Courseiva

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 901–975

1616 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 12

Page 13 of 22

Page 14
901
MCQeasy

A company runs a critical SAP application on AWS. The operations team needs to monitor the system for performance issues and receive alerts when CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this monitoring and alerting?

A.AWS Config
B.AWS CloudTrail
C.Amazon CloudWatch
D.AWS Health
AnswerC

CloudWatch monitors metrics and can trigger alarms based on thresholds.

Why this answer

Amazon CloudWatch can monitor CPU utilization and trigger alarms when a threshold is breached. CloudTrail is for API auditing, Config is for compliance, and AWS Health provides service health notifications.

Full explanation →
902
MCQmedium

A company is running SAP NetWeaver on AWS and wants to implement a high-availability solution for the SAP Central Services (ASCS). Which AWS service can be used to manage the virtual IP address for failover?

A.Amazon Route 53 with failover routing
B.AWS Global Accelerator
C.Elastic Load Balancer (ELB)
D.Elastic IP address reassignment
AnswerA

Route 53 failover routing can redirect clients to the secondary ASCS.

Why this answer

Amazon Route 53 with failover routing is the correct choice because it can manage a virtual IP address (VIP) for SAP Central Services (ASCS) failover by using DNS health checks to detect ASCS failure and automatically update the DNS record to point to the healthy secondary instance. This aligns with the SAP on AWS high-availability pattern where a DNS-based VIP is preferred over traditional floating IPs, as AWS does not support layer 2 VIP failover across Availability Zones.

Exam trap

The trap here is that candidates often assume a floating IP (Elastic IP) or a load balancer is required for SAP ASCS VIP failover, but AWS DNS-based failover with Route 53 is the recommended and supported method for SAP on AWS, avoiding the limitations of layer 2 networking in the cloud.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator provides static anycast IP addresses for traffic routing and does not support the granular health-check-driven DNS failover needed for SAP ASCS VIP management; it is designed for global traffic optimization, not for single-region SAP failover. Option C is wrong because Elastic Load Balancer (ELB) operates at layer 4/7 and cannot be used to assign a virtual IP address directly to an ASCS instance; it distributes traffic across targets but does not provide a static VIP that the SAP application can bind to for failover. Option D is wrong because Elastic IP address reassignment requires manual intervention or custom scripting to detect failure and reassign the IP, and it does not provide automated health-check-based failover; additionally, Elastic IPs cannot be shared between instances in different Availability Zones for seamless failover without downtime.

Full explanation →
903
MCQhard

An SAP system on AWS is experiencing intermittent network connectivity issues between the application servers and the database server. Both are in the same VPC but different subnets. The security groups allow all traffic between them. What should the administrator check next?

A.Network ACL rules for the subnets
B.VPC Flow Logs to analyze dropped packets
C.Route tables to ensure proper routing
D.Security group rules for outbound traffic
AnswerA

NACLs are stateless and must allow ephemeral port return traffic.

Why this answer

Network ACLs are stateless and must allow both inbound and outbound traffic. If NACLs block return traffic, connectivity fails intermittently. VPC Flow Logs can help diagnose but are not the first check.

Route tables are typically correct within a VPC. The issue is likely at the NACL level.

Full explanation →
904
MCQhard

A company is migrating an SAP NetWeaver system to AWS using the AWS Application Migration Service (AWS MGN). The source server runs SUSE Linux Enterprise Server (SLES) 12 SP5. After the cutover, the SAP application fails to start with an error indicating that the hostname resolution fails. The target EC2 instance has the same hostname as the source. What is the most likely cause?

A.The network configuration file /etc/sysconfig/network was not replicated
B.The /etc/hosts file on the target instance still references the source server's old private IP address
C.The source server's operating system is not supported by AWS MGN
D.The target instance is not registered in Amazon Route 53 private hosted zone
AnswerB

After migration, the target instance gets a new IP; /etc/hosts must be updated to reflect the new IP.

Why this answer

AWS MGN replicates the entire disk, including the /etc/hosts file. After cutover, the target EC2 instance gets a new private IP address, but the /etc/hosts file still contains the source server's old private IP. This causes hostname resolution to fail because the SAP application tries to resolve the hostname to the old IP.

Option A is incorrect because /etc/sysconfig/network is not directly related to hostname resolution failure. Option C is incorrect because SLES 12 SP5 is supported by AWS MGN. Option D is incorrect because Route 53 private hosted zone is not required for hostname resolution if /etc/hosts is correctly configured.

Full explanation →
905
Multi-Selectmedium

Which TWO are best practices for securing SAP on AWS?

Select 2 answers
A.Place all SAP systems in the default VPC.
B.Attach public IP addresses to all SAP EC2 instances for easy management.
C.Use security groups to control traffic between SAP components.
D.Disable security groups and rely on SSH key pairs only.
E.Use IAM roles for EC2 instances to access AWS services securely.
AnswersC, E

Security groups are stateful firewalls.

Why this answer

Security groups act as a virtual firewall for EC2 instances, allowing you to control inbound and outbound traffic at the instance level. For SAP on AWS, using security groups to restrict traffic between SAP components (e.g., between the SAP application server and database server) is a best practice because it enforces least-privilege access and reduces the attack surface. IAM roles for EC2 instances enable secure, automated access to AWS services (like S3 for backups or CloudWatch for monitoring) without embedding long-term credentials in the instance, which is critical for compliance and operational security.

Exam trap

The trap here is that candidates often assume that because SAP systems are business-critical, they should be placed in the default VPC for simplicity, or that public IPs are needed for management access, when in fact AWS best practices mandate private subnets, bastion hosts, and IAM roles to maintain security and compliance.

Full explanation →
906
MCQmedium

A company is running SAP HANA on AWS. The system administrator notices that the SAP HANA database is frequently running out of memory, causing performance degradation. Which AWS service should the administrator use to set up memory usage alarms and automate scaling of the SAP HANA instance?

A.Amazon EC2 Auto Scaling
B.AWS Lambda
C.AWS Systems Manager
D.Amazon CloudWatch and AWS Auto Scaling
AnswerC

AWS Systems Manager can automate vertical scaling by using an Automation document that resizes the instance, triggered by CloudWatch alarms on memory metrics.

Why this answer

AWS Systems Manager. To scale a single SAP HANA instance vertically, the administrator can use CloudWatch to monitor memory usage (via custom metrics) and trigger an alarm that invokes an AWS Systems Manager Automation document. The Automation document can execute the 'modify-instance-type' step to change the EC2 instance type to one with more memory.

Option D (Amazon CloudWatch and AWS Auto Scaling) is incorrect because AWS Auto Scaling is designed for horizontal scaling (adding/removing instances) and does not natively support vertical scaling of a single instance. Option B (AWS Lambda) could be part of a custom solution but is not the primary service for setting up alarms and scaling; Lambda alone does not provide monitoring or scaling orchestration. Option A (Amazon EC2 Auto Scaling) also focuses on horizontal scaling and is not suitable for vertical scaling.

Exam trap

Candidates often assume that 'Auto Scaling' can perform vertical scaling, but AWS Auto Scaling is horizontal only. Vertical scaling of a single instance requires services like AWS Systems Manager or a custom Lambda-based solution.

Full explanation →
907
Multi-Selectmedium

Which TWO actions should an operations team take to ensure high availability for SAP HANA in a single AWS Region?

Select 2 answers
A.Create read replicas of the HANA database.
B.Deploy SAP HANA in a Multi-AZ configuration using HANA System Replication.
C.Use HANA System Replication with automatic failover.
D.Configure automated backups to Amazon S3.
E.Use a single large EC2 instance in one Availability Zone.
AnswersB, C

Multi-AZ with HSR provides failover across Availability Zones.

Why this answer

Deploying SAP HANA in a Multi-AZ configuration using HANA System Replication ensures that a replica is maintained in a different Availability Zone, providing high availability across AZs. Option C is correct because HANA System Replication with automatic failover allows the system to automatically fail over to the replica if the primary fails, minimizing downtime. Option A is incorrect because read replicas are used for scaling read operations, not for high availability.

Option D is incorrect because automated backups to Amazon S3 provide data protection but do not enable automatic failover. Option E is incorrect because a single EC2 instance in one AZ is a single point of failure and does not provide high availability.

Full explanation →
908
MCQmedium

Refer to the exhibit. An administrator is creating an IAM policy for a user who will manage SAP application servers during migration. The policy currently allows starting and stopping EC2 instances. What additional permission is required to allow the user to terminate instances?

A.ec2:ModifyInstanceAttribute
B.ec2:TerminateInstances
C.ec2:RebootInstances
D.ec2:DeleteInstances
AnswerB

TerminateInstances is the correct action for terminating EC2 instances.

Why this answer

The action 'ec2:TerminateInstances' is needed to terminate instances. Option A (ec2:DeleteInstances) is not a valid action. Option C (ec2:ModifyInstanceAttribute) is unrelated.

Option D (ec2:RebootInstances) is for reboot.

Full explanation →
909
MCQhard

A company runs SAP on AWS using a multi-AZ deployment. The database is an SAP HANA system replicated across two Availability Zones. During a recent failure, the standby HANA instance did not take over automatically. The operations team finds that the HANA replication status was 'ERROR' before the failure. What is the most likely reason for the failed takeover?

A.The standby HANA instance had a different instance number than the primary.
B.The fencing mechanism was not configured correctly in the cluster.
C.The HANA system replication was not in sync; data was not fully replicated to the standby.
D.The network latency between the two Availability Zones was too high.
AnswerC

An error status means replication is broken; the standby cannot take over safely.

Why this answer

If the HANA system replication status is 'ERROR', automatic takeover cannot occur. The replication link must be healthy for the standby to have the latest data. Option A is wrong because a difference in instance numbers does not cause a replication status error; replication setup would fail if instance numbers mismatched.

Option B is wrong because a misconfigured fencing mechanism would not cause a replication status error; it would prevent takeover only if fencing fails. Option D is wrong because high network latency could cause replication lag but not an error status; the status error indicates a more fundamental issue.

Full explanation →
910
Multi-Selectmedium

A company is migrating a legacy on-premises application to AWS. The application uses a MySQL database with a complex stored procedure that runs every hour and takes approximately 10 minutes to complete. The company wants to minimize downtime during migration. Which TWO approaches should the company use to migrate the database?

Select 2 answers
A.Use AWS DMS with a full load only, without ongoing replication, and schedule a cutover window.
B.Use AWS Database Migration Service (DMS) with ongoing replication from the source MySQL database to an Amazon RDS for MySQL instance.
C.Set up an Amazon Aurora MySQL DB cluster and use AWS DMS with the on-premises MySQL database as the source and the Aurora cluster as the target, enabling ongoing replication.
D.Take a full database dump using mysqldump and import it into an Amazon RDS for MySQL instance during a planned maintenance window.
E.Create an Amazon RDS for MySQL read replica from the on-premises database.
AnswersB, C

This approach minimizes downtime by continuously replicating changes until cutover.

Why this answer

AWS DMS with ongoing replication allows continuous synchronization from the source MySQL database to Amazon RDS for MySQL, minimizing downtime during migration. The complex stored procedure that runs hourly and takes 10 minutes is handled seamlessly as DMS captures ongoing changes, enabling a controlled cutover with minimal disruption.

Exam trap

The trap here is that candidates often assume mysqldump or a full-load-only DMS task is sufficient for minimizing downtime, overlooking the need for ongoing replication to handle continuous changes during the migration window.

Full explanation →
911
MCQhard

An SAP system running on AWS uses a shared file system via Amazon EFS for transport directories. The system administrator notices that file operations are slow across multiple application servers. The EFS file system is configured with Bursting Throughput mode. What is the most effective way to improve performance?

A.Switch the file system to Provisioned Throughput mode and set a higher throughput value.
B.Use EFS Access Points to enforce a different UID/GID for each application server.
C.Increase the burst credit balance by reducing file operations during off-peak hours.
D.Create additional mount targets in each Availability Zone to distribute load.
AnswerA

Provisioned Throughput mode allows you to specify a higher throughput level, providing consistent performance independent of burst credits.

Why this answer

Provisioned Throughput mode allows you to specify a higher throughput level for your Amazon EFS file system, providing consistent performance independent of burst credits. Option B is incorrect: using EFS Access Points does not affect throughput, they enforce access permissions. Option C is incorrect: reducing operations during off-peak hours may conserve burst credits but does not directly increase performance; significant improvement requires Provisioned Throughput.

Option D is incorrect: additional mount targets in each AZ do not increase throughput as they share the same file system throughput.

Full explanation →
912
MCQmedium

A company is planning to run SAP BusinessObjects (BOBJ) on AWS. The application servers require consistent low-latency access to a shared file system for storing reports and configuration files. Which AWS storage solution is BEST suited for this requirement?

A.Amazon Elastic Block Store (Amazon EBS) with a multi-attach enabled volume.
B.Amazon Elastic File System (Amazon EFS).
C.Amazon Simple Storage Service (Amazon S3).
D.Amazon FSx for Windows File Server.
AnswerB

EFS provides a scalable, shared NFS file system for Linux instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and shared file system that can be accessed concurrently by multiple EC2 instances via the NFSv4.1 protocol. For SAP BusinessObjects application servers requiring consistent low-latency access to shared reports and configuration files, EFS delivers the necessary POSIX permissions, strong consistency, and automatic scaling without provisioning overhead, making it the ideal choice.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach with a true shared file system, not realizing that EBS Multi-Attach is limited to a single Availability Zone and does not support concurrent writes from multiple instances, whereas EFS is designed for exactly that use case with full NFS semantics.

How to eliminate wrong answers

Option A is wrong because Amazon EBS with multi-attach is limited to a maximum of 16 Nitro-based EC2 instances in the same Availability Zone, and it does not support the concurrent read/write workloads typical of shared report storage; it also lacks the automatic scaling and shared file system semantics required. Option C is wrong because Amazon S3 is an object storage service that does not provide a POSIX-compliant file system interface, and accessing it via S3 File Gateway or mount points introduces latency and consistency trade-offs unsuitable for low-latency shared file access. Option D is wrong because Amazon FSx for Windows File Server uses the SMB protocol and is designed for Windows-based workloads, whereas SAP BusinessObjects typically runs on Linux and requires NFS-based shared storage for optimal performance.

Full explanation →
913
MCQeasy

A company is migrating an SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS service is best suited for this?

A.Amazon RDS Multi-AZ deployment
B.EC2 Auto Scaling group
C.Amazon Route 53 weighted routing policy
D.Amazon S3 cross-region replication
AnswerC

Correct. Amazon Route 53 weighted routing policy, combined with health checks, can route traffic to multiple ASCS instances and automatically redirect traffic from unhealthy instances, achieving high availability.

Why this answer

None of the provided options is correct for ensuring high availability for SAP ASCS. ASCS requires a cluster manager with shared file systems (e.g., Amazon EFS) and failover mechanisms (e.g., overlay IP or Elastic Network Interface repositioning), which are not represented by any of the options. The current answer, Amazon Route 53 weighted routing policy, alone does not provide true high availability for ASCS as it lacks stateful failover and shared storage coordination.

Full explanation →
914
MCQhard

An SAP environment on AWS uses a shared /sapmnt file system via Amazon EFS. The company wants to encrypt data at rest for the entire stack. Which services require separate encryption configurations?

A.EBS volumes and EFS file system
B.Application Load Balancer and EFS
C.EFS file system and S3 bucket
D.CloudWatch Logs and EBS volumes
AnswerA

Both require separate encryption enablement.

Why this answer

Amazon EBS volumes and Amazon EFS file systems each require separate encryption configurations because they use distinct encryption mechanisms. EBS uses AWS KMS keys per volume at the block level, while EFS uses a different KMS key configuration at the file system level. Both must be explicitly enabled to achieve full at-rest encryption for the SAP stack.

Exam trap

The trap here is that candidates assume a single encryption setting (like enabling EBS default encryption) covers all storage services, but AWS requires separate encryption configurations for each service (EBS, EFS, S3, etc.) because they use independent encryption mechanisms and KMS key policies.

How to eliminate wrong answers

Option B is wrong because Application Load Balancer does not store data at rest; it only processes traffic in transit, so it does not require encryption configuration for data at rest. Option C is wrong because while EFS does require encryption configuration, the S3 bucket is not part of the shared /sapmnt file system described in the scenario; S3 encryption is separate and not required for this specific stack. Option D is wrong because CloudWatch Logs are encrypted by default using AWS service keys and do not require separate customer-managed encryption configuration for this scenario, and EBS volumes do require encryption but the pairing is incorrect.

Full explanation →
915
MCQeasy

A company is planning to migrate its SAP HANA workload to AWS. The system requires high network throughput and low latency between application and database servers. Which AWS networking feature should be used to meet these requirements?

A.Create a VPC Peering connection between the application and database subnets.
B.Use Elastic Fabric Adapter (EFA) for network connectivity.
C.Use Enhanced Networking on all instances.
D.Place the instances in a Cluster Placement Group.
AnswerD

A Cluster Placement Group places instances within a single Availability Zone, ensuring low-latency, non-blocking 10 Gbps or 25 Gbps network connectivity between SAP HANA application and database servers. This satisfies the requirement for high throughput and low latency by minimising physical distance and network hops, unlike spread or partition groups which prioritise fault isolation over performance.

Why this answer

A Cluster Placement Group (CPG) is a logical grouping of instances within a single Availability Zone that provides low-latency, high-throughput network connectivity by placing them in close physical proximity. For SAP HANA workloads requiring consistent high network throughput and low latency between application and database servers, a CPG ensures that all instances are co-located, minimizing network hops and jitter. This is the correct choice because it directly addresses the need for low-latency, high-bandwidth communication between tightly coupled components.

Exam trap

The trap here is that candidates often confuse Enhanced Networking (which improves individual instance performance) with the co-location benefits of a Cluster Placement Group, failing to recognize that low latency between instances requires physical proximity, not just faster virtualized networking.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects separate VPCs but does not provide any special performance guarantees; it relies on the standard AWS network infrastructure and does not reduce latency or increase throughput between subnets within the same VPC. Option B is wrong because Elastic Fabric Adapter (EFA) is designed for tightly coupled HPC/ML workloads using MPI or NCCL, not for standard SAP HANA traffic, and it requires special OS and application support that SAP does not provide. Option C is wrong because Enhanced Networking (using SR-IOV) improves network performance by providing higher bandwidth and lower jitter compared to traditional virtualized networking, but it does not guarantee the low-latency, high-throughput co-location that a Cluster Placement Group offers; it is a prerequisite but not sufficient alone.

Full explanation →
916
MCQmedium

A company is designing a disaster recovery solution for SAP HANA. The primary site is in us-east-1 and the DR site is in us-west-2. The RPO is 5 minutes and the RTO is 30 minutes. Which replication method meets these requirements?

A.Amazon RDS Multi-AZ deployment
B.Scheduled EBS snapshots copied to us-west-2
C.SAP HANA System Replication with synchronous mode
D.AWS Database Migration Service with ongoing replication
AnswerC

HANA System Replication can achieve sub-minute RPO synchronously.

Why this answer

SAP HANA System Replication with synchronous mode is the correct choice because it provides continuous, real-time data replication to the DR site in us-west-2, enabling an RPO of 5 minutes or less and an RTO of 30 minutes. Synchronous replication ensures that every committed transaction is acknowledged by the secondary site before the primary confirms to the application, meeting the strict RPO requirement. This method is purpose-built for SAP HANA and supports automatic failover, which aligns with the 30-minute RTO.

Exam trap

The trap here is that candidates often confuse AWS-native services like RDS Multi-AZ or DMS with SAP HANA-specific replication, failing to recognize that SAP HANA requires its own replication technology to meet low RPO/RTO and that cross-region replication demands synchronous mode for near-zero data loss.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Multi-AZ deployment is designed for relational databases like MySQL or PostgreSQL, not for SAP HANA, and it operates within a single AWS region, not across us-east-1 and us-west-2. Option B is wrong because scheduled EBS snapshots copied to us-west-2 can only achieve an RPO of minutes to hours (snapshot intervals are typically 1 hour or more), far exceeding the 5-minute RPO, and recovery from snapshots requires manual steps that would likely exceed the 30-minute RTO. Option D is wrong because AWS Database Migration Service (DMS) with ongoing replication is a heterogeneous migration tool that does not support SAP HANA as a source for continuous replication, and its change data capture (CDC) introduces latency that cannot guarantee a 5-minute RPO for SAP HANA workloads.

Full explanation →
917
MCQeasy

An SAP administrator needs to integrate SAP S/4HANA with Amazon S3 for archival purposes. Which AWS service should be used to enable secure and efficient data transfer from SAP to S3?

A.Amazon Kinesis
B.Amazon Athena
C.AWS Glue
D.AWS DataSync
AnswerD

DataSync is optimized for data transfers to S3.

Why this answer

AWS DataSync is the correct choice because it is purpose-built for efficiently and securely transferring large volumes of data from on-premises or SAP systems to Amazon S3. It automates the transfer process, supports encryption in transit (TLS) and at rest, and can handle the high-throughput requirements of SAP S/4HANA archival jobs without requiring custom scripting or complex network configurations.

Exam trap

The trap here is that candidates often confuse AWS DataSync with AWS Glue or Amazon Kinesis, mistakenly thinking that any data movement to S3 requires an ETL or streaming service, rather than recognizing DataSync as the dedicated, high-performance transfer service for large-scale batch workloads like SAP archiving.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis is a real-time data streaming service designed for ingesting and processing streaming data (e.g., clickstreams, logs), not for batch archival transfers from SAP S/4HANA to S3. Option B is wrong because Amazon Athena is an interactive query service for analyzing data directly in S3 using SQL, not a data transfer or integration tool. Option C is wrong because AWS Glue is a serverless data integration and ETL service primarily used for preparing and transforming data for analytics, not for direct, efficient bulk data movement from SAP to S3.

Full explanation →
918
Multi-Selecthard

Which THREE of the following are valid considerations when designing a SAP landscape on AWS?

Select 3 answers
A.The EBS volumes for HANA data and logs must be provisioned with the correct IOPS and throughput.
B.AWS Managed Services (AMS) is mandatory for running SAP on AWS.
C.The SAPRouter must be configured to allow SAP support access to the AWS environment.
D.An AWS Support plan that includes SAP support is required to get SAP support for AWS-related issues.
E.All SAP instances must be launched in a cluster placement group.
AnswersA, C, D

IOPS and throughput are critical for HANA performance.

Why this answer

SAP HANA is extremely sensitive to storage performance; EBS volumes for HANA data and log must be provisioned with sufficient IOPS and throughput to meet SAP's documented sizing guidelines. Inadequate IOPS can cause HANA to abort transactions or crash, and AWS allows you to use Provisioned IOPS (io1/io2) or gp3 volumes with custom IOPS and throughput settings to meet these requirements.

Exam trap

The trap here is that candidates often assume AWS Managed Services (AMS) is required for SAP on AWS because of the complexity, but AWS explicitly allows self-managed SAP deployments, and the exam tests knowledge of optional vs. mandatory services.

Full explanation →
919
MCQhard

An SAP administrator is troubleshooting an issue where SAP application servers are unable to connect to the SAP HANA database. The database is running on an EC2 instance in a private subnet. The application servers are in a different VPC connected via VPC peering. The security group for the database instance allows TCP port 3$15$13 from the application server security group. Which additional configuration is MOST likely required?

A.Modify the security group to allow traffic from the application server subnet CIDR.
B.Update the route tables to add a route to the database subnet.
C.Add a rule to the network ACL to allow inbound traffic on port 3$15$13.
D.Enable DNS resolution for the VPC peering connection.
AnswerD

VPC peering requires DNS resolution to be enabled for hostname resolution across VPCs.

Why this answer

VPC peering does not automatically enable DNS resolution for hostnames across peered VPCs. The application servers need to resolve the database's private DNS hostname to its private IP. By default, DNS resolution for peered VPCs is disabled.

Enabling DNS resolution on the VPC peering connection allows the application servers to resolve the database's hostname, which is essential for connectivity. Option A is incorrect as the security group already allows the port; Option B is incorrect because the route tables already handle traffic via the peering connection; Option C is incorrect because network ACLs are not the core issue—the problem is DNS resolution, not NACL rules.

Full explanation →
920
MCQhard

A company is migrating an SAP HANA system from on-premises to AWS. The database size is 3 TB, and the network bandwidth to AWS is 1 Gbps. The migration window is limited to 48 hours. What is the most efficient migration strategy?

A.Set up an AWS Direct Connect connection and use HANA backup and restore
B.Use AWS Database Migration Service (DMS) for continuous replication
C.Use AWS Snowball Edge to transfer the HANA backup
D.Upload the HANA backup to Amazon S3 using multipart upload
AnswerC

Snowball Edge can transfer data offline at high speed.

Why this answer

The 3 TB database size and 1 Gbps bandwidth would require approximately 7 hours for data transfer alone, but the 48-hour migration window includes backup, transfer, and restore time. AWS Snowball Edge provides a petabyte-scale physical data transport solution that bypasses network constraints entirely, making it the most efficient strategy for transferring a 3 TB HANA backup within the limited window. Snowball Edge supports direct integration with SAP HANA backup workflows via NFS or S3-compatible endpoints, ensuring minimal migration time.

Exam trap

The trap here is that candidates often overestimate network transfer speeds and underestimate the total time required for backup, transfer, and restore, leading them to choose Direct Connect or S3 multipart upload without considering the physical data transport option for large datasets.

How to eliminate wrong answers

Option A is wrong because setting up AWS Direct Connect with 1 Gbps bandwidth would require over 6.7 hours for the raw data transfer (3 TB at 1 Gbps), but this does not account for backup creation, restore time, and potential network congestion, making it infeasible within a 48-hour window when considering end-to-end migration steps. Option B is wrong because AWS DMS is designed for continuous replication of transactional databases, not for large-scale backup and restore of SAP HANA systems; DMS does not support SAP HANA as a source for full database migration and cannot handle the 3 TB initial load efficiently within the time constraint. Option D is wrong because uploading a 3 TB HANA backup to Amazon S3 using multipart upload over a 1 Gbps link would still take approximately 7 hours for transfer alone, plus the time to create the backup and restore it on AWS, exceeding the 48-hour window when factoring in all steps and potential retries.

Full explanation →
921
MCQmedium

A company is running SAP on AWS and needs to migrate a large on-premises SAP HANA database to AWS with minimal downtime. Which approach is most suitable?

A.Export the HANA database to a file, upload to S3, and import into a new HANA instance on EC2.
B.Use AWS Server Migration Service (SMS) to replicate the entire on-premises server to AWS.
C.Use AWS Database Migration Service (DMS) to continuously replicate data to an Amazon RDS for SAP HANA instance.
D.Set up SAP HANA System Replication between the on-premises system and an EC2 instance running HANA in AWS.
AnswerD

HSR provides asynchronous or synchronous replication with minimal downtime.

Why this answer

SAP HANA System Replication (HSR) is the native, low-latency replication mechanism designed for HANA databases, enabling near-continuous data synchronization between an on-premises system and an EC2 instance. This approach supports a controlled takeover with minimal downtime, as it replicates transactions in real time using log shipping or synchronous replication, making it the most suitable for large databases requiring minimal interruption.

Exam trap

The trap here is that candidates often confuse AWS DMS with a database-agnostic replication tool, but DMS does not support SAP HANA as a target, and Amazon RDS for SAP HANA does not exist, leading to the incorrect assumption that DMS can handle the migration with minimal downtime.

How to eliminate wrong answers

Option A is wrong because exporting a HANA database to a file, uploading to S3, and importing is a full offline backup/restore process that incurs significant downtime, not minimal. Option B is wrong because AWS Server Migration Service (SMS) is designed for server-level replication of virtual machines, not for database-level replication, and it cannot handle the transactional consistency required for SAP HANA without additional complexity and downtime. Option C is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a target for continuous replication; DMS is primarily for homogeneous/heterogeneous migrations to RDS or Aurora, and Amazon RDS for SAP HANA is not a supported service (SAP HANA on AWS runs on EC2, not RDS).

Full explanation →
922
MCQmedium

A company is running SAP HANA on a bare metal EC2 instance. The system experiences a hardware failure that causes an instance stop. The company needs to recover the instance quickly. What should the company do to minimize recovery time?

A.Use AWS CloudFormation to recreate the instance
B.Manually start the instance from the EC2 console
C.Restore the instance from the latest EBS snapshot
D.Configure an Amazon CloudWatch alarm to automatically recover the instance
AnswerD

CloudWatch can automatically recover an instance on healthy hardware.

Why this answer

Amazon CloudWatch can automatically recover an impaired EC2 instance by restarting it on new underlying hardware, preserving the instance ID, private IP, Elastic IP, and EBS attachments. This minimizes recovery time by eliminating manual intervention and leveraging AWS's automated recovery mechanism, which is specifically designed for hardware failures on bare metal instances like those running SAP HANA.

Exam trap

The trap here is that candidates mistakenly think manual restart (Option B) or snapshot restore (Option C) are faster, but they overlook that CloudWatch automatic recovery is the only option that preserves the instance identity and minimizes downtime for hardware failures on bare metal instances.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not a recovery mechanism; recreating the instance from scratch would take longer and lose the existing instance configuration and data. Option B is wrong because manually starting the instance from the EC2 console will not resolve a hardware failure on a bare metal instance; the instance stop was caused by underlying hardware issues, and starting it again would likely fail or require manual migration to new hardware. Option C is wrong because restoring from the latest EBS snapshot would require creating a new instance, reattaching volumes, and reconfiguring networking, which is significantly slower than automatic recovery and does not preserve the instance ID or attached resources.

Full explanation →
923
MCQhard

During a migration of an SAP ERP system to AWS, the team notices that the SAP application performance is slow on the new EC2 instances. The instance type is correct for SAP certification. What is the most likely cause?

A.Instances are in different placement groups
B.Incorrect EC2 instance type
C.Security group rules are blocking traffic
D.EBS volumes are not provisioned with enough IOPS
AnswerD

Insufficient IOPS leads to storage bottlenecks and slow performance.

Why this answer

Storage performance, specifically IOPS, often impacts SAP performance. Even if the instance type is correct, if the EBS volumes are not provisioned with sufficient IOPS, performance will suffer. Option D is correct.

Option A (incorrect instance type) is not the issue. Option B (placement group) could be an issue but is less likely. Option C (security group) wouldn't cause performance issues.

Full explanation →
924
MCQeasy

A company is migrating its SAP system to AWS and wants to ensure that the migration does not violate any SAP licensing requirements. Which of the following is a correct licensing consideration?

A.SAP licenses are based on the number of AWS accounts used
B.SAP licenses must be purchased separately from SAP or an SAP partner
C.SAP licenses are automatically included when you use AWS Launch Wizard
D.SAP licenses are not required for non-production environments in AWS
AnswerB

Customers need to bring their own SAP licenses.

Why this answer

SAP requires that customers have proper licenses for all systems, including production and non-production, running on AWS. Option A is wrong because AWS does not provide SAP licenses by default. Option C is wrong because SAP licensing is based on the number of users or processor cores, not on the AWS account.

Option D is wrong because SAP licensing is required for all environments.

Full explanation →
925
Multi-Selectmedium

Which TWO AWS services can be used to monitor SAP HANA database performance in real time? (Select TWO.)

Select 2 answers
A.AWS Systems Manager
B.AWS CloudTrail
C.AWS Trusted Advisor
D.Amazon CloudWatch
E.AWS Config
AnswersA, D

Systems Manager can run scripts and collect performance data.

Why this answer

AWS Systems Manager is correct because it provides the capability to run SAP-specific commands and scripts on EC2 instances via Run Command or State Manager, enabling real-time monitoring of SAP HANA database performance metrics such as memory usage, CPU load, and SQL query execution. It integrates with SAP HANA's built-in monitoring tools (e.g., SAP HANA Studio or SAP HANA Cockpit) to collect and report performance data without requiring additional agents. Amazon CloudWatch is also correct because it can collect and track metrics from SAP HANA by using the CloudWatch agent or custom metrics, allowing real-time monitoring of key performance indicators like CPU utilization, memory consumption, and disk I/O.

CloudWatch integrates with SAP HANA via the SAP HANA CloudWatch connector or custom scripts, providing dashboards and alarms for proactive monitoring.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logs) or AWS Config (configuration tracking) with real-time performance monitoring, overlooking that Systems Manager and CloudWatch are the only services that can directly interact with SAP HANA's runtime metrics.

Full explanation →
926
MCQeasy

A company is running SAP on AWS and needs to ensure that all changes to the SAP infrastructure are logged for audit purposes. Which AWS service should be enabled to record API calls?

A.AWS CloudTrail
B.Amazon GuardDuty
C.Amazon CloudWatch
D.AWS Config
AnswerA

CloudTrail records all API activity for auditing.

Why this answer

(AWS CloudTrail) is correct because it records all API activity in the AWS account for audit purposes. Option B (Amazon GuardDuty) detects threats. Option C (Amazon CloudWatch) monitors performance.

Option D (AWS Config) evaluates resource configurations.

Full explanation →
927
MCQeasy

Refer to the exhibit. A CloudFormation template is used to launch an SAP application server. The stack creation succeeds, but the application server fails to start correctly. What is the most likely reason?

A.The template is missing an output parameter to verify the instance status.
B.The instance type r5.2xlarge is not supported for SAP application servers.
C.The AMI ID is invalid because it contains numeric characters.
D.The UserData script may not be executed due to timing issues; the sleep command may be insufficient.
AnswerD

The script has a 30-second sleep, but if the instance is not fully ready, the script may fail.

Why this answer

The UserData script includes a 'sleep 30' command, which may not be sufficient if the instance takes longer to become ready, causing the application server to fail to start correctly. Option A is incorrect because missing an output parameter does not affect the startup of the application server; outputs are for stack information. Option B is incorrect because the r5.2xlarge instance type is supported for SAP application servers on AWS.

Option C is incorrect because AMI IDs can contain numeric characters; the example AMI ID is valid.

Full explanation →
928
MCQhard

A company runs its SAP HANA database on an EC2 instance with EBS volumes. The database requires consistent low-latency I/O with a high number of IOPS. The current configuration uses EBS gp2 volumes. During peak loads, the application experiences performance degradation. Which change will provide the most consistent performance for SAP HANA?

A.Switch to EBS st1 (Throughput Optimized HDD) volumes.
B.Migrate to EBS io2 Block Express volumes with provisioned IOPS.
C.Configure multiple EBS gp2 volumes in a RAID 0 array to increase IOPS.
D.Increase the size of the existing gp2 volumes to gain higher baseline IOPS.
AnswerB

io2 Block Express volumes offer provisioned IOPS with consistent low latency, meeting the demanding I/O requirements of SAP HANA.

Why this answer

EBS io2 Block Express volumes (Option B) provide provisioned IOPS with consistent low latency, making them ideal for SAP HANA workloads that require high and predictable performance. st1 volumes (Option A) are throughput-optimized HDDs and not designed for high IOPS. RAID 0 with gp2 volumes (Option C) can increase IOPS but lacks the consistency and guaranteed performance of io2. Increasing gp2 volume size (Option D) improves baseline IOPS but does not guarantee consistent performance under peak load like provisioned IOPS.

Full explanation →
929
MCQmedium

A company is designing a disaster recovery (DR) strategy for SAP S/4HANA on AWS. The primary site is in us-east-1. They want a secondary site in us-west-2 with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which solution meets these requirements with the LEAST operational overhead?

A.Take hourly backups to S3 and restore in us-west-2 when needed.
B.Use HANA System Replication to us-west-2 with manual failover.
C.Use HANA System Replication in async mode to us-west-2.
D.Use HANA System Replication in sync mode with automatic failover to us-west-2.
AnswerC

Correct. Asynchronous HANA System Replication with automatic failover provides a balance between data loss (within RPO) and performance, and automated failover meets RTO with low operational overhead.

Why this answer

HANA System Replication in asynchronous mode can meet the 15-minute RPO and 2-hour RTO requirements when combined with automatic failover. Asynchronous replication is recommended for cross-region DR on AWS to avoid performance impact from latency, and automatic failover minimizes operational overhead. Option D is not recommended because synchronous replication over long distances introduces latency that can degrade primary site performance and may not be feasible for cross-region scenarios.

Exam trap

Candidates often choose synchronous mode because it offers zero data loss, but they overlook the latency impact of cross-region replication. Asynchronous mode with automatic failover is sufficient for the given RPO/RTO and has lower operational overhead.

How to eliminate wrong answers

Option A is wrong because hourly backups to S3 cannot achieve a 15-minute RPO (backups are taken only once per hour) and restoring from S3 would take significantly longer than 2 hours, failing both RPO and RTO. Option B is wrong because HANA System Replication with manual failover introduces human intervention, which typically exceeds the 2-hour RTO due to detection and execution delays, and does not meet the 'least operational overhead' requirement. Option C is wrong because HANA System Replication in async mode can achieve a 15-minute RPO but may lose data during a failover if the primary fails before the last asynchronous replication completes; however, the primary issue is that it does not include automatic failover, so recovery still requires manual steps, increasing operational overhead and potentially exceeding the 2-hour RTO.

Full explanation →
930
MCQhard

An SAP system on AWS is experiencing high latency for database transactions. The system uses a single EBS volume for the SAP HANA data volume. The operations team needs to improve I/O performance without changing the instance type. Which action should be taken?

A.Use a single EBS volume for both data and log
B.Switch to EBS io2 Block Express volumes
C.Increase the EBS volume size to gain more IOPS
D.Enable EBS optimization on the instance
AnswerB

io2 Block Express offers sub-millisecond latency and high IOPS, suitable for SAP HANA.

Why this answer

Switching to EBS io2 Block Express volumes provides higher IOPS and lower latency compared to gp3. Increasing volume size does not necessarily improve latency. Using a single volume for log and data is not recommended.

Enabling EBS optimization is already enabled on current generation instances.

Full explanation →
931
MCQhard

Refer to the exhibit. An SAP administrator is creating an IAM policy for a migration user who will use AWS DMS to migrate an SAP database to Amazon RDS. The migration also requires reading from an S3 bucket containing source database export files and writing the DMS logs to another S3 bucket. The policy above is attached. Which required permission is MISSING from this policy?

A.dms:TestConnection
B.s3:ListBucket
C.rds:ModifyDBInstance
D.dms:CreateEndpoint
AnswerD

DMS requires CreateEndpoint to define source and target databases.

Why this answer

The policy includes dms:CreateReplicationTask and permissions for S3 and RDS, but it lacks dms:CreateEndpoint, which is required to create source and target endpoints for DMS migrations. Without this permission, the migration user cannot set up the endpoints necessary for the replication process.

Option A (dms:TestConnection): This permission is used to test endpoint connectivity, but it is not essential for creating a replication task; the missing permission is for creating endpoints.

Option B (s3:ListBucket): While s3:ListBucket might be useful for browsing S3 objects, it is not strictly required because DMS can access objects by key if the path is provided.

Option C (rds:ModifyDBInstance): This permission is not needed for DMS to perform migration; DMS uses the RDS instance as a target but does not require modification rights.

Option D (dms:CreateEndpoint): Correct. Without this permission, the user cannot create the source or target endpoints, which are prerequisites for running a DMS task.

Full explanation →
932
MCQmedium

A company has deployed an SAP HANA database on AWS using a single EC2 instance with EBS volumes. The database is used for a critical SAP system. The company needs to ensure that the database can be restored to a point in time within the last 24 hours with minimal data loss. The administrator currently takes nightly EBS snapshots of the data and log volumes. However, recent tests show that recovery to a specific point in time (e.g., one hour ago) is not possible because the log volume is not backed up frequently enough. The administrator must implement a solution that allows point-in-time recovery with a recovery point objective (RPO) of 15 minutes. Which solution should the administrator implement?

A.Create EBS snapshots of the log volume every 15 minutes using a cron job
B.Use Amazon Data Lifecycle Manager (DLM) to schedule snapshots of the log volume every 15 minutes
C.Configure SAP HANA Backint agent to back up log files to Amazon S3 every 15 minutes
D.Enable EBS Multi-Attach on the log volume and attach it to a second instance to replicate logs
AnswerC

Correct. SAP HANA Backint to S3 allows frequent log backups (every 15 minutes), enabling point-in-time recovery with an RPO of 15 minutes. This is the recommended approach.

Why this answer

SAP HANA Backint enables log backups to Amazon S3 at frequent intervals (e.g., 15 minutes), allowing point-in-time recovery with minimal data loss. This is the native SAP HANA method for log backup and is efficient for achieving a 15-minute RPO. Option A is incorrect because EBS snapshots of the log volume every 15 minutes would be costly, cause I/O spikes, and are not recommended for frequent log backups.

Option B is incorrect because Amazon DLM automates EBS snapshots but still suffers from the same cost and performance issues as option A. Option D is incorrect because Multi-Attach does not address backup and replication of logs does not provide a usable backup for point-in-time recovery.

Exam trap

Candidates often confuse EBS snapshot automation (DLM) with SAP-native backup methods. The key is that SAP HANA requires log backups via Backint or similar to achieve frequent point-in-time recovery, not just volume snapshots.

Full explanation →
933
Multi-Selecteasy

Which TWO of the following are best practices for running SAP HANA on AWS? (Choose 2)

Select 2 answers
A.Stop HANA instances when not in use to save costs
B.Use general-purpose instances (e.g., t3) to reduce costs
C.Use separate EBS volumes for HANA data and log files
D.Use EBS-optimized instances for dedicated EBS bandwidth
E.Launch all HANA instances in a single placement group
AnswersC, D

Avoids I/O contention.

Why this answer

SAP HANA requires separate EBS volumes for data and log files to ensure I/O isolation and meet performance requirements. Data and log volumes have different I/O patterns (sequential for logs, random for data), and using separate volumes prevents contention, which is critical for HANA's high-throughput demands.

Exam trap

The trap here is that candidates may think stopping HANA instances saves costs (Option A) without realizing that HANA is an in-memory database that must remain running to preserve data, and that AWS charges for storage even when instances are stopped, making this a false economy for production systems.

Full explanation →
934
MCQmedium

A company is migrating a legacy on-premises application to AWS. The application requires static IP addresses for its clients to whitelist. The migration strategy includes using an Application Load Balancer (ALB) to distribute traffic across multiple EC2 instances in an Auto Scaling group. The clients require a fixed set of IP addresses to whitelist. Which solution meets the requirement?

A.Use AWS Global Accelerator with the Application Load Balancer as an endpoint.
B.Use an Application Load Balancer and assign Elastic IP addresses to it.
C.Use a Network Load Balancer with Elastic IP addresses.
D.Launch EC2 instances with Elastic IPs and place them behind a NAT Gateway.
AnswerC

NLB supports static IP addresses via Elastic IPs, meeting the whitelisting requirement.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses via Elastic IP (EIP) assignment per Availability Zone, which allows clients to whitelist a fixed set of IPs. The ALB, by contrast, does not support static IP assignment; its DNS name resolves to dynamic IPs that can change. Using an NLB with EIPs meets the requirement for a fixed whitelist while still distributing traffic to the ALB or directly to EC2 instances.

Exam trap

The trap here is that candidates assume an Application Load Balancer can be assigned Elastic IPs because they are familiar with assigning EIPs to EC2 instances, but ALBs do not support static IP assignment at all, making the NLB the only correct choice for fixed whitelist IPs.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator provides two static IP addresses but is an overlay service that still requires an endpoint (like an ALB or NLB) to receive traffic; it does not replace the need for a load balancer with static IPs, and the ALB itself still lacks static IPs. Option B is wrong because an Application Load Balancer cannot be assigned Elastic IP addresses; ALBs are designed to be internet-facing via a DNS name with dynamic IPs, and attaching EIPs is not supported. Option D is wrong because launching EC2 instances with Elastic IPs and placing them behind a NAT Gateway does not provide a load-balanced, highly available frontend; the NAT Gateway is used for outbound traffic, not inbound, and the EIPs would be tied to individual instances, not a single whitelistable set.

Full explanation →
935
MCQmedium

A company operates an SAP system on AWS with a shared SAP HANA database across multiple SAP applications. The database size is 5 TB. The operations team wants to implement a disaster recovery strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. Which solution meets these requirements with the least operational overhead?

A.Use AWS DMS to replicate data to an S3 bucket in a different Region
B.Use SAP HANA backup to S3 and restore in another Region
C.Configure SAP HANA System Replication (HSR) to a secondary instance in another AWS Region
D.Use AWS CloudEndure Disaster Recovery to replicate the entire server
AnswerC

HSR provides near-real-time replication and fast failover.

Why this answer

SAP HANA System Replication (HSR) to a secondary instance in another AWS Region meets the RPO of 15 minutes and RTO of 2 hours with the least operational overhead because HSR provides synchronous or near-synchronous replication at the database level, ensuring minimal data loss and fast failover. It is natively supported by SAP HANA, requires no additional third-party tools, and integrates directly with AWS for cross-Region networking via VPC peering or Direct Connect, making it the most efficient and low-maintenance DR solution for a shared 5 TB HANA database.

Exam trap

The trap here is that candidates often confuse backup-based recovery (Option B) with replication-based recovery, underestimating the time required to restore a 5 TB database from S3, or they overcomplicate the solution by choosing a generic server replication tool (Option D) instead of the native, database-optimized replication provided by SAP HANA System Replication.

How to eliminate wrong answers

Option A is wrong because AWS DMS is designed for heterogeneous database migrations and continuous change data capture, not for SAP HANA native replication; it cannot achieve the required RPO of 15 minutes for a 5 TB HANA database without significant overhead and latency, and it does not support SAP HANA-specific features like multi-tenant database containers. Option B is wrong because SAP HANA backup to S3 and restore in another Region is a backup-based approach, not a replication strategy; the RTO of 2 hours cannot be reliably met due to the time required to restore a 5 TB database from S3, and the RPO of 15 minutes would require frequent full or incremental backups that consume excessive storage and compute resources. Option D is wrong because AWS CloudEndure Disaster Recovery replicates the entire server at the block level, which introduces unnecessary overhead for a database-only DR scenario, does not understand SAP HANA transaction consistency, and would require additional configuration to ensure crash-consistent recovery, making it less efficient than native HSR.

Full explanation →
936
MCQeasy

A company is migrating an SAP system to AWS and wants to use an existing AWS Direct Connect connection for the migration. The on-premises network team reports that the Direct Connect link is consistently at 80% utilization during business hours. What should the company do to ensure a successful migration without impacting production traffic?

A.Increase the bandwidth of the Direct Connect link.
B.Use AWS Site-to-Site VPN over the internet as an alternative.
C.Schedule the migration during off-peak hours to avoid high utilization.
D.Use AWS Snowball Edge to transfer the data physically.
AnswerC

Off-peak hours ensure minimal impact on production traffic.

Why this answer

The correct approach is to schedule the migration during off-peak hours when the link utilization is lower to avoid congestion. Increasing bandwidth may not be feasible immediately. Using VPN over the internet may add latency and security concerns.

Snowball is for large data volumes, but if the data volume is manageable, off-peak migration is simpler.

Full explanation →
937
Multi-Selecthard

Which THREE considerations are important when designing a disaster recovery (DR) strategy for SAP on AWS?

Select 3 answers
A.Use EBS snapshots in the same Region for recovery
B.Copy Amazon Machine Images (AMIs) to the DR Region
C.Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
D.Use cross-Region replication for SAP HANA database backups
E.Deploy all SAP resources in a single AWS Region
AnswersB, C, D

Pre-built AMIs allow quick instance launch in DR.

Why this answer

Amazon Machine Images (AMIs) must be copied to the DR Region to ensure that the exact EC2 instance configuration, including the operating system, SAP application binaries, and any custom patches, is available for recovery. Without copying AMIs, you cannot launch identical instances in the DR Region, which is essential for a consistent SAP environment.

Exam trap

The trap here is that candidates often assume EBS snapshots in the same Region are sufficient for DR, but they fail to recognize that true DR requires cross-Region replication of both AMIs and database backups to meet RTO and RPO objectives.

Full explanation →
938
MCQeasy

A company runs SAP ERP on AWS using a Multi-AZ RDS for SAP HANA database. The operations team needs to automate the rotation of the database master password. Which AWS service should be used to securely store and rotate the password?

A.AWS Systems Manager Parameter Store
B.AWS Secrets Manager
C.AWS CloudHSM
D.AWS Identity and Access Management (IAM)
AnswerB

Secrets Manager can rotate RDS credentials automatically.

Why this answer

AWS Secrets Manager, is the correct choice because it is designed to securely store secrets and provides built-in capabilities to automatically rotate credentials for supported services like RDS. Option A (Systems Manager Parameter Store) can store secrets but does not natively support automatic rotation of RDS passwords. Option C (CloudHSM) is a hardware security module used for key management, not password rotation.

Option D (IAM) manages user permissions and policies, not database passwords.

Full explanation →
939
MCQeasy

An SAP system is running on AWS with an SAP HANA database. The administrator needs to back up the HANA database to Amazon S3. Which AWS service or feature should be used to perform efficient incremental backups?

A.AWS Backup with the SAP HANA backup plan
B.Amazon S3 Transfer Acceleration
C.AWS Storage Gateway with volume gateway
D.Amazon EBS snapshots of the HANA data volumes
AnswerA

AWS Backup integrates with SAP HANA to perform incremental backups to S3.

Why this answer

AWS Backup with the SAP HANA backup plan is correct because it provides native integration for SAP HANA databases, enabling automated, incremental, and log backups directly to Amazon S3. It uses the SAP HANA Backint agent to stream backup data to S3, supporting efficient incremental backups by only transferring changed data blocks since the last full or incremental backup, which minimizes storage and network costs.

Exam trap

The trap here is that candidates often confuse EBS snapshots (which are block-level incremental) with database-level incremental backups, failing to recognize that EBS snapshots do not integrate with SAP HANA's Backint protocol and require application-level consistency, making them unsuitable for efficient, non-disruptive HANA backups to S3.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads over long distances by using AWS edge locations, but it does not perform backups or manage incremental backup logic; it is merely a transport optimization. Option C is wrong because AWS Storage Gateway with volume gateway provides iSCSI block storage volumes that can be backed up as EBS snapshots, but it does not natively support SAP HANA database backups or incremental backup streaming to S3; it is designed for on-premises caching and hybrid storage, not for HANA-specific Backint integration. Option D is wrong because Amazon EBS snapshots of the HANA data volumes capture the entire volume state at a point in time, but they are not incremental at the database level—they are block-level incremental but require the database to be in a consistent state (e.g., frozen or stopped), which is disruptive for a production SAP HANA system and does not support log backups or point-in-time recovery as efficiently as Backint-based backups.

Full explanation →
940
MCQmedium

A company runs a critical SAP HANA database on an m5.24xlarge EC2 instance. The operations team notices that the database performance degrades during peak hours. Which AWS service should be used to identify whether the instance is experiencing CPU throttling due to CPU credit exhaustion?

A.Use CloudTrail to review the EC2 instance launch configuration.
B.Use AWS Trusted Advisor to check for instance performance issues.
C.Use CloudWatch to monitor the CPUUtilization metric.
D.Use CloudWatch to monitor the CPUCreditBalance metric.
AnswerC

This is the correct metric to identify high CPU usage.

Why this answer

CloudWatch CPUUtilization measures the actual CPU usage of the EC2 instance. For m5 instances, which are dedicated performance instances, there is no CPU credit concept, so monitoring CPUCreditBalance (option D) is irrelevant. The operations team can set a CloudWatch alarm on CPUUtilization to detect when CPU usage is high during peak hours, indicating potential performance degradation.

Option A (CloudTrail) logs API calls, not performance metrics. Option B (Trusted Advisor) provides best practice recommendations but does not offer real-time CPU monitoring. Therefore, CloudWatch CPUUtilization is the appropriate service to identify CPU throttling issues.

Full explanation →
941
Multi-Selectmedium

Which THREE of the following are valid methods to secure network traffic between SAP application servers and the SAP HANA database on AWS? (Choose three.)

Select 3 answers
A.Use VPC peering to connect different VPCs securely.
B.Use AWS Direct Connect to encrypt traffic.
C.Use network ACLs to control traffic at the subnet level.
D.Use security groups to restrict traffic between instances.
E.Use AWS Shield to encrypt traffic.
AnswersA, C, D

VPC peering enables private connectivity.

Why this answer

VPC peering allows you to connect SAP application servers in one VPC to SAP HANA databases in another VPC securely using private IP addresses, with traffic staying within the AWS network and not traversing the public internet. This is a valid method for securing network traffic between these components when they are deployed in separate VPCs.

Exam trap

The trap here is that candidates often confuse AWS Direct Connect with encryption (it provides a private connection but no inherent encryption) and mistake AWS Shield (a DDoS protection service) for a traffic encryption solution.

Full explanation →
942
Multi-Selecthard

A company is migrating a large SAP HANA database (5 TB) from on-premises to AWS. The migration must have minimal downtime and use AWS DMS for ongoing replication. Which TWO actions should be taken to ensure the migration completes successfully? (Choose 2.)

Select 2 answers
A.Use a t2.large instance for the DMS replication instance to reduce cost
B.Use Amazon S3 as an intermediate target for initial load
C.Provision a large EC2 instance for the DMS replication instance (e.g., x1e.32xlarge)
D.Enable Multi-AZ on the target RDS instance
E.Disable automatic backup retention on the target database
AnswersB, C

Using Amazon S3 as an intermediate target for the initial full load is a best practice for large databases, as it reduces load on the source and accelerates the initial transfer.

Why this answer

Options B and C are correct. Option B: Using Amazon S3 as an intermediate target for the initial full load helps reduce the load on the source and accelerates the initial data transfer, which is critical for a 5 TB database. Option C: Provisioning a large EC2 instance for the DMS replication instance (e.g., x1e.32xlarge) provides the necessary memory and compute to handle large data volumes and ongoing replication with minimal downtime.

Option D is incorrect because Amazon RDS does not support SAP HANA as a database engine; SAP HANA must be deployed on Amazon EC2, so Multi-AZ on RDS is not applicable. Option A is incorrect because a t2.large instance lacks sufficient resources for a 5 TB migration. Option E is incorrect because disabling backup retention is not a best practice during migration and could lead to data loss.

Full explanation →
943
MCQeasy

An SAP system is experiencing high disk I/O latency. The operations team checks the Amazon CloudWatch metrics and finds that the Average Queue Length for the EBS volumes is consistently above the recommended threshold. Which action should be taken to address this issue?

A.Change the volume type to Throughput Optimized HDD (st1).
B.Increase the provisioned IOPS for the EBS volumes.
C.Enable EBS encryption to improve I/O performance.
D.Increase the volume size to improve I/O performance.
AnswerB

Higher IOPS can handle more requests, reducing queue length.

Why this answer

Increasing the provisioned IOPS for the EBS volumes directly increases the number of I/O operations the volume can handle, reducing the average queue length. Option A is incorrect because st1 volumes are optimized for throughput, not IOPS. Option C is incorrect because EBS encryption does not improve I/O performance and may introduce a slight overhead.

Option D is incorrect because increasing volume size does not directly affect queue length; for gp2 volumes, it only increases baseline IOPS indirectly via burst credits, but it is not a reliable method to reduce queue length.

Full explanation →
944
MCQhard

A company is migrating its SAP system from on-premises to AWS. The system uses a shared filesystem (NFS) for transport directories and logs. The company wants to use AWS storage services to provide a similar shared filesystem. Which storage solution is MOST appropriate for this migration?

A.Amazon EFS (Elastic File System)
B.Amazon S3 with a mount point via s3fs-fuse
C.Amazon FSx for Windows File Server
D.Amazon EBS with multi-attach enabled
AnswerA

EFS provides a scalable NFS filesystem that can be shared across multiple EC2 instances.

Why this answer

Amazon EFS provides a managed NFS filesystem that can be mounted by multiple EC2 instances, making it suitable for SAP transport directories that require shared POSIX/NFS access. Option B (Amazon S3 with a mount point via s3fs-fuse) is not ideal because S3 is object storage and s3fs-fuse does not provide full POSIX compliance or consistent NFS semantics, leading to performance and concurrency issues. Option C (Amazon FSx for Windows File Server) uses SMB protocol, not NFS, so it is not appropriate for SAP systems that expect NFS.

Option D (Amazon EBS with multi-attach enabled) allows attaching a single volume to multiple instances but is limited to a few instances, requires a cluster-aware filesystem, and is more complex to manage than EFS for shared filesystem use cases.

Full explanation →
945
MCQmedium

A company is migrating a SAP system to AWS and needs to ensure that the database migration from SAP ASE to Amazon Aurora is successful with minimal downtime. Which AWS service should be used?

A.AWS Snowball Edge
B.AWS Server Migration Service (SMS)
C.AWS DataSync
D.AWS Database Migration Service (DMS)
AnswerD

DMS supports heterogeneous migrations and ongoing replication.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports heterogeneous migrations from SAP ASE (Sybase) to Amazon Aurora with minimal downtime. DMS can continuously replicate ongoing changes from the source database to the target using change data capture (CDC), allowing the source system to remain operational during the migration and enabling a cutover with only a brief outage.

Exam trap

The trap here is that candidates may confuse AWS DMS with AWS DataSync, assuming DataSync can handle database migrations, but DataSync is strictly for file-based data transfers and lacks the heterogeneous database replication capabilities required for SAP ASE to Aurora.

How to eliminate wrong answers

Option A (AWS Snowball Edge) is wrong because it is a physical data transfer device designed for large-scale offline data migrations, not for live database replication with minimal downtime, and it cannot perform ongoing CDC from SAP ASE to Aurora. Option B (AWS Server Migration Service) is wrong because it is used for migrating on-premises virtual machines to AWS as AMIs, not for database-level migrations between different database engines. Option C (AWS DataSync) is wrong because it is optimized for moving large volumes of file data over the network (e.g., NFS/SMB shares) and does not support heterogeneous database replication or CDC for SAP ASE to Aurora.

Full explanation →
946
Multi-Selectmedium

A company is designing an SAP HANA disaster recovery solution on AWS across two regions. Which TWO actions meet the requirement of a Recovery Point Objective (RPO) of less than 5 minutes?

Select 2 answers
A.Set up AWS Database Migration Service (DMS) with ongoing replication from the primary to the DR region.
B.Use Amazon S3 Cross-Region Replication to copy HANA data files to the DR region every minute.
C.Schedule a script to run every minute that exports HANA data and uploads to S3 in the DR region.
D.Implement SAP HANA System Replication with asynchronous replication to the DR region.
E.Configure automated nightly snapshots of the HANA database and copy them to the DR region using AWS Backup.
AnswersA, D

AWS DMS with ongoing replication can achieve sub-5-minute RPO by continuously replicating changes.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication can continuously capture and apply changes from the SAP HANA source database to a target in the DR region, achieving sub-5-minute RPO by replicating transactions in near real-time. Option D is correct because SAP HANA System Replication with asynchronous mode replicates data at the database level, typically achieving RPO of seconds to a few minutes, well under the 5-minute requirement.

Exam trap

The trap here is that candidates may confuse S3 Cross-Region Replication or scripted exports as viable for low RPO, not realizing that these methods cannot provide the continuous, transactional consistency required for SAP HANA disaster recovery.

Full explanation →
947
MCQeasy

A company wants to automate the backup of its SAP HANA database to Amazon S3. The database is running on an EC2 instance with a 500 GB gp3 volume. The backup should be encrypted at rest in S3. What is the most efficient way to achieve this with minimal operational overhead?

A.Use the SAP HANA Backup and Restore integration with Amazon S3 to back up directly to S3 buckets, enabling default S3 encryption.
B.Back up to an EBS snapshot, then copy the snapshot to S3 using AWS Backup.
C.Schedule an AWS Backup plan to back up the EC2 instance and its EBS volumes.
D.Use AWS Storage Gateway to back up the database to S3, then enable S3 encryption.
AnswerA

SAP natively supports backing up to S3, which is efficient and supports encryption.

Why this answer

SAP HANA natively supports direct backup to Amazon S3 via the SAP HANA Backup and Restore integration, which uses the S3 API to stream backup files directly to an S3 bucket. This eliminates the need for intermediate storage or additional services, and enabling default S3 encryption (SSE-S3 or SSE-KMS) ensures data is encrypted at rest with minimal configuration overhead, meeting the requirement for efficiency and low operational burden.

Exam trap

The trap here is that candidates often assume AWS Backup or EBS snapshots are the simplest approach for database backups, but they fail to recognize that SAP HANA has a native, direct-to-S3 backup feature that avoids the overhead of volume-level snapshots and ensures application consistency without additional scripting.

How to eliminate wrong answers

Option B is wrong because backing up to an EBS snapshot and then copying it to S3 using AWS Backup is inefficient; it requires an intermediate EBS snapshot step, adds latency, and does not leverage SAP HANA's native S3 integration, increasing operational overhead. Option C is wrong because scheduling an AWS Backup plan to back up the EC2 instance and its EBS volumes captures the entire volume (including OS and non-database files), not a consistent SAP HANA database backup, and it does not provide application-consistent backups for SAP HANA without additional pre/post-scripts, leading to potential data corruption. Option D is wrong because using AWS Storage Gateway to back up the database to S3 introduces an unnecessary intermediary service, adds complexity and latency, and does not integrate directly with SAP HANA's backup mechanisms, making it less efficient than native S3 backup.

Full explanation →
948
Multi-Selectmedium

A company is designing an SAP system on AWS with SAP HANA as the database. The system must be highly available across multiple Availability Zones. Which TWO actions should the company take to meet this requirement?

Select 2 answers
A.Configure SAP HANA System Replication (HSR) in synchronous mode
B.Perform periodic EBS snapshots and restore in another AZ
C.Use Amazon S3 cross-region replication for the database files
D.Set up a Pacemaker cluster to automate failover between primary and secondary
E.Use manual failover by changing DNS records
AnswersA, D

HSR provides real-time replication to a secondary instance in another AZ.

Why this answer

SAP HANA System Replication (HSR) in synchronous mode ensures that every committed transaction is replicated to a secondary HANA instance in another Availability Zone before acknowledging the commit to the application. This provides zero data loss (RPO=0) and enables automatic failover, meeting the high availability requirement across AZs.

Exam trap

The trap here is that candidates may confuse backup strategies (EBS snapshots or S3 replication) with true high availability, or assume manual DNS changes are sufficient, while the exam expects understanding that synchronous HSR plus an automated cluster manager (Pacemaker) is mandatory for HA across AZs.

Full explanation →
949
MCQmedium

An SAP system is running on an EC2 instance with an attached EBS volume for /usr/sap. The operations team notices that the volume is almost full. Which action should be taken to increase the available space without downtime?

A.Modify the EBS volume to increase its size while the instance is running, then extend the filesystem.
B.Reduce the size of the volume by modifying the volume configuration.
C.Create a new larger EBS volume, attach it to the instance, and copy the data.
D.Create a snapshot of the volume and use it to create a larger volume, then attach and mount.
AnswerA

EBS volumes can be increased online, and the filesystem can be extended without downtime.

Why this answer

You can increase the size of an EBS volume while the instance is running, then extend the filesystem. Option A is correct. Option B is wrong because snapshots are for backup, not immediate space increase.

Option C is wrong because reducing the volume size is not supported. Option D is wrong because creating a new volume and copying data requires downtime.

Full explanation →
950
MCQmedium

A company is migrating its SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS). The solution must support automatic failover in the event of an instance failure. Which AWS architecture meets these requirements?

A.Deploy ASCS on Amazon RDS Multi-AZ
B.Deploy two EC2 instances in different Availability Zones with a shared Amazon EFS filesystem and use Route53 health checks for failover
C.Use AWS Global Accelerator with a static IP
D.Deploy a single EC2 instance with a large EBS volume
AnswerB

This is the standard architecture for ASCS HA on AWS.

Why this answer

SAP ASCS high availability on AWS requires a cluster spanning two Availability Zones with a shared filesystem for /sapmnt and /usr/sap/trans. AWS does not support cluster-based floating IPs, so Route53 health checks are used for failover. Option B is correct: it uses two EC2 instances in different AZs with Amazon EFS (shared filesystem) and Route53 health checks for automatic failover.

Option A (Amazon RDS Multi-AZ) is for databases, not ASCS. Option C (AWS Global Accelerator) provides traffic routing and static IP but does not handle ASCS failover. Option D (single EC2) lacks high availability.

Full explanation →
951
Multi-Selecthard

A company is migrating a large SAP ERP system to AWS using SAP HANA. They want to minimize downtime and ensure consistency. Which three approaches should they combine? (Choose THREE.)

Select 3 answers
A.Use AWS Snowball Edge for the initial data transfer
B.Use AWS DataSync for ongoing replication
C.Use AWS Server Migration Service (SMS) for server replication
D.Use AWS DMS for ongoing change data capture
E.Set up SAP HANA system replication between source and target
AnswersA, D, E

Snowball handles large initial data efficiently.

Why this answer

The correct combination involves Snowball Edge for the initial large data transfer (A), DMS with ongoing change data capture (D), and SAP HANA system replication for zero-downtime cutover (E). Snowball Edge handles the initial bulk load efficiently. DMS captures ongoing changes during migration.

SAP HANA system replication provides continuous data synchronization for a seamless switch. Option B (DataSync) is redundant as DMS already handles ongoing replication. Option C (SMS) is designed for server-level migration, not for SAP HANA data.

Thus, A, D, and E are the three approaches to combine.

Full explanation →
952
MCQhard

A team is migrating an Oracle database to Amazon RDS for MySQL using AWS DMS with ongoing replication (CDC). The initial load succeeded, but the CDC task fails with the error shown in the exhibit. The source Oracle database is on-premises. Which action should the team take to resolve the issue?

A.Configure binary logging on the target MySQL RDS instance.
B.Stop and restart the DMS task to clear the error.
C.Switch the target database to Amazon RDS for Oracle to maintain compatibility.
D.Connect to the source Oracle database and enable full supplemental logging by executing the command: ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;
AnswerD

This command enables the required logging for CDC to work.

Why this answer

AWS DMS requires full supplemental logging on the source Oracle database to capture all column values for CDC (ongoing replication). Without it, DMS cannot reconstruct the complete row changes from the redo logs, causing the CDC task to fail. Enabling full supplemental logging with `ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;` ensures that every column is logged, allowing DMS to replicate all changes correctly.

Exam trap

The trap here is that candidates often assume the issue is on the target side (e.g., binary logging) or that a simple restart will fix transient errors, but AWS DMS CDC failures from Oracle almost always point to missing supplemental logging on the source.

How to eliminate wrong answers

Option A is wrong because binary logging is a MySQL-specific feature for replication, and the target RDS for MySQL already has it enabled by default; the issue is on the source Oracle side, not the target. Option B is wrong because stopping and restarting the DMS task will not resolve the underlying missing supplemental logging; the error will recur immediately. Option C is wrong because switching the target to RDS for Oracle would avoid the supplemental logging requirement but is an unnecessary and costly workaround that does not fix the root cause; the migration to MySQL is the stated goal.

Full explanation →
953
MCQhard

An SAP Basis administrator needs to apply an SAP kernel patch to the SAP Central Services (ASCS) instance running on an EC2 instance in a Multi-AZ deployment. The ASCS instance is configured with a floating IP address using Elastic IP. The administrator wants to minimize downtime during the patching process. Which approach should the administrator take?

A.Stop the ASCS instance, apply the patch, and start the instance.
B.Create a new EC2 instance with the patched kernel, associate the Elastic IP to the new instance, and terminate the old one.
C.Add the ASCS instance to an Application Load Balancer and then perform the patch.
D.Use an Auto Scaling group with a rolling update to apply the patch.
AnswerB

It implements a blue/green deployment. By creating a new EC2 instance with the patched kernel and associating the Elastic IP, the running ASCS instance is not affected, and downtime is minimized to the brief period required to update the Elastic IP association.

Why this answer

It implements a blue/green deployment, allowing the patch to be applied on a new EC2 instance without affecting the running ASCS instance. After patching, associate the Elastic IP to the new instance and terminate the old one, minimizing downtime to a brief DNS propagation delay. Option A is wrong because stopping the instance causes downtime during the patch.

Option C is wrong because an Application Load Balancer does not support floating IP setups like Elastic IP for ASCS. Option D is wrong because Auto Scaling rolling updates are designed for scaling groups, not a single ASCS instance, and would still cause downtime.

Full explanation →
954
Multi-Selecthard

Which THREE metrics should be monitored in Amazon CloudWatch to proactively identify performance issues in an SAP NetWeaver application server? (Choose three.)

Select 3 answers
A.S3 request metrics
B.CPUUtilization
C.Memory utilization (via CloudWatch Agent)
D.VPC Flow Logs
E.DiskQueueDepth
AnswersB, C, E

High CPU indicates performance issues.

Why this answer

The correct metrics to proactively identify performance issues in an SAP NetWeaver application server are CPUUtilization (B), Memory utilization via the CloudWatch Agent (C), and DiskQueueDepth (E). CPUUtilization indicates CPU load, Memory utilization shows memory pressure, and DiskQueueDepth reflects I/O bottlenecks. S3 request metrics (A) are for object storage, not the application server itself.

VPC Flow Logs (D) capture network traffic metadata, not performance metrics.

Full explanation →
955
MCQeasy

A company is migrating an SAP ERP system on Oracle to SAP HANA on AWS. The migration requires near-zero downtime. The company has a test environment that can be used for the migration rehearsal. The SAP HANA database will be 3 TB. Which migration approach should the company use to achieve near-zero downtime?

A.Use AWS Database Migration Service (DMS) for ongoing replication.
B.Perform a full backup of the Oracle database and restore to SAP HANA.
C.Use SAP Software Update Manager (SUM) with Database Migration Option (DMO).
D.Use SAP HANA Studio to export the Oracle schema and import into HANA.
AnswerC

DMO supports near-zero downtime migration.

Why this answer

SAP Software Update Manager (SUM) with Database Migration Option (DMO) is the correct approach because it combines the SAP system upgrade and the migration from Oracle to SAP HANA into a single process, leveraging SAP's own tools to minimize downtime. DMO uses a trigger-based replication mechanism that can achieve near-zero downtime by keeping the source Oracle database and target SAP HANA database synchronized during the migration window, which is critical for a 3 TB database where traditional backup-restore would exceed downtime limits.

Exam trap

The trap here is that candidates often assume AWS DMS is the universal tool for any database migration to AWS, but for SAP HANA migrations, the certified and supported approach is SAP's own DMO tool, not a generic AWS service.

How to eliminate wrong answers

Option A is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a target for ongoing replication from Oracle in a certified SAP migration scenario; DMS is designed for homogeneous or heterogeneous database migrations but lacks the SAP-specific schema and application-level consistency required for SAP workloads. Option B is wrong because performing a full backup of the Oracle database and restoring to SAP HANA would require a significant downtime window to complete the backup transfer and restore, which cannot achieve near-zero downtime for a 3 TB database. Option D is wrong because using SAP HANA Studio to export the Oracle schema and import into HANA is a manual, offline process that does not support ongoing replication or near-zero downtime; it would require the source system to be stopped during the export and import phases.

Full explanation →
956
MCQmedium

A company is using AWS CloudFormation to manage infrastructure. The development team wants to deploy a new version of a stack that updates an existing RDS DB instance's DB engine version. The update requires a replacement of the database. Which CloudFormation stack policy setting allows the update to proceed while preventing other resources from being replaced or updated?

A.Set a stack policy that allows updates to RDS resources only.
B.Set a stack policy that allows updates to the specific RDS DB instance resource.
C.Set a stack policy that denies all updates.
D.Set a stack policy that allows all updates.
AnswerB

Stack policies can be written to allow updates to specific resources.

Why this answer

A stack policy in AWS CloudFormation can be set to explicitly allow updates to a specific resource (e.g., the RDS DB instance) while denying updates to all other resources by default. Since the update requires a replacement of the database, the policy must permit the update action on that exact resource logical ID, ensuring the DB engine version change proceeds without risking unintended modifications to other stack resources.

Exam trap

The trap here is that candidates often confuse a stack policy with an IAM policy or resource-level permissions, mistakenly thinking that allowing updates to a resource type (Option A) is sufficient, when in fact the policy must target the specific resource logical ID to avoid unintended updates to other resources of the same type.

How to eliminate wrong answers

Option A is wrong because allowing updates to all RDS resources is too broad; it would permit updates to any RDS resource in the stack, not just the specific DB instance, potentially causing unintended replacements or updates to other RDS resources like DB subnet groups or read replicas. Option C is wrong because denying all updates would block the intended DB engine version update entirely, preventing the deployment from proceeding. Option D is wrong because allowing all updates removes any protection, making every resource in the stack vulnerable to accidental replacement or modification, which defeats the purpose of using a stack policy for controlled updates.

Full explanation →
957
MCQeasy

Your SAP on AWS environment uses a central S3 bucket to store SAP transport files. The operations team reports that transport import fails intermittently. Which AWS service can be used to monitor and alert on S3 API call failures?

A.AWS CloudTrail
B.AWS Config
C.Amazon CloudWatch Metrics
D.AWS Trusted Advisor
AnswerA

Correct. AWS CloudTrail records S3 API calls, allowing you to monitor and alert on failures.

Why this answer

CloudTrail logs all S3 API calls and can be used to monitor failures via CloudWatch Logs or EventBridge. AWS Config tracks configuration changes, not API calls. CloudWatch Metrics provides S3 metrics but is not the primary service for detailed API call monitoring.

Trusted Advisor offers best-practice checks, not real-time monitoring.

Full explanation →
958
MCQmedium

A company is running an SAP S/4HANA system on AWS. The SAP application is deployed on EC2 instances in a Multi-AZ setup with a shared /sapmnt directory using Amazon EFS. The database is running on Amazon RDS for SAP ASE. Performance monitoring reveals that the /sapmnt volume is experiencing high read latency during peak hours. Which action would most effectively reduce latency?

A.Migrate /sapmnt to Amazon FSx for NetApp ONTAP.
B.Use Amazon ElastiCache for Redis to cache /sapmnt data.
C.Increase the provisioned throughput on the EFS file system.
D.Increase the size of the EC2 instances running SAP.
AnswerA

Migrating /sapmnt to Amazon FSx for NetApp ONTAP provides a high-performance, low-latency shared file system optimized for SAP S/4HANA, effectively reducing read latency.

Why this answer

Migrating /sapmnt to Amazon FSx for NetApp ONTAP provides a high-performance, low-latency shared file system that is fully supported for SAP S/4HANA. FSx for NetApp ONTAP offers consistent low-latency access and is optimized for SAP workloads. Option B (using Amazon ElastiCache for Redis) is not a file system solution and cannot replace the shared /sapmnt directory.

Option C (increasing the provisioned throughput on the EFS file system) may improve performance but is less effective than using FSx, as EFS is a general-purpose file system with higher latency compared to FSx for NetApp ONTAP. Option D (increasing EC2 instance size) addresses compute capacity, not storage latency, and thus would not reduce read latency on the file system.

Full explanation →
959
MCQmedium

An SAP administrator notices that the SAP HANA database on an EC2 instance is running out of memory frequently. The instance type is r5.4xlarge with 128 GiB of memory. Which action should the administrator take to resolve this issue?

A.Reduce the SAP HANA buffer cache size
B.Increase swap space on the instance
C.Enable SAP HANA compression
D.Scale up to a larger instance type with more memory
AnswerD

Larger instance provides more memory.

Why this answer

Scaling up to a larger instance type, such as moving from an r5.4xlarge to an r5.8xlarge or higher, directly increases the available memory for SAP HANA, resolving the out-of-memory issue. Option A is incorrect because reducing the SAP HANA buffer cache size would degrade database performance and does not address the underlying memory shortage. Option B is incorrect because increasing swap space introduces disk-based paging, which can severely slow down HANA due to high latency, and is not a recommended solution.

Option C is incorrect because enabling SAP HANA compression can reduce memory usage for data storage but does not add memory capacity; it is a tuning measure, not a direct fix for running out of memory.

Full explanation →
960
MCQmedium

A company is migrating an SAP HANA database to AWS. They have set up HANA System Replication (HSR) between the on-premises primary and an AWS secondary. The initial data synchronization is complete, but during the final cutover, the replication breaks due to network latency. What should the company do to complete the migration successfully?

A.Perform a manual takeover to promote the AWS secondary to primary.
B.Set up a new HSR connection with a different port.
C.Increase the HSR timeout settings on the primary.
D.Restart the initial synchronization from scratch.
AnswerA

This completes the cutover and makes the AWS system the new primary.

Why this answer

The correct action is to perform a manual failover using HSR takeover, which will promote the AWS secondary to primary and allow the system to continue. Increasing timeout may not resolve underlying latency. Restarting replication will take time.

Setting up a new replication is unnecessary.

Full explanation →
961
Multi-Selecthard

An SAP system administrator is troubleshooting an issue where SAP users cannot log in to the SAP system. The administrator checks the SAP application server logs and finds that the connection to the SAP HANA database is failing with 'connection refused'. Which THREE AWS resources should be investigated to resolve the issue?

Select 3 answers
A.VPC peering connection
B.Network ACLs for the database subnet
C.Internet Gateway
D.Security group rules for the database instance
E.Route tables for the application server subnet
AnswersB, D, E

Network ACLs are stateless firewalls; misconfigured rules can block traffic.

Why this answer

Options B, D, and E are correct. Network ACLs for the database subnet must allow inbound and outbound traffic between the application server and database. Security group rules for the database instance must permit traffic from the application server's security group on the database port.

Route tables for the application server subnet must have a route to the database subnet. Option A is incorrect because a VPC peering connection is not needed unless the resources are in different VPCs. Option C is incorrect because an Internet Gateway is not required for internal communication within a VPC.

Full explanation →
962
MCQhard

A company runs a critical workload on Amazon RDS for PostgreSQL with Multi-AZ. The operations team notices that during a recent failover test, the DNS record updated in about 60 seconds. However, the application experienced a 2-minute downtime because some connections were not re-established quickly. What should the team do to reduce downtime during failover?

A.Enable automated backups with a short retention period.
B.Increase the TTL of the RDS DNS record to 300 seconds.
C.Configure the application's connection string to use the RDS endpoint with a retry mechanism.
D.Place a Network Load Balancer in front of the RDS instance.
AnswerC

Using the read replica endpoint can redirect traffic faster; retries help re-establish connections.

Why this answer

During a Multi-AZ failover, the RDS DNS record is updated to point to the standby instance. However, DNS caching at the client side can cause delays. By configuring the application to use a retry mechanism on the RDS endpoint, connections are re-established quickly after failover completes, without waiting for DNS TTL expiry.

This reduces downtime compared to approaches that rely solely on DNS propagation.

Exam trap

The trap here is that candidates often think increasing DNS TTL speeds up failover, but in reality, a higher TTL increases client-side caching delay, making downtime worse, while the correct approach is to use a retry mechanism on the RDS endpoint to bypass DNS propagation issues entirely.

How to eliminate wrong answers

Option A is wrong because enabling automated backups with a short retention period does not affect DNS resolution or connection re-establishment during failover; backups are for point-in-time recovery, not for reducing failover downtime. Option B is wrong because increasing the TTL of the RDS DNS record to 300 seconds would actually increase the time clients cache the old DNS record, making the failover downtime longer (up to 300 seconds) instead of reducing it. Option D is wrong because placing a Network Load Balancer (NLB) in front of an RDS instance is not supported; RDS does not allow an NLB to front it directly, and even if it did, the NLB would still rely on DNS or health checks that introduce similar delays.

Full explanation →
963
MCQmedium

Refer to the exhibit. An SAP HANA instance is running on an EC2 instance. The volume `/dev/sdf` is used for HANA data. The operations team needs to increase the disk size for HANA data without downtime. Which action should they take?

A.Launch a new instance with a larger volume and migrate HANA data.
B.Stop the instance, modify the volume size, and start the instance.
C.Add a new EBS volume to the instance and move HANA data to the new volume.
D.Modify the EBS volume size while the instance is running.
AnswerD

EBS volumes can be modified without detaching or stopping the instance.

Why this answer

Modifying the EBS volume size while the instance is running is supported for most volume types, allowing for a no-downtime increase. Option A is wrong because launching a new instance and migrating data would cause downtime. Option B is wrong because stopping the instance is unnecessary and would cause downtime.

Option C is wrong because adding a new volume and moving data would also require downtime for the migration.

Full explanation →
964
Multi-Selecteasy

A company is migrating its SAP system to AWS and needs to transfer a large amount of data (10 TB) from the on-premises data center to AWS. Which TWO AWS services can be used for this data transfer?

Select 2 answers
A.Amazon S3 Transfer Acceleration
B.AWS DataSync
C.AWS CloudFormation
D.AWS Snowball
E.AWS Database Migration Service (DMS)
AnswersB, D

DataSync can transfer data over the network efficiently.

Why this answer

For large-scale data transfer (10 TB) to AWS, AWS DataSync (Option B) efficiently transfers data over the network with automation and optimization. AWS Snowball (Option D) is a physical device for offline transfer, ideal for large datasets when network transfer is impractical. Option A is incorrect because Amazon S3 Transfer Acceleration only speeds up S3 uploads over the internet, not a full migration service.

Option C is incorrect because AWS CloudFormation is for infrastructure as code, not data transfer. Option E is incorrect because AWS DMS is for database migration, not general file transfer.

Full explanation →
965
MCQhard

An SAP administrator needs to patch the operating system of SAP application servers that are part of an Auto Scaling group. What is the best practice to ensure that instances are updated without downtime?

A.Update the AMI used by the Auto Scaling group launch configuration and manually terminate all running instances.
B.Create a new launch configuration with an updated AMI and perform a rolling update using the Auto Scaling group.
C.Update the AMI and stop the Auto Scaling group, then start it again.
D.Install patches on each running instance using AWS Systems Manager Patch Manager.
AnswerB

Rolling update replaces instances one by one, maintaining service availability.

Why this answer

A rolling update replaces instances gradually, maintaining capacity. Option A is wrong because it does not address replacement. Option C is wrong because it causes downtime.

Option D is wrong because it does not apply to running instances.

Full explanation →
966
MCQmedium

A company wants to automate the installation of SAP HANA on AWS using CloudFormation. Which AWS resource should be used to run a script that downloads and installs SAP HANA software on an EC2 instance after the instance is launched?

A.AWS::CloudFormation::Init (cfn-init)
B.AWS::CloudFormation::CreationPolicy with cfn-signal
C.AWS Lambda function triggered by EC2 state change
D.EC2 User Data
AnswerB

CreationPolicy waits for signals from cfn-signal after script completes.

Why this answer

AWS CloudFormation's CreationPolicy with cfn-signal allows you to control the stack creation process by waiting for a signal from the EC2 instance after it has completed its configuration. When using a CreationPolicy, CloudFormation will not mark the resource as created until it receives a signal (e.g., via cfn-signal) indicating that the installation script has finished. This is ideal for automating SAP HANA installations where you need to ensure the software is fully installed before proceeding.

Option A is incorrect because AWS::CloudFormation::Init (cfn-init) is used to install packages, create files, and run commands during instance launch, but it does not provide a mechanism for CloudFormation to wait for the completion of long-running scripts; it runs as part of the user data and returns immediately. Option C is incorrect because while a Lambda function can be triggered by EC2 state changes, it does not integrate directly with CloudFormation's stack creation process to signal completion. You would need additional custom logic to send a signal back to CloudFormation, making it less straightforward than using CreationPolicy.

Option D is incorrect because EC2 User Data runs once at instance launch, but CloudFormation does not inherently wait for user data scripts to finish. Without a CreationPolicy or similar mechanism, CloudFormation will proceed to the next resource immediately after launching the instance, even if the script is still running.

Full explanation →
967
Multi-Selectmedium

Which TWO factors are most important to consider when planning the network connectivity for an SAP migration to AWS using AWS Direct Connect?

Select 2 answers
A.Number of VPC endpoints required.
B.Security group rules for the SAP application.
C.Latency and bandwidth requirements.
D.BGP routing configuration and failover.
E.IP address range for VPC subnets.
AnswersC, D

Direct Connect provides consistent latency and dedicated bandwidth.

Why this answer

The two most important factors for planning Direct Connect connectivity in an SAP migration are latency/bandwidth requirements (C) and BGP routing configuration with failover (D). SAP applications are highly sensitive to latency and require consistent throughput, so ensuring sufficient bandwidth and low latency is critical. BGP routing and failover mechanisms guarantee high availability and resilience by enabling automatic failover to backup connections.

Option A (VPC endpoints) is not a Direct Connect factor—endpoints provide private access to AWS services but are unrelated to Direct Connect planning. Option B (security group rules) controls instance-level traffic and is not a primary Direct Connect consideration. Option E (VPC subnet IP ranges) is important for VPC design but does not directly impact the Direct Connect connection itself.

Full explanation →
968
Multi-Selecteasy

A company is planning a migration of an SAP system to AWS. Which TWO factors should be considered when selecting the AWS Region for the migration?

Select 2 answers
A.Proximity to on-premises data center and end users
B.Number of Availability Zones
C.Data residency and compliance requirements
D.AWS service cost
E.Availability of specific instance types
AnswersA, C

Lower latency improves performance.

Why this answer

Proximity to users reduces latency. Compliance requirements may mandate specific regions. Cost varies but is not primary for region selection.

Instance availability is global. Service features may vary but are secondary.

Full explanation →
969
MCQhard

A company is migrating a critical SAP HANA database to AWS and needs to ensure high availability. The SAP HANA system replication will be configured across two Availability Zones. Which AWS service should be used to automate the failover of the SAP HANA database?

A.Amazon Route 53
B.AWS CloudFormation
C.AWS Elastic Disaster Recovery (DRS)
D.AWS Backup
AnswerA

Correct. Route 53 with failover routing and health checks automates DNS-level failover, redirecting traffic to the standby SAP HANA instance when the primary fails.

Why this answer

Amazon Route 53 with failover routing policy and health checks can automate DNS-level failover by directing traffic to the healthy SAP HANA instance. Combined with SAP HANA System Replication across AZs, this provides automated database failover. Option B (AWS CloudFormation) provisions infrastructure but does not automate failover.

Option C (AWS Elastic Disaster Recovery) is designed for cross-region disaster recovery, not cross-AZ high availability. Option D (AWS Backup) handles scheduled backups, not real-time failover.

Exam trap

Candidates often select AWS DRS because it replicates data, but for cross-AZ HA of SAP HANA, DNS-based failover with Route 53 is the standard approach. DRS is intended for cross-region DR.

Full explanation →
970
MCQeasy

A company wants to run SAP S/4HANA on AWS and needs to ensure that the SAP application and database are deployed according to AWS best practices. Which deployment method should they use?

A.Manual deployment using EC2 and RDS
B.AWS Launch Wizard for SAP
C.AWS Quick Start for SAP
D.AWS CloudFormation with custom templates
AnswerB

Launch Wizard automates SAP deployment following AWS best practices.

Why this answer

AWS Launch Wizard for SAP is the correct deployment method because it provides a guided, best-practice-based deployment experience specifically for SAP S/4HANA, automatically provisioning EC2 instances, storage, and networking while validating SAP requirements such as kernel compatibility, sizing, and high availability. It reduces manual effort and errors by integrating directly with AWS services like Amazon EBS and Elastic Load Balancing, ensuring compliance with SAP on AWS best practices.

Exam trap

The trap here is that candidates often confuse AWS Quick Start for SAP with a guided deployment tool, but Quick Start only provides static templates without the real-time validation and optimization that Launch Wizard offers for SAP-specific workloads.

How to eliminate wrong answers

Option A is wrong because manual deployment using EC2 and RDS is not supported for SAP S/4HANA; SAP requires a certified database (e.g., SAP HANA or ASE) and RDS does not support SAP HANA, making this option technically invalid. Option C is wrong because AWS Quick Start for SAP provides reference architectures and CloudFormation templates but is not a guided deployment wizard; it requires manual configuration and does not perform real-time validation of SAP-specific parameters like SAPS sizing or high-availability setup. Option D is wrong because AWS CloudFormation with custom templates, while powerful, lacks the built-in SAP validation and optimization logic of Launch Wizard; users must manually ensure compliance with SAP on AWS best practices, increasing risk of misconfiguration.

Full explanation →
971
Multi-Selecthard

A company is designing a highly available SAP NetWeaver AS ABAP environment on AWS with a 2-node ASCS/ERS cluster. Which TWO of the following must be configured to ensure a successful failover? (Choose 2)

Select 2 answers
A.An AWS ASW (Automated SAP Workload) service
B.Amazon EBS io1 volumes with Multi-Attach enabled for the database
C.A shared file system (e.g., Amazon EFS) for /sapmnt
D.Each node must have its own /usr/sap/<SID>/ASCS and /usr/sap/<SID>/ERS directory on instance store
E.A virtual IP address (VIP) using Route53 health checks or the AWS CLI
AnswersC, E

Required for shared profile data.

Why this answer

SAP NetWeaver AS ABAP requires a shared /sapmnt directory accessible by both nodes in an ASCS/ERS cluster for consistent profile and configuration access during failover. Amazon EFS provides a POSIX-compliant, NFS-based shared file system that supports concurrent access from multiple EC2 instances across Availability Zones, which is essential for the cluster to function correctly. Option E is correct because a virtual IP address (VIP) is needed to provide a stable endpoint for clients to connect to the ASCS instance, regardless of which node is active.

This can be achieved using Route53 health checks with failover routing or AWS CLI scripts that reassign the IP to the active node, ensuring seamless failover.

Exam trap

A common pitfall in AWS SAP exams is thinking that instance store volumes are suitable for persistent SAP cluster directories, but they are ephemeral and will cause data loss on instance stop or termination, making them invalid for failover-critical components.

Full explanation →
972
MCQmedium

A company runs SAP on AWS. During a maintenance window, the SAP application team needs to apply a kernel update that requires a reboot of the SAP application servers. The environment uses an Auto Scaling group for the application tier. What is the BEST approach to minimize downtime?

A.Stop all instances in the Auto Scaling group, apply the update, and start them again.
B.Detach all instances from the Auto Scaling group, apply the update, and reattach them.
C.Double the desired capacity of the Auto Scaling group, wait for new instances, then terminate old instances.
D.Terminate instances one at a time, allowing the Auto Scaling group to launch new instances with the updated configuration.
AnswerD

Terminating instances one at a time allows the Auto Scaling group to launch new instances with updated configuration, maintaining capacity and minimizing downtime.

Why this answer

The best approach to minimize downtime is to terminate instances one at a time, allowing the Auto Scaling group to launch new instances with the updated configuration. This method ensures that the desired capacity is maintained at all times, as the Auto Scaling group automatically replaces each terminated instance. Option A is wrong because stopping instances does not trigger the Auto Scaling group to launch new ones; it only suspends billing.

Option B is wrong because detaching instances removes them from the group, requiring manual reattachment and risking capacity gaps. Option C might minimize downtime but incurs additional costs by running extra instances and is not as efficient as the rolling replacement in option D.

Full explanation →
973
Multi-Selecthard

Which THREE storage options are supported for SAP HANA data files on AWS? (Select THREE.)

Select 3 answers
A.Amazon EFS
B.NVMe instance store SSDs on i3en instances
C.Amazon EBS gp3 volumes with sufficient IOPS
D.Amazon EBS io2 Block Express volumes
E.Amazon S3
AnswersB, C, D

Instance store is supported on certified instances.

Why this answer

I3en instances provide NVMe instance store SSDs that are directly attached to the physical server, offering very low latency and high IOPS for SAP HANA data files. These instance stores are ephemeral but are the recommended storage for SAP HANA data and log volumes when using certified instance types, as they meet the strict performance requirements for HANA's in-memory database operations.

Exam trap

The trap here is that candidates often assume any high-performance storage (like EFS or S3) can support SAP HANA, but AWS explicitly requires block storage with guaranteed low latency and IOPS, which only NVMe instance store, gp3, and io2 Block Express provide.

Full explanation →
974
MCQhard

An SAP administrator is migrating an SAP system to AWS and has launched an EC2 instance from an AMI. The administrator runs the command shown in the exhibit. Which statement is true about the root volume?

A.The root volume will be deleted when the instance is terminated.
B.The root volume is detached from the instance.
C.The root volume is encrypted.
D.The root volume is an instance store volume.
AnswerA

Correct. The command output indicates DeleteOnTermination is set to true, so the root volume will be deleted when the instance terminates.

Why this answer

The output of the command shows that the 'DeleteOnTermination' attribute is set to 'true' for the root volume, meaning the volume will be deleted when the EC2 instance is terminated. Option B is incorrect because the root volume is attached to the instance, not detached. Option C is incorrect because the output does not indicate that the root volume is encrypted; encryption is a separate attribute.

Option D is incorrect because the root volume is an EBS volume, not an instance store volume.

Full explanation →
975
MCQhard

A company runs SAP S/4HANA on AWS with a three-tier architecture. The operations team receives alerts that the application server's CPU utilization is consistently above 90%. The team wants to add an additional application server to distribute the load. Which AWS service should be used to register the new instance with the SAP system's load balancer?

A.Amazon CloudFront
B.Network Load Balancer (NLB)
C.Amazon Route 53
D.Application Load Balancer (ALB)
AnswerD

Registers EC2 instances as targets.

Why this answer

(Application Load Balancer). ALB can register EC2 instances as targets and distribute incoming traffic across multiple instances, making it suitable for adding an additional application server to distribute the load. Option A (CloudFront) is a CDN service, not a load balancer.

Option B (Network Load Balancer) operates at the transport layer (TCP/UDP) and is not ideal for application-level load balancing. Option C (Route 53) is a DNS service and does not register instances directly.

Exam trap

Candidates may confuse NLB with ALB. For SAP applications using HTTP/HTTPS, ALB is appropriate.

Full explanation →
Page 12

Page 13 of 22

Page 14

All pages

12345678910111213141516171819202122

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWSTechnologyMigrationOperations and Maintenance
See all domains with question counts →