. Option B is wrong because ssm:GetParameter controls read access to a parameter in AWS Systems Manager Parameter Store, which is unrelated to executing automation documents. Option D is wrong because ssm:ListDocuments allows listing available documents but does not grant permission to execute them.

Full explanation →

831

MCQmedium

A company is migrating an SAP environment and wants to automate the provisioning of infrastructure using Infrastructure as Code (IaC). Which AWS service should they use to define and deploy AWS resources?

A.AWS OpsWorks

B.AWS CodeDeploy

C.AWS CloudFormation

D.AWS Elastic Beanstalk

AnswerC

CloudFormation allows you to define and provision AWS infrastructure declaratively.

Why this answer

AWS CloudFormation allows you to define infrastructure as code. OpsWorks is for configuration management. Elastic Beanstalk is for application deployment.

CodeDeploy is for code deployment.

Full explanation →

832

MCQeasy

A company is migrating its SAP ERP system to AWS. The system has a custom ABAP code that uses RFC calls to an external system. The company wants to test the migrated system in a sandbox environment before the final cutover. What is the best practice for handling the RFC connections during testing?

A.Create a separate sandbox environment that is isolated from production and uses mock endpoints for RFC calls.

B.Use the same RFC destinations as production but disable the external system.

C.Set up a VPN between the sandbox and the external system to test real connectivity.

D.Configure the sandbox to use the production RFC endpoints but with read-only access.

AnswerA

Isolation prevents unintended effects on production.

Why this answer

Using a sandbox environment disconnected from the production system prevents accidental data changes or impacts. Options B, C, D are incorrect because they either involve production connections or are not best practices.

Full explanation →

833

MCQmedium

An AWS administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver. The instance type is r5.2xlarge. Which CloudWatch metric should the administrator use to track the CPU usage of the instance?

A.MemoryUtilization

B.CPUUtilization

C.NetworkIn

D.DiskReadOps

AnswerB

CPUUtilization is the standard CloudWatch metric that tracks the CPU usage of an EC2 instance, making it the correct choice for monitoring CPU utilization of an r5.2xlarge instance running SAP NetWeaver.

Why this answer

(CPUUtilization). CPUUtilization is a standard CloudWatch metric for EC2 instances that measures the percentage of allocated EC2 compute units that are currently in use. It is suitable for monitoring CPU usage of an EC2 instance running SAP NetWeaver.

Option A (MemoryUtilization) is incorrect because memory utilization is not a default CloudWatch metric; it requires a custom agent. Option C (NetworkIn) measures network traffic, not CPU. Option D (DiskReadOps) measures disk I/O operations.

Full explanation →

834

MCQhard

A company is migrating an SAP Business Suite system to AWS. The system runs on AIX on IBM Power Systems. The company wants to rehost the system on AWS using a lift-and-shift approach. Which AWS service can replicate the AIX operating system to run on AWS?

A.AWS CloudEndure Migration

B.AWS Database Migration Service (AWS DMS)

C.AWS Server Migration Service (AWS SMS)

D.AWS Application Migration Service (AWS MGN)

AnswerD

AWS MGN supports AIX via the AWS Replication Agent for lift-and-shift.

Why this answer

AWS Application Migration Service (AWS MGN) supports agent-based migration for AIX via the AWS Replication Agent. Option A (AWS CloudEndure Migration) has been rebranded as AWS MGN. Option B (AWS SMS) does not support AIX.

Option C (AWS Database Migration Service) is for databases, not OS.

Full explanation →

835

MCQeasy

A company is running an SAP HANA database on an EC2 instance with a large amount of memory. The system is experiencing performance issues during peak loads. Which AWS service should be used to capture detailed performance metrics for analysis?

A.AWS Config

B.AWS CloudTrail

C.AWS X-Ray

D.Amazon CloudWatch

AnswerD

CloudWatch with agent can capture detailed performance metrics including memory.

Why this answer

Amazon CloudWatch is the correct service because it provides detailed, customizable performance metrics for EC2 instances, including memory utilization, CPU, disk I/O, and network throughput. For SAP HANA, which is memory-intensive, CloudWatch can capture custom metrics (e.g., via the CloudWatch Agent) to monitor memory pressure and identify bottlenecks during peak loads, enabling performance analysis and scaling decisions.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (auditing) or AWS Config (compliance) with performance monitoring, but the exam specifically tests whether you know that CloudWatch is the only service that captures OS-level and custom performance metrics for EC2 instances.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration management service that tracks resource inventory and changes, not real-time performance metrics; it cannot capture memory or CPU utilization data. Option B is wrong because AWS CloudTrail records API activity and user actions for auditing, not system-level performance metrics like memory usage or I/O. Option C is wrong because AWS X-Ray is designed for tracing and debugging distributed applications (e.g., microservices), not for monitoring OS-level or database performance metrics on a single EC2 instance.

Full explanation →

836

MCQeasy

A company runs SAP HANA on AWS and needs to ensure that the database can be restored to any point in time within the last 48 hours with minimal data loss. Which backup strategy should be used?

A.Use Amazon EBS snapshots every 6 hours.

B.Schedule daily full backups and hourly incremental log backups to Amazon S3 using Backint.

C.Use AWS Backup with a daily backup plan.

D.Take weekly full backups and daily differential backups to Amazon S3.

AnswerB

This combination allows point-in-time recovery with minimal data loss.

Why this answer

SAP HANA supports Backint integration with Amazon S3 for log backups, enabling point-in-time recovery (PITR) with minimal data loss. Daily full backups combined with hourly incremental log backups ensure that any transaction committed within the last 48 hours can be restored, meeting the RPO requirement of minimal data loss.

Exam trap

The trap here is that candidates often confuse EBS snapshots or AWS Backup with SAP HANA's specific requirement for Backint-based log backups, assuming general-purpose backup tools can achieve the same PITR granularity without understanding SAP HANA's dependency on transaction log continuity.

How to eliminate wrong answers

Option A is wrong because Amazon EBS snapshots every 6 hours cannot achieve point-in-time recovery to any moment within 48 hours; they only provide recovery points every 6 hours, leading to potential data loss of up to 6 hours. Option C is wrong because AWS Backup with a daily backup plan does not support the granular log backups needed for SAP HANA PITR; it lacks the Backint integration for transaction log backups. Option D is wrong because weekly full backups with daily differential backups do not provide the hourly log backup granularity required for minimal data loss; differential backups capture changes since the last full backup, not transaction-level logs, so PITR within 48 hours is not possible.

Full explanation →

837

MCQmedium

A company runs SAP on AWS and uses a shared Amazon EFS file system for /sapmnt and /usr/sap/trans. The administrator wants to control access to specific directories based on the source IP address of the SAP application servers. Which method should be used to achieve this?

A.Configure security group rules to allow only specific IP addresses

B.Use Amazon S3 bucket policies with IP conditions

C.Use Amazon EFS access points with IAM policies

D.Use network ACLs to restrict access by IP

AnswerC

Access points enforce directory access, IAM policies can restrict by IP.

Why this answer

Amazon EFS access points can be combined with IAM policies to enforce a specific POSIX user and directory path per application, and IAM conditions can restrict access based on the source IP address of the SAP application servers. This allows fine-grained control over which EC2 instances (by IP) can access specific subdirectories like /sapmnt or /usr/sap/trans without modifying the NFS client configuration.

Exam trap

The trap here is that candidates often confuse network-level controls (security groups, NACLs) with file-system-level controls, assuming IP-based restrictions can be applied directly to directories within a shared EFS volume, when in fact EFS access points with IAM policies are the correct AWS-native mechanism for this granularity.

How to eliminate wrong answers

Option A is wrong because security group rules operate at the network interface level and cannot control access to specific directories within a shared EFS file system; they only allow or deny traffic to the entire EFS mount target. Option B is wrong because Amazon S3 bucket policies are not applicable to EFS; EFS is a file system, not an object store, and does not use S3 bucket policies. Option D is wrong because network ACLs are stateless and apply at the subnet level, not at the file system or directory level, and they cannot enforce directory-specific access controls.

Full explanation →

838

MCQmedium

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP application servers. The ALB is configured with a TCP listener. Users report that some sessions are terminated unexpectedly. What is the MOST likely cause?

A.The ALB is not configured with SSL termination.

B.The target group health check interval is set too low.

C.The ALB idle timeout setting is shorter than the SAP session timeout.

D.The ALB is configured with cross-zone load balancing disabled.

AnswerC

If idle timeout is lower than SAP session timeout, connections are dropped.

Why this answer

The ALB's idle timeout setting controls how long the load balancer keeps a connection open without data transfer. If this timeout is shorter than the SAP session timeout, the ALB will close the connection prematurely, causing the user's session to be terminated unexpectedly. This is a common mismatch when long-running SAP transactions or background jobs do not send data within the ALB's idle timeout window.

Exam trap

The trap here is that candidates often confuse the ALB's idle timeout with the target group health check interval, assuming that frequent health checks cause session drops, when in fact health checks do not affect established connections.

How to eliminate wrong answers

Option A is wrong because SSL termination is not required for TCP listeners; TCP listeners pass traffic through without decryption, and the lack of SSL termination does not cause session termination. Option B is wrong because setting the health check interval too low would cause the target group to mark instances as unhealthy more frequently, potentially dropping connections, but the described symptom is unexpected session termination, not health check failures; a low interval actually increases health check frequency, which does not directly terminate established sessions. Option D is wrong because disabling cross-zone load balancing affects traffic distribution across Availability Zones, not the persistence of individual TCP sessions; it may cause uneven load but does not terminate active sessions.

Full explanation →

839

MCQmedium

A company is running SAP Business Suite on AWS. The system includes a central services (ASCS) instance, a primary application server (PAS), and a database server running SAP HANA. The company recently experienced an outage when the EC2 instance hosting the ASCS instance failed due to a hardware issue. The system was down for 4 hours while the IT team manually recovered the ASCS instance from an AMI. The company wants to implement a highly available ASCS instance with automatic failover and a Recovery Time Objective (RTO) of less than 15 minutes. The system is currently running in a single Availability Zone. What should the company do to meet these requirements?

A.Place the ASCS instance behind an Application Load Balancer and configure health checks.

B.Configure an Auto Scaling group for the ASCS instance with a minimum of 1 and maximum of 2, and use a lifecycle hook to attach an Elastic IP.

C.Deploy a second ASCS instance in a different Availability Zone, set up SAP enqueue replication, and use a virtual IP address with Route 53 health checks for failover.

D.Enable CloudWatch EC2 Auto Recovery on the ASCS instance and configure it to start a new instance in a different AZ.

AnswerC

This is the correct approach: deploy a second ASCS in another AZ, use SAP enqueue replication, and use Route 53 health checks with a virtual IP to achieve automatic failover with RTO <15 minutes.

Why this answer

Deploying a second ASCS instance in a different Availability Zone with SAP enqueue replication and a virtual IP address managed by Route 53 health checks provides automatic failover with an RTO under 15 minutes. This setup ensures that if the primary ASCS instance fails, the standby instance takes over quickly, maintaining enqueue state and minimizing downtime. Option A is wrong because an Application Load Balancer is not designed for SAP ASCS failover; it would not handle enqueue replication or virtual hostname.

Option B is wrong because an Auto Scaling group with lifecycle hooks does not provide application-level clustering or enqueue state replication. Option D is wrong because CloudWatch EC2 Auto Recovery only restarts the instance in the same Availability Zone and does not address enqueue replication or cross-AZ failover, resulting in an RTO longer than 15 minutes.

Full explanation →

840

MCQeasy

An SAP application server on an EC2 instance is unable to connect to the SAP HANA database on another EC2 instance. Both instances are in the same VPC and security groups allow traffic. What is the most likely cause?

A.The VPC does not have an Internet Gateway

B.The security group for the database instance does not allow inbound traffic on the HANA port

C.Network ACLs are blocking traffic

D.The route table does not have a local route

AnswerB

HANA uses port 3XX13; must be allowed.

Why this answer

The most likely cause is that the security group attached to the SAP HANA database instance does not have an inbound rule allowing traffic on the SAP HANA database port (typically 3<span>00</span>15 for HANA system DB or 3<span>NN</span>13 for tenant DBs). Even if the security group for the application server allows outbound traffic, the database security group must explicitly permit inbound TCP traffic from the application server's security group or IP address on the correct HANA port. Without this rule, the database will reject the connection at the instance level.

Exam trap

The trap here is that candidates often confuse security groups (stateful, instance-level) with Network ACLs (stateless, subnet-level) and assume that if the security group allows outbound traffic from the app server, the connection should work, forgetting that the database's security group must also allow inbound traffic on the specific HANA port.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway is only required for instances to communicate with the internet or with other VPCs via public IPs; it is not needed for communication between two EC2 instances within the same VPC. Option C is wrong because Network ACLs are stateless and, by default, allow all inbound and outbound traffic in a default VPC; even if custom NACLs were used, they would need to explicitly block traffic on the HANA port, which is less common than a missing security group rule. Option D is wrong because the route table in a VPC always includes a local route for the VPC CIDR by default, which enables direct communication between instances in the same VPC without any additional configuration.

Full explanation →

841

MCQmedium

An SAP system is experiencing performance issues during peak hours. The SAP application servers are running on EC2 instances behind a Network Load Balancer (NLB). The NLB is configured to use cross-zone load balancing. The issue is that one application server receives significantly more traffic than others. What is the most likely cause?

A.The application servers have different instance sizes, causing the NLB to send more traffic to larger instances

B.The NLB is using round-robin algorithm and one server is slower

C.The flow hash algorithm is causing an uneven distribution of client traffic

D.The health check is failing on the other servers

AnswerC

NLB uses a flow hash based on source IP, port, and protocol; with few clients, distribution can be uneven.

Why this answer

The Network Load Balancer (NLB) uses a flow hash algorithm based on the 5-tuple (source IP, source port, destination IP, destination port, and protocol) to route traffic. This algorithm is designed to maintain session stickiness, but it can cause uneven distribution if a small number of clients generate a disproportionate amount of traffic, as each client's flows are consistently sent to the same target. Cross-zone load balancing distributes traffic across all targets in all enabled Availability Zones, but it does not alter the flow hash algorithm's per-flow routing, so one server can still receive more flows if its hash bucket is overloaded.

Exam trap

The trap here is that candidates often assume cross-zone load balancing alone ensures even distribution, but they overlook that the NLB's flow hash algorithm inherently causes per-flow stickiness, which can lead to imbalance when a small number of clients generate many flows.

How to eliminate wrong answers

Option A is wrong because the NLB does not consider instance size when routing traffic; it uses the flow hash algorithm and distributes flows independently of target capacity. Option B is wrong because the NLB does not use a round-robin algorithm; it uses a flow hash algorithm for connection routing, and a slower server would not cause the NLB to send more traffic to it—the NLB does not adjust distribution based on server performance. Option D is wrong because if health checks were failing on other servers, those servers would be removed from the target group and would not receive any traffic, which would not cause one server to receive significantly more traffic than others; instead, traffic would be distributed only among healthy targets.

Full explanation →

842

Multi-Selecteasy

Which TWO AWS services can be used to store SAP backup data? (Choose two.)

Select 2 answers

A.Amazon S3

B.Amazon S3 Glacier

C.Amazon RDS

D.Amazon DynamoDB

E.Amazon EBS

AnswersA, B

S3 is a common backup target.

Why this answer

Amazon S3 is correct because it provides a highly durable, scalable, and cost-effective object storage service that can be used to store SAP backup data, such as database backups from SAP HANA or SAP ASE, via native integration or third-party backup tools. SAP-certified backup solutions, including the SAP HANA Backup & Recovery tool, can directly write backups to S3 buckets using the S3 API, supporting standard storage classes for frequent access.

Exam trap

The trap here is that candidates may confuse Amazon EBS as a backup storage service because it is commonly used for EC2 instance storage, but EBS volumes are not designed for long-term, cost-effective backup archiving, whereas S3 and S3 Glacier are the correct services for storing SAP backup data.

Full explanation →

843

MCQhard

An IAM policy for a migration team is shown in the exhibit. The team is unable to start a DMS replication task. What is the most likely missing permission?

A.dms:CreateReplicationInstance and dms:CreateEndpoint

B.s3:ListBucket

C.kms:Decrypt

D.ec2:CreateNetworkInterface

AnswerD

Correct. DMS uses ec2:CreateNetworkInterface to create an elastic network interface in the VPC for the replication instance when starting a task. Without this permission, the task fails to start.

Why this answer

To start a DMS replication task, the IAM policy must include permissions for DMS to create network interfaces in the VPC. The ec2:CreateNetworkInterface permission is required because DMS dynamically creates an elastic network interface for the replication instance when the task starts. The other options are not the most likely missing permission: dms:CreateReplicationInstance and dms:CreateEndpoint are needed for creating resources, not for starting an existing task; s3:ListBucket is unrelated; kms:Decrypt is only needed if using encrypted endpoints, which is not indicated.

Exam trap

Candidates often confuse the permissions needed to create DMS resources with those needed to start a task. Starting a task requires dms:StartReplicationTask and ec2:CreateNetworkInterface, not the create actions for instances or endpoints.

Full explanation →

844

MCQmedium

A company runs SAP HANA on EC2 with EBS io1 volumes. The administrator notices that the disk queue depth is consistently high during peak hours, causing increased latency. The volume is 2 TB with 5000 provisioned IOPS. The instance is an r5.4xlarge with EBS bandwidth of 4750 Mbps. The database workload is write-intensive. The administrator wants to reduce latency without increasing costs significantly. Which action should the administrator take?

A.Increase the provisioned IOPS to 10,000

B.Enable EBS Multi-Attach and use multiple instances to share the volume

C.Change the volume type to gp3 with 5000 IOPS

D.Upgrade the EC2 instance to an r5.8xlarge

AnswerA

Higher IOPS reduces queue depth and latency.

Why this answer

Increasing the provisioned IOPS to 10,000 directly addresses the high disk queue depth by allowing more I/O operations to be processed concurrently, thereby reducing latency. Option B is incorrect because EBS Multi-Attach is used to attach a volume to multiple EC2 instances simultaneously, but it does not improve queue depth or latency for a single instance write-intensive workload. Option C is incorrect because changing to gp3 with the same 5000 IOPS does not provide any performance improvement; gp3 has a baseline of 3000 IOPS and relies on burst credits, which is not suitable for sustained high write demands.

Option D is incorrect because upgrading to an r5.8xlarge increases network and EBS bandwidth but does not increase the provisioned IOPS, so it does not resolve the queue depth issue and adds unnecessary cost.

Full explanation →

845

MCQhard

An SAP on AWS environment is experiencing intermittent connectivity issues between the SAP application servers and the SAP HANA database. Both are in the same VPC but in different Availability Zones. The network team has confirmed that the security groups allow traffic on the required ports. What is a likely cause of the issue?

A.AWS Shield Advanced is blocking legitimate traffic.

B.Network ACLs are misconfigured, blocking return traffic.

C.VPC Flow Logs are enabled and dropping packets.

D.The VPC is using AWS Direct Connect, which adds latency.

AnswerB

Network ACLs are stateless, so even when security groups permit outbound traffic from application servers to the HANA database, a misconfigured inbound rule on the ACL for the database subnet can block ephemeral return traffic, causing intermittent connectivity. This satisfies the constraint that both instances reside in different Availability Zones, where ACLs operate at the subnet boundary.

Why this answer

Network ACLs are stateless, meaning they evaluate inbound and outbound traffic separately. Even if inbound rules allow traffic from the SAP application servers to the HANA database, the outbound rules on the database subnet's NACL must explicitly allow the return traffic (ephemeral ports) back to the application servers. Misconfigured outbound rules in the NACL can drop the response packets, causing intermittent connectivity issues between the application and database tiers across Availability Zones.

Exam trap

The trap here is that candidates often assume security groups (which are stateful) are the only firewall layer, forgetting that Network ACLs are stateless and require explicit outbound rules for return traffic, especially when traffic crosses Availability Zones.

How to eliminate wrong answers

Option A is wrong because AWS Shield Advanced is a DDoS protection service that does not block legitimate traffic based on application-layer rules; it only mitigates volumetric attacks and requires explicit configuration to filter traffic. Option C is wrong because VPC Flow Logs are a monitoring feature that captures metadata about IP traffic; they do not drop or block packets. Option D is wrong because AWS Direct Connect provides a dedicated network connection that reduces latency compared to the public internet; it does not add latency and is not the cause of intermittent connectivity within the same VPC.

Full explanation →

846

MCQhard

An SAP system on AWS is experiencing intermittent connectivity issues between the application servers and the HANA database. The network team has confirmed that the VPC and subnets are configured correctly. What should the operations team check NEXT?

A.DNS resolution for the database endpoint.

B.VPC route tables for the application subnet.

C.Security group rules on the database server.

D.Network ACLs on the database subnet.

AnswerC

Security group rules on the database server. Correct. Security groups can cause intermittent drops if rules are missing or have time-based issues.

Why this answer

Intermittent connectivity issues between application servers and HANA database often point to security group rules. Security groups act as virtual firewalls for EC2 instances. If the security group on the database server does not allow inbound traffic from the application servers on the required ports (e.g., 3xx41 for HANA), connections may fail intermittently.

While route tables and NACLs could affect connectivity, they are typically stable and less likely to cause intermittent problems. DNS resolution issues would be more consistent. Therefore, the operations team should first check the security group rules on the database server.

Full explanation →

847

MCQmedium

A company is using AWS DMS to migrate an SAP database. The full load is complete, but the CDC latency is high. Which step should the company take to reduce latency?

A.Increase the compute capacity of the DMS replication instance.

B.Increase the size of the target database instance.

C.Restart the DMS replication task.

D.Disable change data capture (CDC) on the source database.

AnswerA

A larger replication instance can process CDC faster.

Why this answer

Increasing the compute capacity of the DMS replication instance provides more resources to process CDC changes, reducing latency. Option B is incorrect because increasing the target database size does not directly affect DMS replication performance. Option C is incorrect because restarting the task does not address the underlying resource constraint and may cause temporary downtime.

Option D is incorrect because disabling CDC would stop replication entirely, not reduce latency.

Full explanation →

848

MCQmedium

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP Web Dispatchers. The system is experiencing intermittent session drops. What is the most likely cause?

A.The ALB is not configured for sticky sessions.

B.The ALB deletion protection is enabled.

C.The ALB health check interval is too short.

D.Cross-zone load balancing is not enabled on the ALB.

AnswerA

Without sticky sessions, subsequent requests may go to different Web Dispatchers, breaking session state.

Why this answer

The ALB operates at Layer 7 and, by default, distributes each request independently across healthy targets. SAP Web Dispatchers maintain user session state (e.g., logon tickets, application context) locally. Without sticky sessions (session affinity) enabled on the ALB, subsequent requests from the same user can be routed to a different Web Dispatcher, causing the new dispatcher to lack the session context and dropping the user's session.

Enabling stickiness based on the ALB-generated cookie ensures all requests from a session are sent to the same Web Dispatcher, preventing these intermittent drops.

Exam trap

The trap here is that candidates often confuse health check intervals or cross-zone load balancing with session persistence, assuming that any routing issue must be caused by target availability or distribution, rather than recognizing that the ALB's default stateless behavior is the root cause of session drops in stateful SAP Web Dispatcher deployments.

How to eliminate wrong answers

Option B is wrong because deletion protection only prevents accidental deletion of the ALB itself; it has no effect on traffic routing or session persistence. Option C is wrong because a health check interval that is too short would cause the ALB to mark targets as unhealthy more aggressively, potentially removing them from rotation, but it would not cause intermittent session drops for requests that reach a healthy target; the described symptom is session affinity loss, not target availability. Option D is wrong because cross-zone load balancing distributes traffic evenly across targets in all Availability Zones, which improves utilization but does not affect session stickiness; without sticky sessions, requests can still be routed to different targets regardless of cross-zone settings.

Full explanation →

849

MCQeasy

A company is migrating its SAP landscape to AWS and wants to automate the deployment of SAP applications using infrastructure as code. Which AWS service should the company use to define and provision the AWS infrastructure?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS CodeDeploy

D.AWS OpsWorks

AnswerB

CloudFormation enables infrastructure as code.

Why this answer

AWS CloudFormation allows defining and provisioning AWS infrastructure as code. Option A (Elastic Beanstalk) is wrong because it is a platform-as-a-service (PaaS) for deploying web applications, not for defining infrastructure. Option C (CodeDeploy) is wrong because it automates code deployments to running instances, not infrastructure provisioning.

Option D (OpsWorks) is wrong because it is a configuration management service using Chef/Puppet, not a general-purpose IaC tool.

Full explanation →

850

MCQmedium

An operations team manages an SAP ERP system on AWS that uses a single EC2 instance for the SAP central services (SCS) and multiple instances for application servers. The system is running in a VPC with both public and private subnets. The team notices that the SCS instance is unreachable from the application servers after a maintenance window where network ACLs were updated. The application servers are in private subnets, and the SCS instance is in a public subnet. The team has verified that the security groups allow the required traffic. Which step should the team take to resolve the connectivity issue?

A.Review the network ACL rules for both the public and private subnets.

B.Verify that the route tables have a route to the internet gateway.

C.Assign an Elastic IP to the SCS instance.

D.Check the security group rules on the application servers.

AnswerA

Network ACLs can block traffic if misconfigured.

Why this answer

The issue is that after maintenance, network ACLs were updated, causing connectivity loss between the SCS instance (public subnet) and application servers (private subnets). Network ACLs are stateless and control traffic at the subnet level. Since security groups are already verified, the likely cause is the NACL rules.

Option A is correct because reviewing NACL rules for both subnets will identify missing inbound/outbound rules. Option B is incorrect because route tables to the internet gateway affect internet-bound traffic, not internal VPC traffic. Option C is incorrect because Elastic IPs are for internet access, not internal connectivity.

Option D is incorrect because security groups were confirmed to allow traffic, so the issue is at the NACL level.

Full explanation →

851

MCQhard

An SAP application on EC2 is experiencing high CPU utilization. The instance is part of an Auto Scaling group. The CPU metric shows spikes every hour. Which scaling policy should be used to preemptively scale out before the spike?

A.Simple scaling policy based on CPU > 80%

B.Step scaling policy with multiple thresholds

C.Target tracking scaling policy with CPU target 75%

D.Scheduled scaling policy to add capacity just before the spike

AnswerD

Scheduled scaling can anticipate predictable patterns.

Why this answer

The CPU spikes are predictable (every hour), making a scheduled scaling policy the ideal choice to preemptively add capacity just before the spike occurs. Scheduled scaling allows you to define a specific time to increase the desired capacity of the Auto Scaling group, ensuring resources are available before the load increases, rather than reacting after the spike has started.

Exam trap

The trap here is that candidates often choose reactive policies (like target tracking or step scaling) because they focus on CPU thresholds, missing the key requirement for preemptive scaling based on a predictable, time-based pattern.

How to eliminate wrong answers

Option A is wrong because a simple scaling policy based on CPU > 80% is reactive, not preemptive; it only triggers after the threshold is breached, which would not prevent the spike from causing high utilization. Option B is wrong because a step scaling policy also reacts to real-time metric alarms (e.g., CPU crossing thresholds) and cannot anticipate future spikes; it adjusts capacity based on current demand, not scheduled events. Option C is wrong because a target tracking scaling policy maintains a target CPU utilization (e.g., 75%) by continuously adjusting capacity based on current load, but it cannot preemptively scale before a known periodic spike; it would only react after the metric deviates from the target.

Full explanation →

852

MCQmedium

An SAP administrator notices that the SAP application server on AWS is experiencing high latency when connecting to the SAP HANA database. The database is on a separate EC2 instance in the same VPC. What is the MOST likely cause?

A.Enhanced Networking is not enabled on the EC2 instances.

B.EBS optimization is not enabled on the application server.

C.The HANA database is using a public IP address.

D.The instances are not in a placement group.

AnswerA

Enhanced Networking reduces latency and packet drops.

Why this answer

High latency between an SAP application server and a SAP HANA database in the same VPC is most likely caused by Enhanced Networking not being enabled on the EC2 instances. Enhanced Networking uses the Elastic Network Adapter (ENA) to provide higher bandwidth, higher packet-per-second performance, and consistently lower inter-instance latencies. Without it, network traffic is handled by the Xen or Nitro hypervisor's default driver, which introduces additional overhead and latency, especially under the high-throughput, low-latency requirements of SAP HANA communication.

Exam trap

The trap here is that candidates often confuse EBS optimization (storage I/O) with network performance, or assume that being in the same VPC automatically guarantees low latency, overlooking that Enhanced Networking is a required feature for high-performance workloads like SAP HANA.

How to eliminate wrong answers

Option B is wrong because EBS optimization affects storage I/O performance between the EC2 instance and its attached EBS volumes, not network latency between two EC2 instances. Option C is wrong because using a public IP address would introduce additional routing through the internet gateway and potential NAT overhead, but the question states both instances are in the same VPC, so traffic would still use the local VPC routing unless explicitly configured otherwise; the most likely cause is a missing network performance feature, not a public IP. Option D is wrong because placement groups reduce network latency by ensuring instances are in close physical proximity, but they are not required for low-latency communication; Enhanced Networking is a prerequisite for achieving the lowest latency even within a placement group.

Full explanation →

853

MCQhard

Refer to the exhibit. An IAM policy is attached to an EC2 instance role used by SAP HANA backup scripts. The backup script attempts to upload a file to the S3 bucket without specifying server-side encryption. What will happen?

A.The upload fails because there is no Allow statement without condition.

B.The upload succeeds because there is an Allow statement.

C.The upload fails because of the Deny statement.

D.The upload succeeds because the Deny condition does not match.

AnswerC

The Deny statement explicitly denies PutObject when encryption is not AES256.

Why this answer

The first statement allows PutObject only if encryption is AES256. The second statement denies PutObject if encryption is not AES256. Since the request does not specify encryption, it does not match the condition in the Allow statement (so not allowed) and it matches the Deny statement because encryption is not AES256 (StringNotEquals).

Therefore, the request is denied.

Full explanation →

854

MCQeasy

A company is migrating a SAP HANA database to AWS. Which storage configuration is recommended for SAP HANA to meet performance requirements?

A.Amazon EC2 instance store volumes

B.Amazon S3 as a block device

C.Amazon EBS gp2 volumes

D.Amazon EBS io2 Block Express volumes

AnswerD

io2 Block Express offers high IOPS and low latency.

Why this answer

Amazon EBS io2 Block Express volumes are the recommended storage configuration for SAP HANA on AWS because they provide up to 4,000 MB/s throughput per volume and 256,000 IOPS, with 99.999% durability. This meets the high-performance, low-latency requirements of SAP HANA, which demands consistent sub-millisecond latency for its columnar in-memory database operations. io2 Block Express volumes also support multi-attach for SAP HANA scale-out configurations and are the only EBS volume type validated by SAP for production HANA workloads.

Exam trap

The trap here is that candidates often choose gp2 volumes (Option C) because they are familiar with general-purpose workloads, but they fail to recognize that SAP HANA requires sustained high IOPS and low latency that only io2 Block Express volumes can guarantee, as gp2's burst model cannot maintain performance for production HANA databases.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 instance store volumes are ephemeral and data is lost on instance stop or termination, making them unsuitable for persistent SAP HANA data and log storage. Option B is wrong because Amazon S3 is an object storage service, not a block device, and cannot be mounted as a filesystem or provide the low-latency block-level access required by SAP HANA. Option C is wrong because Amazon EBS gp2 volumes offer burstable performance with a baseline of 3 IOPS per GB and maximum 16,000 IOPS per volume, which is insufficient for the sustained high IOPS and throughput demands of production SAP HANA workloads.

Full explanation →

855

Multi-Selecteasy

A company is migrating its SAP ERP system from an on-premises environment to AWS. The database is SAP HANA. The migration must minimize downtime. Which TWO approaches should the company consider?

Select 2 answers

A.Use AWS Database Migration Service (DMS) with full load only.

B.Use VM Import/Export to migrate the entire on-premises virtual machine to AWS.

C.Use the SAP Software Provisioning Manager (SWPM) to perform a homogeneous system copy over the network.

D.Use AWS DMS with full load and ongoing change data capture (CDC).

E.Set up SAP HANA System Replication from the on-premises HANA database to AWS HANA.

AnswersD, E

CDC keeps the target updated with minimal downtime.

Why this answer

AWS DMS with full load and ongoing change data capture (CDC) enables a near-zero-downtime migration by continuously replicating changes from the source SAP HANA database to the target on AWS after the initial full load, allowing the cutover to occur with minimal disruption. Option E is correct because SAP HANA System Replication provides a native, asynchronous or synchronous replication mechanism that can be configured between the on-premises HANA database and an AWS-hosted HANA instance, supporting a controlled switchover with very low downtime.

Exam trap

The trap here is that candidates often overlook the native SAP HANA System Replication option (E) because they assume only AWS-native services like DMS are valid, or they mistakenly believe that VM Import/Export (B) can achieve minimal downtime without understanding the need for ongoing replication.

Full explanation →

856

Multi-Selectmedium

Which TWO AWS services can be used to automate the startup and shutdown of SAP application servers based on a schedule to reduce costs? (Select TWO.)

Select 2 answers

A.Amazon CloudWatch Events

B.AWS CodePipeline

C.AWS Instance Scheduler

D.Amazon EC2 Auto Scaling

E.AWS Systems Manager Maintenance Windows

AnswersC, E

Instance Scheduler is a solution to start/stop instances on a schedule.

Why this answer

AWS Instance Scheduler (option C) is a solution that automatically starts and stops EC2 instances based on a schedule, reducing costs for non-production SAP systems. AWS Systems Manager Maintenance Windows (option E) can be configured to stop and start instances during scheduled maintenance windows, enabling automated start/stop. Option A (CloudWatch Events) can trigger actions via Lambda but does not natively schedule instance start/stop.

Option B (CodePipeline) is for CI/CD, not scheduling. Option D (Auto Scaling) adjusts capacity based on demand, not schedule-based start/stop of specific instances.

Full explanation →

857

MCQeasy

A company is planning to run SAP S/4HANA on AWS. They need to ensure that the SAP system can be accessed from the corporate network via a secure VPN connection. Which AWS service should be used to establish this connectivity?

A.AWS Client VPN

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.AWS Direct Connect

AnswerC

Provides secure IPsec VPN between corporate network and AWS VPC.

Why this answer

AWS Site-to-Site VPN creates a secure IPsec tunnel between the corporate network's on-premises VPN device and a Virtual Private Gateway (VGW) attached to the VPC hosting the SAP S/4HANA system. This enables encrypted communication over the public internet, meeting the requirement for secure VPN connectivity from the corporate network to the SAP workload.

Exam trap

The trap here is that candidates confuse AWS Client VPN (remote access for individual users) with Site-to-Site VPN (network-to-network connectivity), or assume Transit Gateway alone provides VPN connectivity without understanding it requires a VPN attachment.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is a managed remote-access VPN service that connects individual clients (e.g., laptops) to AWS, not a site-to-site connection between a corporate network and AWS. Option B is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it does not itself establish a VPN connection; it requires a VPN attachment (e.g., Site-to-Site VPN) to connect to the corporate network. Option D is wrong because AWS Direct Connect provides a dedicated private physical connection, not a VPN over the internet, and does not use IPsec encryption by default; it is a separate service for dedicated bandwidth and lower latency, not a VPN solution.

Full explanation →

858

Multi-Selectmedium

Which TWO AWS services can be used to monitor the performance of an SAP HANA database on AWS? (Select TWO.)

Select 2 answers

A.AWS Trusted Advisor

B.Amazon CloudWatch

C.AWS X-Ray

D.Amazon RDS Performance Insights

E.AWS Config

AnswersB, D

Amazon CloudWatch can monitor SAP HANA metrics such as CPU, memory, and disk I/O, making it a valid choice.

Why this answer

Amazon CloudWatch (option B) can monitor SAP HANA metrics such as CPU, memory, and disk I/O via custom metrics or the SAP HANA plugin. Amazon RDS Performance Insights (option D) provides database-specific performance metrics and SQL-level analysis when SAP HANA is deployed on Amazon RDS. Option A is incorrect because AWS Trusted Advisor offers best-practice checks, not real-time performance monitoring.

Option C is wrong because AWS X-Ray traces application requests, not database performance. Option E is wrong because AWS Config audits configuration changes, not performance.

Exam trap

Candidates may mistakenly choose AWS Trusted Advisor (Option A) for monitoring, but it only provides recommendations, not performance metrics.

Full explanation →

859

Multi-Selecthard

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet high availability and low latency requirements. The company expects traffic to spike unpredictably. Which THREE strategies should the company implement to ensure the application can handle the load? (Choose THREE.)

Select 3 answers

A.Enable API Gateway caching with a suitable TTL

B.Set the Lambda function timeout to the maximum value of 15 minutes

C.Configure provisioned concurrency for the Lambda functions

D.Configure DynamoDB auto scaling with a minimum capacity of 10 read and 10 write capacity units

E.Use DynamoDB on-demand capacity mode for the tables

AnswersA, C, E

Caching reduces backend load and improves response times for repeated requests, helping handle spikes.

Why this answer

API Gateway caching stores responses from your endpoints, reducing the number of calls made to the backend Lambda function and DynamoDB. By setting a suitable TTL, you ensure that frequently accessed data is served from the cache, which lowers latency and offloads the backend during unpredictable traffic spikes. This directly supports high availability by preventing backend overload.

Exam trap

The trap here is that candidates often confuse auto scaling (Option D) with on-demand capacity mode, not realizing that auto scaling has a lag time and requires manual capacity planning, whereas on-demand mode is designed for unpredictable traffic with instant scaling.

Full explanation →

860

MCQhard

A company is migrating an SAP ERP system to AWS. The SAP application servers use a shared /sapmnt filesystem. Which AWS storage solution is most suitable for this shared filesystem with high availability?

A.Amazon S3 with a mount point

B.Amazon FSx for Windows File Server

C.Amazon EBS with Multi-Attach enabled

D.Amazon EFS

AnswerD

EFS provides a shared NFS filesystem with high availability.

Why this answer

(Amazon EFS) is correct because Amazon EFS is a managed NFS filesystem that provides high availability and can be shared across multiple EC2 instances, making it suitable for the shared /sapmnt filesystem required by SAP. Option A (Amazon S3) is wrong because S3 is object storage, not a POSIX-compliant filesystem, and cannot be mounted as a shared filesystem. Option B (Amazon FSx for Windows File Server) is incorrect because SAP typically runs on Linux, and FSx for Windows is designed for Windows workloads.

Option C (Amazon EBS with Multi-Attach) is not ideal because EBS Multi-Attach has limitations (max 16 instances, single Availability Zone) and is not as scalable or resilient as EFS for this use case.

Exam trap

The /sapmnt filesystem must be accessible from multiple application servers simultaneously. While EBS Multi-Attach can technically attach a volume to multiple instances, it is not recommended for SAP workloads due to limited concurrency and lack of managed high availability. EFS is the correct choice.

Full explanation →

861

MCQeasy

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for PostgreSQL database. The operations team reports that the application becomes unresponsive for about 30 seconds every hour at the same time. The team checks the ALB access logs and notices that during the outage, the ALB returns HTTP 504 errors. The RDS monitoring shows a spike in CPU usage and active connections during the same period. The application team confirms there are no scheduled jobs during that time. What should the team do to diagnose the root cause?

A.Review the security group rules for the database to ensure the application can connect.

B.Review the ALB target group health checks and ensure the EC2 instances are passing the health check.

C.Increase the EC2 instance size to handle more concurrent connections.

D.Check the RDS Enhanced Monitoring metrics for the database instance to identify resource bottlenecks such as high memory pressure or disk I/O.

AnswerD

Enhanced Monitoring provides detailed OS-level metrics to pinpoint the root cause of the database spike.

Why this answer

The symptoms—hourly 30-second unresponsiveness, HTTP 504 errors from the ALB, and a correlated spike in RDS CPU and active connections—point to a database-side bottleneck. RDS Enhanced Monitoring provides OS-level metrics (memory, disk I/O, CPU) that can reveal resource contention or throttling events (e.g., swap usage, IOPS exhaustion) not visible in standard CloudWatch metrics, enabling precise root cause identification.

Exam trap

The trap here is that candidates confuse HTTP 504 errors with ALB or EC2 health check failures, but 504 specifically indicates the ALB received no response from the target (often due to database timeout), not that the target is unhealthy.

How to eliminate wrong answers

Option A is wrong because security group rules are static and would cause persistent connectivity failures, not a predictable hourly 30-second outage. Option B is wrong because ALB target group health checks failing would cause 503 errors (not 504) and would not explain the correlated RDS CPU/connection spike. Option C is wrong because increasing EC2 instance size addresses compute capacity on the application tier, but the bottleneck is on the database tier (RDS CPU/connections spike), so it would not resolve the root cause.

Full explanation →

862

MCQmedium

A company has deployed SAP on AWS with a shared file system using Amazon EFS for the /sapmnt directory. The EFS file system is mounted on all SAP application servers. Recently, users reported that the SAP system is slow when accessing reports that are stored as PDF files in the /sapmnt directory. The operations team checks the CloudWatch metrics and finds that the EFS file system's PercentIOLimit metric is consistently at 100% during peak hours. The file system is using the General Purpose performance mode. The team also notices that the BurstCreditBalance is decreasing over time. What action should be taken to resolve this performance issue?

A.Enable EFS lifecycle management to move infrequently accessed files to Infrequent Access storage class.

B.Increase the size of the EFS file system to improve performance.

C.Increase the burst credit balance by enabling throughput mode.

D.Switch the EFS performance mode to Max I/O to get higher throughput.

AnswerB

Correct. Increasing the file system size increases baseline throughput (50 MiB/s per TB) and burst credit accumulation, directly addressing the performance issue.

Why this answer

Increasing the size of the EFS file system increases the baseline throughput (which scales at 50 MiB/s per TB of storage) and also increases the rate at which burst credits are earned, helping to reduce the percent I/O limit and rebuild the burst credit balance. Option A is wrong because lifecycle management only moves files to Infrequent Access, which does not improve I/O performance and may add latency. Option C is wrong because enabling Provisioned Throughput does not increase the burst credit balance; it provides a fixed throughput independent of credits, but the wording is misleading.

Option D is wrong because the EFS performance mode cannot be changed after creation; it is set when the file system is created.

Full explanation →

863

MCQmedium

A company is migrating its SAP environment to AWS. The operations team needs to ensure that all changes to the SAP infrastructure are tracked and that unauthorized changes are detected. Which AWS service should they use?

A.AWS CloudTrail

B.AWS Config

C.Amazon GuardDuty

D.AWS Trusted Advisor

AnswerB

AWS Config provides configuration history and compliance checking.

Why this answer

AWS Config records configuration changes and enables compliance monitoring, making it the right choice for tracking changes and detecting unauthorized changes. CloudTrail records API calls, not configuration state. GuardDuty is for threat detection.

Trusted Advisor provides best practice checks.

Full explanation →

864

MCQmedium

Refer to the exhibit. An operations team uses this CloudFormation template to launch SAP application servers. After deployment, the application server fails to join the SAP system. The team verified that the security group allows outbound traffic to the SAP system. What is the MOST likely cause?

A.The instance type is not specified correctly.

B.The security group ID is not properly referenced.

C.The user data script is not base64 encoded correctly.

D.The `LatestAmiId` parameter is not defined in the template.

AnswerD

!Ref LatestAmiId requires a parameter or mapping that is not defined.

Why this answer

The template uses `!Ref LatestAmiId` which does not exist as a parameter; it should be a parameter or a mapping. Option A is wrong because the instance type is parameterized. Option B is wrong because the security group is referenced correctly.

Option C is wrong because the user data script is base64 encoded correctly.

Full explanation →

865

MCQhard

A company is migrating an SAP ERP system to AWS using an SAP-certified backup/restore method. After restoring the database to Amazon RDS for SAP ASE, the SAP application fails to start with an error 'database connection refused'. The security group allows inbound traffic from the application server. What is the most likely cause?

A.The RDS instance is in a 'stopped' state

B.The security group does not allow outbound traffic

C.The SAP application is using the wrong database hostname or port

D.The RDS instance is in a different VPC than the application server

AnswerC

After migration, the hostname/port may differ; need to update SAP profile.

Why this answer

After restoring the database to Amazon RDS, the database endpoint (hostname and port) changes. The SAP application likely still uses the old connection parameters, leading to a 'connection refused' error. Option A is incorrect because, although a stopped RDS instance would also cause this error, after a restore the instance is automatically started and running; a stopped state is unlikely.

Option B is incorrect because outbound traffic rules are not required for inbound connections; the inbound rule on the database security group is sufficient. Option D is incorrect because different VPCs would typically result in 'no route to host' or timeout errors, not 'connection refused'.

Full explanation →

866

MCQhard

A company is migrating its SAP ERP system running on Oracle to SAP HANA on AWS. The system has a database size of 2 TB. During migration planning, the team needs to minimize downtime. Which strategy should be used?

A.Take a full backup of Oracle, restore to SAP HANA, and then apply incremental logs.

B.Use SAP HANA System Replication to initially load data from the source SAP HANA (or migrate using SAP DMO with SUM) and then switch over.

C.Use the AWS Database Migration Service (DMS) to perform an online migration from Oracle to SAP HANA.

D.Perform an export/import using SAP tools while the source database is online.

AnswerB

SAP HANA System Replication allows near-zero downtime migration by replicating data while source is online.

Why this answer

SAP DMO (Database Migration Option) with SUM (Software Update Manager) is the recommended approach for migrating SAP systems to SAP HANA with minimal downtime. It performs a heterogeneous migration directly from Oracle to SAP HANA, using a combination of initial data load and subsequent delta replication to reduce the final cutover window. This method is specifically designed for SAP landscapes and supports near-zero downtime migration scenarios.

Exam trap

The trap here is that candidates often assume AWS DMS can handle any database migration, but it lacks support for SAP HANA as a target and cannot manage SAP-specific metadata and dependencies required for a successful migration.

How to eliminate wrong answers

Option A is wrong because restoring an Oracle full backup directly to SAP HANA is not possible; SAP HANA uses a completely different storage engine and data format, requiring a logical migration via SAP tools. Option C is wrong because AWS DMS does not support SAP HANA as a target for heterogeneous migrations from Oracle; DMS is designed for standard relational databases, not SAP-specific systems. Option D is wrong because performing an export/import while the source is online can cause data inconsistency and does not provide a mechanism for incremental replication, leading to longer downtime during the final cutover.

Full explanation →

867

MCQmedium

A company is deploying a new SAP HANA database on AWS and needs to ensure the EBS volumes are optimized for throughput. Which EBS volume type should be used for the HANA data and log volumes?

A.sc1

B.io2 Block Express

C.gp3

D.st1

AnswerB

io2 Block Express offers high performance and is certified for SAP HANA.

Why this answer

For SAP HANA data and log volumes, io2 Block Express (option B) is the correct choice because it provides the highest throughput and IOPS consistency required for SAP HANA's demanding workload. io2 Block Express supports up to 256,000 IOPS and 4,000 MB/s throughput per volume, with 99.999% durability, making it ideal for mission-critical SAP HANA databases on AWS.

Exam trap

The trap here is that candidates may choose gp3 (option C) because it is a general-purpose SSD that can be provisioned with higher IOPS, but they overlook that SAP HANA specifically requires the ultra-low latency and high throughput consistency of io2 Block Express for log volumes, and that gp3's maximum IOPS and throughput are insufficient for large-scale SAP HANA deployments.

How to eliminate wrong answers

Option A (sc1) is wrong because sc1 is a cold HDD volume type designed for infrequently accessed, throughput-oriented workloads with low cost, but it cannot meet the high IOPS and low latency requirements of SAP HANA. Option C (gp3) is wrong because while gp3 offers balanced performance and can be used for some SAP workloads, it does not provide the consistent sub-millisecond latency and high throughput needed for SAP HANA log volumes, and its maximum IOPS (16,000) is significantly lower than io2 Block Express. Option D (st1) is wrong because st1 is a throughput-optimized HDD volume type intended for big data and log processing, but it has burstable performance and cannot sustain the high IOPS and low latency required for SAP HANA data and log volumes.

Full explanation →

868

Multi-Selectmedium

Which TWO of the following are required for SAP HANA high availability on AWS using HANA System Replication (HSR) with automatic failover? (Select TWO.)

Select 2 answers

A.Application Auto Scaling to automatically scale HANA instances.

B.An Amazon Route 53 health check that monitors the primary instance and updates a DNS record to the secondary IP on failure.

C.An Elastic Load Balancer (ELB) in front of the HANA instances to distribute traffic.

D.Placement of primary and secondary HANA instances in different Availability Zones.

E.An Amazon Route 53 alias record pointing to the primary instance's private IP.

AnswersB, D

Route 53 health checks can be used to update DNS for automatic failover.

Why this answer

Amazon Route 53 health checks can monitor the primary HANA instance's availability. On failure, a Route 53 failover routing policy automatically updates the DNS record to point to the secondary instance's private IP, enabling clients to reconnect without manual intervention. This is a key component of HANA System Replication (HSR) with automatic failover on AWS.

Exam trap

The trap here is that candidates often confuse load balancers (ELB) with DNS-based failover, but ELBs are stateless and cannot handle HANA's direct client connections or replication state, making Route 53 health checks with failover routing the correct choice for HSR automatic failover.

Full explanation →

869

MCQmedium

A company is running SAP on AWS and wants to ensure high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which architecture meets this requirement?

A.Deploy ASCS and ERS on the same EC2 instance with S3 replication.

B.Configure Route 53 health checks to switch between two instances in the same AZ.

C.Deploy ASCS and ERS on separate EC2 instances in different Availability Zones, with a Network Load Balancer.

D.Use a single EC2 instance with an S3 bucket for shared storage and Lambda for failover.

AnswerC

Multi-AZ with separate instances and NLB ensures HA.

Why this answer

SAP Central Services (ASCS) and Enqueue Replication Server (ERS) must run on separate EC2 instances in different Availability Zones to achieve high availability. A Network Load Balancer (NLB) is used to distribute traffic and provide a single endpoint, while the enqueue replication mechanism (enrep) synchronizes the lock table between the two instances, enabling automatic failover without data loss.

Exam trap

The trap here is that candidates often assume ASCS and ERS can be co-located on the same instance or in the same AZ for simplicity, but the PAS-C01 exam explicitly tests the requirement for separate instances in different AZs with an NLB to meet SAP's HA architecture for critical services.

How to eliminate wrong answers

Option A is wrong because deploying ASCS and ERS on the same EC2 instance creates a single point of failure; S3 replication does not provide the low-latency shared storage or enqueue replication required for SAP HA. Option B is wrong because placing both instances in the same Availability Zone does not protect against AZ-level failures, and Route 53 health checks alone cannot handle the rapid, stateful failover required for SAP enqueue replication. Option D is wrong because a single EC2 instance is a single point of failure, S3 is not a supported shared filesystem for SAP (it lacks POSIX semantics and low latency), and Lambda cannot perform the real-time enqueue replication or orchestrate the failover of SAP Central Services.

Full explanation →

870

Multi-Selecthard

An SAP system is running on AWS with a Multi-AZ deployment. The system uses an Amazon RDS for SAP HANA database. Which TWO actions should be taken to ensure high availability?

Select 2 answers

A.Create a read replica in a different region

B.Configure automated backups with a retention period

C.Enable Multi-AZ on the RDS instance

D.Deploy the RDS instance in a single Availability Zone

E.Take manual snapshots every hour

AnswersB, C

Automated backups enable point-in-time recovery, which is essential for HA.

Why this answer

Enabling Multi-AZ on RDS automatically provisions a standby in a different AZ and handles failover. Configuring automated backups allows point-in-time recovery. Read replicas are for read scaling, not HA.

Manual snapshots are not automatic. Using a single AZ does not provide HA.

Full explanation →

871

MCQeasy

A company wants to migrate its SAP BusinessObjects system to AWS. The system includes a CMS database that runs on Microsoft SQL Server. The company wants to use AWS DMS to migrate the database with minimal downtime. Which migration method should they use?

A.Snapshot restore to Amazon RDS

B.Full load with one-time restore

C.Full load with ongoing replication (change data capture)

D.Full load only

AnswerC

Ongoing replication syncs changes, minimizing downtime.

Why this answer

Ongoing replication (change data capture) allows DMS to keep the target database in sync with the source, minimizing downtime. Options A, B, D are incorrect because full load only, one-time restore, or snapshot restore do not minimize downtime.

Full explanation →

872

MCQmedium

A company is running SAP HANA on an EC2 instance. The storage is configured with multiple EBS volumes striped using LVM. The SAP administrator notices that disk I/O latency spikes during peak hours. Which change would MOST effectively reduce latency without incurring additional cost?

A.Increase the size of the EBS volumes

B.Provision additional IOPS on the EBS volumes

C.Switch from LVM to RAID 0 striping

D.Use an EBS-optimized EC2 instance type

AnswerD

EBS-optimized instances provide dedicated bandwidth to EBS, reducing latency.

Why this answer

Using an EBS-optimized EC2 instance provides dedicated network bandwidth for EBS I/O, which reduces contention and latency without additional cost if the instance type already supports it. Option A is incorrect because increasing the size of EBS volumes does not directly reduce latency. Option B is incorrect because provisioning additional IOPS incurs extra cost, contradicting the requirement.

Option C is incorrect because switching to RAID 0 striping improves throughput but does not lower latency.

Full explanation →

873

MCQmedium

A company is running SAP HANA on a memory-optimized EC2 instance with an EBS volume for /hana/data and /hana/log. The database administrator notices that the /hana/log volume is experiencing high write latency. The current volume is a gp2 volume with 1000 GB size. Which change would most effectively reduce write latency?

A.Change the volume type to st1 (throughput optimized) for better write throughput.

B.Increase the volume size to 2000 GB to get more IOPS.

C.Enable Multi-Attach on the volume to distribute writes.

D.Ensure the EC2 instance is EBS-optimized and use a higher instance type with dedicated EBS bandwidth.

AnswerD

EBS-optimized instances provide dedicated throughput to EBS, reducing latency.

Why this answer

Using EBS-optimized instances with dedicated EBS bandwidth reduces contention and latency, improving write performance for SAP HANA log. Option A is wrong because changing to st1 is not ideal for log writes; st1 is optimized for throughput, not low latency, and has variable performance. Option B is wrong because increasing volume size increases baseline IOPS for gp2 but does not directly address write latency; latency is influenced more by burst credits and instance EBS bandwidth.

Option C is wrong because enabling Multi-Attach does not reduce latency; it allows multiple instances to attach the same volume but can introduce contention.

Full explanation →

874

MCQmedium

An SAP system uses a Network Load Balancer (NLB) to distribute traffic to SAP application servers. The application servers are in private subnets. The operations team notices that the health checks are failing for one of the application servers. The health check is configured to use TCP on port 3200. The application server's security group allows inbound traffic on port 3200 from the NLB's subnet CIDR. The network ACL allows inbound and outbound traffic on ephemeral ports. What is the most likely cause of the health check failure?

A.The security group does not allow inbound traffic from the NLB's private IP addresses.

B.The network ACL is blocking the health check traffic.

C.The SAP application is not listening on port 3200.

D.The NLB is configured to use the instance's public IP address.

AnswerC

Correct. The health check failure is isolated to one instance, and the network configuration (security group and NACL) is correct. Therefore, the most likely cause is that the SAP application on that instance is not listening on port 3200. This could be due to the application service not running, a misconfiguration, or the instance not being properly joined to the SAP system.

Why this answer

The health check failure is isolated to one instance, and the security group is configured correctly to allow traffic from the NLB's subnet CIDR on port 3200. The network ACL allows ephemeral ports. Therefore, the most likely cause is that the SAP application on that instance is not listening on port 3200.

This could be due to the application service not running, a misconfiguration, or the instance not being properly joined to the SAP system.

Exam trap

A common trap is to assume that security group rules are the issue when health checks fail, even when the security group seems correctly configured. However, if the security group allows traffic from the NLB's subnet CIDR, the problem is more likely at the application level. Remember that health check failures can also occur if the application itself is not responding on the health check port.

Full explanation →

875

MCQmedium

A company is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The database is 5 TB and the migration must be completed within a 2-hour downtime window. Which AWS service should be used to perform the initial full load and then replicate ongoing changes?

A.AWS Snowball Edge

B.AWS Database Migration Service (DMS)

C.AWS Application Migration Service (MGN)

D.AWS DataSync

AnswerB

Supports full load and ongoing replication.

Why this answer

AWS DMS can perform a full load and then continuously replicate changes. Option A (AWS Snowball Edge) is for large data transfer but does not support ongoing replication. Option C (AWS Application Migration Service) is for server migration.

Option D (AWS DataSync) is for file transfers.

Full explanation →

876

MCQhard

A company is running SAP HANA on AWS using a scale-out architecture with multiple worker nodes. The system is used for real-time analytics. Recently, query performance has degraded. The HANA administrator notices that the data is not evenly distributed across nodes. What is the best course of action?

A.Redistribute the tables across nodes using HANA's table partitioning features.

B.Increase the memory allocation for the HANA database.

C.Add more worker nodes to the scale-out cluster to distribute the load.

D.Upgrade the EC2 instance type of all nodes to a memory-optimized type.

AnswerA

Partitioning and redistribution ensures even data distribution.

Why this answer

SAP HANA's table partitioning features allow you to redistribute data across worker nodes in a scale-out architecture, addressing the root cause of uneven data distribution. This rebalancing improves query performance by ensuring parallel processing and minimizing data movement between nodes. The HANA administrator can use commands like ALTER TABLE ...

REBALANCE or partition management to achieve even distribution.

Exam trap

The trap here is that candidates often confuse scaling up (increasing resources) or scaling out (adding nodes) with the need to rebalance existing data, assuming that more capacity alone will fix performance degradation caused by data skew.

How to eliminate wrong answers

Option B is wrong because increasing memory allocation does not fix uneven data distribution; it only addresses memory pressure, not the logical imbalance of data across nodes. Option C is wrong because adding more worker nodes without redistributing existing data will not solve the uneven distribution; new nodes would remain underutilized while overloaded nodes continue to degrade performance. Option D is wrong because upgrading EC2 instance types to memory-optimized instances improves per-node capacity but does not redistribute data; the underlying skew remains, and query performance will still suffer due to uneven load.

Full explanation →

877

MCQhard

An SAP Basis team is designing a high-availability (HA) setup for SAP NetWeaver on AWS. They plan to use a shared file system for transport directories. Which storage solution provides the most cost-effective NFS share with support for automatic failover across Availability Zones?

A.Amazon Elastic File System (EFS)

B.Amazon EBS Multi-Attach gp3 volume

C.Amazon FSx for NetApp ONTAP

D.Amazon S3 with AWS Storage Gateway file gateway

AnswerC

FSx for NetApp ONTAP provides a fully managed NFS share with cross-AZ HA, suitable for SAP transport directories.

Why this answer

Amazon FSx for NetApp ONTAP is the correct choice because it provides a fully managed, highly available NFS share that supports automatic failover across Availability Zones (AZs) using NetApp's SnapMirror and multi-AZ HA pair architecture. It is the most cost-effective solution for SAP transport directories that require a shared file system with cross-AZ failover, as it offers native NFSv3/v4.1 support, consistent performance, and lower total cost of ownership compared to alternatives for this specific SAP workload.

Exam trap

The trap here is that candidates often assume Amazon EFS is the default choice for any NFS workload on AWS due to its simplicity and regional failover, but they overlook that FSx for NetApp ONTAP is specifically optimized for SAP workloads with better cost efficiency and performance consistency for transport directories, making it the correct answer in this context.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a regional NFS service that provides automatic failover across AZs, but it is not the most cost-effective for SAP transport directories due to higher per-GB storage costs and potential performance inconsistencies under high I/O workloads typical of SAP. Option B is wrong because Amazon EBS Multi-Attach gp3 volumes cannot span across Availability Zones; they are limited to a single AZ and do not support automatic failover across AZs, making them unsuitable for HA across AZs. Option D is wrong because Amazon S3 with AWS Storage Gateway file gateway does not provide native NFS failover across AZs; it relies on a single file gateway appliance in one AZ, and while S3 is durable, the gateway itself is a single point of failure without built-in automatic cross-AZ failover for NFS.

Full explanation →

878

MCQmedium

A company is migrating an SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which architecture should be used to meet this requirement?

A.Use a cluster of EC2 instances across two Availability Zones with shared storage and a cluster manager.

B.Deploy the ASCS on a single large EC2 instance with a Multi-Attach EBS volume.

C.Use an Auto Scaling group with a launch configuration for ASCS.

D.Deploy two EC2 instances in the same Availability Zone with a replicated file system.

AnswerA

This provides HA across AZs with failover.

Why this answer

SAP Central Services (ASCS) requires a high-availability cluster that can fail over between physical hosts while maintaining shared storage and a quorum mechanism. Deploying a cluster of EC2 instances across two Availability Zones with shared storage (e.g., Amazon EFS or FSx for NetApp ONTAP) and a cluster manager (e.g., Pacemaker) meets this requirement by providing automatic failover and data consistency. This architecture aligns with SAP's official high-availability guidelines for AWS, which mandate multi-AZ deployment to tolerate an entire AZ failure.

Exam trap

The trap here is that candidates often confuse high availability with fault tolerance or scalability, leading them to choose Auto Scaling (Option C) or a single-instance Multi-Attach EBS (Option B), which do not provide the automatic failover and AZ-level resilience required for SAP ASCS.

How to eliminate wrong answers

Option B is wrong because a single large EC2 instance with a Multi-Attach EBS volume provides no high availability; if the instance or AZ fails, ASCS becomes unavailable. Option C is wrong because Auto Scaling groups are designed for stateless, horizontally scalable workloads, not for stateful SAP ASCS instances that require a fixed cluster quorum and shared storage. Option D is wrong because deploying two EC2 instances in the same Availability Zone does not protect against an AZ failure, which is a key requirement for high availability; a replicated file system alone cannot ensure automatic failover without a cluster manager.

Full explanation →

879

Multi-Selecteasy

A company is migrating a SAP system to AWS and wants to use AWS Systems Manager for patching. Which TWO prerequisites are required to use AWS Systems Manager Patch Manager?

Select 2 answers

A.The EC2 instance must be in a public subnet.

B.The EC2 instance must be running Amazon Linux 2.

C.The AWS Systems Manager Agent (SSM Agent) must be installed on the EC2 instance.

D.An IAM role with permissions for Systems Manager must be attached to the EC2 instance.

E.A maintenance window must be configured with a reboot option.

AnswersC, D

Correct: The SSM Agent must be installed and running on the instance to enable patching via Patch Manager.

Why this answer

Correct options are C and D. The SSM Agent must be installed and running on the EC2 instances (C), and the instances must have an IAM role that grants Systems Manager permissions (D). Option A is incorrect because Patch Manager works with instances in private subnets as long as they have outbound internet access or a VPC endpoint.

Option B is incorrect because Patch Manager supports multiple operating systems, not just Amazon Linux 2. Option E is incorrect because a maintenance window is not strictly required for Patch Manager; patching can be done on demand.

Full explanation →

880

MCQeasy

An SAP system on AWS is configured with a Multi-AZ deployment for high availability. During a failover test, the operations team notices that the secondary instance does not take over correctly. What is the most likely cause?

A.The SAP application layer is not configured to retry connections.

B.The CloudWatch alarm thresholds for failover are set too high.

C.The route tables or security groups do not allow traffic to the secondary instance.

D.The secondary instance's IP address is not automatically updated in DNS.

AnswerC

Network configuration errors can prevent failover from completing.

Why this answer

After a failover, the secondary instance becomes the active one, and if route tables or security groups do not permit traffic to it, clients cannot connect, causing the failover to appear ineffective. Option A is incorrect because the SAP application layer retry connections may affect user experience but not the failover mechanism itself. Option B is incorrect because CloudWatch alarms are monitoring thresholds and do not directly control failover behavior.

Option D is incorrect because in a properly configured Multi-AZ setup, IP address changes are handled automatically (e.g., via Elastic IP or DNS updates), so this is less likely to be the root cause.

Full explanation →

881

MCQeasy

A company has an SAP HANA database running on an RDS for SAP HANA instance. The operations team wants to automate the backup process and retain backups for 90 days. Which AWS service should they use?

A.RDS automated backups

B.Amazon S3 lifecycle policies

C.AWS Backup

D.AWS Storage Gateway

AnswerC

AWS Backup can schedule and retain backups for 90 days.

Why this answer

AWS Backup is the correct answer because it provides a centralized backup service that can automate and retain backups of RDS for SAP HANA instances with custom retention policies, including beyond 35 days. Options A and B are incorrect: RDS automated backups are limited to a maximum retention of 35 days, and Amazon S3 lifecycle policies manage object lifecycles, not database backups. Option D is incorrect because AWS Storage Gateway is a hybrid storage service, not a backup service for RDS.

Exam trap

Candidates may confuse RDS automated backups (which have a 35-day retention limit) with the ability to retain manual snapshots. AWS Backup can manage manual snapshots and automate their retention for longer periods.

Full explanation →

882

MCQeasy

A company is migrating its SAP application from on-premises to AWS. The SAP application uses a shared file system (NFS) for transport directories. Which AWS service should the company use to replace the on-premises NFS?

A.Amazon FSx for Windows File Server

B.Amazon S3

C.Amazon EBS

D.Amazon EFS

AnswerD

Amazon EFS supports NFS and can be shared across instances for SAP transport directories.

Why this answer

Amazon EFS provides a scalable NFS file system that can be shared across multiple EC2 instances, making it suitable for SAP transport directories. Option A is wrong because Amazon FSx for Windows File Server uses SMB protocol, not NFS. Option B is wrong because Amazon S3 is object storage, not a file system.

Option C is wrong because Amazon EBS is block storage attached to a single instance and cannot be shared across multiple instances natively.

Full explanation →

883

MCQeasy

A company is running SAP S/4HANA on AWS with an RDS for SAP HANA database. The operations team needs to perform a minor version upgrade of the database. They want to minimize downtime and ensure that the upgrade can be rolled back if needed. What should they do?

A.Take a manual snapshot before the upgrade, then perform the upgrade.

B.Enable Multi-AZ, then perform the upgrade.

C.Use the clone feature of SAP HANA to create a copy.

D.Create a read replica, promote it after the upgrade.

AnswerA

Snapshot allows restore to pre-upgrade state if needed.

Why this answer

Taking a manual snapshot before the upgrade provides a point-in-time backup that can be restored if the upgrade fails, enabling a rollback. RDS minor version upgrades are typically performed with minimal downtime (usually a few minutes). Option B is incorrect because enabling Multi-AZ does not provide a rollback mechanism; it only provides high availability during the upgrade.

Option C is incorrect because the clone feature is specific to SAP HANA native tools, not RDS; RDS for SAP HANA does not support cloning for version upgrades. Option D is incorrect because creating a read replica does not facilitate rollback of the primary instance; read replicas are used for read scaling and cannot be used to revert an upgrade on the source.

Full explanation →

884

MCQhard

A company is migrating its SAP ERP system to AWS using the SAP S/4HANA migration approach. They need to replicate the source system continuously to the target before cutover. Which AWS service should be used for this continuous replication?

A.AWS Schema Conversion Tool (SCT)

B.AWS Server Migration Service (SMS)

C.AWS Database Migration Service (DMS)

D.AWS CloudEndure Migration

AnswerD

AWS CloudEndure Migration provides continuous block-level replication for entire servers, including SAP systems. It is the appropriate service for replicating the source system continuously to AWS before cutover in SAP S/4HANA migrations.

Why this answer

AWS CloudEndure Migration provides continuous block-level replication from on-premises servers to AWS, making it suitable for SAP S/4HANA migrations requiring ongoing replication before cutover. AWS SCT (A) is for schema conversion, not replication. AWS SMS (B) migrates entire servers but does not support continuous replication.

AWS DMS (C) can replicate databases but has limitations for SAP-specific workloads and is not the recommended service for SAP S/4HANA continuous replication. Therefore, AWS CloudEndure (D) is the correct choice.

Full explanation →

885

MCQeasy

An SAP system administrator needs to ensure that all SAP application logs are centrally collected and monitored for errors. Which AWS service should they use to aggregate logs from multiple EC2 instances?

A.Amazon S3 with server access logs

B.Amazon Kinesis Data Firehose

C.Amazon CloudWatch Logs

D.AWS Lambda to process logs from each instance

AnswerC

CloudWatch Logs with the unified CloudWatch agent can collect and aggregate logs from multiple EC2 instances.

Why this answer

Amazon CloudWatch Logs is the correct service because it provides a centralized, agent-based log aggregation solution. The CloudWatch Logs agent (or unified CloudWatch agent) can be installed on each EC2 instance to automatically collect, encrypt, and stream SAP application logs to a central CloudWatch Logs group. This allows the administrator to monitor logs in real time, set metric filters for error patterns, and trigger alarms without needing to build custom infrastructure.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose as a direct log collector, but it requires a separate data producer and is not an agent-based aggregation service like CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with server access logs only captures HTTP requests made to the S3 bucket itself, not application logs from EC2 instances. Option B is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service that requires a separate producer (e.g., a CloudWatch Logs subscription filter or a custom agent) to send logs; it does not natively collect logs from EC2 instances without additional setup. Option D is wrong because AWS Lambda is a serverless compute service that can process logs but cannot directly aggregate them from multiple EC2 instances; it would need to be triggered by another service (like CloudWatch Logs or S3) and is not designed for continuous log collection.

Full explanation →

886

Multi-Selecteasy

A company is migrating an SAP HANA database to AWS. The database must be backed up automatically. Which TWO AWS services can be used for this purpose? (Choose 2.)

Select 2 answers

A.Amazon RDS

B.Amazon S3

C.AWS Database Migration Service

D.AWS Backup

E.Amazon EFS

AnswersB, D

SAP HANA can back up directly to S3 using the S3 API.

Why this answer

Amazon S3 is correct because it can be used as a target for SAP HANA backup and recovery using the SAP HANA Backup to S3 feature, which allows direct backup of HANA databases to S3 buckets via the SAP HANA Studio or hdbsql commands. AWS Backup is correct because it provides a fully managed backup service that can automate and centralize backups of SAP HANA databases running on Amazon EC2 instances, using the AWS Backup console or API to create and manage backup policies.

Exam trap

The trap here is that candidates often confuse AWS Database Migration Service (DMS) as a backup tool because it can replicate data, but DMS is for migration and continuous replication, not for creating point-in-time backups of SAP HANA databases.

Full explanation →

887

Multi-Selectmedium

A company is designing a disaster recovery (DR) strategy for a critical application that runs on EC2 instances in a single AWS Region. The application uses an Amazon RDS MySQL Multi-AZ DB instance. The company wants to achieve a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 15 minutes for both compute and database tiers. Which TWO options should the company implement? (Choose TWO.)

Select 2 answers

A.Configure a cross-Region read replica for the RDS MySQL DB instance in the secondary Region

B.Create Amazon Machine Images (AMIs) of the EC2 instances and copy them to the secondary Region

C.Use Amazon EBS snapshots of the EC2 instances and copy them to the secondary Region every minute

D.Migrate the database to Amazon Aurora MySQL and configure an Aurora Global Database

E.Enable cross-Region automated backups for the RDS Multi-AZ DB instance

AnswersA, B

A cross-Region read replica can be promoted to a primary in seconds, meeting the RPO of 1 minute.

Why this answer

A cross-Region read replica for RDS MySQL can be promoted to a standalone primary in the secondary Region within minutes, meeting the 15-minute RTO. The asynchronous replication lag is typically under 1 minute, satisfying the 1-minute RPO. This provides a managed, low-latency DR database tier without needing to restore from backups.

Exam trap

The trap here is that candidates may confuse cross-Region automated backups (Option E) with cross-Region read replicas, not realizing that backups have a higher RPO and longer restore times, while read replicas provide near-real-time replication and faster promotion.

Full explanation →

888

MCQeasy

A company wants to implement a backup strategy for SAP HANA on AWS. The backup must be stored securely and be accessible for restore to a different AWS Region. Which combination of AWS services should be used?

A.Take EBS snapshots and copy them to another region

B.Use AWS Backup with cross-region backup copy

C.Store HANA backups in Amazon S3 Standard-IA

D.Use Amazon S3 Glacier Deep Archive

AnswerB

AWS Backup supports cross-region copies and is integrated with HANA.

Why this answer

AWS Backup with cross-region backup copy is the correct choice because it provides a fully managed, policy-driven backup service that natively supports SAP HANA on Amazon EC2, including automated cross-region copy for disaster recovery. This ensures backups are stored securely (encrypted at rest and in transit) and can be restored in a different AWS Region without manual intervention.

Exam trap

The trap here is that candidates often assume EBS snapshots (Option A) are sufficient for database backups, overlooking the need for application-consistent backups and the managed cross-region replication that AWS Backup provides.

How to eliminate wrong answers

Option A is wrong because EBS snapshots alone do not provide application-consistent backups for SAP HANA; they capture only the block-level state of the volume, which can lead to data corruption if the database is not quiesced. Option C is wrong because storing HANA backups directly in Amazon S3 Standard-IA does not include built-in cross-region copy capabilities, requiring additional custom scripting and infrastructure to replicate backups to another region. Option D is wrong because Amazon S3 Glacier Deep Archive is designed for long-term archival with retrieval times of 12 hours or more, making it unsuitable for operational backups that need to be accessible for restore to a different region within acceptable recovery time objectives (RTOs).

Full explanation →

889

MCQhard

A global company is migrating its SAP ERP system to AWS. The system runs SAP ECC on IBM AIX with Oracle Database. The company plans to move to SAP S/4HANA on AWS. The source system is 5 TB in size. The network bandwidth between the on-premises data center and AWS is 100 Mbps. The migration must be completed within a 2-week window with minimal downtime. The company has a SAP license that allows running S/4HANA on certified hardware. They have already used AWS SCT to convert the database schema to SAP HANA-compatible format. They now need to execute the data migration. The team is considering the following options: Option A: Use AWS DMS with ongoing replication from Oracle to HANA, then perform a final cutover. Option B: Use AWS Snowball Edge to transfer the Oracle backup files to AWS, then restore to HANA. Option C: Use AWS DataSync to copy the Oracle data files to Amazon EFS, then import into HANA. Option D: Use SAP HANA system replication from the source Oracle database to the target HANA database. Which option is the most feasible and efficient for this migration?

A.Use SAP HANA system replication from the source Oracle database to the target HANA database

B.Use AWS Snowball Edge to transfer the Oracle backup files to AWS, then restore to HANA

C.Use AWS DataSync to copy the Oracle data files to Amazon EFS, then import into HANA

D.Use AWS DMS with ongoing replication from Oracle to HANA, then perform a final cutover

AnswerD

DMS supports heterogeneous migrations and ongoing replication to minimize downtime.

Why this answer

The most feasible because AWS DMS supports heterogeneous migrations from Oracle to SAP HANA, and the ongoing replication capability minimizes downtime during the cutover. Option A (SAP HANA system replication) is incorrect because it requires the source database to already be SAP HANA, not Oracle. Option B (Snowball Edge) is inefficient for this scenario because restoring from backup files does not provide ongoing replication, and the 2-week window with minimal downtime would be difficult to achieve.

Option C (DataSync to EFS) is designed for file transfers, not database migration, and importing into HANA would require additional complex steps. The schema conversion has already been done with AWS SCT, so DMS can handle the data migration efficiently.

Full explanation →

890

MCQeasy

An SAP administrator runs the df command on an SAP HANA server and sees the output above. The /hana/data filesystem is 96% full. Which action should be taken to prevent the database from running out of space?

A.Increase the IOPS of the EBS volume

B.Delete old database logs to free up space

C.Increase the size of the EBS volume and extend the filesystem

D.Migrate the database to a larger instance type

AnswerC

This is the standard procedure to add more disk space.

Why this answer

The correct action is to increase the size of the EBS volume and extend the filesystem because the /hana/data filesystem is 96% full, and SAP HANA requires sufficient free space for data growth and savepoint operations. Simply increasing the EBS volume size without extending the filesystem (e.g., using resize2fs or xfs_growfs) would not make the additional space available to the operating system. This approach directly addresses the capacity issue without unnecessary changes to performance or instance type.

Exam trap

A common misconception in the AWS SAP on AWS Specialty exam is that modifying performance parameters like IOPS or changing the instance type can resolve storage capacity issues. In reality, only resizing the underlying EBS volume and extending the filesystem (e.g., with xfs_growfs or resize2fs) directly addresses a full filesystem on /hana/data.

How to eliminate wrong answers

Option A is wrong because increasing IOPS addresses performance (throughput/latency), not storage capacity; the problem is space exhaustion, not I/O performance. Option B is wrong because deleting old database logs frees space on the /hana/log filesystem, not /hana/data; SAP HANA data files contain persistent data, not logs, and log deletion does not recover data volume space. Option D is wrong because migrating to a larger instance type increases compute and memory resources but does not change the size of the attached EBS volumes; the /hana/data filesystem would remain at the same capacity.

Full explanation →

891

MCQhard

A company is troubleshooting an issue where SAP users cannot log in to the SAP GUI. The SAP application server is running on an EC2 instance behind an Application Load Balancer (ALB). The ALB is configured to use the HTTPS listener on port 443. Which configuration is most likely causing the issue?

A.The ALB's target group is not configured with health checks.

B.The security group for the ALB does not allow inbound traffic on port 3300.

C.The ALB is terminating HTTPS connections, but the SAP application server expects unencrypted DIAG protocol.

D.The ALB's stickiness settings are misconfigured, causing session persistence issues.

AnswerC

SAP GUI uses DIAG (TCP 3200), not HTTP/HTTPS; an ALB is not suitable for non-HTTP traffic.

Why this answer

SAP GUI uses the DIAG protocol over TCP port 3200, not HTTPS. The ALB terminates HTTPS connections, but the backend SAP application server expects unencrypted DIAG traffic, so the protocol mismatch prevents successful login. Option A is incorrect because health checks affect target availability, not user authentication.

Option B is incorrect because port 3300 is not the standard DIAG port (3200 is), and security group rules are not the primary cause. Option D is incorrect because stickiness settings influence session persistence but do not block initial login when protocol mismatch exists.

Full explanation →

892

Multi-Selecteasy

An SAP system is running on AWS with a production HANA database. The database administrator wants to ensure that backups are consistent and can be restored. Which TWO approaches should be used together for a robust backup strategy?

Select 2 answers

A.AWS Backup with a backup plan that includes both EBS snapshots and Backint.

B.Regular EBS snapshots of the data volume.

C.Amazon EC2 Auto Scaling to create backup instances.

D.AWS Database Migration Service (DMS) for continuous replication.

E.SAP HANA Backint integration with AWS Backup.

AnswersA, E

Combining both provides crash-consistent and application-consistent backups.

Why this answer

Options A and E are correct. AWS Backup with a backup plan that includes both EBS snapshots (crash-consistent) and Backint integration (application-consistent) provides a comprehensive backup strategy for SAP HANA on AWS. Option A ensures crash-consistent backups at the storage level, while Option E uses SAP HANA Backint to produce application-consistent backups that can be orchestrated by AWS Backup.

Option B (regular EBS snapshots without coordination) lacks application consistency. Option C (Auto Scaling) is not a backup mechanism. Option D (DMS) is for database migration, not backup.

Full explanation →

893

MCQhard

An SAP HANA database running on an EC2 instance is configured with multiple EBS volumes using RAID 0 for increased throughput. During a backup operation, the instance experiences a significant drop in I/O performance. Which solution would best address this without affecting ongoing backups?

A.Add more EBS volumes to the RAID 0 array to increase total I/O bandwidth.

B.Use instance store volumes for the HANA data instead of EBS.

C.Use EBS snapshots for backup instead of file-level backup to reduce I/O load.

D.Reduce the number of EBS volumes to limit the RAID 0 penalty.

AnswerA

More volumes in RAID 0 increase parallelism and throughput, helping during backup.

Why this answer

Adding more EBS volumes to the RAID 0 array increases the total number of I/O channels available, which directly improves aggregate throughput and reduces per-volume I/O pressure during backup operations. This is because RAID 0 stripes data across all volumes, so additional volumes distribute the I/O load more evenly, mitigating the performance drop without interrupting the ongoing backup.

Exam trap

The trap here is that candidates may think reducing volumes or switching to instance store will solve performance issues, but they overlook that RAID 0 performance scales linearly with the number of volumes, and instance store lacks durability for critical SAP HANA data.

How to eliminate wrong answers

Option B is wrong because instance store volumes are ephemeral and provide no data persistence; if the instance stops or fails, all HANA data is lost, making them unsuitable for a production database. Option C is wrong because EBS snapshots are a backup method but do not reduce I/O load during the backup process; in fact, snapshotting can cause additional I/O latency due to the need to flush caches and read data from the volumes. Option D is wrong because reducing the number of EBS volumes in a RAID 0 array decreases the total I/O bandwidth and increases the I/O load on each remaining volume, worsening the performance drop rather than addressing it.

Full explanation →

894

Multi-Selecthard

An SAP HANA database is running on an EC2 instance with multiple EBS volumes for /hana/data, /hana/log, and /hana/shared. Which TWO AWS features should be used to ensure that the EBS volumes are backed up consistently?

Select 2 answers

A.Amazon S3

B.AWS Storage Gateway

C.EBS snapshots

D.EBS Lifecycle Manager

E.AWS Backup

AnswersC, E

EBS snapshots are the primary backup mechanism.

Why this answer

EBS snapshots are the standard backup method for EBS volumes. However, to ensure consistency across multiple volumes (e.g., for a striped filesystem), the volumes should be snapshotted at the same point in time. AWS Backup can automate this with snapshot consistency groups.

While AWS Backup can create consistent snapshots, it also supports application-consistent backups. The two correct options are EBS snapshots and AWS Backup. Lifecycle Manager can create snapshots but does not ensure cross-volume consistency by default.

Full explanation →

895

Multi-Selecthard

A company is deploying SAP S/4HANA on AWS and needs to choose instance types that are certified by SAP. Which TWO instance families are SAP-certified for production SAP HANA workloads?

Select 2 answers

A.R5

B.T3

C.X1e

D.M5

E.P3

AnswersA, C

Correct. R5 is memory-optimized and SAP-certified for production HANA.

Why this answer

The question asks for two certified instance families for production SAP HANA workloads. Among the provided options, only R5 (A) and X1e (C) are SAP-certified for production HANA. T3, M5, and P3 are not certified.

Therefore, the correct answers are A and C.

Exam trap

Candidates may think general-purpose or other instance families are certified, but only memory-optimized families like R5 and X1e are certified for production HANA. Do not select uncertified families.

Full explanation →

896

MCQhard

An SAP administrator runs the AWS CLI command shown in the exhibit. The SAP application is experiencing performance issues. The administrator notices that one instance is stopped. What is the most likely impact of this on the SAP landscape?

A.The SAP system will be fully functional as long as the database is running.

B.The running instance will automatically take over the workload.

C.The stopped instance will continue to incur charges.

D.The SAP application will be unavailable or have reduced capacity.

AnswerD

A stopped application server cannot serve requests.

Why this answer

If the SAP application server is stopped, the application will be unavailable or degraded. The database is not shown. Stopped instances do not incur compute charges.

Instance type mismatch is not the issue; the running instance is larger.

Full explanation →

897

MCQmedium

An SAP system running on AWS uses a Multi-AZ RDS for SAP ASE database. The operations team notices that the database failover took longer than expected during a recent outage. What should the team investigate to reduce failover time?

A.Increase the allocated storage for the database to improve I/O performance.

B.Ensure that the standby instance is in the same Availability Zone as the primary.

C.Check for long-running transactions that delay the failover.

D.Verify that the database is using asynchronous replication.

AnswerC

Long-running transactions can significantly increase failover time.

Why this answer

Multi-AZ failover time is primarily affected by the time required to complete in-flight transactions and apply redo logs to the standby. Long-running transactions can delay failover because they must be completed or rolled back before the standby can become the primary. Option A is incorrect because increasing storage may improve I/O performance but does not directly reduce failover time.

Option B is incorrect because the standby must be in a different Availability Zone for Multi-AZ. Option D is incorrect because Multi-AZ RDS uses synchronous replication, not asynchronous.

Exam trap

Candidates often assume that scaling storage or instance size will reduce failover time, but the primary delay is caused by long-running transactions that must complete before failover.

Full explanation →

898

MCQeasy

An SAP system on AWS needs to store sensitive configuration files securely and automatically rotate the encryption keys. Which AWS service should be used?

A.AWS Systems Manager Parameter Store with AWS KMS.

B.Amazon S3 with server-side encryption.

C.AWS Key Management Service (KMS) alone.

D.AWS Secrets Manager.

AnswerA

Parameter Store can store configuration securely and use KMS for encryption with automatic key rotation.

Why this answer

AWS Systems Manager Parameter Store integrated with AWS KMS is the correct choice because it provides a secure, hierarchical store for sensitive configuration data (like SAP configuration files) and supports automatic key rotation via KMS-managed keys. Parameter Store can store encrypted strings using KMS keys, and KMS can be configured to rotate the underlying encryption key automatically every year (or on demand), meeting the requirement for both secure storage and automated key rotation.

Exam trap

The trap here is that candidates often confuse AWS Secrets Manager with Parameter Store, but Secrets Manager is designed for rotating secrets (like passwords) automatically, not for storing configuration files, and it lacks the hierarchical parameter organization that Parameter Store provides for SAP configuration management.

How to eliminate wrong answers

Option B is wrong because Amazon S3 with server-side encryption (SSE-S3 or SSE-KMS) can store files securely, but it does not natively support automatic rotation of the encryption keys; SSE-S3 uses AWS-managed keys with automatic rotation, but the key material is not customer-controlled, and the requirement specifies 'automatically rotate the encryption keys' in a way that implies customer-managed key rotation, which S3 alone does not provide. Option C is wrong because AWS KMS alone is a key management service that can create and rotate keys, but it does not store the configuration files themselves; it lacks the storage and retrieval capabilities needed for the SAP configuration files. Option D is wrong because AWS Secrets Manager is designed for managing secrets like database credentials and API keys, and while it supports automatic rotation of secrets, it is not optimized for storing configuration files (which may be larger or structured differently) and does not provide the hierarchical parameter store features that Parameter Store offers for configuration management.

Full explanation →

899

MCQmedium

A company is migrating an SAP system from an Oracle database to Amazon RDS for Oracle using AWS DMS. The DMS task fails with the error shown in the exhibit. What is the most likely cause?

A.The DMS replication instance does not have network access to the source database.

B.The source endpoint credentials are incorrect.

C.The DMS task requires additional IAM permissions.

D.The target endpoint is not configured correctly.

AnswerB

ORA-01017 indicates invalid username or password.

Why this answer

The error indicates invalid username/password for the source Oracle database. The source endpoint credentials are incorrect. The DMS replication instance may not have network access, but the error is a login failure.

The target endpoint is not the issue.

Full explanation →

900

Multi-Selectmedium

Which TWO actions should an SAP administrator take to ensure high availability for an SAP HANA database on AWS? (Choose two.)

Select 2 answers

A.Enable SAP HANA system replication

B.Deploy the database on a single large instance

C.Schedule regular manual snapshots

D.Use a Multi-AZ deployment for the database

E.Use a single EBS volume with high IOPS

AnswersA, D

Provides data redundancy across nodes.

Why this answer

Options A and D are correct. Enabling SAP HANA system replication provides data redundancy and automatic failover within the same region. Using a Multi-AZ deployment (e.g., with Amazon EBS multi-attach or cluster) ensures the database is available across different Availability Zones, providing automatic failover and high availability.

Option B is wrong because a single large instance is a single point of failure. Option C is wrong because manual snapshots are not automatic and do not provide high availability. Option E is wrong because a single EBS volume is a single point of failure and does not provide redundancy.

Full explanation →

Page 12 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →