Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 976–1050

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 14 of 22

976

MCQhard

An organization is migrating a SAP ERP system to AWS. The system has a requirement for high availability for the SAP Central Services (ASCS) instance. Which architecture should be used to meet this requirement?

A.Deploy the ASCS on a single EC2 instance with a Multi-AZ RDS database.

B.Deploy two ASCS instances in different Availability Zones with a shared Amazon EFS or FSx for Windows File Server and a floating IP using Route 53.

C.Deploy two ASCS instances in different Availability Zones with an EBS volume attached to both.

D.Use an Application Load Balancer to distribute traffic between two ASCS instances.

AnswerB

Shared storage and floating IP meet ASCS HA requirements.

Why this answer

For high availability of SAP Central Services (ASCS), you need to deploy two ASCS instances in different Availability Zones with a shared filesystem (Amazon EFS or FSx for Windows File Server) and a floating IP mechanism. Option B correctly describes this architecture using Route 53 for the floating IP. Option A is incorrect because Multi-AZ RDS is for databases, not ASCS.

Option C is incorrect because an EBS volume cannot be attached to multiple EC2 instances simultaneously. Option D is incorrect because an Application Load Balancer does not support floating IPs and is not appropriate for ASCS.

Full explanation →

977

MCQhard

An SAP system running on AWS is experiencing high memory utilization on the application server. The team suspects a memory leak in the SAP ABAP application. Which tool or process should be used to identify the root cause?

A.Run SAP transaction STAD to analyze memory consumption per user and program.

B.Use the Linux 'top' command to identify the process consuming the most memory.

C.Use SAP HANA Studio to check memory consumption of the database.

D.Enable detailed CloudWatch memory metrics on the EC2 instance.

AnswerA

STAD provides detailed memory usage breakdown for ABAP programs.

Why this answer

SAP transaction STAD provides detailed analysis of memory consumption per user and program, allowing identification of a memory leak in the ABAP application. Option B is wrong because the Linux 'top' command shows OS-level process memory usage, but does not provide ABAP-specific memory allocation details per program or user. Option C is wrong because SAP HANA Studio is used to monitor the HANA database, not the application server memory.

Option D is wrong because CloudWatch memory metrics provide overall EC2 memory usage, not per-process or per-user ABAP memory consumption.

Full explanation →

978

MCQhard

An SAP system on AWS is using a Multi-AZ deployment for high availability. The SAP Central Services (ASCS) and Enqueue Replication Server (ERS) are running on separate EC2 instances. During a failover test, the ASCS instance fails, but the ERS does not take over. What is the most likely cause?

A.The ERS instance does not have the required security group rules

B.The DNS TTL is set too high

C.The ERS instance is in a different subnet

D.The floating IP address is not configured to move to the ERS instance

AnswerD

Without floating IP reassignment, clients cannot reach the ERS.

Why this answer

SAP Enqueue Replication requires a floating IP address (using AWS Elastic IP or Route 53) that moves from ASCS to ERS during failover. If the floating IP is not properly configured, the ERS cannot take over. DNS resolution is not the primary method.

Health checks are not the issue. Instance type is irrelevant.

Full explanation →

979

MCQeasy

A company is migrating a legacy SAP HANA database (version 1.0) to SAP HANA on Amazon EC2 (version 2.0) with minimal downtime. Which AWS service should be used for the migration?

A.Use SAP HANA System Replication to replicate the source database to an Amazon RDS for SAP HANA instance.

B.Use AWS Database Migration Service (DMS) with change data capture (CDC) from the source SAP HANA database.

C.Export the database to flat files, upload to Amazon S3, and restore using an RDS read replica.

D.Use AWS Schema Conversion Tool (SCT) to convert the schema and then use AWS Database Migration Service (DMS) for data replication.

AnswerB

AWS DMS supports SAP HANA as both source and target and can use CDC to minimize downtime during homogeneous migration. This option is correct.

Why this answer

AWS DMS supports homogeneous migrations for SAP HANA and can replicate data with minimal downtime using change data capture (CDC). Option B is correct because DMS can migrate data from SAP HANA 1.0 to SAP HANA 2.0 on EC2 with CDC to minimize downtime. Option A is incorrect because RDS does not support SAP HANA, and read replicas cannot be created from an on-premises source.

Option C is incorrect because exporting to flat files and restoring via an RDS read replica is not a valid procedure and would cause downtime. Option D is incorrect because SCT is for schema conversion between different database engines, but since both source and target are SAP HANA, no schema conversion is needed; DMS alone is sufficient.

Full explanation →

980

Multi-Selectmedium

Which TWO AWS services can be used to monitor the performance of SAP HANA on AWS and set alarms? (Select TWO.)

Select 2 answers

A.AWS CloudTrail

B.AWS Config

C.AWS Trusted Advisor

D.Amazon CloudWatch

E.AWS Systems Manager

AnswersD, E

For monitoring and alarms.

Why this answer

Options D and E are correct. Amazon CloudWatch is used for monitoring SAP HANA on AWS and setting alarms based on metrics. AWS Systems Manager can run scripts to collect custom metrics and trigger alarms.

Option A is incorrect because CloudTrail is for API auditing, not performance monitoring. Option B is incorrect because AWS Config evaluates configuration compliance. Option C is incorrect because Trusted Advisor provides best practice checks, not real-time monitoring.

Full explanation →

981

MCQmedium

An SAP system is experiencing high CPU utilization on the application server. The administrator wants to automatically scale the EC2 instance based on CPU usage. Which AWS service should be used?

A.Elastic Load Balancing

B.AWS Auto Scaling

C.AWS Lambda

D.Amazon CloudWatch

AnswerB

Auto Scaling can add or remove EC2 instances based on CPU utilization.

Why this answer

Auto Scaling with scaling policies based on CloudWatch alarms can automatically adjust the number of instances. Option B is correct. Option A is wrong because Elastic Load Balancing distributes traffic, not scaling.

Option C is wrong because Lambda can be used but is not the primary service for EC2 scaling. Option D is wrong because CloudWatch monitors but does not scale.

Full explanation →

982

MCQmedium

A company runs SAP ERP on AWS with an Oracle database on an r5.4xlarge instance. The system experiences performance degradation during month-end closing. Monitoring shows high CPU and I/O wait on the database server. The storage is EBS gp2 volumes. The company plans to migrate to SAP HANA in the future. What immediate change should be made to improve performance?

A.Implement AWS RDS Oracle read replicas to offload reporting queries.

B.Migrate the database to SAP HANA immediately to improve performance.

C.Change the EBS volumes from gp2 to gp3 to improve I/O performance and throughput.

D.Increase the EC2 instance size to r5.8xlarge to provide more CPU and memory.

AnswerC

gp3 offers more consistent performance and higher throughput at lower cost than gp2.

Why this answer

Switching from gp2 to gp3 provides better baseline performance and higher throughput at lower cost. Option A (Implement RDS Oracle read replicas) is for RDS, not self-managed Oracle. Option B (Migrate to HANA immediately) is a longer-term solution, not immediate.

Option C (Change EBS volumes from gp2 to gp3) is the correct immediate change to improve I/O performance. Option D (Increase instance size) might help CPU but is more expensive and does not directly address I/O wait.

Full explanation →

983

MCQeasy

A company uses an SAP HANA database on AWS. The database administrator wants to back up the database using Backint integration with AWS. Which AWS service is the recommended target for Backint backups?

A.Amazon EFS

B.Amazon EBS

C.Amazon S3 Glacier

D.Amazon S3

AnswerD

S3 is the recommended target for Backint.

Why this answer

Amazon S3 is the standard target for SAP HANA Backint backups on AWS. Backint is an SAP HANA feature that integrates directly with Amazon S3 to back up database files. Option A is incorrect because Amazon EFS is a file system service and not directly integrated with Backint.

Option B is incorrect because Amazon EBS volumes are not directly used by Backint for backups. Option C is incorrect because Amazon S3 Glacier is a cold storage service and is not directly integrated with Backint; Backint targets standard S3 buckets, not Glacier.

Full explanation →

984

MCQhard

A company is running SAP S/4HANA on AWS. The SAP application servers and database are in the same VPC. The security team requires encryption in transit between all SAP components. Which combination of services and configurations meets this requirement?

A.Use AWS Transit Gateway with encryption enabled.

B.Enable SAP SNC with TLS certificates on all SAP instances.

C.Use AWS VPN to connect all SAP instances to a single endpoint.

D.Create a VPC peering connection between the application and database subnets.

AnswerB

SNC encrypts SAP-specific communications.

Why this answer

SAP SNC (Secure Network Communications) with TLS certificates provides end-to-end encryption for communication between SAP components, including application servers and databases, regardless of network topology. Since all SAP components reside in the same VPC, the encryption requirement is satisfied at the application layer without relying on network-level encryption. SNC ensures that data in transit between SAP systems is encrypted using X.509 certificates, meeting the security team's mandate.

Exam trap

The trap here is that candidates often assume network-level encryption services like Transit Gateway or VPN are required for in-transit encryption, but the question specifically requires encryption between SAP components, which is natively achieved through SAP SNC at the application layer, not through AWS networking features.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub for routing traffic between VPCs and on-premises networks, but it does not natively encrypt traffic between resources within the same VPC; encryption would require additional VPN or TLS configurations. Option C is wrong because AWS VPN creates an encrypted tunnel between a VPC and an external network, but it does not encrypt traffic between SAP components within the same VPC; using it to connect all instances to a single endpoint would add unnecessary complexity and latency without addressing internal encryption. Option D is wrong because VPC peering connects subnets or VPCs at Layer 3 without providing any encryption; traffic between peered subnets remains unencrypted unless additional measures like TLS are applied.

Full explanation →

985

MCQmedium

A company runs an SAP HANA database on an EC2 instance in a single Availability Zone. The database experiences performance degradation during peak hours. Which action should be taken to improve performance without changing the instance type?

A.Increase the provisioned IOPS on the EBS volumes

B.Enable detailed CloudWatch monitoring

C.Change the EBS volumes to gp3

D.Enable Enhanced Networking on the EC2 instance

AnswerD

Enhanced Networking reduces network latency and improves throughput, directly benefiting HANA performance.

Why this answer

Enabling Enhanced Networking on the EC2 instance reduces network latency and improves throughput, which is critical for SAP HANA performance during peak hours. Option A is wrong because increasing provisioned IOPS can help with storage performance but does not address network bottlenecks. Option B is wrong because detailed CloudWatch monitoring provides more metrics but does not directly improve performance.

Option C is wrong while gp3 volumes offer better baseline performance, switching to gp3 may not fully resolve network-related performance degradation without also enabling Enhanced Networking.

Full explanation →

986

MCQeasy

A DevOps engineer needs to automatically restart a specific service on an EC2 instance whenever the service crashes. The instance is running Amazon Linux 2. Which approach is the MOST operationally efficient?

A.Set up a CloudWatch alarm that triggers an SSM Run Command to restart the service

B.Write a cron job that checks the service status every minute and restarts it if needed

C.Configure the service as a systemd unit with Restart=on-failure

D.Use an AWS Lambda function that polls the service status and calls the EC2 reboot API

AnswerC

systemd is the native init system and handles restarts efficiently.

Why this answer

Systemd, the default init system on Amazon Linux 2, provides a built-in `Restart=` directive that can be set to `on-failure`. This instructs systemd to automatically restart the service unit when it exits with a non-zero exit code or is terminated by a signal, without requiring any external monitoring or additional infrastructure. This is the most operationally efficient approach as it leverages the native service manager functionality with zero external dependencies.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing external AWS services (CloudWatch, Lambda) or traditional cron-based polling, overlooking the fact that the operating system's native service manager (systemd) already provides a simple, built-in mechanism for automatic service restart.

How to eliminate wrong answers

Option A is wrong because it introduces unnecessary complexity and latency: a CloudWatch alarm requires metric data, evaluation periods, and an SSM Run Command invocation, which is not immediate and adds operational overhead compared to a local restart mechanism. Option B is wrong because a cron job running every minute creates a polling loop that wastes CPU cycles and introduces a delay of up to 60 seconds before detecting a crash, whereas systemd reacts instantly to process termination. Option D is wrong because using a Lambda function to poll service status and call the EC2 reboot API is extremely inefficient, introduces cold start latency, requires IAM roles and network configuration, and rebooting the entire instance is a heavy-handed action when only a single service needs restarting.

Full explanation →

987

MCQmedium

A company runs SAP S/4HANA on AWS. The environment includes an SAP HANA database on an EC2 instance with multiple EBS volumes for data, log, and backup. The backup strategy uses AWS Backup to create daily snapshots of all EBS volumes. During a disaster recovery test, the team discovers that the snapshots are not crash-consistent and the database cannot be restored to a consistent state. The backup window is set to 2 AM daily. What should the team do to ensure crash-consistent backups?

A.Configure AWS Backup to create multi-volume crash-consistent snapshots for the instance.

B.Use SAP HANA backup to S3 instead of EBS snapshots for database backups.

C.Take individual EBS snapshots of each volume sequentially within the backup window.

D.Stop the EC2 instance before the backup window and start it after the snapshots complete.

AnswerA

Multi-volume snapshots ensure all volumes are snapshotted at the same point in time, providing crash consistency.

Why this answer

AWS Backup supports creating multi-volume crash-consistent snapshots, which ensures that all EBS volumes are snapshotted at the same point in time. This provides crash consistency for the SAP HANA database. Option B is incorrect because while SAP HANA backup to S3 is a valid backup method, the question specifically asks about ensuring crash-consistent EBS snapshots.

Option C is incorrect because taking individual snapshots sequentially does not guarantee cross-volume consistency. Option D is incorrect because stopping the instance causes unnecessary downtime; crash-consistent snapshots can be achieved without stopping the instance.

Full explanation →

988

Multi-Selectmedium

A company is planning to run SAP HANA on AWS. Which TWO of the following are required to ensure the system is supported by SAP? (Choose TWO.)

Select 2 answers

A.Place all instances in a cluster placement group

B.Use only EBS io2 Block Express volumes for all HANA data

C.Use an operating system that is on the SAP HANA supported OS list

D.Enable termination protection on all instances

E.Use an SAP-certified EC2 instance type

AnswersC, E

SAP requires specific OS versions.

Why this answer

SAP requires the operating system to be listed on the SAP HANA supported OS list. Running an unsupported OS violates SAP's support policy and can lead to denial of support for the entire HANA system.

Exam trap

The trap here is that candidates often confuse operational best practices (like placement groups or termination protection) with mandatory SAP support requirements, leading them to select options that are not explicitly required by SAP.

Full explanation →

989

Multi-Selectmedium

A company is designing a disaster recovery strategy for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires RPO of 15 minutes and RTO of 1 hour. Which TWO approaches meet these requirements?

Select 2 answers

A.Use EBS Snapshots taken every 15 minutes and copy them to the DR region

B.Use AWS Backup with a backup plan that takes cross-region backups every 15 minutes

C.Use Amazon Machine Images (AMIs) backed by EBS snapshots, taken hourly

D.Use EBS Multi-Attach volumes to allow the DR instance to access the same volumes

E.Use EBS Reboot (not Stop/Start) to move the instance to the DR region with replicated volumes

AnswersA, E

Correct. EBS Snapshots can be taken every 15 minutes and copied to another region, meeting the RPO of 15 minutes. With pre-provisioned instances, RTO under 1 hour is achievable.

Why this answer

EBS Snapshots can be taken every 15 minutes and copied across regions, enabling volume creation in the DR region with an RPO of 15 minutes and RTO under 1 hour if the EC2 instance is pre-provisioned. Using AWS Elastic Disaster Recovery (which may be referred to as 'EBS Reboot' in this context) provides continuous replication and failover, meeting the RPO/RTO requirements. Options B, C, and D are incorrect: AWS Backup has a minimum 1-hour backup interval; hourly AMIs exceed the 15-minute RPO; and EBS Multi-Attach does not support cross-region failover.

Exam trap

The PAS-C01 exam often tests the misconception that AWS Backup can support sub-hourly backup intervals, but the minimum is 1 hour, so candidates may incorrectly select Option B thinking it meets the 15-minute RPO. Additionally, candidates may overlook Option E because the term 'EBS Reboot' is ambiguous; however, this refers to AWS Elastic Disaster Recovery (formerly CloudEndure), which provides continuous replication and automated failover to meet tight RPO/RTO requirements.

Full explanation →

990

MCQmedium

A company is migrating its SAP landscape to AWS and has a requirement to use existing software licenses to reduce costs. Which AWS pricing model should be used?

A.Dedicated Hosts

B.Compute Savings Plans

C.Reserved Instances (RI)

D.Dedicated Instances

AnswerA

Dedicated Hosts allow per-socket/core licensing.

Why this answer

Dedicated Hosts provide visibility into the underlying physical cores and sockets, enabling you to bring your own existing SAP licenses (e.g., per-core or per-socket) to AWS and reduce costs. Option B (Compute Savings Plans) offers discounts on compute usage but does not support license management. Option C (Reserved Instances) provides capacity reservation and cost savings but does not allow use of your own licenses.

Option D (Dedicated Instances) offers instance isolation at the hardware level but does not expose the underlying physical server for license tracking.

Full explanation →

991

Multi-Selectmedium

A company uses AWS CloudTrail to log API calls. The security team wants to detect unauthorized attempts to modify security group rules and send real-time alerts. Which TWO AWS services should be used together to achieve this?

Select 2 answers

A.Amazon Simple Notification Service (SNS)

B.Amazon CloudWatch Events (or EventBridge)

C.AWS Lambda

D.AWS Config

E.Amazon GuardDuty

AnswersA, B

Can send alerts via email, SMS, etc.

Why this answer

Amazon CloudWatch Events (or EventBridge) can capture CloudTrail API calls related to security group modifications (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress) and route them to an SNS topic. SNS then sends real-time alerts (e.g., email, SMS) to the security team. This combination provides event-driven, near-instantaneous notification without polling or custom code.

Exam trap

The trap here is that candidates often over-engineer by adding Lambda or GuardDuty, not realizing that CloudWatch Events (EventBridge) can directly trigger SNS for real-time alerting without additional compute or security services.

Full explanation →

992

MCQhard

An SAP HANA database on EC2 is experiencing high I/O latency. The database uses a single EBS volume for /hana/log. The volume is a gp2 volume with 1000 GB size. The administrator notices that the volume's burst balance is depleted. Which action should be taken to improve latency?

A.Change the volume type to Throughput Optimized HDD (st1)

B.Add additional gp2 volumes and stripe them in a RAID 0

C.Increase the volume size to 2000 GB to double the baseline IOPS

D.Change the volume type to Provisioned IOPS SSD (io1) with sufficient IOPS

AnswerD

io1 provides consistent IOPS without burst credits.

Why this answer

Switching to io1 provides consistent IOPS without burst balance. Option C (increasing size to 2000 GB) would double the baseline IOPS but not eliminate burst dependency. Option B (adding more volumes) may help but is more complex.

Option A (using st1) is for throughput, not low latency.

Full explanation →

993

MCQmedium

A company is migrating its on-premises SAP landscape to AWS. The SAP system uses Oracle Database. The migration must minimize downtime. Which AWS service should be used for the database migration?

A.AWS Snowball Edge

B.AWS Database Migration Service (DMS)

C.AWS CloudEndure Migration

D.Amazon S3 Transfer Acceleration

AnswerB

AWS DMS supports ongoing replication to minimize downtime during migration.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication from Oracle to a target database (e.g., Amazon RDS for Oracle or Amazon Aurora) with minimal downtime. DMS can perform a full load followed by continuous change data capture (CDC) using Oracle LogMiner or binary reader to keep the source and target synchronized until cutover.

Exam trap

The trap here is that candidates often confuse AWS DMS with general-purpose migration tools like CloudEndure or Snowball, not realizing that DMS is the only service purpose-built for live database migrations with minimal downtime via CDC.

How to eliminate wrong answers

Option A is wrong because AWS Snowball Edge is a physical data transfer device designed for offline bulk data migration, not for minimizing downtime during an active database migration with ongoing replication. Option C is wrong because AWS CloudEndure Migration is a lift-and-shift server migration service that replicates entire servers at the block level, not a database-specific migration tool, and it does not natively handle Oracle database schema conversion or CDC for minimal downtime. Option D is wrong because Amazon S3 Transfer Acceleration is a service that speeds up uploads to S3 over the internet using optimized network paths; it has no capability to migrate or replicate a live Oracle database.

Full explanation →

994

Multi-Selecteasy

Which TWO of the following are valid storage options for SAP HANA data files on AWS?

Select 2 answers

A.Amazon EBS gp3 volumes with sufficient IOPS

B.Amazon S3

C.Amazon EBS io2 Block Express volumes

D.Instance Store volumes

E.Amazon EFS

AnswersA, C

gp3 can be provisioned with adequate IOPS.

Why this answer

Amazon EBS gp3 volumes are a valid storage option for SAP HANA data files because they provide consistent baseline performance of 3,000 IOPS and 125 MB/s throughput, with the ability to provision additional IOPS independently of storage capacity. SAP HANA requires high IOPS and low latency for its data persistence layer, and gp3 volumes meet these requirements when configured with sufficient IOPS, making them a cost-effective choice for many HANA workloads on AWS.

Exam trap

The trap here is that candidates often confuse Amazon S3 or EFS as viable storage for SAP HANA data files because they are durable and scalable, but they fail to recognize that HANA requires block-level storage with low latency and high IOPS that only EBS volumes can provide.

Full explanation →

995

MCQeasy

A company needs to ensure that only authorized users can access the SAP S/4HANA system running on AWS. Which AWS service can be used to manage user identities and permissions?

A.AWS Directory Service

B.AWS Organizations

C.AWS Identity and Access Management (IAM)

D.Amazon Cognito

AnswerA

Correct. AWS Directory Service can be used to extend an existing Active Directory to AWS, enabling SAP users to authenticate with their corporate credentials, thereby managing identities and access to the SAP system.

Why this answer

AWS Directory Service can integrate with on-premises Active Directory to provide a managed directory service, which allows organizations to use existing corporate credentials to access SAP S/4HANA systems running on AWS. This enables centralized user identity management and single sign-on for SAP applications. Option C (IAM) is incorrect because IAM manages access to AWS resources (e.g., EC2, S3), not user identities within SAP applications themselves.

Option B (AWS Organizations) is for managing multiple AWS accounts. Option D (Amazon Cognito) is aimed at customer-facing identity management.

Full explanation →

996

MCQmedium

A company is planning to migrate its SAP ECC system to SAP S/4HANA on AWS. The current system uses an IBM Db2 database on-premises. The target system will use SAP HANA as the database. The company wants to perform the migration with minimal downtime. Which tool or method should be used?

A.Use IBM Db2 native tools to export the database and import into HANA.

B.Use AWS Database Migration Service (DMS) to replicate data from Db2 to HANA.

C.Use SAP Software Update Manager (SUM) with the Database Migration Option (DMO).

D.Use SAP Landscape Transformation (SLT) to replicate data in real-time.

AnswerC

SUM with DMO supports migration from Db2 to HANA with minimal downtime.

Why this answer

SAP Software Update Manager (SUM) with the Database Migration Option (DMO) is the only tool that combines both the system upgrade from SAP ECC to SAP S/4HANA and the database migration from IBM Db2 to SAP HANA in a single, integrated process. DMO uses a trigger-based replication approach to minimize downtime by migrating data in the background while the source system remains operational, then performing a short final cutover. This is the officially recommended SAP methodology for heterogeneous migrations with minimal downtime.

Exam trap

The trap here is that candidates often confuse real-time replication tools like SLT or AWS DMS with the specialized SAP DMO process, not realizing that only DMO combines the database migration, system upgrade, and minimal downtime in a single, SAP-supported workflow.

How to eliminate wrong answers

Option A is wrong because IBM Db2 native tools (e.g., db2 export/import) are designed for homogeneous Db2-to-Db2 transfers and cannot convert the database schema or data to SAP HANA format; they also require the source system to be offline for the entire duration, causing significant downtime. Option B is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a target endpoint and cannot handle the complex SAP-specific data structures, application logic, or the required system conversion steps (e.g., Unicode conversion, S/4HANA simplification). Option D is wrong because SAP Landscape Transformation (SLT) is a real-time data replication tool primarily used for loading data into SAP BW or other systems, not for performing a full system migration with database conversion and application upgrade; it lacks the ability to execute the necessary SUM upgrade steps and HANA schema conversion.

Full explanation →

997

MCQhard

A company is migrating a critical application to AWS and needs to ensure compliance with PCI DSS. The application handles credit card numbers. Which AWS service should be used to encrypt the data at rest?

A.Amazon S3 server-side encryption

B.AWS Key Management Service (KMS)

C.AWS CloudHSM

D.AWS Secrets Manager

AnswerC

CloudHSM provides dedicated hardware security modules meeting PCI DSS requirements.

Why this answer

AWS CloudHSM, is correct because it provides dedicated hardware security modules (HSMs) that are FIPS 140-2 Level 3 compliant, which is often required for PCI DSS compliance when handling credit card numbers. Option A (Amazon S3 server-side encryption) is incorrect because it is used for encrypting objects in S3 and does not provide dedicated HSM capabilities. Option B (AWS KMS) is a managed key service but is FIPS 140-2 Level 2 only, which may not meet the stringent requirements of PCI DSS for protecting cardholder data.

Option D (AWS Secrets Manager) is incorrect because it manages secrets such as database credentials, not encryption keys for data at rest.

Full explanation →

998

MCQhard

A company is migrating an SAP ERP system to AWS using the SAP Landscape Virtualization Management (LVM) tool. During the migration, the team encounters a timeout error when replicating the database. The source database is an SAP HANA multi-tenant database container (MDC) system. What is the most likely cause of the timeout?

A.The SAP Landscape Virtualization Management (LVM) agent is incompatible with the SAP HANA version

B.The SAP HANA multi-tenant database container (MDC) configuration is not supported by LVM

C.The SSH session between LVM and the target server timed out due to a missing ServerAliveInterval setting

D.The SAP Router is not configured to forward traffic between the source and target

AnswerC

LVM uses SSH; without keep-alive settings, idle SSH sessions can timeout during long-running operations.

Why this answer

LVM uses SSH to communicate between the source and target servers. If the SSH session times out due to inactivity (e.g., a missing ServerAliveInterval setting in the SSH client configuration), the database replication process can fail with a timeout error. Option A is incorrect because the LVM agent's compatibility with the SAP HANA version is not the typical cause of a replication timeout; such version compatibility issues would likely surface earlier during configuration.

Option B is incorrect because SAP HANA MDC (multi-tenant database container) is supported by LVM for migration; LVM can handle MDC systems properly. Option D is incorrect because the SAP Router is used for routing between SAP systems over a network, not for the direct SSH-based replication between source and target in an LVM migration; the timeout is due to SSH, not router misconfiguration.

Full explanation →

999

MCQmedium

An administrator needs to apply a critical OS security patch to multiple SAP application servers in an Auto Scaling group without disrupting ongoing operations. Which strategy should be used?

A.Stop all instances, apply the patch using AWS Systems Manager, then restart all instances.

B.Use AWS CloudFormation with a rolling update policy to gradually replace instances in the Auto Scaling group.

C.Use AWS Systems Manager Patch Manager to patch instances at the next maintenance window.

D.Create a new Amazon Machine Image (AMI) with the patch, update the Auto Scaling group's launch configuration, and terminate all instances.

AnswerB

Rolling update minimizes downtime by replacing instances one by one.

Why this answer

Using AWS CloudFormation with a rolling update policy allows gradual replacement of instances in the Auto Scaling group, applying the patch without downtime. Option A (stop all instances) causes downtime. Option C (Systems Manager Patch Manager) may not handle Auto Scaling gracefully and could patch instances inconsistently.

Option D (new AMI and terminate all instances) is a blue/green approach that can cause disruption if not carefully managed.

Full explanation →

1000

Multi-Selecthard

Which THREE security best practices should be implemented for SAP systems on AWS? (Choose three.)

Select 3 answers

A.Disable SSH key pair access and use only password authentication.

B.Use security groups to restrict inbound and outbound traffic to SAP systems.

C.Deploy all SAP systems in a single VPC for simplified management.

D.Use IAM roles for EC2 instances to access AWS services.

E.Enable encryption at rest for all EBS volumes used by SAP.

AnswersB, D, E

Security groups provide stateful filtering.

Why this answer

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. For SAP systems, this is critical to restrict access to only necessary ports (e.g., 3200 for SAP Application Server, 36xx for SAProuter, 443 for HTTPS) and trusted IP ranges, reducing the attack surface. Unlike network ACLs, security groups are stateful, meaning return traffic is automatically allowed, simplifying rule management for SAP communication flows.

Exam trap

The trap here is that candidates may confuse security groups with network ACLs or assume that a single VPC simplifies management, but AWS best practices emphasize isolation and least privilege for SAP workloads, not consolidation.

Full explanation →

1001

MCQmedium

A company is running a production SAP HANA database on an AWS EC2 instance with a single EBS gp3 volume. The database frequently experiences high write latency during peak hours. Which design change would MOST effectively reduce write latency?

A.Replace the single gp3 volume with multiple io2 Block Express volumes configured in a RAID 0 stripe.

B.Increase the size of the existing gp3 volume to maximize its baseline throughput.

C.Migrate the database to a larger EC2 instance type with higher network bandwidth.

D.Move the SAP HANA database to Amazon RDS for SAP HANA.

AnswerA

io2 Block Express volumes provide very high IOPS and low latency; RAID 0 stripes I/O across volumes to maximize performance.

Why this answer

Replacing a single gp3 volume with multiple io2 Block Express volumes in a RAID 0 stripe increases the available IOPS and reduces write latency by distributing write operations across multiple volumes in parallel. io2 Block Express volumes offer up to 256,000 IOPS per volume and sub-millisecond latency, which directly addresses the high write latency during peak hours. RAID 0 striping further aggregates the IOPS and throughput of multiple volumes, providing the performance needed for SAP HANA's demanding write workloads.

Exam trap

The trap here is that candidates may assume increasing gp3 volume size or moving to a larger instance will solve latency issues, but the core problem is the volume type's inherent latency and IOPS ceiling, not capacity or compute.

How to eliminate wrong answers

Option B is wrong because increasing the size of a gp3 volume only increases its baseline throughput (up to 1,000 MiB/s) and does not significantly improve IOPS beyond the gp3 baseline of 3,000 IOPS (or 16,000 with provisioning); it does not reduce write latency for a database that already experiences high write latency, as gp3's latency is higher than io2 Block Express. Option C is wrong because migrating to a larger EC2 instance with higher network bandwidth does not affect the latency of local EBS storage; write latency is a function of the EBS volume type and configuration, not the instance's network bandwidth. Option D is wrong because Amazon RDS for SAP HANA does not exist; SAP HANA is not supported on Amazon RDS, and the service is not available for SAP HANA databases.

Full explanation →

1002

Multi-Selecthard

Which THREE of the following are valid considerations when designing an SAP HANA backup strategy on AWS?

Select 3 answers

A.Use EBS snapshots for backing up HANA data volumes.

B.Store backups in Amazon S3 for long-term retention.

C.Use the AWS Backint agent for SAP HANA to back up to S3.

D.Back up HANA data directly to Amazon S3 using standard tools.

E.Replicate backups to another AWS Region using S3 Cross-Region Replication.

AnswersA, B, C

EBS snapshots are a valid backup method.

Why this answer

EBS snapshots provide a consistent, point-in-time backup of HANA data volumes when the database is in backup mode (e.g., using hdbsql to create a snapshot). This method is supported by SAP and AWS, and it allows for fast recovery by restoring the entire volume without needing to replay transaction logs from a separate backup.

Exam trap

The trap here is that candidates may assume any S3-based backup method (like direct copy) is valid, but AWS and SAP require certified tools (Backint or snapshot integration) to guarantee HANA consistency and supportability.

Full explanation →

1003

Multi-Selectmedium

Which TWO of the following are required when integrating SAP HANA with AWS Direct Connect for hybrid connectivity?

Select 2 answers

A.A Public Virtual Interface to access the VPC.

B.A Virtual Private Gateway attached to the VPC.

C.A Direct Connect Gateway for the connection.

D.BGP peering between on-premises router and AWS router.

E.A VPN tunnel between on-premises and AWS.

AnswersB, D

VGW is required for Direct Connect private VIF.

Why this answer

A Virtual Private Gateway (VGW) is required to attach the VPC to the Direct Connect connection, enabling private IP traffic between on-premises and the VPC. Without a VGW, the Direct Connect virtual interface cannot terminate within the VPC, making hybrid connectivity impossible for SAP HANA workloads that require low-latency, private network paths.

Exam trap

The trap here is that candidates confuse a Public Virtual Interface with a Private Virtual Interface, assuming any Direct Connect interface can reach the VPC, but only a Private Virtual Interface combined with a VGW provides private VPC access.

Full explanation →

1004

Multi-Selectmedium

Which TWO AWS services can be used to automate the patching of SAP EC2 instances? (Choose 2)

Select 2 answers

A.AWS Systems Manager Patch Manager

B.AWS Backup

C.Amazon Inspector

D.AWS Config

E.EC2 Image Builder

AnswersA, E

Automates OS patching for EC2 instances.

Why this answer

Options A and E are correct. AWS Systems Manager Patch Manager automates OS patching directly on EC2 instances, while EC2 Image Builder creates updated AMIs with patches for SAP workloads. Options B (AWS Backup), C (Amazon Inspector), and D (AWS Config) do not automate patching: AWS Backup is for backups, Amazon Inspector scans for vulnerabilities, and AWS Config audits configuration compliance.

Full explanation →

1005

MCQeasy

Refer to the exhibit. An operations team sees this log entry in CloudWatch Logs for an SAP system. What is the MOST likely cause?

A.The HANA database has crashed.

B.The SAP system user password has expired.

C.The network connection between the ABAP application server and HANA is down.

D.The ABAP program Z_MONITOR has a bug.

AnswerC

RFC communication failure typically indicates a network issue.

Why this answer

The error indicates an RFC communication failure, which is typically due to a network issue between the ABAP application server and the HANA database. Option A is wrong because there is no indication of a HANA crash. Option B is wrong because the error is about communication, not authentication (password expiry would result in a different error).

Option D is wrong because the error is not about the ABAP program itself; it is a connectivity issue.

Full explanation →

1006

MCQeasy

A company runs SAP ERP on AWS using an Oracle database. To meet disaster recovery requirements, they need to replicate the database to a second AWS Region with low RPO. Which AWS service should be used for continuous, asynchronous replication of the Oracle database?

A.Copy the EC2 instance with the Oracle database as an AMI to the DR Region.

B.AWS Database Migration Service (DMS) with ongoing replication from the source Oracle database to a target Oracle database in the DR Region.

C.Amazon S3 Cross-Region Replication (CRR) to replicate database backups.

D.Amazon RDS for Oracle Read Replicas in the DR Region.

AnswerB

DMS supports continuous replication with low RPO.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports continuous, asynchronous change data capture (CDC) from an on-premises or EC2-hosted Oracle source to a target Oracle database in another AWS Region, achieving low RPO by replicating transactions in near real-time without requiring application downtime. This meets the DR requirement for cross-region replication of an Oracle database with minimal data loss.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which do not exist for Oracle RDS) with cross-region replication capabilities, or mistakenly think that S3 CRR can replicate live database changes, when in fact it only replicates static objects like backup files.

How to eliminate wrong answers

Option A is wrong because copying an EC2 instance as an AMI to the DR Region provides only a point-in-time snapshot, not continuous replication, and cannot achieve low RPO as it requires manual or scheduled automation. Option C is wrong because Amazon S3 Cross-Region Replication (CRR) replicates objects in S3 buckets, not live database transactions; it can only copy database backup files, which are point-in-time and do not provide continuous, asynchronous replication of the running database. Option D is wrong because Amazon RDS for Oracle Read Replicas are only supported within the same AWS Region and cannot be created across regions, and they are designed for read scaling, not for disaster recovery replication to a second Region.

Full explanation →

1007

Multi-Selecthard

A company runs a web application on Amazon ECS with Fargate launch type. The application's memory utilization spikes periodically, causing tasks to be killed. The operations team wants to automatically scale the service based on memory usage. Which TWO steps are necessary to implement this?

Select 2 answers

A.Attach an EC2 Auto Scaling group to the ECS service to handle capacity.

B.Create an Application Auto Scaling target tracking scaling policy based on memory utilization.

C.Configure step scaling policies to add multiple tasks at once.

D.Create a CloudWatch alarm that triggers the scaling policy when memory exceeds a threshold.

E.Enable the ECS service to publish custom CloudWatch metrics for memory utilization.

AnswersB, E

Correct. Target tracking scaling policy automatically adjusts capacity to maintain the target metric value.

Why this answer

Options B and E are necessary. B: Application Auto Scaling with a target tracking scaling policy automatically adjusts the desired task count to maintain a target memory utilization, preventing OOM kills. E: The ECS service must publish custom CloudWatch metrics for memory utilization because Fargate does not publish memory metrics by default; enabling this makes the metric available for the scaling policy.

Option D is not necessary because target tracking scaling policies use the metric directly without requiring a separate CloudWatch alarm.

Exam trap

The trap here is that candidates often think a CloudWatch alarm is required to trigger scaling, but target tracking scaling policies use the metric directly without an alarm. Also, they may confuse Fargate with EC2 launch type and try to use an Auto Scaling group.

Full explanation →

1008

Multi-Selecteasy

Which TWO AWS services can be used to automate the deployment of SAP infrastructure during migration? (Choose 2.)

Select 2 answers

A.AWS OpsWorks

B.AWS Service Catalog

C.AWS CloudFormation

D.AWS Elastic Beanstalk

E.AWS CodePipeline

AnswersB, C

AWS Service Catalog allows organizations to create and manage a catalog of approved IT services, including standardized SAP infrastructure templates, enabling automated and compliant deployment.

Why this answer

AWS CloudFormation allows you to model and provision SAP infrastructure as code using templates. Option B is correct because AWS Service Catalog allows you to create and manage a catalog of approved IT services, including SAP infrastructure templates, which can be deployed in a standardized and automated manner. Option D is wrong because AWS Elastic Beanstalk is a PaaS service that abstracts the underlying OS and is not designed for the specific requirements of SAP deployments, such as kernel patching and custom system configurations.

Option A is wrong because AWS OpsWorks uses Chef/Puppet and is not typically used for SAP deployment automation. Option E is wrong because AWS CodePipeline is a CI/CD service, not for infrastructure deployment. So correct answers: B and C.

Full explanation →

1009

Multi-Selecteasy

A company is planning to run SAP NetWeaver on AWS and needs to ensure that the architecture supports high availability for the application layer. Which TWO components are essential for an HA SAP NetWeaver application server setup? (Choose TWO.)

Select 2 answers

A.Amazon ElastiCache for session management

B.Multiple EC2 instances in different Availability Zones

C.A single large EC2 instance for all application servers

D.An Application Load Balancer to distribute traffic

E.Amazon RDS for database layer

AnswersB, D

Multiple instances across AZs provide failover capability.

Why this answer

For high availability of the SAP NetWeaver application layer, you need multiple EC2 instances distributed across different Availability Zones (AZs) to eliminate a single point of failure. An Application Load Balancer (ALB) is essential to distribute incoming traffic across these instances and perform health checks, ensuring that if one instance or AZ fails, traffic is routed to healthy instances. This combination provides fault tolerance and automatic failover for the SAP application servers.

Exam trap

The trap here is that candidates often confuse the database layer (RDS) or caching services (ElastiCache) as part of the application layer HA, when in fact the core requirement is multiple EC2 instances across AZs and a load balancer to distribute traffic.

Full explanation →

1010

MCQmedium

An SAP HANA administrator runs the AWS CLI command shown in the exhibit. The volume is attached to an SAP HANA server. The HANA database is experiencing low write throughput. Which action would most likely improve performance?

A.Detach the volume and reattach it to a different instance.

B.Increase the volume size to 1 TB to double the baseline IOPS.

C.Change the volume type to io2 and provision 6000 IOPS.

D.Enable EBS optimization on the attached instance.

AnswerC

io2 provides consistent high IOPS.

Why this answer

The AWS CLI command output shows the volume is a gp2 volume with a size of 500 GB. gp2 volumes provide a baseline IOPS of 3 per GB, so this volume has 1,500 baseline IOPS. For SAP HANA workloads requiring high write throughput, gp2's burst model is insufficient. Changing to io2 Block Express with provisioned 6000 IOPS delivers consistent, high-performance IOPS needed for sustained write operations, directly addressing the low write throughput issue.

Exam trap

The trap here is that candidates often assume increasing volume size (Option B) or enabling EBS optimization (Option D) will solve throughput issues, but they overlook that gp2's burst model is fundamentally unsuitable for sustained SAP HANA write workloads, whereas io2 with provisioned IOPS directly guarantees performance.

How to eliminate wrong answers

Option A is wrong because detaching and reattaching the volume to a different instance does not change the volume's performance characteristics; it only moves the same gp2 volume with its 1,500 baseline IOPS to another instance, which will not improve write throughput. Option B is wrong because increasing the volume size to 1 TB would double the baseline IOPS to 3,000 (at 3 IOPS/GB for gp2), but this is still below the required 6000 IOPS and does not address the need for provisioned IOPS for SAP HANA's sustained write demands. Option D is wrong because EBS optimization on the instance ensures dedicated network bandwidth for EBS traffic but does not increase the volume's IOPS or throughput limits; the bottleneck is the gp2 volume's performance, not the instance's network path.

Full explanation →

1011

MCQmedium

An SAP customer is using AWS KMS to encrypt EBS volumes for an SAP HANA database. The database administrator reports that the database is slow after enabling encryption. What is the MOST likely cause?

A.The KMS key is not rotated frequently enough.

B.The KMS API request rate limit is being exceeded, causing throttling.

C.The EBS volume is not using the correct instance type for encrypted volumes.

D.The KMS key is using a symmetric algorithm that degrades CPU performance.

AnswerB

High request rate can cause throttling and delays.

Why this answer

When EBS volumes are encrypted, every I/O operation to the volume must call AWS KMS to decrypt the data key. If the database workload generates a high rate of these requests, it can exceed the KMS API request rate limit (default 5,500 requests per second per Region for symmetric keys), causing throttling and increased latency. This is the most likely cause of the observed slowdown after enabling encryption.

Exam trap

The trap here is that candidates often attribute performance degradation to CPU overhead from encryption algorithms, but AWS KMS throttling is the real bottleneck because EBS encryption relies on API calls for key decryption, not on-instance cryptographic processing.

How to eliminate wrong answers

Option A is wrong because KMS key rotation does not affect the performance of ongoing encryption/decryption operations; it only changes the backing key used for new data, and the old key remains available for decryption. Option C is wrong because there is no 'correct instance type for encrypted volumes' — all EBS volume types and instance types support encryption without inherent performance degradation from the instance itself. Option D is wrong because symmetric encryption algorithms (like AES-256 used by KMS) are hardware-accelerated on modern AWS instances (e.g., using Intel AES-NI) and do not degrade CPU performance; the slowdown is due to API call throttling, not CPU overhead.

Full explanation →

1012

MCQeasy

An SAP system administrator needs to ensure that an EC2 instance running SAP can access an S3 bucket containing installation media. The instance is in a private subnet without internet access. What is the recommended way to provide access to S3?

A.Set up a VPN connection to S3.

B.Create a VPC Gateway Endpoint for S3.

C.Set up a NAT Gateway in the public subnet.

D.Use AWS Direct Connect to connect to S3.

AnswerB

Gateway Endpoints provide private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without internet access. NAT Gateway is for internet access, Direct Connect is for on-premises connectivity, and VPN is for site-to-site.

Full explanation →

1013

MCQhard

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances running SAP Web Dispatcher. The operations team notices that some instances are failing health checks intermittently. The ALB health check is configured with a 5-second interval, 2 healthy threshold, and 5 unhealthy threshold. The instances are all in the same Auto Scaling group. What is the most likely cause of the intermittent health check failures?

A.The Auto Scaling group health check grace period is too short

B.The ALB health check interval is too long

C.The health check path returns a 200 status only when the application is fully loaded

D.The health check path returns a non-200 status periodically due to a short-lived issue

AnswerD

Intermittent short-lived issues cause temporary failures; the ALB marks the instance unhealthy after multiple consecutive failures.

Why this answer

If the health check path returns a non-200 status due to a brief glitch (e.g., temporary resource exhaustion), the ALB will consider the instance unhealthy after 5 consecutive failures (25 seconds). The instances are not being replaced quickly because the Auto Scaling group health check type is likely not set to ELB, or the cooldown period delays replacement.

Full explanation →

1014

MCQhard

A company runs SAP ERP on AWS using a single Availability Zone. The system includes an SAP HANA database on an EC2 instance with 2 TB of memory. The operations team plans to perform a major version upgrade of the SAP HANA database, which requires approximately 4 hours of downtime. The company's SLA allows a maximum of 2 hours of downtime. The team decides to use a blue/green deployment strategy by creating a new HANA instance in a different Availability Zone and replicating data using HANA System Replication (HSR). After setting up replication, they perform a failover to the new instance. However, the failover takes 3 hours due to the large amount of data that needs to be synchronized. What should the team do to meet the 2-hour downtime requirement?

A.Scale up the source HANA instance to a larger instance type to speed up replication.

B.Increase the network bandwidth between the two Availability Zones to 10 Gbps.

C.Use HANA System Replication with initial snapshot by taking a backup of the source, restoring on the target, and then setting up replication.

D.Use Amazon RDS for SAP HANA instead of self-managed EC2.

AnswerC

Initial snapshot reduces sync time by using a backup restore instead of full data transfer over the network.

Why this answer

Using initial snapshot with HSR reduces the initial sync time significantly because it avoids copying all data over the network. Instead, the snapshot is restored on the target and then replication catches up. Option A is wrong because increasing bandwidth may help but not enough for 2 TB of memory; the initial sync will still take hours.

Option B is wrong because multi-AZ for RDS is for RDS databases, not for self-managed HANA on EC2. Option D is wrong because scaling up the source does not help; the issue is data transfer time.

Full explanation →

1015

MCQmedium

A company uses AWS Systems Manager to automate patching of SAP EC2 instances. The patching fails for some instances with the error 'SSM Agent not running'. What should the administrator do to resolve this?

A.Reboot the instances.

B.Install the Amazon CloudWatch Agent on the instances.

C.Configure a VPC endpoint for Systems Manager.

D.Verify that the SSM Agent is installed and running on the instances.

AnswerD

SSM Agent must be running for patching.

Why this answer

The error 'SSM Agent not running' indicates that the AWS Systems Manager Agent is not installed or not running on the instance. The correct action is to verify and ensure the SSM Agent is installed and running. Option A (rebooting) is incorrect because rebooting does not resolve a missing or stopped agent.

Option B (installing CloudWatch Agent) is unrelated to Systems Manager patching. Option C (configuring a VPC endpoint) addresses connectivity but not the agent status. Therefore, D is the correct answer.

Full explanation →

1016

Drag & Dropmedium

Drag and drop the steps to configure an SAP Fiori front-end server on AWS behind an Application Load Balancer (ALB) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Fiori ALB setup requires EC2 instances, target group, ALB listener, certificate, and DNS update.

Full explanation →

1017

MCQhard

A company runs SAP Business Suite on AWS with an Oracle database. The database is stored on Amazon EBS volumes. The architect wants to implement a backup strategy that meets a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. Which solution is the most cost-effective?

A.Maintain a standby Oracle database in another Availability Zone using Oracle Data Guard

B.Use Oracle Recovery Manager (RMAN) to back up to Amazon S3 every 15 minutes

C.Take EBS snapshots of the database volumes every 15 minutes and store them in Amazon S3

D.Use AWS Database Migration Service (DMS) with ongoing replication to a separate EC2 instance

AnswerC

EBS snapshots are incremental and cost-effective; automation can achieve 15-minute RPO.

Why this answer

The most cost-effective because EBS snapshots are incremental, storing only changed blocks, and can be automated via Amazon Data Lifecycle Manager to meet a 15-minute RPO. Restoring from an EBS snapshot to a new volume typically completes within minutes, easily satisfying the 2-hour RTO, and there are no ongoing compute costs for a standby instance or replication server.

Exam trap

The trap here is that candidates often assume a standby database (Data Guard) or continuous replication (DMS) is required for low RPO/RTO, overlooking that EBS snapshots taken every 15 minutes can achieve the same RPO at a fraction of the cost without ongoing compute overhead.

How to eliminate wrong answers

Option A is wrong because maintaining a standby Oracle database with Oracle Data Guard requires a second EC2 instance and additional EBS storage, incurring continuous compute and storage costs that are not cost-effective compared to snapshot-based backups. Option B is wrong because using RMAN to back up to Amazon S3 every 15 minutes would require frequent full or incremental backups that consume significant CPU and I/O on the database server, and RMAN backups to S3 typically involve higher latency and cost per backup than native EBS snapshots. Option D is wrong because AWS DMS with ongoing replication requires a separate replication instance and target EC2 instance, incurring ongoing costs and complexity, and is designed for migration rather than as a primary backup strategy for an Oracle database on EBS.

Full explanation →

1018

MCQeasy

A company needs to back up its SAP HANA database running on Amazon EC2. The database is 500 GB. What is the recommended approach for backups?

A.Enable automated backups and configure the backup retention period

B.Create manual EBS snapshots of the RDS instance

C.Export the database using mysqldump and store the dump in S3

D.Use SAP HANA Studio to back up to an S3 bucket directly

AnswerD

This is the recommended approach. SAP HANA Studio can be used with the Backint agent to back up the database directly to an S3 bucket. This is a common and supported method for SAP HANA on AWS.

Why this answer

Option A (automated backups) is not applicable for EC2 instances running SAP HANA. Option B (manual EBS snapshots) can lead to inconsistent backups and is not recommended. Option C (mysqldump) is for MySQL databases, not SAP HANA.

The correct approach is to use SAP HANA Studio with the Backint agent to back up directly to an S3 bucket, which is a supported and recommended method for SAP HANA running on Amazon EC2.

Full explanation →

1019

Multi-Selectmedium

A company is designing a disaster recovery solution for SAP HANA on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO strategies can be used to replicate HANA data to the DR region? (Choose TWO.)

Select 2 answers

A.Use AWS Database Migration Service (DMS) for ongoing replication

B.Use SAP HANA System Replication (HSR) with ASYNC mode

C.Copy EBS snapshots to the DR region using AWS CLI

D.Configure S3 Cross-Region Replication for HANA data files

E.Use AWS CloudEndure Disaster Recovery

AnswersA, B

DMS can perform continuous replication to a target database in DR.

Why this answer

AWS Database Migration Service (DMS) can be used for ongoing replication of SAP HANA data to a DR region by continuously capturing changes from the source HANA database and applying them to a target HANA instance in us-west-2. DMS supports HANA as both source and target, enabling near-real-time replication without requiring native HANA replication features. Additionally, SAP HANA System Replication (HSR) with ASYNC mode is a native HANA feature that replicates data at the database level asynchronously to a secondary system in the DR region.

HSR ASYNC minimizes performance impact on the primary and provides a consistent database copy for failover. Both strategies are valid for cross-region disaster recovery of SAP HANA on AWS.

Exam trap

The trap here is that candidates often assume any backup or replication tool (like EBS snapshots or S3 replication) can serve as a DR solution for SAP HANA, but they fail to recognize that HANA requires database-consistent, log-based replication to maintain ACID compliance and avoid data corruption during failover.

Full explanation →

1020

MCQhard

An SAP system administrator needs to monitor the memory usage of SAP HANA on AWS. Which CloudWatch metric or log should be used to track HANA memory consumption?

A.CloudWatch Logs from HANA trace files

B.SAP HANA CloudWatch integration via SQL queries

C.EC2 instance-level memory metrics

D.AWS CloudWatch Agent for OS metrics

AnswerB

HANA exposes memory metrics via SQL, which can be sent to CloudWatch.

Why this answer

SAP HANA exposes memory consumption metrics via built-in SQL views (e.g., M_HOST_MEMORY, M_MEMORY), and the SAP HANA CloudWatch integration uses a dedicated AWS Lambda function to execute these SQL queries and push the results as custom CloudWatch metrics. This is the only option that directly captures HANA-specific memory usage, such as allocation limit, used memory, and heap memory, rather than generic OS-level metrics.

Exam trap

The trap here is that candidates often confuse OS-level memory metrics (which require the CloudWatch Agent) with HANA-specific memory metrics, not realizing that HANA’s internal memory management (e.g., column store, row store, heap) is only accessible through its SQL views, not through standard OS monitoring tools.

How to eliminate wrong answers

Option A is wrong because HANA trace files contain diagnostic logs (e.g., error traces, SQL traces) but do not expose structured, real-time memory consumption metrics suitable for CloudWatch monitoring. Option C is wrong because EC2 instance-level memory metrics are not available by default in CloudWatch; they require the CloudWatch Agent or a custom script, and even then they report OS-level memory (e.g., RAM usage) rather than HANA-specific memory allocation. Option D is wrong because the AWS CloudWatch Agent for OS metrics collects operating system metrics (e.g., memory utilization, disk I/O) from the EC2 instance, but it cannot query SAP HANA’s internal memory views or provide HANA-specific memory consumption data.

Full explanation →

1021

Drag & Dropmedium

Drag and drop the steps to implement disaster recovery for SAP S/4HANA using AWS Elastic Disaster Recovery (DRS) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

DRS involves agent installation, configuration, testing, recovery initiation, and post-recovery steps.

Full explanation →

1022

Multi-Selecthard

Which THREE metrics should an operations team monitor to detect performance issues in an SAP HANA database running on EC2?

Select 3 answers

A.CPU utilization

B.Disk I/O (read/write latency)

C.Network packets in/out

D.Memory usage

E.Swap usage

AnswersA, B, D

High CPU can indicate performance issues.

Why this answer

Options A, B, and D are correct. A: CPU utilization indicates compute pressure, which can affect HANA performance. B: Disk I/O (especially read/write latency) is critical for HANA's data persistence and log writes; high latency can degrade performance.

D: Memory usage is essential since HANA is an in-memory database; insufficient memory leads to performance issues. Option C (Network packets) is wrong because network throughput is less directly impactful for HANA performance compared to the other metrics. Option E (Swap usage) is wrong because while high swap usage can indicate severe memory pressure, HANA should not swap under normal operations; monitoring memory usage directly is more effective and a primary metric.

Swap usage is a secondary indicator that typically follows memory pressure, and is not among the top three critical performance metrics to watch.

Full explanation →

1023

MCQmedium

Refer to the exhibit. An administrator is setting up a migration from on-premises VMware VMs to AWS using AWS Server Migration Service (SMS). The IAM policy shown is attached to the SMS service role. The migration fails with an error indicating insufficient permissions. Which additional permission is required for SMS to successfully replicate VMs?

A.ec2:DeleteSnapshot

B.ec2:ImportImage

C.ec2:DescribeRegions

D.ec2:CreateSnapshot

AnswerB

SMS uses ImportImage to import VMs as EC2 instances.

Why this answer

The correct additional permission is ec2:ImportImage (Option B). AWS SMS uses this action to import a VM from on-premises as an Amazon Machine Image (AMI) in EC2. The IAM policy in the exhibit likely includes actions such as ec2:CreateSnapshot (needed for replication) but is missing ec2:ImportImage, which is explicitly required for the final import step.

Option A (ec2:DeleteSnapshot) is not needed because SMS does not delete snapshots as part of the replication process. Option C (ec2:DescribeRegions) is a read-only action and is not required for the import. Option D (ec2:CreateSnapshot) is typically already included in the SMS service role, so the error is not due to its absence.

Full explanation →

1024

MCQmedium

A company is migrating its SAP ERP system to AWS and needs to retain the same SAP system ID (SID) and hostnames. The migration must be completed with minimal downtime. Which AWS service or feature supports this requirement?

A.SAP Software Update Manager (SUM) with Database Migration Option (DMO)

B.AWS CloudEndure Migration (now AWS Application Migration Service)

C.AWS Application Migration Service (MGN) with custom scripts

D.AWS Database Migration Service (DMS)

AnswerA

SUM with DMO can migrate the entire SAP system while preserving SID and hostnames.

Why this answer

SAP Software Update Manager (SUM) with Database Migration Option (DMO). SUM with DMO is an SAP tool specifically designed for system migrations, including cross-platform migrations like on-premises to AWS. It preserves the SAP system ID (SID) and hostnames by performing a homogeneous or heterogeneous migration while keeping the application configuration intact. It supports minimal downtime through near-zero downtime techniques.

Option B (AWS CloudEndure Migration, now AWS Application Migration Service) is a general-purpose migration service that replicates entire servers at the block level. While it can preserve hostnames and SIDs if configured, it is not SAP-aware and does not optimize for SAP system consistency or offer the same integration as SUM with DMO. It may require additional steps to ensure SAP-specific components are migrated correctly.

Option C (AWS Application Migration Service with custom scripts) similarly lacks SAP-specific tools and would rely on manual scripting to preserve SID and hostnames, increasing complexity and risk.

Option D (AWS Database Migration Service) is for database-level migration only and does not migrate the SAP application layer, so it cannot preserve the SID or hostnames of the entire SAP system.

Full explanation →

1025

Multi-Selecthard

A company is migrating a large SAP HANA database to AWS. They want to use SAP HANA Backup and Recovery with AWS storage. Which THREE options can be used as backup targets? (Choose THREE.)

Select 3 answers

A.Amazon S3

B.Amazon EFS

C.Amazon FSx for NetApp ONTAP

D.Amazon EBS volumes

E.Amazon S3 Glacier

AnswersA, C, D

S3 is a supported backup target using SAP HANA backup to S3.

Why this answer

SAP HANA backups can be stored on Amazon S3 (Option A) as a backup target using Backint, on Amazon FSx for NetApp ONTAP (Option C) as a file system mount, and on Amazon EBS volumes (Option D) attached to the HANA instance. Option B (Amazon EFS) is not supported as a backup target because SAP HANA requires block storage or specific file system features like snapshots that EFS does not provide. Option E (Amazon S3 Glacier) is not directly supported; while S3 is correct, Glacier is a cold storage class not suitable for direct backup targets.

Full explanation →

1026

MCQmedium

A company runs SAP on AWS and uses a Network Load Balancer (NLB) to distribute traffic to multiple EC2 instances. The Operations team needs to ensure that the NLB only sends traffic to instances that are healthy. Which health check configuration is appropriate for TCP traffic?

A.ICMP ping

B.TCP health check on the application port

C.HTTP health check on port 80

D.HTTPS health check on port 443

AnswerB

NLB supports TCP health checks which verify that the port is open and accepting connections.

Why this answer

The correct health check for a Network Load Balancer (NLB) handling TCP traffic is a TCP health check on the application port (Option B). NLB supports TCP, HTTP, HTTPS, and TLS health checks, but for raw TCP traffic, a TCP health check directly verifies that the target port is open and responding, which is efficient and appropriate. Option A (ICMP ping) is incorrect because NLB does not support ICMP health checks.

Options C and D (HTTP/HTTPS on ports 80/443) are unnecessary for TCP traffic and require the target to run an HTTP server, which may not be the case for all TCP applications.

Full explanation →

1027

MCQhard

A financial services company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances for the web tier, and an Amazon RDS for MySQL database for the backend. The operations team uses AWS CloudFormation to manage infrastructure. During a recent deployment, a change to the database security group caused an outage because the web tier lost connectivity to the database. The team wants to prevent similar incidents in the future. They need a solution that allows them to review and approve changes to critical resources before deployment, while still enabling rapid deployment for non-critical changes. The team uses AWS CodePipeline for CI/CD. Which approach should the team implement?

A.Use AWS Config rules to automatically remediate non-compliant changes before they are applied.

B.Use CloudFormation Change Sets in the pipeline and add a manual approval step for any change that modifies the database security group.

C.Use AWS Service Catalog to create a portfolio of approved stacks and require all deployments to use the portfolio.

D.Use AWS CloudTrail to monitor changes to the security group and trigger a rollback if unauthorized changes are detected.

AnswerB

Change Sets show the impact, and manual approval gates allow review before deployment.

Why this answer

CloudFormation Change Sets allow you to preview how proposed changes will affect your resources before execution. By integrating a manual approval step in the CodePipeline that triggers specifically when the change set modifies the database security group, the team can review and approve critical changes while allowing non-critical changes to proceed automatically. This directly addresses the requirement to prevent outages from unapproved security group modifications.

Exam trap

The trap here is that candidates often confuse reactive auditing tools (Config, CloudTrail) with proactive approval mechanisms, or they overestimate Service Catalog's ability to handle per-resource approval workflows within a single stack.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive — they evaluate resources after they have been deployed and can trigger auto-remediation, but they cannot prevent a change from being applied in the first place, so the outage would already occur. Option C is wrong because AWS Service Catalog enforces approved templates at deployment time but does not provide a per-change review and approval workflow for specific resource modifications within a stack; it would block all non-approved stacks, not allow rapid deployment for non-critical changes. Option D is wrong because AWS CloudTrail logs API calls after they happen, so it cannot prevent the outage; triggering a rollback after detection still means the outage has already occurred, which does not meet the requirement to prevent similar incidents.

Full explanation →

1028

MCQmedium

A company runs SAP HANA on AWS and wants to implement a backup strategy using AWS Backint agent for SAP HANA. Which storage service is best suited for storing the backup files when using Backint?

A.Amazon S3 Glacier

B.Amazon EFS

C.Amazon S3

D.Amazon EBS

AnswerC

Backint is designed to use S3 as the backup target.

Why this answer

AWS Backint agent for SAP HANA is designed to stream backups directly to Amazon S3, making S3 the optimal storage service for backup files. Option B (Amazon EFS) is a file storage service not intended for Backint backups. Option A (Amazon S3 Glacier) is a cold archival storage, not suited for frequent backups.

Option D (Amazon EBS) provides block storage for EC2 instances, not the target for Backint.

Full explanation →

1029

Multi-Selectmedium

Which TWO statements are true regarding Amazon EBS volume types for SAP HANA data volumes?

Select 2 answers

A.io1 volumes are the recommended choice for SAP HANA

B.io2 Block Express volumes provide up to 256,000 IOPS

C.gp3 volumes can be provisioned with up to 16,000 IOPS

D.st1 volumes are suitable for SAP HANA log volumes

E.sc1 volumes are cost-effective for SAP HANA data volumes

AnswersB, C

io2 Block Express offers high IOPS and durability for critical workloads.

Why this answer

Io2 Block Express volumes are designed for SAP HANA data volumes, offering up to 256,000 IOPS and 4,000 MB/s throughput per volume, which meets the high-performance requirements for SAP HANA. Option C is correct because gp3 volumes can be provisioned with up to 16,000 IOPS and 1,000 MB/s throughput, making them a cost-effective alternative for smaller SAP HANA workloads or non-production environments.

Exam trap

The trap here is that candidates may assume io1 is still the premium choice for SAP HANA, but AWS has deprecated io1 in favor of io2 Block Express, and they may also overlook that gp3 can meet SAP HANA data volume requirements with its provisioned IOPS capability.

Full explanation →

1030

MCQmedium

A company runs a production SAP HANA database on AWS using an EC2 instance with EBS volumes. The database is experiencing high latency during peak hours. The operations team needs to identify the root cause. Which steps should the team take to diagnose the issue?

A.Migrate the EBS volumes to Provisioned IOPS SSD (io1) immediately.

B.Monitor the EBS volume queue length and latency using Amazon CloudWatch metrics.

C.Move the SAP HANA database to Amazon RDS for SAP.

D.Increase the instance size to improve performance.

AnswerB

CloudWatch metrics for EBS can identify performance bottlenecks.

Why this answer

Amazon CloudWatch provides metrics such as EBS volume queue length (depth) and average latency, which are key indicators of I/O bottlenecks. High queue depth with corresponding latency spikes suggests that the EBS volume is overwhelmed and needs adjustment (e.g., switching to Provisioned IOPS). Option A is incorrect because migrating to Provisioned IOPS without diagnosing the root cause may not solve the issue and increases cost unnecessarily.

Option C is incorrect because moving SAP HANA to Amazon RDS for SAP is not a direct solution for latency and introduces migration complexity. Option D is incorrect because increasing instance size without analyzing I/O patterns may not address the bottleneck and can also increase costs.

Full explanation →

1031

MCQmedium

An SAP administrator created an IAM policy to allow an EC2 instance to upload backups to an S3 bucket. The policy is shown in the exhibit. However, the backup job fails with an access denied error. What is the most likely cause?

A.The KMS key policy does not grant the EC2 instance permission to use the key

B.The policy requires server-side encryption with KMS, but the backup job does not include the required encryption header

C.The resource ARN is incorrect because it does not include the bucket name correctly

D.The IAM role does not have permission to call s3:PutObject

AnswerB

The condition requires the encryption header, which may be missing.

Why this answer

The IAM policy includes the `s3:x-amz-server-side-encryption` condition key set to `aws:kms`, which enforces server-side encryption with KMS (SSE-KMS) for all `s3:PutObject` requests. If the backup job does not include the `x-amz-server-side-encryption: aws:kms` header in its PUT request, S3 will deny the request with an access denied error, even if the IAM role has the necessary permissions.

Exam trap

The trap here is that candidates assume the access denied error is due to missing IAM permissions (Option D) or incorrect ARN syntax (Option C), rather than recognizing that the policy's condition key enforces a specific request header that the backup job fails to include.

How to eliminate wrong answers

Option A is wrong because the question does not mention KMS key usage in the backup job; the policy enforces SSE-KMS via a condition, but the error is caused by the missing encryption header, not a missing key policy grant. Option C is wrong because the resource ARN `arn:aws:s3:::my-bucket/*` is correctly formatted for an S3 bucket and its objects; the bucket name is included after the service namespace. Option D is wrong because the IAM role does have permission to call `s3:PutObject` as shown in the policy's Action element; the failure is due to the condition requiring the encryption header, not a missing action permission.

Full explanation →

1032

MCQeasy

A company wants to automate the backup of SAP HANA database on AWS. Which AWS service is best suited for creating consistent snapshots of HANA data volumes?

A.AWS Backup

B.AWS Lambda

C.Amazon CloudWatch

D.Amazon S3

AnswerA

AWS Backup is the best choice because it natively supports SAP HANA with pre/post scripts for consistency.

Why this answer

AWS Backup is the best suited service for automating consistent snapshots of SAP HANA data volumes. It integrates with SAP HANA using pre and post scripts to ensure application-consistent backups. AWS Lambda can also be used but requires custom scripting, making it less optimal.

Amazon CloudWatch is for monitoring, and Amazon S3 is a storage service, not a backup service.

Full explanation →

1033

MCQhard

During a migration of an SAP system to AWS, the administrator notices that the SAP application servers are experiencing high network latency when communicating with the SAP HANA database. The application and database servers are in different VPCs connected via VPC peering. Which design change would most effectively reduce the latency?

A.Set up an AWS Direct Connect connection.

B.Enable Enhanced Networking on the EC2 instances.

C.Increase the bandwidth of the VPC peering connection.

D.Place the application and database servers in the same subnet.

AnswerD

Same subnet eliminates network hops, reducing latency.

Why this answer

Placing the SAP application servers and the SAP HANA database in the same subnet eliminates the need for traffic to traverse a VPC peering connection, which introduces additional network hops and potential latency. In a single subnet, all traffic stays within the same VPC and uses the local network infrastructure, providing the lowest possible latency for SAP HANA communication, which is critical for performance.

Exam trap

The trap here is that candidates assume VPC peering is a low-latency solution and overlook that any inter-VPC traffic introduces additional network hops, while the simplest and most effective fix is to co-locate the servers in the same subnet to avoid the peering overhead entirely.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a hybrid connectivity service that connects an on-premises data center to AWS, not a solution for reducing latency between two VPCs within the same AWS region; it would not address the inter-VPC latency issue. Option B is wrong because Enhanced Networking uses the SR-IOV (Single Root I/O Virtualization) driver to provide higher packet-per-second performance and lower jitter, but it does not reduce the physical network distance or the number of hops introduced by VPC peering. Option C is wrong because VPC peering connections do not have a configurable bandwidth limit; bandwidth is determined by the instance type and network performance, and increasing it is not a valid operation—the latency issue stems from the additional network hops, not bandwidth constraints.

Full explanation →

1034

MCQmedium

A company runs SAP NetWeaver on AWS and needs to ensure that the SAP application server instances are evenly distributed across two Availability Zones. Which AWS service should be used to distribute traffic?

A.AWS Global Accelerator

B.Application Load Balancer

C.Amazon CloudFront

D.Amazon Route 53 weighted routing

AnswerB

ALB can distribute incoming traffic across multiple AZs and instances.

Why this answer

The Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as SAP application servers, in different Availability Zones. By registering SAP instances in two AZs and enabling cross-zone load balancing, the ALB ensures even distribution of traffic across both zones, which is critical for high availability and balanced resource utilization in SAP NetWeaver deployments.

Exam trap

The trap here is that candidates often confuse DNS-level routing (Route 53 weighted routing) with actual load balancing, not realizing that DNS does not control the distribution of individual requests and cannot react to instance health in real time, whereas an ALB provides layer-7 health checks and even distribution across AZs.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by routing traffic over the AWS global network to the optimal endpoint, but it does not provide native layer-7 load balancing or even distribution across specific AZs; it relies on an underlying load balancer or endpoint for that. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations; it is not designed to distribute traffic to SAP application servers across AZs and lacks the necessary health checks and load balancing for SAP workloads. Option D is wrong because Amazon Route 53 weighted routing distributes DNS traffic based on weights assigned to records, but it operates at the DNS level and cannot evenly distribute individual requests across AZs in real time; it also does not perform health checks on SAP instances to reroute traffic in case of failure.

Full explanation →

1035

MCQhard

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

A.Manually delete the DynamoDB table and then retry the stack update.

B.Delete the stack and recreate it from the template.

C.Use the ContinueUpdateRollback API to resume the rollback.

D.Update the stack again with a different change set to bypass the failed resource.

AnswerC

This allows CloudFormation to retry rolling back the failed resource.

Why this answer

When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Exam trap

The trap here is that candidates often assume the only way to recover from a failed rollback is to delete the stack or manually fix the resource, but AWS provides the ContinueUpdateRollback API specifically to handle this state with minimal disruption.

How to eliminate wrong answers

Option A is wrong because manually deleting the DynamoDB table will cause the stack to become orphaned and may lead to data loss; CloudFormation expects to manage the resource lifecycle, and deleting it outside of CloudFormation does not resolve the rollback failure. Option B is wrong because deleting the stack and recreating it from the template would destroy all resources, including the DynamoDB table and Lambda function, causing significant disruption and potential data loss; it is an unnecessarily destructive approach. Option D is wrong because updating the stack with a different change set while in UPDATE_ROLLBACK_FAILED state is not supported; CloudFormation requires the stack to be in a stable state (e.g., UPDATE_ROLLBACK_COMPLETE) before initiating a new update, and attempting to bypass the failed resource will result in an error.

Full explanation →

1036

MCQeasy

An operations team needs to back up the SAP HANA database running on an EC2 instance. The database is 1 TB in size and the team wants to minimize backup time and cost. Which backup strategy should they use?

A.Use SAP HANA Studio to back up the database to Amazon S3

B.Use Amazon S3 lifecycle policies to move old backups to Glacier

C.Use AWS Systems Manager to run a script that copies data to S3

D.Use AWS Backup to create EBS snapshots of the attached EBS volumes

AnswerD

EBS snapshots are incremental and fast, suitable for large databases.

Why this answer

EBS snapshots provide point-in-time backups that are incremental after the first full snapshot, reducing backup time and cost. HANA Studio backup to S3 requires more manual steps and is slower. AWS Backup can be used but EBS snapshots are more direct.

S3 lifecycle policies are for object management, not database backups.

Full explanation →

1037

MCQhard

An SAP administrator configures SAP HANA backup using Backint as shown in the exhibit. The backup job fails with an error indicating that the bucket 'sap-hana-backup-prod' does not exist. The administrator confirms that the bucket name is correct. What is the most likely cause of the failure?

A.The IAM role used by the instance does not have s3:PutObject permission.

B.The chunk size is too large for the bucket.

C.The bucket is in a different AWS region than the EC2 instance.

D.The bucket has a bucket policy that denies access.

AnswerC

Backint by default uses the region of the instance; if bucket is in different region, need to specify region.

Why this answer

The SAP HANA Backint agent communicates with Amazon S3 using the AWS SDK, which resolves the bucket endpoint based on the region configured in the agent or the instance metadata. If the bucket 'sap-hana-backup-prod' exists in a different AWS region than the EC2 instance, the Backint agent will attempt to access the bucket using the wrong regional endpoint, resulting in a 'bucket does not exist' error. This is a common misconfiguration when the Backint parameter file does not explicitly set the correct region or when the instance's default region differs from the bucket's region.

Exam trap

The trap here is that candidates often assume the error message 'bucket does not exist' always means the bucket name is incorrect or the bucket was deleted, overlooking the region mismatch issue that causes the S3 API to return a 404 when the bucket is in a different region.

How to eliminate wrong answers

Option A is wrong because the error message specifically states the bucket does not exist, not a permissions issue; an s3:PutObject permission failure would produce an 'Access Denied' or '403 Forbidden' error. Option B is wrong because the chunk size parameter in SAP HANA Backint controls the size of data segments sent to S3, and an oversized chunk would cause a 'Request entity too large' error, not a 'bucket does not exist' error. Option D is wrong because a bucket policy that denies access would result in an 'Access Denied' or '403 Forbidden' error, not a 'bucket does not exist' error.

Full explanation →

1038

Multi-Selectmedium

A company is deploying SAP NetWeaver on AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which TWO AWS features should be used together to achieve this?

Select 2 answers

A.Network Load Balancer (NLB)

B.Amazon RDS Multi-AZ

C.Application Load Balancer (ALB)

D.Amazon S3

E.Amazon EFS

AnswersA, E

NLB provides a virtual IP address for the ASCS cluster.

Why this answer

Amazon EFS provides a shared filesystem for the ASCS cluster, and a Network Load Balancer (NLB) is used to distribute traffic to the active ASCS instance. S3 is not suitable for shared files, and Multi-AZ for RDS is for databases, not ASCS.

Full explanation →

1039

MCQhard

A company is migrating SAP applications to AWS and uses the CloudFormation template snippet shown in the exhibit. The SAP ASCS instance requires a shared file system for the transport directory. However, the template does not create any shared storage. Which AWS resource should be added to the template to provide a shared file system?

A.Amazon EFS file system

B.Instance Store

C.Additional Amazon EBS volume

D.Amazon S3 bucket

AnswerA

Provides shared file system for multiple instances.

Why this answer

Amazon EFS provides a scalable, shared file system that can be mounted across multiple EC2 instances, making it suitable for the SAP transport directory. Option C (Additional EBS volume) is block storage that can only be attached to a single instance, not shared. Option D (Amazon S3 bucket) is object storage, not a file system.

Option B (Instance Store) is ephemeral and not shared.

Full explanation →

1040

MCQmedium

An SAP system running on AWS uses a Multi-AZ deployment with an Application Load Balancer (ALB) distributing traffic across two application servers in different Availability Zones. The ALB health checks are configured to check the /sap/public/health endpoint on each instance. Recently, the operations team noticed that one of the instances is being marked as unhealthy intermittently, causing a slight increase in response times. The instance's CPU utilization is under 40%, memory is sufficient, and the health endpoint returns a 200 OK status when tested manually. What is the most likely cause?

A.The health check endpoint is configured with the wrong path.

B.The security group for the instances does not allow inbound traffic from the ALB.

C.The health check requests are blocked by a network ACL.

D.The health check interval is too frequent or the timeout is too short.

AnswerD

This is correct because intermittent failures with low CPU and memory suggest the health check timing parameters (interval or timeout) are too aggressive, causing the ALB to mark the instance unhealthy when the endpoint response time slightly increases.

Why this answer

A health check interval that is too frequent or a timeout that is too short can cause the ALB to mark an instance as unhealthy intermittently, even when the endpoint returns 200 OK manually. The instance may occasionally respond slower than the timeout, especially under brief transient conditions. Option A is incorrect because the health check endpoint path is correct (as it returns 200 OK).

Option B is incorrect because security group rules allowing inbound traffic from the ALB are typically configured correctly; otherwise, the health check would fail consistently. Option C is incorrect because network ACLs are stateless and would affect all traffic equally, not intermittently.

Full explanation →

1041

Multi-Selecthard

A company is migrating its SAP ERP system to AWS. The system includes an SAP Central Services (ASCS) instance and an SAP application server. Which TWO of the following are required for high availability? (Choose TWO.)

Select 2 answers

A.Use an EBS Multi-Attach volume for shared /sapmnt

B.Enqueue replication server (ERS) must be set up for the ASCS cluster

C.Configure an Elastic Load Balancer for ASCS

D.Set up a cluster for ASCS using AWS cluster management tools

E.Deploy at least two application servers in different Availability Zones

AnswersB, D

ERS is required for enqueue replication in HA.

Why this answer

The Enqueue Replication Server (ERS) is a mandatory component for an SAP ASCS high-availability cluster. In a clustered ASCS setup, the ERS replicates the lock table from the active ASCS node to the standby node, ensuring that in the event of a failover, the new active ASCS instance can recover the locks without data inconsistency. Without ERS, the ASCS cluster cannot provide true high availability for the enqueue service.

Exam trap

The trap here is that candidates often confuse high availability for the ASCS instance with general application-level redundancy, leading them to select 'deploy at least two application servers' (Option E) instead of recognizing that the ASCS cluster with ERS is the specific HA requirement for the SAP Central Services.

Full explanation →

1042

MCQmedium

A company is migrating its SAP ERP system to AWS. They need to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS architecture should they implement?

A.Configure a two-node cluster with a virtual IP (VIP) using AWS Route 53 health checks and failover

B.Run ASCS on Amazon RDS for SAP with Multi-AZ

C.Deploy ASCS on a single large EC2 instance

D.Use an Auto Scaling group with a minimum of 2 instances

AnswerA

Cluster with VIP provides HA for ASCS.

Why this answer

SAP ASCS requires a highly available cluster with a virtual IP (VIP) that can fail over between two EC2 instances. AWS Route 53 health checks can monitor the VIP and update DNS records to redirect traffic to the standby node upon failure, providing the necessary high availability for the ASCS instance without relying on a single point of failure.

Exam trap

The trap here is that candidates confuse the high availability requirements of SAP ASCS (which needs a cluster with VIP and fencing) with generic AWS HA mechanisms like Auto Scaling or RDS Multi-AZ, which are not designed for stateful SAP application services.

How to eliminate wrong answers

Option B is wrong because Amazon RDS for SAP does not support SAP Central Services (ASCS); RDS is a managed database service for SAP HANA or other databases, not for application services like ASCS. Option C is wrong because deploying ASCS on a single large EC2 instance creates a single point of failure, which does not meet high availability requirements. Option D is wrong because Auto Scaling groups are designed for horizontal scaling of stateless applications, not for stateful SAP ASCS services that require a fixed VIP and controlled failover between two nodes.

Full explanation →

1043

Multi-Selecthard

Which TWO AWS services can be used to automate the restart of an SAP application server when it becomes unresponsive? (Choose 2.)

Select 2 answers

A.Amazon ECS service auto-recovery

B.Amazon CloudWatch alarm with an EC2 action to recover the instance

C.AWS Systems Manager Automation document

D.EC2 Auto Scaling group with a health check

E.Amazon EventBridge with a Lambda function

AnswersB, C

Alarm can trigger instance recovery.

Why this answer

To automate the restart of an SAP application server when unresponsive, two appropriate AWS services are Amazon CloudWatch alarms with an EC2 action to recover the instance (Option B) and AWS Systems Manager Automation documents (Option C). A CloudWatch alarm can monitor a metric (e.g., StatusCheckFailed) and trigger an EC2 Recover action, which stops and starts the instance to restore service. Systems Manager Automation provides pre-defined or custom runbooks to perform automated remediation steps, including restarting services or instances.

Option A (Amazon ECS) is for container orchestration, not for EC2 instance recovery. Option D (EC2 Auto Scaling) can replace instances via health checks but is not designed to restart the same instance. Option E (Amazon EventBridge with Lambda) could be used but requires custom coding and is not a native automated restart solution like the two correct options.

Full explanation →

1044

MCQeasy

A company is migrating an SAP system to AWS and wants to use an existing AWS Direct Connect connection for data transfer. The migration involves transferring 10 TB of data. Which AWS service is designed to accelerate data transfer over Direct Connect?

A.Amazon S3 Transfer Acceleration

B.AWS VPN

C.AWS DataSync

D.AWS Snowball

AnswerC

DataSync uses a purpose-built protocol to accelerate transfers over Direct Connect.

Why this answer

AWS DataSync is designed to accelerate data transfer over Direct Connect by optimizing network usage, performing automatic encryption, and managing retries. Amazon S3 Transfer Acceleration (Option A) is optimized for transfers over the internet using AWS edge locations, not Direct Connect. AWS VPN (Option B) provides a secure tunnel but does not accelerate bulk transfers.

AWS Snowball (Option D) is an offline physical device, not for use with Direct Connect.

Full explanation →

1045

MCQeasy

A company is using AWS Systems Manager to automate patching of SAP EC2 instances. The patching fails for some instances with the error 'Unable to retrieve SSM Agent registration'. What is the MOST likely cause?

A.The patching window is too short and the instance times out.

B.The IAM role attached to the instance does not have permissions to list patches.

C.The instance does not have outbound internet access or a VPC endpoint for Systems Manager.

D.The SSM Agent is not installed because the instance is running in a container.

AnswerC

SSM requires connectivity to Systems Manager endpoints.

Why this answer

The error 'Unable to retrieve SSM Agent registration' indicates that the SSM Agent cannot communicate with the Systems Manager service. This typically occurs when the instance lacks outbound internet access or a VPC endpoint for Systems Manager. Option A is incorrect because a patching window timeout would produce a different error.

Option B is incorrect because the IAM role permissions issue would cause an access denied error, not a registration failure. Option D is incorrect because the SSM Agent runs on EC2 instances, not containers, and the error is unrelated to container environments.

Full explanation →

1046

MCQmedium

A company is deploying SAP Business Suite on AWS and wants to minimize network latency between the SAP application servers and the database server. Which placement strategy is best?

A.Place the servers in the same placement group within a single Availability Zone.

B.Place the servers in different VPCs connected via VPC Peering.

C.Place the application and database servers in different Availability Zones within the same region.

D.Place the servers in different AWS Regions.

AnswerA

Placement groups ensure low-latency, high-bandwidth connectivity.

Why this answer

Placement groups in AWS allow you to influence the placement of a group of interdependent instances to meet the needs of your workload. For SAP Business Suite, which is sensitive to network latency between application and database servers, using a cluster placement group within a single Availability Zone ensures the lowest possible latency and maximum throughput, as instances are placed in close proximity to each other, often within the same rack, enabling high-bandwidth, low-latency networking.

Exam trap

The trap here is that candidates often assume that distributing servers across multiple Availability Zones provides high availability, but for latency-sensitive SAP workloads, the question specifically asks for minimizing latency, not maximizing fault tolerance, so the single-AZ placement group is the correct answer.

How to eliminate wrong answers

Option B is wrong because placing servers in different VPCs connected via VPC Peering introduces additional network hops and latency, as traffic must traverse the VPC peering connection and potentially transit gateways, which is counterproductive for minimizing latency. Option C is wrong because placing servers in different Availability Zones within the same region introduces inter-AZ latency, typically 1-2 milliseconds, which is significantly higher than the sub-millisecond latency achievable within a single AZ using a placement group. Option D is wrong because placing servers in different AWS Regions introduces inter-region latency, often tens of milliseconds, which is unacceptable for the tight latency requirements of SAP Business Suite's application-to-database communication.

Full explanation →

1047

Multi-Selecthard

A company has a mission-critical SAP S/4HANA system running on AWS with a multi-node HANA database. The system must be highly available with an RPO of 0 and an RTO of less than 30 minutes. The database uses SAP HANA System Replication (HSR) with synchronous replication. Which THREE components are essential for this high-availability architecture?

Select 3 answers

A.An Application Load Balancer to distribute traffic between HANA nodes.

B.A VPN connection between the two Availability Zones.

C.An ENSA2 (Enqueue Replication 2) enqueue server.

D.A secondary HANA instance in a different Availability Zone.

E.A cluster manager such as Pacemaker to orchestrate failover.

AnswersC, D, E

ENSA2 provides high availability for the enqueue service.

Why this answer

SAP S/4HANA with a multi-node HANA database requires the ENSA2 (Enqueue Replication 2) enqueue server to replicate the application-level lock table synchronously between the active and standby central services (ASCS and ERS) instances. This ensures that in the event of a failover, the enqueue locks are preserved, preventing data inconsistencies and enabling a seamless transition within the required RTO of less than 30 minutes.

Exam trap

A common misconception is that an Application Load Balancer is needed for database-level high availability, but in SAP HANA HSR, the replication is handled directly between database nodes, and traffic distribution is not a requirement for the database tier.

Full explanation →

1048

MCQhard

Refer to the exhibit. An operations team uses an EC2 instance with this IAM policy to manage EBS snapshots for SAP HANA backups. The backup script calls the DeleteSnapshot API for snapshot snap-0abcdef1234567890. What will happen?

A.The snapshot will be deleted because the Deny applies only to other snapshots.

B.The snapshot will be deleted because the Allow statement grants permission.

C.The policy is invalid and will cause an error.

D.The DeleteSnapshot API call will be denied.

AnswerD

Correct. The explicit Deny on the specific snapshot ARN ensures the DeleteSnapshot API call is denied.

Why this answer

The IAM policy evaluation logic dictates that an explicit Deny overrides any Allow. Since the policy explicitly denies DeleteSnapshot for the specific snapshot snap-0abcdef1234567890, the API call will be denied even if an Allow statement exists. Option A is incorrect because the Deny is not restricted to 'other snapshots'; it specifically targets the snapshot in question.

Option B is incorrect because the Allow does not override an explicit Deny. Option C is incorrect because the policy is syntactically valid; the explicit Deny is a legitimate policy statement.

Exam trap

A common trap is to assume that an Allow statement always grants access. In AWS IAM, an explicit Deny takes precedence over any Allow, even if the Allow appears more specific.

Full explanation →

1049

MCQeasy

A company running SAP on AWS needs to back up their SAP HANA database daily with point-in-time recovery. Which service should they use to achieve this with minimal operational overhead?

A.Amazon RDS automated backups.

B.Amazon EBS snapshots via a script.

C.AWS Backup with the SAP HANA backup plan.

D.Amazon S3 with lifecycle policies.

AnswerC

AWS Backup provides automated, policy-based backups for SAP HANA.

Why this answer

AWS Backup with the SAP HANA backup plan is the correct choice because it provides a fully managed, policy-driven backup service that integrates directly with SAP HANA to perform database-consistent, log-based backups for point-in-time recovery. This eliminates the need for custom scripts or manual orchestration, minimizing operational overhead while ensuring compliance with SAP's backup requirements.

Exam trap

The trap here is that candidates often confuse Amazon RDS automated backups or EBS snapshots as viable for SAP HANA, not realizing that SAP HANA requires database-aware backup mechanisms (like Backint) to ensure transaction log consistency and point-in-time recovery, which only AWS Backup with the SAP HANA plan provides natively.

How to eliminate wrong answers

Option A is wrong because Amazon RDS automated backups are designed for relational databases like MySQL, PostgreSQL, or Oracle, not for SAP HANA, which is an in-memory database that requires SAP-specific backup integration via Backint or AWS Backup. Option B is wrong because Amazon EBS snapshots via a script capture block-level volume data but cannot guarantee SAP HANA database consistency or support point-in-time recovery at the transaction log level without additional, complex scripting and coordination. Option D is wrong because Amazon S3 with lifecycle policies is a storage optimization feature for object lifecycle management, not a backup service; it cannot perform SAP HANA database backups or enable point-in-time recovery.

Full explanation →

1050

MCQmedium

A company is running a critical SAP HANA database on a single EC2 instance with a large gp2 EBS volume. They need to ensure high availability with a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes. Which solution meets these requirements?

A.Deploy the SAP HANA database on Amazon RDS for SAP HANA in a Multi-AZ configuration.

B.Use AWS Backup to take daily snapshots of the EBS volume and restore to a new instance in another Availability Zone.

C.Use AWS Application Recovery Controller to continuously replicate data to a standby EC2 instance in another region.

D.Configure SAP HANA System Replication in scale-up mode with a standby HANA instance in a different Availability Zone.

AnswerD

SAP HANA System Replication provides near-synchronous replication and automatic failover, meeting RPO and RTO.

Why this answer

SAP HANA System Replication in scale-up mode with a standby instance in a different Availability Zone meets the RTO of less than 15 minutes and RPO of less than 5 minutes by continuously replicating data synchronously or near-synchronously to a standby EC2 instance. This allows automatic failover to the standby instance, ensuring minimal data loss and rapid recovery without relying on EBS snapshots or cross-region replication.

Exam trap

The trap here is that candidates may confuse AWS Application Recovery Controller (a traffic management service) with a data replication solution, or assume that EBS snapshots can meet low RPO/RTO requirements, when in fact SAP HANA's native replication is required for sub-5-minute RPO and sub-15-minute RTO.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for SAP HANA does not exist; SAP HANA is not supported on Amazon RDS, and RDS Multi-AZ is not applicable for SAP HANA workloads. Option B is wrong because daily snapshots cannot achieve an RPO of less than 5 minutes (snapshots are point-in-time and taken at most every few hours) and restoring from snapshots typically takes longer than 15 minutes for large volumes. Option C is wrong because AWS Application Recovery Controller is a traffic routing and failover orchestration service, not a data replication tool; it does not continuously replicate SAP HANA data, and cross-region replication would introduce latency that cannot meet the sub-5-minute RPO for synchronous replication.

Full explanation →

Page 14 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →