Courseiva

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 1051–1125

1616 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 14

Page 15 of 22

Page 16
1051
Multi-Selectmedium

An architect is designing a disaster recovery plan for an SAP system using SAP HANA. The primary site is in us-east-1 and the DR site is in us-west-2. The RPO is 15 minutes and RTO is 1 hour. Which TWO AWS services or features should the architect use to meet these requirements? (Choose TWO.)

Select 2 answers
A.AWS Transit Gateway with VPC peering
B.AWS Elastic Disaster Recovery (AWS DRS)
C.Amazon S3 Cross-Region Replication
D.SAP HANA System Replication
E.AWS CloudEndure Disaster Recovery
AnswersB, D

AWS DRS automates failover and recovery, meeting RTO.

Why this answer

SAP HANA System Replication (option D) is the native SAP mechanism for replicating HANA databases synchronously or asynchronously, supporting an RPO of 15 minutes with asynchronous replication. AWS Elastic Disaster Recovery (option B) provides continuous block-level replication for the entire SAP system (including OS and application volumes) and enables automated failover within the 1-hour RTO. Together, they ensure both database consistency and full infrastructure recovery.

Exam trap

The PAS-C01 exam often tests the distinction between native SAP replication (HANA System Replication) and AWS infrastructure-level DR services (AWS DRS), and the trap here is that candidates may think CloudEndure (option E) is a separate valid service, but it is simply the previous branding of AWS DRS, making it a duplicate and incorrect choice.

Full explanation →
1052
MCQeasy

An SAP system uses Amazon EFS for shared file storage. The SAP application writes many small files concurrently, causing high metadata operations. Which EFS performance mode should be selected to optimize for this workload?

A.General Purpose
B.Throughput Optimized
C.Max I/O
D.Provisioned Throughput
AnswerC

Max I/O mode is designed for high throughput and parallel metadata operations.

Why this answer

Max I/O mode is designed for workloads with high concurrency and metadata-intensive operations, such as many small files being written simultaneously. It scales to higher levels of aggregate throughput and IOPS than General Purpose mode, making it the correct choice for this SAP workload.

Exam trap

The trap here is confusing EFS performance modes with throughput settings or S3 storage classes, leading candidates to select 'Throughput Optimized' (which does not exist for EFS) or 'Provisioned Throughput' (which controls throughput, not metadata performance).

How to eliminate wrong answers

Option A is wrong because General Purpose mode is optimized for low-latency workloads with moderate metadata operations and does not provide the high concurrency scaling needed for many small files. Option B is wrong because Throughput Optimized is not a valid EFS performance mode; it is a storage class for S3. Option D is wrong because Provisioned Throughput is a throughput setting (not a performance mode) that allows you to specify a fixed throughput rate, but it does not address the metadata scaling requirements of high-concurrency small-file writes.

Full explanation →
1053
MCQmedium

A company is planning to migrate SAP S/4HANA to AWS. The system has a high transaction rate and requires low network latency between SAP application servers and the database. Which AWS infrastructure design minimizes network latency between the SAP application tier and the database tier?

A.Place the database server in one Availability Zone and application servers in another to improve fault tolerance.
B.Use a cluster placement group for the application servers and a separate placement group for the database.
C.Use a mix of instance types optimized for compute and memory across different Availability Zones.
D.Place all SAP application servers and the database server in the same Availability Zone.
AnswerD

Same AZ ensures minimal network hops and lowest latency.

Why this answer

Placing all SAP application servers and the database server in the same Availability Zone (AZ) minimizes network latency by keeping traffic within a single, high-bandwidth, low-latency AWS data center. SAP S/4HANA with a high transaction rate is sensitive to inter-AZ latency (typically 1-2 ms), which can degrade performance for synchronous database calls. Co-locating all tiers in one AZ ensures the lowest possible round-trip time for SAP's dialog work processes and database commits.

Exam trap

The trap here is that candidates often confuse high availability with performance, assuming that spreading resources across AZs improves both, but for SAP S/4HANA with high transaction rates, the primary design goal for latency is co-location in a single AZ, not fault tolerance.

How to eliminate wrong answers

Option A is wrong because placing the database and application servers in different Availability Zones introduces inter-AZ latency (typically 1-2 ms), which increases response time for SAP's synchronous database calls and can degrade transaction throughput. Option B is wrong because using separate placement groups for application and database servers does not guarantee they are in the same AZ or same rack; cluster placement groups are designed for low-latency within a single group, not across groups, and splitting them can still result in cross-AZ or cross-rack latency. Option C is wrong because mixing instance types across different Availability Zones does not address latency; it may actually increase network distance and variability, and SAP workloads require consistent low latency between tiers, not just optimized compute or memory.

Full explanation →
1054
MCQhard

An SAP administrator is troubleshooting an issue where an AWS Lambda function is unable to start an EC2 instance. The Lambda execution role has the IAM policy shown in the exhibit. What is the likely cause of the failure?

A.The Lambda function is not configured with the correct VPC subnet or security group to reach the EC2 instance.
B.The policy does not allow ec2:DescribeInstances.
C.The policy does not allow ec2:StartInstances.
D.The policy does not allow s3:GetObject on the specific backup object.
AnswerA

Lambda may need VPC access to start instances in a VPC, but the policy is fine.

Why this answer

The issue is likely that the Lambda function is not configured with the correct VPC subnet or security group to reach the EC2 instance. Lambda functions running in a VPC require proper networking configuration to interact with EC2 instances in the same VPC. The IAM policy shown allows ec2:StartInstances, ec2:DescribeInstances, and s3:GetObject on the specified resources, so IAM permissions are not the problem.

Option A is correct because networking misconfiguration is a common cause of such failures. Options B, C, and D are incorrect as the policy does grant the necessary permissions.

Full explanation →
1055
MCQmedium

A company is migrating a legacy on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB and has a 1-hour maintenance window. The company needs to minimize downtime and ensure data consistency. Which migration strategy should be used?

A.Use AWS Database Migration Service (AWS DMS) with ongoing replication from the source to the target.
B.Use Oracle Data Pump to export and import the database during the maintenance window.
C.Use AWS Schema Conversion Tool (AWS SCT) to convert the schema and then copy data manually.
D.Export the database to flat files, upload to Amazon S3, and then import into RDS.
AnswerA

AWS DMS with CDC minimizes downtime by replicating changes continuously.

Why this answer

AWS DMS with ongoing replication minimizes downtime by continuously replicating changes from the source to the target, allowing a cutover with minimal downtime. Native Oracle tools (Data Pump) or exporting to flat files require significant downtime, and AWS SCT only handles schema conversion.

Full explanation →
1056
MCQmedium

A company is deploying SAP NetWeaver on AWS and needs to ensure high availability for the ASCS instance. They plan to use a shared file system for the transport directory. Which AWS storage service is most appropriate for this shared file system?

A.Amazon EFS
B.Amazon EBS volumes with multi-attach
C.EC2 Instance Store
D.Amazon S3
AnswerA

EFS provides a shared NFS file system that can be accessed from multiple EC2 instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and highly available NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. For SAP NetWeaver ASCS high availability, the transport directory (/usr/sap/trans) must be shared between the active and passive ASCS instances, and EFS supports the required NFSv4 protocol with strong consistency and POSIX permissions, making it the most appropriate choice.

Exam trap

The trap here is that candidates confuse 'shared file system' with 'shared block storage' and choose EBS multi-attach, not realizing that EBS multi-attach is limited to a single AZ and lacks the cross-AZ high availability required for SAP ASCS failover.

How to eliminate wrong answers

Option B is wrong because Amazon EBS volumes with multi-attach support up to 16 Nitro-based instances but only within a single Availability Zone, which cannot provide cross-AZ high availability required for SAP ASCS failover. Option C is wrong because EC2 Instance Store provides ephemeral block storage that is physically attached to the host and data is lost when the instance stops or terminates, making it unsuitable for persistent shared file systems. Option D is wrong because Amazon S3 is an object storage service that does not support POSIX file system semantics, NFS protocol, or concurrent file locking required by SAP transport directory operations.

Full explanation →
1057
MCQeasy

A company is running SAP on AWS and wants to automate the patching of SAP application servers. The servers are behind an Auto Scaling group. Which AWS service is BEST suited to apply OS patches without downtime?

A.AWS Config
B.AWS Systems Manager Patch Manager
C.AWS CloudFormation
D.AWS OpsWorks
AnswerB

Patch Manager automates OS patching; combined with Auto Scaling rolling updates, it minimizes downtime.

Why this answer

AWS Systems Manager Patch Manager is the best choice because it automates the patching of OS-level updates. Combined with Auto Scaling groups, you can perform rolling updates to avoid downtime. AWS Config (option A) is used for compliance and configuration auditing, not patching.

AWS CloudFormation (option C) is an infrastructure-as-code service, not a patching solution. AWS OpsWorks (option D) supports Chef and Puppet automation but is less integrated and not the primary service for OS patching.

Full explanation →
1058
Multi-Selecteasy

Which TWO methods can be used to migrate an SAP system from on-premises to AWS while minimizing the need for re-architecture? (Choose two.)

Select 2 answers
A.Replatform by moving to Amazon RDS for SAP
B.Rehost by manually copying servers to Amazon EC2
C.Rehost using AWS Application Migration Service (AWS MGN)
D.Refactor the application to use microservices
E.Use AWS Database Migration Service to move the database to Amazon Aurora
AnswersB, C

Manual rehost also minimizes changes, though less automated.

Why this answer

Lift-and-shift (rehost) using AWS Application Migration Service and the 7-Migration Strategies (7Rs) rehost approach minimize re-architecture. Option A is wrong because replatforming involves some changes. Option D is wrong because refactoring involves significant re-architecture.

Option E is wrong because AWS DMS is for databases, not full systems.

Full explanation →
1059
Multi-Selecthard

A company is migrating SAP HANA to AWS and needs to ensure that the database instances have high network throughput for replication traffic. Which THREE AWS features should be enabled? (Choose THREE.)

Select 3 answers
A.Placement Groups
B.EBS-optimized instances
C.Enhanced Networking (SR-IOV)
D.Elastic IP addresses
E.VPC peering connections
AnswersA, B, C

Placement Groups, specifically the cluster placement group type, place SAP HANA instances in a low-latency, high-bandwidth logical group within a single Availability Zone. This satisfies the requirement for high network throughput for replication traffic by ensuring instances are physically close, minimising network hops and maximising throughput for SAP HANA’s log replication and data synchronisation.

Why this answer

Enhanced Networking provides higher network performance, Placement Groups provide low-latency network, and EBS-optimized instances provide dedicated bandwidth to EBS. Option D is wrong because Elastic IP does not improve throughput. Option E is wrong because VPC peering does not improve throughput, it connects VPCs.

Full explanation →
1060
Multi-Selecthard

Which THREE AWS services are commonly used to implement high availability for SAP HANA databases on AWS? (Choose three.)

Select 3 answers
A.Amazon EC2 Auto Recovery
B.AWS Global Accelerator
C.Multi-AZ deployment of SAP HANA
D.Amazon Route 53
E.Elastic Load Balancing
AnswersA, C, E

Auto Recovery can automatically recover an instance from hardware failure.

Why this answer

Amazon EC2 Auto Recovery is correct because it automatically recovers an impaired EC2 instance by restarting it on a new healthy host within the same Availability Zone, preserving the instance ID, private IP, and Elastic IP. For SAP HANA, this minimizes downtime by quickly restoring the database instance without manual intervention, though it does not protect against an entire Availability Zone failure.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) or global traffic acceleration (Global Accelerator) with direct database high availability mechanisms, but AWS expects you to recognize that SAP HANA HA relies on instance recovery, multi-AZ replication, and load balancing at the application layer, not just network-level traffic management.

Full explanation →
1061
MCQhard

A company is running a stateful application on EC2 instances in an Auto Scaling group. The instances store session state locally. The group uses a simple scaling policy based on network traffic. The company notices that when instances are terminated during scale-in, active sessions are lost. What is the MOST effective way to preserve session state during scaling events?

A.Use a step scaling policy instead of a simple scaling policy.
B.Use a lifecycle hook to gracefully drain sessions before instance termination.
C.Increase the cooldown period for the Auto Scaling group.
D.Use a launch configuration that enables termination protection.
AnswerB

Lifecycle hooks allow instances to perform custom actions before being terminated.

Why this answer

A lifecycle hook is the most effective solution because it pauses the instance termination process during scale-in, allowing the application to drain active sessions (e.g., by transferring session state to a shared data store like ElastiCache or DynamoDB) before the instance is fully terminated. This preserves session continuity without requiring architectural changes to the application's stateful design.

Exam trap

The trap here is that candidates often confuse termination protection (which prevents manual termination) with lifecycle hooks (which manage the termination process), or they mistakenly believe that scaling policy types or cooldowns can influence session state preservation.

How to eliminate wrong answers

Option A is wrong because a step scaling policy only adjusts the number of instances to be added or removed based on alarm thresholds; it does not affect the termination process or provide any mechanism to preserve session state during scale-in. Option C is wrong because increasing the cooldown period merely delays the next scaling activity, but it does not prevent active sessions from being lost when an instance is eventually terminated. Option D is wrong because termination protection prevents an instance from being terminated via the EC2 console or API, but Auto Scaling can still terminate instances during scale-in unless the protection is set at the Auto Scaling group level (which is not supported); moreover, it would prevent scale-in entirely, defeating the purpose of dynamic scaling.

Full explanation →
1062
Multi-Selecteasy

An SAP administrator wants to automate the patching of SAP application servers. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.AWS Systems Manager Patch Manager
B.AWS Lambda
C.AWS Systems Manager Maintenance Windows
D.AWS OpsWorks
E.Amazon CloudWatch Alarms
AnswersA, C

Patch Manager automates OS patching.

Why this answer

Options A and C are correct. AWS Systems Manager Patch Manager automates the patching of instances, and AWS Systems Manager Maintenance Windows schedules when the patching occurs. Option B (AWS Lambda) is incorrect because Lambda can orchestrate patching processes but does not directly patch.

Option D (AWS OpsWorks) is incorrect as it is a configuration management service based on Chef/Puppet, not for direct patching automation. Option E (Amazon CloudWatch Alarms) is for monitoring and alerting, not patching.

Full explanation →
1063
MCQeasy

A company is running SAP S/4HANA on AWS and needs to ensure high availability for the database layer. Which AWS service should be used to replicate the database to a standby instance in a different Availability Zone?

A.EC2 Auto Scaling
B.Amazon S3
C.Amazon RDS Multi-AZ
D.AWS Database Migration Service (DMS)
AnswerD

AWS DMS can perform ongoing replication to a standby HANA database.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication from an SAP HANA source database to a standby instance in a different Availability Zone using change data capture (CDC). This allows continuous data synchronization without requiring native SAP HANA replication features, making it suitable for high-availability setups where the database layer must be replicated across AZs.

Exam trap

The trap here is that candidates often confuse Amazon RDS Multi-AZ with a generic high-availability solution, but RDS Multi-AZ does not support SAP HANA, making DMS the correct choice for replicating SAP S/4HANA databases across Availability Zones.

How to eliminate wrong answers

Option A is wrong because EC2 Auto Scaling is designed to automatically adjust compute capacity based on demand, not to replicate databases or provide database-level high availability across AZs. Option B is wrong because Amazon S3 is an object storage service and cannot be used for real-time database replication or as a standby database instance. Option C is wrong because Amazon RDS Multi-AZ is a managed database service that provides automatic failover for supported database engines, but it does not support SAP HANA as a database engine, which is required for SAP S/4HANA workloads.

Full explanation →
1064
Multi-Selecthard

A company is migrating a critical application to AWS using a phased approach. The application uses a custom Linux distribution that is not supported by AWS Application Migration Service. Which THREE steps should the company take to migrate the application? (Choose THREE)

Select 3 answers
A.Use AWS Server Migration Service (SMS) to replicate the on-premises server to AWS.
B.Convert the application to run on Amazon Linux 2 to simplify future management.
C.Perform a test migration to a non-production environment to validate the application.
D.Use AWS Database Migration Service (DMS) to migrate the application server.
E.Create a custom Amazon Machine Image (AMI) with the required Linux distribution and dependencies.
AnswersA, C, E

SMS can replicate servers even if the OS is not officially supported by AWS MGN.

Why this answer

AWS Server Migration Service (SMS) is the correct choice because it is an agentless service that can replicate on-premises servers running custom Linux distributions as long as they are supported by the underlying hypervisor. SMS uses incremental replication to create Amazon Machine Images (AMIs) from the source server, enabling a lift-and-shift migration without requiring the application to be converted to a different OS. This approach directly addresses the scenario where AWS Application Migration Service does not support the custom Linux distribution.

Exam trap

The trap here is that candidates often confuse AWS DMS as a general-purpose migration tool for servers, when in fact it is strictly for database migrations, leading them to incorrectly select Option D instead of recognizing that server migration requires a dedicated replication service like SMS or a custom AMI approach.

Full explanation →
1065
MCQhard

A company plans to migrate a 10 TB on-premises SQL Server database to Amazon RDS for SQL Server. The migration must be completed within a 4-hour window. The network bandwidth is 1 Gbps. Which migration approach should they choose?

A.Use AWS SCT to convert schema and then export/import via native tools
B.Use AWS DMS over the internet
C.Set up an AWS Direct Connect connection and use DMS
D.Use AWS Snowball Edge to transfer data and then perform a cutover
AnswerD

AWS Snowball Edge physically ships the data, avoiding network transfer time. The cutover can be performed within the 4-hour window after the data is loaded to Amazon RDS.

Why this answer

AWS SCT only converts schema, not data; export/import via native tools would still need to transfer the full 10 TB over the internet, which at 1 Gbps takes ~22 hours, far exceeding the 4-hour window. Option B is incorrect because DMS over the internet is limited by the 1 Gbps bandwidth, resulting in a transfer time of ~22 hours, too slow. Option C is incorrect because while Direct Connect provides a dedicated connection, it still has a 1 Gbps bandwidth limit, so the transfer would still take ~22 hours, exceeding the window.

Option D is correct because AWS Snowball Edge physically ships the data, bypassing network bandwidth limitations, and allows a fast cutover.

Full explanation →
1066
MCQeasy

An SAP environment uses Amazon CloudWatch to monitor EC2 instances. The operations team wants to receive a notification when the CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should they use?

A.Amazon CloudWatch Alarms with Amazon SNS.
B.AWS Config.
C.Amazon CloudWatch Logs.
D.AWS CloudTrail.
AnswerA

Alarms send notifications via SNS when thresholds are breached.

Why this answer

Amazon CloudWatch Alarms can monitor a metric (like CPUUtilization) and trigger an action when the metric crosses a defined threshold for a specified number of consecutive evaluation periods. By setting the alarm to evaluate CPU utilization > 90% for 5 consecutive minutes (e.g., 5 periods of 1 minute each) and configuring the alarm action to publish to an Amazon SNS topic, the operations team receives a notification directly. This is the native, serverless way to react to CloudWatch metrics without additional infrastructure.

Exam trap

The trap here is that candidates confuse AWS Config (configuration compliance) or CloudTrail (API auditing) with real-time metric monitoring, or they think CloudWatch Logs can directly alert on CPU metrics, but only CloudWatch Alarms with SNS provide the precise threshold-based notification for CloudWatch metrics.

How to eliminate wrong answers

Option B (AWS Config) is wrong because AWS Config is a service for evaluating and recording resource configuration changes and compliance against rules, not for monitoring real-time metric thresholds like CPU utilization. Option C (Amazon CloudWatch Logs) is wrong because CloudWatch Logs is used to store, monitor, and access log files from EC2 instances or other sources; it does not natively trigger notifications based on metric thresholds (it can trigger on log patterns via metric filters, but not on CPU utilization directly). Option D (AWS CloudTrail) is wrong because CloudTrail records API activity and governance events for auditing, not real-time performance metric monitoring or alerting.

Full explanation →
1067
Multi-Selecthard

A company is designing a disaster recovery (DR) strategy for SAP HANA on AWS. Which TWO of the following are valid DR approaches? (Choose two.)

Select 2 answers
A.Configure HANA System Replication to a secondary Region.
B.Use S3 cross-Region replication (CRR) to copy HANA backups.
C.Copy EBS snapshots to another Region using cross-Region snapshot copy.
D.Use AWS Backup with cross-Region copy.
E.Use Amazon RDS cross-Region read replicas for HANA.
AnswersA, C

HANA System Replication provides near real-time replication.

Why this answer

HANA System Replication (HSR) is a native SAP feature that asynchronously replicates the in-memory database to a secondary Region, enabling a full DR failover with minimal data loss. This approach is fully supported on AWS by deploying HANA instances in different Availability Zones or Regions, and it meets the RPO/RTO requirements for enterprise SAP HANA workloads.

Exam trap

The trap here is that candidates confuse backup replication (S3 CRR, AWS Backup) with live database replication (HSR), assuming any cross-Region copy mechanism qualifies as DR for HANA, when only HSR provides the required near-real-time data consistency and failover capability.

Full explanation →
1068
MCQhard

A company runs SAP NetWeaver on AWS. The system uses a shared file system for transport files via Amazon EFS. Recently, the transport directory performance has degraded. Which configuration change is most likely to improve the I/O performance for the transport directory?

A.Enable EFS performance mode with Max I/O.
B.Migrate the transport directory to an Amazon EBS volume.
C.Use Amazon S3 with a mount point.
D.Use EFS with Bursting Throughput mode.
AnswerA

Max I/O mode optimizes for high throughput and large file operations.

Why this answer

Enabling EFS Max I/O performance mode provides higher throughput and IOPS for workloads with high I/O demands, such as SAP transport directories. Max I/O mode scales horizontally by distributing file data across multiple servers, which improves performance for parallel access patterns common in SAP transport operations.

Exam trap

The trap here is that candidates often assume Bursting Throughput mode (Option D) is sufficient for all EFS workloads, but they overlook that SAP transport directories require sustained high I/O that can exhaust burst credits, making Max I/O mode the better choice for consistent performance.

How to eliminate wrong answers

Option B is wrong because migrating to an EBS volume would require re-architecting the shared file system, as EBS is a block-level storage attached to a single EC2 instance, not suitable for shared access across multiple SAP instances. Option C is wrong because Amazon S3 with a mount point (e.g., using S3FS or similar FUSE-based solutions) introduces significant latency and lacks POSIX compliance, making it unsuitable for SAP transport directories that require low-latency file locking and consistency. Option D is wrong because EFS Bursting Throughput mode relies on burst credits and may not sustain high I/O performance for continuous workloads like SAP transport, leading to throttling once credits are exhausted.

Full explanation →
1069
MCQhard

An SAP administrator is troubleshooting why a user cannot stop a production EC2 instance. The IAM policy attached to the user is shown in the exhibit. Which action is likely causing the failure?

A.The instance does not have the tag Environment=production.
B.There is an explicit deny statement in another policy.
C.The policy does not allow the StopInstances action.
D.The policy does not include ec2:DescribeInstances action.
AnswerA

The condition requires the tag to be exactly 'production'.

Why this answer

The IAM policy allows StopInstances only when the instance has the tag Environment=production. If the instance does not have this tag, the condition in the policy is not met, and the action is implicitly denied. Option B is not necessarily correct because there is no evidence of an explicit deny in another policy.

Option C is incorrect because the policy does allow StopInstances with the condition. Option D is incorrect because the ec2:DescribeInstances action is not required to stop an instance.

Full explanation →
1070
Multi-Selecthard

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances running SAP Web Dispatcher. The operations team needs to implement a health check that verifies the Web Dispatcher is ready to accept traffic. Which THREE configuration options should the team set for the health check? (Choose THREE.)

Select 3 answers
A.Set the unhealthy threshold to 5 consecutive failures
B.Set the health check path to /sap/wdisp/health
C.Set the health check port to 443 (HTTPS)
D.Set the health check interval to 10 seconds
E.Set the healthy threshold to 2 consecutive successes
AnswersA, B, D

This prevents premature marking of instances as unhealthy.

Why this answer

The health check should target a custom path that validates the application status, use a reasonable interval, and set a threshold for consecutive failures to mark the instance unhealthy. The healthy threshold determines how many consecutive successes are needed to mark the instance healthy. The path should be a specific endpoint like /sap/wdisp/health.

The interval and unhealthy threshold are important to detect failures quickly while avoiding flapping.

Full explanation →
1071
MCQhard

A company is designing a disaster recovery (DR) solution for SAP HANA on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The RPO is 5 minutes, and the RTO is 1 hour. The company wants to use SAP HANA System Replication (HSR). Which configuration meets these requirements?

A.Use asynchronous HSR with multiple secondary instances (multi-target) in us-west-2.
B.Use synchronous HSR between us-east-1 and us-west-2.
C.Use asynchronous HSR with a single secondary instance in us-west-2.
D.Use EBS snapshots every 5 minutes and copy them to us-west-2.
AnswerA

Multi-target async replication provides better RPO by replicating to multiple targets.

Why this answer

Multi-target asynchronous HSR allows SAP HANA to replicate data to multiple secondary instances simultaneously, meeting the 5-minute RPO with asynchronous replication while providing the flexibility to fail over to a secondary instance in us-west-2 within the 1-hour RTO. Asynchronous replication is necessary over such a long distance (us-east-1 to us-west-2) to avoid latency impacting primary site performance, and multi-target enables multiple DR targets without additional primary-side overhead.

Exam trap

The trap here is that candidates often assume synchronous replication is always better for low RPO, but over long distances it introduces unacceptable latency, making asynchronous the only viable option for cross-region DR.

How to eliminate wrong answers

Option B is wrong because synchronous HSR over a cross-region distance (us-east-1 to us-west-2) would introduce significant network latency, causing transaction commit delays and potentially exceeding the RTO due to performance degradation or replication timeouts. Option C is wrong because a single secondary instance in us-west-2 does not provide the required high availability for DR; if that single instance fails or becomes unreachable, replication stops and the RPO/RTO cannot be guaranteed. Option D is wrong because EBS snapshots every 5 minutes cannot achieve a 5-minute RPO due to snapshot creation and copying latency, and restoring from snapshots typically takes longer than 1 hour, failing the RTO.

Full explanation →
1072
MCQeasy

A company is migrating an SAP HANA database to AWS using AWS DMS. An IAM policy has been created for the DMS service role as shown in the exhibit. The migration fails with an error that the DMS task cannot access the source database. Which additional permission is most likely required?

A.dms:DescribeEndpoints and dms:CreateEndpoint
B.kms:Decrypt
C.rds:DescribeDBInstances
D.ec2:DescribeSubnets
AnswerA

DMS needs permissions to manage endpoints.

Why this answer

The policy allows DMS actions and S3 bucket access, but does not include permissions for source database endpoints (e.g., RDS or EC2). DMS needs permissions to describe and connect to the source. kms:Decrypt is not relevant unless encryption is used. ec2:DescribeSubnets is for network settings.

Full explanation →
1073
MCQeasy

A company is planning to migrate its SAP environment to AWS. They have multiple SAP systems that are interconnected. Which migration approach is recommended to minimize dependency issues?

A.Migrate systems based on business process priority, ignoring technical dependencies
B.Migrate systems in logical groups that have dependencies on each other
C.Migrate systems individually based on size, starting with the smallest
D.Migrate all systems at the same time in a big bang approach
AnswerB

Grouping dependent systems ensures they are migrated together, preserving connections.

Why this answer

When migrating interconnected SAP systems, the recommended approach is to migrate them in logical groups based on dependencies. This ensures that dependent systems are moved together, minimizing issues with integrations, interfaces, and data consistency. Option A is incorrect because ignoring technical dependencies can lead to broken integrations.

Option C is incorrect because migrating by size may break dependencies across systems. Option D is incorrect because a big bang migration of all systems simultaneously is highly risky and complex.

Full explanation →
1074
MCQeasy

A company is migrating its SAP ERP system to AWS and needs to choose a storage option for the SAP HANA database. Which AWS storage service is most suitable for SAP HANA data volumes?

A.Amazon S3
B.Amazon EBS io2 Block Express volumes
C.Amazon EBS gp3 volumes
D.Amazon EFS
AnswerB

io2 Block Express volumes provide high throughput and low latency, suitable for SAP HANA.

Why this answer

Amazon EBS io2 Block Express volumes are the most suitable for SAP HANA data volumes because they provide the highest level of performance, durability, and consistency required for SAP HANA's demanding I/O workloads. io2 Block Express volumes offer up to 256,000 IOPS per volume and sub-millisecond latency, meeting SAP's certification requirements for production SAP HANA deployments on AWS. This storage type ensures the low-latency, high-throughput, and consistent performance that SAP HANA's in-memory database requires for its data and log volumes.

Exam trap

The trap here is that candidates often choose gp3 volumes (Option C) because they are cost-effective and offer good general-purpose performance, but they fail to recognize that SAP HANA production workloads require the maximum IOPS and sub-millisecond latency that only io2 Block Express volumes can provide, as per SAP's certification guidelines.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service with high latency and no support for file-level locking or POSIX semantics, making it unsuitable for SAP HANA database volumes that require block-level storage with low latency and high IOPS. Option C is wrong because Amazon EBS gp3 volumes, while offering good baseline performance, cannot match the maximum IOPS (16,000 per volume) and consistent sub-millisecond latency required by SAP HANA for production workloads, and they are not certified by SAP for HANA data volumes in large-scale deployments. Option D is wrong because Amazon EFS is a file-level NFS storage service with higher latency and lower IOPS compared to block storage, and it is not supported for SAP HANA data or log volumes as SAP HANA requires direct-attached block storage for its database files.

Full explanation →
1075
MCQhard

An SAP Basis team is implementing SAP HANA system replication across two AWS Availability Zones. The HANA primary instance uses Provisioned IOPS SSD (io2) EBS volumes. The secondary instance must be kept in sync with minimal data loss. Which networking configuration is required to ensure low-latency, high-throughput replication traffic between the instances?

A.Use ClassicLink to connect the instances.
B.Set up a VPN connection between the instances.
C.Enable Enhanced Networking (ENA) on both instances.
D.Configure VPC peering between the two subnets.
AnswerC

Enhanced Networking (ENA) provides the high throughput and low latency required for SAP HANA system replication traffic across Availability Zones. Cluster placement groups are not valid for cross-AZ placement because they are limited to a single Availability Zone.

Why this answer

The correct configuration is to enable Enhanced Networking (ENA) on both instances. ENA provides high throughput and low latency for SAP HANA replication traffic across Availability Zones. ClassicLink is deprecated, VPN adds unnecessary latency, and VPC peering is not needed between subnets already in the same VPC.

Cluster placement groups cannot span Availability Zones.

Exam trap

Do not confuse low-latency placement with networking requirements. Cluster placement groups are limited to a single Availability Zone and cannot be used for cross-AZ HANA replication. Enhanced Networking (ENA) is the key requirement for high-throughput, low-latency replication traffic.

How to eliminate wrong answers

Option A is wrong because ClassicLink is a legacy feature for connecting EC2-Classic instances to a VPC, and it does not provide the low-latency, high-throughput networking required for SAP HANA replication; it also does not apply to instances already in a VPC. Option B is wrong because a VPN connection introduces encryption overhead and traverses the public internet or AWS VPN endpoints, adding latency and reducing throughput, which is unsuitable for synchronous HANA replication. Option D is wrong because VPC peering connects two separate VPCs, but the question states the instances are in two Availability Zones, which are within the same VPC; VPC peering does not optimize intra-VPC network performance or reduce latency between AZs.

Full explanation →
1076
MCQeasy

An SAP administrator needs to apply an OS security patch to all SAP application servers running on EC2 instances in an Auto Scaling group. The patch requires a reboot. What is the most efficient way to apply the patch with minimal downtime?

A.SSH into each instance and apply the patch manually
B.Create a new AMI with the patch and update the Auto Scaling group
C.Use AWS CloudFormation to update the instances
D.Use AWS Systems Manager Patch Manager with a maintenance window
AnswerD

Patch Manager automates patching and reboots with minimal disruption.

Why this answer

AWS Systems Manager Patch Manager can orchestrate patching across instances, and using a maintenance window with a reboot strategy minimizes downtime. Option A is wrong because manual patching is not efficient. Option B is wrong because creating a new AMI and updating the Auto Scaling group requires creating a new launch configuration or template and rolling out new instances, which is more effort and not the most efficient.

Option C is wrong because AWS CloudFormation is for infrastructure provisioning, not for applying OS patches.

Full explanation →
1077
MCQeasy

A company needs to back up its SAP HANA database running on AWS. The backup must be stored in a durable and cost-effective manner. Which AWS service should the company use for long-term backup storage?

A.Amazon EBS snapshots
B.Amazon Glacier
C.AWS Backup
D.Amazon S3
AnswerD

S3 is ideal for durable and cost-effective backup storage.

Why this answer

Amazon S3 is the correct choice for long-term backup storage of SAP HANA databases on AWS because it offers 99.999999999% durability, is cost-effective with lifecycle policies to transition data to lower-cost tiers like S3 Glacier Deep Archive, and supports native integration with SAP HANA backup tools via the SAP HANA Backint agent for S3. This allows direct backup to S3 without intermediate storage, meeting both durability and cost requirements.

Exam trap

The trap here is that candidates confuse Amazon Glacier as a separate service rather than recognizing it as a storage class within Amazon S3, and they overlook that AWS Backup is an orchestration layer, not the primary storage target for SAP HANA's native Backint integration.

How to eliminate wrong answers

Option A is wrong because Amazon EBS snapshots are stored in Amazon S3 but are tied to a specific Availability Zone and are not designed for long-term, cost-optimized archival; they lack native lifecycle management to lower-cost tiers and incur costs for each incremental snapshot. Option B is wrong because Amazon Glacier is a storage class within S3, not a standalone service for direct SAP HANA backups; using Glacier directly would require additional tooling and does not support the Backint agent, making it impractical for active backup workflows. Option C is wrong because AWS Backup is a centralized backup service that can orchestrate backups to S3, but it does not provide the direct, native SAP HANA Backint integration that S3 offers, and it adds overhead for a simple backup-to-S3 requirement.

Full explanation →
1078
MCQhard

A company is migrating an SAP system to AWS and needs to ensure high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which architecture meets SAP's high availability requirements?

A.Use a cluster solution with a shared file system and a virtual IP address in a multi-AZ setup
B.Deploy ASCS and ERS in a single Availability Zone with an automatic restart
C.Use an Application Load Balancer to distribute traffic between ASCS and ERS
D.Configure Amazon Route 53 health checks to failover between ASCS and ERS
AnswerA

This is the recommended architecture for SAP ASCS/ERS HA, using Pacemaker and a floating IP.

Why this answer

A cluster solution with a shared file system and a virtual IP address in a multi-AZ setup meets SAP's high availability requirements for ASCS and ERS. This architecture ensures automatic failover across Availability Zones (AZs) and is the standard recommendation for SAP HA. Option B is incorrect because deploying ASCS and ERS in a single AZ with automatic restart does not protect against AZ failure.

Option C is incorrect because an Application Load Balancer is designed for HTTP/HTTPS traffic, not for SAP Central Services which require a shared file system and virtual IP. Option D is incorrect because Amazon Route 53 health checks alone do not provide the fast failover required; they are typically used with DNS-based failover, not cluster-based HA.

Full explanation →
1079
Matchingmedium

Match the AWS service to its role in SAP high availability.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Automatically adjusts capacity of SAP application servers

DNS failover and health checks

Distributes traffic across SAP instances

Infrastructure as code for multi-AZ deployment

Why these pairings

In SAP on AWS, Elastic Load Balancing and Route 53 are key HA services. ELB distributes traffic across healthy instances, and Route 53 provides DNS failover. Auto Scaling helps maintain capacity but does not distribute traffic, and Lambda is not a primary HA component.

Full explanation →
1080
MCQmedium

Refer to the exhibit. An SAP administrator has the IAM policy shown. The administrator needs to attach an EBS volume to an EC2 instance that is tagged with SAPSystem=DEV. Will the administrator be able to perform the attach operation?

A.No, because the condition requires the tag SAPSystem=PRD
B.No, because the policy does not allow attaching volumes
C.Yes, because the policy allows the actions
D.Yes, because the resource is not restricted
AnswerA

The condition StringEquals requires the tag to be PRD, not DEV.

Why this answer

The policy allows AttachVolume and DetachVolume actions, but only when the volume or instance resource has the tag SAPSystem=PRD. Since the instance is tagged DEV, the condition is not met, and the operation will be denied.

Full explanation →
1081
MCQhard

An SAP administrator is trying to run an AWS DMS replication task from an EC2 instance that has this IAM role. The task fails with an access denied error. What is the most likely cause?

A.The EC2 instance role is not attached to the instance.
B.The S3 bucket name is incorrect.
C.The S3 actions require additional permissions for the bucket.
D.The policy does not include permissions for dms:DescribeReplicationTasks.
AnswerD

To start a task, DMS may need to describe replication tasks first.

Why this answer

The IAM policy attached to the EC2 instance role does not include permissions for the dms:DescribeReplicationTasks action. When the DMS replication task is started, the DMS service needs to describe the task status and list replication tasks, which requires this action. Without it, the API call fails with an access denied error.

Although the policy includes dms:CreateReplicationTask and dms:StartReplicationTask, the absence of dms:DescribeReplicationTasks causes the failure. Option D correctly identifies this missing permission.

Full explanation →
1082
MCQeasy

A company is planning to run SAP S/4HANA on AWS. They need to ensure that the SAP system can be restored within 4 hours in the event of a disaster. Which AWS service should be used to achieve this recovery time objective (RTO)?

A.AWS Elastic Disaster Recovery
B.EBS snapshots copied to another region
C.AWS CloudEndure Disaster Recovery
D.Amazon S3 cross-region replication
AnswerA

DRS provides fast recovery for SAP systems.

Why this answer

AWS Elastic Disaster Recovery (AWS DRS) is the correct service because it provides continuous replication of SAP S/4HANA workloads with sub-second RPO and supports automated recovery orchestration, enabling restoration within the 4-hour RTO. It is the direct successor to CloudEndure Disaster Recovery and is purpose-built for enterprise applications like SAP, offering non-disruptive testing and fast failover to a secondary AWS Region or Availability Zone.

Exam trap

The trap here is that candidates confuse AWS Elastic Disaster Recovery with its predecessor name 'CloudEndure Disaster Recovery' (Option C), which is the same service but the exam expects the current AWS branding, or they mistakenly think periodic EBS snapshots (Option B) can achieve a 4-hour RTO for SAP without considering the recovery time for snapshot restoration and database consistency.

How to eliminate wrong answers

Option B is wrong because EBS snapshots copied to another region provide only periodic, point-in-time backups (typically every 1-24 hours), which cannot guarantee the sub-minute RPO needed for SAP S/4HANA and may require manual steps to restore, exceeding the 4-hour RTO. Option C is wrong because AWS CloudEndure Disaster Recovery is the previous name for AWS Elastic Disaster Recovery; it is the same service, but the current AWS service name is 'AWS Elastic Disaster Recovery' (the exam uses the updated name), so selecting this option indicates a misunderstanding of the service naming. Option D is wrong because Amazon S3 cross-region replication is an object-level replication service for S3 buckets, not a block-level replication solution for EC2 instances or SAP databases, and it cannot replicate the entire SAP system state (OS, database, application) required for disaster recovery.

Full explanation →
1083
MCQmedium

A company is migrating a critical SAP HANA database to AWS. The database size is 2 TB. They require the highest network throughput and low latency between EC2 instances. Which EC2 placement strategy should they use?

A.Spread Placement Group across multiple Availability Zones
B.Partition Placement Group
C.Dedicated Hosts
D.Cluster Placement Group
AnswerD

Cluster group provides low latency and high throughput within a single AZ.

Why this answer

Placement Groups with Cluster Placement provide low latency and high throughput within a single AZ. Option D (Cluster Placement Group) is correct. Option A (Spread Placement Group) is for high availability, not performance.

Option B (Partition Placement Group) is for large distributed systems. Option C (Dedicated Hosts) provides licensing benefits, not network performance.

Full explanation →
1084
Multi-Selectmedium

A company is migrating its SAP HANA database to AWS. They need to validate that the target AWS environment meets SAP's certification requirements. Which two steps should they take? (Choose TWO.)

Select 2 answers
A.Configure the instance with 10 Gbps network bandwidth
B.Use an Amazon Machine Image (AMI) from the AWS Marketplace that includes SAP HANA
C.Ensure that the EBS volumes are optimized for high throughput
D.Confirm that the operating system is SAP certified for HANA
E.Verify that the EC2 instance type is listed in the SAP HANA certified instance list
AnswersD, E

OS certification is required.

Why this answer

To validate that the target AWS environment meets SAP HANA certification requirements, two key checks are necessary: (1) the EC2 instance type must be listed in the SAP HANA certified instance list (Option E), and (2) the operating system must be SAP certified for HANA (Option D). Option A (configuring 10 Gbps network bandwidth) is not a certification requirement; SAP HANA instances automatically use enhanced networking with adequate bandwidth. Option B (using an AMI from AWS Marketplace) is not required; you can install SAP HANA on any certified OS.

Option C (ensuring EBS volumes are optimized for high throughput) is not a specific certification criterion; EBS optimization is automatically enabled on supported instance types.

Full explanation →
1085
Multi-Selecthard

Which THREE factors should be considered when choosing an EC2 instance type for SAP HANA? (Choose three.)

Select 3 answers
A.The instance must have enough memory to fit the HANA database.
B.The instance must support high network throughput for data replication.
C.The instance should have GPU accelerators for faster query processing.
D.The instance must have local instance store volumes for data persistence.
E.The instance type must be listed in the SAP HANA hardware directory for AWS.
AnswersA, B, E

HANA is memory-optimized.

Why this answer

SAP HANA is an in-memory database that loads the entire dataset into RAM for processing. The EC2 instance must have sufficient memory to accommodate the HANA database size, including overhead for system tables and temporary data, as specified in the SAP HANA memory sizing guidelines.

Exam trap

The trap here is that candidates may mistakenly think GPU accelerators are needed for SAP HANA's analytical queries or that local instance store volumes provide persistent storage, when in fact SAP HANA requires certified instance types and persistent storage like EBS.

Full explanation →
1086
Multi-Selecteasy

Which TWO AWS services can be used to migrate an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server with minimal downtime? (Choose two.)

Select 2 answers
A.AWS Snowball Edge
B.AWS Schema Conversion Tool (SCT)
C.Amazon EC2 with SQL Server
D.AWS Database Migration Service (DMS)
E.AWS Direct Connect
AnswersB, D

SCT converts schema and can optimize for RDS.

Why this answer

Correct options: B and D. AWS Database Migration Service (DMS) can perform live migration with continuous change data capture (CDC) for minimal downtime. AWS Schema Conversion Tool (SCT) helps convert the on-premises SQL Server schema to be compatible with Amazon RDS for SQL Server.

Options A, C, and E are incorrect: AWS Snowball Edge (A) is for offline data transfer, not minimal downtime; Amazon EC2 with SQL Server (C) is a target but not a migration service; AWS Direct Connect (E) provides network connectivity but does not perform the migration itself.

Full explanation →
1087
MCQeasy

A company runs production workloads on AWS. The Security Team requires that all Amazon S3 buckets with server access logging enabled must have logs delivered to a centralized S3 bucket in a separate account. Which solution meets this requirement?

A.Use S3 bucket policies to restrict log delivery to only the source account.
B.Use S3 replication rules to copy objects from source buckets to the centralized bucket.
C.Enable AWS CloudTrail to log all S3 API calls and store logs in the centralized bucket.
D.Configure the source bucket to deliver logs to the destination bucket. Attach a bucket policy on the destination bucket that grants the log delivery group (e.g., Amazon S3 Log Delivery) write permissions.
AnswerD

S3 server access logs can be delivered to a bucket in another account (cross-account) by configuring the source bucket's logging settings to point to the destination bucket, and the destination bucket must have a bucket policy that grants the S3 log delivery group write permissions.

Why this answer

S3 server access logs can be delivered to a bucket in another account (cross-account) by configuring the source bucket's logging settings to point to the destination bucket, and the destination bucket must have a bucket policy that grants the S3 log delivery group write permissions. Option A is incorrect because bucket policies do not restrict log delivery to only the source account; cross-account delivery is supported. Option B is incorrect because S3 replication copies objects to another bucket after they are logged, but it does not deliver the server access logs themselves.

Option C is incorrect because AWS CloudTrail logs API calls, not the server access logs that record requests made to S3 buckets.

Full explanation →
1088
MCQmedium

An SAP administrator needs to implement a disaster recovery (DR) strategy for SAP HANA with an RTO of 2 hours and RPO of 15 minutes. The primary site is in us-east-1, and the DR site is in us-west-2. The system uses SAP HANA System Replication (HSR) for data replication. Which AWS service should be used to automate failover and minimize downtime?

A.AWS Elastic Disaster Recovery (AWS DRS).
B.AWS Backup with cross-region backup copies.
C.AWS CloudEndure Disaster Recovery.
D.Amazon RDS for SAP HANA.
AnswerA

AWS DRS provides continuous replication and automated failover capabilities, meeting the RTO/RPO requirements.

Why this answer

AWS Elastic Disaster Recovery (DRS) can replicate EC2 instances and automate failover, meeting the RTO and RPO requirements. Option B is wrong because AWS Backup is for backup, not real-time replication. Option C is wrong because CloudEndure is now AWS DRS.

Option D is wrong because RDS is not used for SAP HANA; it is a managed database service.

Full explanation →
1089
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. They need to minimize downtime and ensure data consistency. Which AWS service or feature should they use?

A.AWS Database Migration Service (AWS DMS) with ongoing replication
B.RDS Read Replica
C.VPC Peering
D.AWS Schema Conversion Tool (AWS SCT)
AnswerA

DMS with ongoing replication supports near-zero downtime migration.

Why this answer

(AWS DMS with ongoing replication) is correct because it supports a full load followed by continuous change data capture (CDC) replication, enabling minimal downtime and data consistency during migration from on-premises Oracle to Amazon RDS for Oracle. Option B (RDS Read Replica) is wrong because it is used for scaling read traffic, not for migrating data. Option C (VPC Peering) is a networking feature that connects VPCs but does not perform data migration.

Option D (AWS SCT) is wrong because it only converts database schemas and code, not the actual data.

Full explanation →
1090
MCQeasy

A company is designing a disaster recovery (DR) strategy for its SAP environment on AWS. The primary region is us-east-1 and the DR region is us-west-2. The SAP application and database must be recoverable within 4 hours (RTO) and with a maximum data loss of 15 minutes (RPO). The database is SAP HANA. Which combination of services meets these requirements?

A.Use Amazon EBS snapshots replicated across regions, restoring in the DR region with a CloudFormation template.
B.Back up the HANA database to Amazon S3 and copy the backup to the DR region using cross-region replication.
C.Configure HANA System Replication (HSR) between the primary and DR regions, with a standby EC2 instance in us-west-2.
D.Use AWS Database Migration Service (DMS) with ongoing replication to an RDS for SAP HANA instance in the DR region.
AnswerC

HSR provides near-synchronous replication with RPO as low as seconds, meeting the 15-minute requirement.

Why this answer

HANA System Replication (HSR) with log shipping provides near real-time data replication to the DR region, achieving an RPO of 15 minutes or less. The standby EC2 instance in us-west-2 can be promoted to primary within 4 hours (RTO) by performing a takeover. Option A is incorrect because EBS snapshots are typically taken every few hours and cross-region copy time adds latency, making it difficult to meet a 15-minute RPO.

Option B is incorrect because Amazon S3 cross-region replication for HANA backups is asynchronous and may not ensure consistent log backups every 15 minutes, also requiring manual restore steps that exceed the RTO. Option D is incorrect because AWS DMS does not support SAP HANA as a target for ongoing replication; RDS for SAP HANA is not a supported service, and DMS is designed for homogeneous database migrations, not SAP HANA replication.

Full explanation →
1091
MCQeasy

An SAP administrator wants to deploy a SAP system across two Availability Zones for high availability. The administrator runs the command shown in the exhibit. How many subnets are available for the deployment?

A.4
B.2
C.3
D.1
AnswerB

Two subnets are listed.

Why this answer

The output shows two subnets, one in us-east-1a and one in us-east-1b. Option A is wrong because there are two subnets. Option C is wrong because there are not four.

Option D is wrong because there are exactly two.

Full explanation →
1092
Multi-Selectmedium

An organization runs SAP on AWS and wants to encrypt all data at rest for the SAP HANA database. The encryption keys must be managed by the customer and rotated annually. Which THREE AWS services can be used together to meet these requirements? (Choose THREE.)

Select 3 answers
A.Amazon S3 server-side encryption
B.Amazon EBS encryption
C.AWS Key Management Service (KMS)
D.AWS CloudHSM
E.AWS Certificate Manager (ACM)
AnswersB, C, D

EBS volumes can be encrypted using KMS keys.

Why this answer

Amazon EBS encryption is correct because SAP HANA databases on AWS typically store data on EBS volumes, and enabling EBS encryption ensures data at rest is encrypted using AWS KMS keys. This directly meets the requirement for encrypting the SAP HANA database storage.

Exam trap

A common mistake is to confuse ACM (which handles certificates for encryption in transit) with services that handle encryption at rest (KMS, CloudHSM, EBS encryption). ACM does not provide encryption at rest and is not relevant for encrypting SAP HANA database storage.

Full explanation →
1093
MCQeasy

A company is designing a network architecture for SAP S/4HANA on AWS. The architecture must support high availability by distributing application servers across two Availability Zones. Which AWS service can provide automatic failover for the SAP central services (ASCS) instance?

A.Amazon Route 53 with DNS failover routing
B.AWS Direct Connect
C.Application Load Balancer (ALB)
D.Amazon CloudFront
AnswerA

Route 53 can perform health checks and fail DNS to a standby ASCS in case of primary failure.

Why this answer

Amazon Route 53 with DNS failover routing is correct because SAP ASCS (ABAP SAP Central Services) requires a virtual hostname that clients use to connect. Route 53 can monitor the health of the ASCS instance in the primary Availability Zone and automatically update DNS resolution to point to the standby ASCS instance in the secondary Availability Zone when a failure is detected. This provides the automatic failover needed for SAP central services without requiring a shared IP address across zones.

Exam trap

The trap here is that candidates often assume a load balancer (ALB or NLB) is required for high availability, but SAP ASCS does not support load balancing across multiple active instances—it requires active/passive failover with a single virtual hostname, which DNS failover routing provides.

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a service that provides automatic failover for SAP ASCS instances. Option C is wrong because an Application Load Balancer (ALB) operates at Layer 7 and distributes HTTP/HTTPS traffic, but SAP ASCS uses proprietary protocols (e.g., Message Server, Enqueue Server) that are not HTTP-based and cannot be load-balanced by an ALB. Option D is wrong because Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations, and it does not provide failover routing for SAP central services instances.

Full explanation →
1094
Multi-Selecthard

Which TWO of the following are valid considerations when sizing an SAP HANA instance on AWS for a production environment? (Choose 2.)

Select 2 answers
A.Use EBS consistency groups for snapshot backups
B.Consider instance store volumes for temporary data and high I/O throughput
C.Ensure the instance type supports EBS optimization for dedicated network bandwidth
D.Select an instance with at least 64 GB memory per HANA node
E.Use a single large EBS volume to simplify management
AnswersB, C

Instance store provides high performance for temp data.

Why this answer

Instance store volumes provide very high I/O throughput and low latency, which is critical for SAP HANA's temporary data (e.g., /hana/tmp, /hana/log) and for redo log writes. They are ephemeral but offer the performance needed for production workloads, making this a valid sizing consideration.

Exam trap

The trap here is that candidates often confuse backup strategies (EBS consistency groups) with sizing considerations, or assume a fixed memory minimum (64 GB) that is not universally required by SAP HANA on AWS.

Full explanation →
1095
MCQmedium

An SAP system on AWS uses a multi-AZ deployment with an Application Load Balancer (ALB) to distribute traffic across application servers. The ALB health checks are failing intermittently. What is the most likely cause?

A.The security group for the ALB is blocking health check traffic.
B.The target group is not associated with the ALB.
C.The health check path is not configured correctly for the SAP application.
D.The application servers are running on burstable instance types.
AnswerC

Incorrect health check path can cause intermittent failures if the application occasionally returns non-200 status.

Why this answer

The most likely cause of intermittent health check failures in an SAP system on AWS is a misconfigured health check path. SAP applications often have specific endpoints (e.g., /sap/public/ping or a custom health check URL) that must return a 200 OK response. If the ALB health check path does not match the SAP application's expected endpoint, the ALB will intermittently mark targets as unhealthy, especially under load or during application state changes.

Exam trap

The trap here is that candidates often assume network-level issues (security groups or target group association) are the cause of intermittent failures, but the PAS-C01 exam tests the understanding that application-level health check configuration is the most common culprit for intermittent ALB health check failures in SAP environments.

How to eliminate wrong answers

Option A is wrong because if the ALB's security group were blocking health check traffic, the health checks would fail consistently, not intermittently; ALB health checks originate from the ALB's own IP addresses, and the target security group must allow inbound traffic on the health check port from the ALB's security group. Option B is wrong because if the target group were not associated with the ALB, the ALB would have no targets to route traffic to, resulting in a complete failure of traffic distribution, not intermittent health check failures. Option D is wrong because while burstable instance types (e.g., t3, t4g) can cause performance degradation under sustained CPU load, they do not directly cause health check failures; health checks are based on TCP or HTTP response, not CPU credits, and intermittent failures would more likely stem from application-level misconfiguration.

Full explanation →
1096
MCQmedium

An administrator is troubleshooting an SAP system where the application server cannot connect to the database server. Both servers are in the same VPC but different subnets. Security groups allow traffic on the database port. What is the next step to diagnose the issue?

A.Check the DB Subnet Group configuration
B.Verify route tables for the subnets
C.Review VPC Flow Logs for rejected traffic
D.Check the Network ACLs for both subnets to ensure inbound/outbound rules allow the database port
AnswerD

NACLs are stateless and must allow both inbound and outbound traffic.

Why this answer

Network ACLs (NACLs) are stateless, meaning they require explicit inbound and outbound rules for traffic to flow in both directions. Even if security groups allow the database port, a missing or misconfigured NACL rule on either subnet can silently drop traffic. Since the servers are in different subnets, checking NACLs is the next logical step after confirming security groups are correct.

Exam trap

The trap here is that candidates assume security groups are the only firewall layer, forgetting that NACLs are stateless and must be explicitly configured for both inbound and outbound traffic on each subnet.

How to eliminate wrong answers

Option A is wrong because DB Subnet Group configuration only determines which subnets an RDS instance can be placed in, not the network connectivity between an application server and a database server. Option B is wrong because route tables control traffic between subnets and other networks, but within the same VPC, subnets are implicitly connected via the VPC's main route table, so missing routes are unlikely to cause a connectivity issue between two subnets. Option C is wrong because VPC Flow Logs are a diagnostic tool for analyzing traffic after a problem is suspected, not the next step in a systematic troubleshooting process; they would be useful if NACLs and security groups appear correct but traffic is still failing.

Full explanation →
1097
MCQeasy

An SAP system is deployed on EC2 instances across multiple Availability Zones. Which AWS service should be used to automatically distribute incoming traffic across the SAP application servers?

A.Application Load Balancer
B.Amazon Route 53
C.Network Load Balancer
D.Amazon CloudFront
AnswerA

ALB distributes HTTP/HTTPS traffic for web-based SAP.

Why this answer

An Application Load Balancer distributes HTTP/HTTPS traffic across multiple targets in different Availability Zones. Route 53 (Option B) is a DNS service, not a load balancer. Network Load Balancer (Option C) is for TCP/UDP traffic.

CloudFront (Option D) is a CDN.

Full explanation →
1098
Multi-Selecthard

A company is running an SAP S/4HANA system on AWS. The system experiences high memory usage. The administrator wants to monitor the SAP HANA memory consumption and set alarms for when memory usage exceeds 85% of available memory. Which steps should the administrator take to achieve this? (Choose THREE.)

Select 3 answers
A.Configure an Amazon SNS topic to send email notifications when memory usage is high.
B.Use SAP HANA SQL queries to monitor memory usage and publish custom metrics to CloudWatch.
C.Install the Amazon CloudWatch agent on the EC2 instance to collect memory metrics.
D.Use Amazon CloudWatch Synthetics to monitor HANA memory.
E.Create a CloudWatch alarm on the memory metric with a threshold of 85%.
AnswersB, C, E

Custom metrics can be published via CloudWatch PutMetricData.

Why this answer

Options B, C, and E are correct. B: SAP HANA provides detailed memory consumption metrics via SQL views, which can be queried and published as custom CloudWatch metrics. C: The CloudWatch agent collects OS-level memory metrics from the EC2 instance, enabling monitoring of overall system memory.

E: A CloudWatch alarm can be set on the memory metric (either custom HANA metric or OS-level metric) with a threshold of 85% to trigger notifications via SNS. Option A is incorrect because SNS alone does not provide monitoring; it only delivers notifications. Option D is incorrect because CloudWatch Synthetics is used for endpoint monitoring, not for HANA memory metrics.

Full explanation →
1099
MCQmedium

Refer to the exhibit. An administrator is setting up an AWS DMS task to migrate an SAP database. They receive an error that they are not authorized to perform the operation. Which statement is true about the IAM policy?

A.The policy allows all DMS actions
B.The policy is missing the dms:CreateEndpoint and dms:DescribeEndpoints actions
C.The policy is missing the dms:CreateReplicationTask action
D.The policy should specify an ARN instead of a wildcard for Resource
AnswerB

DMS needs these permissions to create and manage endpoints.

Why this answer

The error 'not authorized' indicates the IAM policy lacks necessary permissions for the DMS task. The missing actions are dms:CreateEndpoint and dms:DescribeEndpoints, which are required to create and describe endpoints during the migration. Option B is correct because the policy explicitly denies these actions (or does not include them).

Option A is incorrect because the policy does not allow all DMS actions; it is missing these two. Option C is incorrect because the error is not related to dms:CreateReplicationTask. Option D is incorrect because using a wildcard for Resource is not the cause; the issue is the missing actions, not the resource scope.

Full explanation →
1100
MCQmedium

An SAP system on AWS uses a Multi-AZ RDS for SQL Server as the database. During a failover test, the application experienced a 2-minute outage. The application team wants to reduce this downtime. What should the operations team recommend?

A.Increase the DB instance size to improve failover performance.
B.Configure Multi-AZ with SQL Server Mirroring instead of Always On Availability Groups.
C.Enable automatic failover handling in the application's JDBC connection string.
D.Use Amazon RDS Proxy to manage connections.
AnswerC

Automatic failover in the connection string allows the application to reconnect quickly.

Why this answer

Enabling Multi-AZ with automatic failover in the JDBC connection string allows the application to automatically reconnect to the new primary without manual intervention. Option A is wrong because increasing instance size does not affect failover time. Option B is wrong because a different Multi-AZ configuration does not reduce failover time.

Option D is wrong because RDS Proxy is not supported for SQL Server.

Full explanation →
1101
Multi-Selectmedium

A company is migrating its SAP HANA database to AWS. The migration requires minimal downtime and data consistency. Which THREE steps should the company take to achieve this?

Select 3 answers
A.Take a full backup of the source database and restore it on the target.
B.Use AWS DMS with change data capture (CDC) for ongoing replication.
C.Create the target HANA database and schema in advance.
D.Perform a full load of the data using AWS DMS before enabling CDC.
E.Disable all logging on the source database to reduce overhead.
AnswersB, C, D

CDC enables continuous replication of changes.

Why this answer

To achieve minimal downtime and data consistency when migrating an SAP HANA database to AWS, the company should: Use AWS DMS with change data capture (CDC) for ongoing replication (B), create the target HANA database and schema in advance (C), and perform a full load of the data using AWS DMS before enabling CDC (D). A full backup and restore (A) would cause downtime, and disabling logging (E) is incorrect as it would compromise data consistency and recovery.

Full explanation →
1102
MCQhard

A company runs its SAP S/4HANA production workload on AWS using an 8xlarge instance with 2,000 GB of gp3 storage for /usr/sap and 6,000 GB of io2 Block Express with 64,000 IOPS for /hana/data and /hana/log. The system experiences intermittent performance degradation during peak hours, particularly for batch jobs that heavily write to the database. The SAP team reports that the database response time spikes from under 5 milliseconds to over 200 milliseconds during these periods. The AWS account has a default EBS IOPS limit of 80,000 per region. The current io2 volume is attached as a single volume. Which combination of actions would resolve the performance issue?

A.Replace the io2 volumes with larger gp3 volumes and increase the volume size to 8,000 GB to benefit from gp3 baseline performance.
B.Split the /hana/data volume into multiple io2 volumes, configure them as a RAID 0 stripe, and attach each to a separate EBS-optimized connection. Increase total provisioned IOPS to 80,000 distributed across volumes.
C.Migrate to a larger instance type with higher EBS-optimized bandwidth and increase the volume IOPS to 80,000.
D.Increase the provisioned IOPS on the existing io2 volume to 80,000 IOPS to stay within the default limit.
AnswerB

RAID 0 across multiple volumes increases aggregate IOPS and throughput, leveraging multiple EBS connections and avoiding single-volume limits.

Why this answer

Splitting the /hana/data volume into multiple io2 volumes and configuring them as a RAID 0 stripe distributes I/O across multiple EBS-optimized connections, effectively increasing the available throughput and IOPS beyond the limits of a single volume attachment. This approach also allows the total provisioned IOPS to reach 80,000, which is the regional default limit, while each individual volume stays within its own IOPS ceiling, thus resolving the database response time spikes during peak batch write operations.

Exam trap

The trap here is that candidates assume increasing IOPS on a single volume or moving to a larger instance alone will solve the performance issue, ignoring the fundamental single-volume throughput and IOPS ceiling that requires striping across multiple volumes to scale.

How to eliminate wrong answers

Option A is wrong because gp3 volumes, even at 8,000 GB, have a baseline IOPS of only 16,000 (with a maximum of 16,000 IOPS without additional cost), which is far below the required 64,000 IOPS and cannot match the low-latency performance of io2 Block Express for SAP HANA workloads. Option C is wrong because simply migrating to a larger instance type with higher EBS-optimized bandwidth does not address the single-volume bottleneck; the existing single io2 volume still cannot exceed its maximum IOPS limit (64,000) and the throughput limitation of a single EBS attachment, so performance degradation would persist. Option D is wrong because increasing the provisioned IOPS on the existing single io2 volume to 80,000 exceeds the volume-level IOPS limit for io2 (which is 64,000 IOPS for volumes up to 16 TB) and also does not resolve the throughput bottleneck of a single EBS-optimized connection.

Full explanation →
1103
MCQmedium

A company is running SAP NetWeaver on AWS with an Oracle database on an EC2 instance. The database uses Oracle Data Guard for disaster recovery across Regions. The primary database is in us-east-1, and the standby is in us-west-2. The database size is 500 GB and the network link between Regions has about 100 Mbps throughput. During a recent disaster recovery drill, the failover to the standby took over 2 hours because the Data Guard redo logs were not fully applied. The team wants to reduce the recovery time objective (RTO). They are considering using Amazon S3 to store archived redo logs, increasing the bandwidth, or using a different replication method. What is the MOST effective action to reduce the RTO?

A.Configure the primary database to automatically archive redo logs to Amazon S3, and have the standby download them from S3.
B.Use Oracle Automatic Storage Management (ASM) to mirror data across Regions.
C.Replace Oracle Data Guard with Amazon EBS snapshot replication across Regions.
D.Increase the network bandwidth between the Regions to reduce redo log shipping lag.
AnswerD

Higher bandwidth reduces the time to transfer redo logs to the standby, allowing it to apply logs faster and be ready for failover sooner.

Why this answer

Increasing the bandwidth between Regions will reduce the lag in redo log shipping, allowing the standby to apply logs more quickly and be ready faster. Option A is incorrect because storing archived logs on S3 still requires transferring them to the standby. Option B is incorrect because EBS replication does not apply to cross-Region scenarios.

Option C is incorrect because ASM is a storage management layer, not a replication solution.

Full explanation →
1104
MCQmedium

A company running SAP on AWS wants to automate the start and stop of non-production instances to save costs. Which AWS service is best suited for scheduling instance state changes?

A.AWS Instance Scheduler
B.Amazon CloudWatch Events (EventBridge)
C.AWS Auto Scaling
D.AWS Lambda with custom code
AnswerA

Specifically designed for scheduling EC2 start/stop.

Why this answer

AWS Instance Scheduler is a purpose-built solution that uses AWS CloudFormation to deploy a scheduler that automatically starts and stops EC2 instances based on defined schedules. It is the recommended approach for SAP non-production instances because it natively supports tagging, time zones, and periodic schedules without requiring custom code, making it the most cost-effective and maintainable option for this use case.

Exam trap

The trap here is that candidates often choose AWS Lambda with custom code (Option D) because they think it gives more control, but the exam expects the purpose-built AWS Instance Scheduler as the best practice for scheduling instance state changes, as it is a managed solution that requires no custom development.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch Events (EventBridge) is a service for routing events to targets, not a scheduler itself; while it can invoke a Lambda function on a schedule, it lacks built-in instance management logic and would require additional custom code to handle start/stop operations. Option C is wrong because AWS Auto Scaling is designed to automatically adjust capacity based on demand or health checks, not to schedule instance state changes at specific times; it cannot start or stop instances on a fixed schedule. Option D is wrong because AWS Lambda with custom code is a valid approach but is not the best suited service for this task; it requires writing and maintaining custom scheduling logic, error handling, and state management, whereas AWS Instance Scheduler provides a ready-to-use, managed solution that reduces operational overhead.

Full explanation →
1105
MCQhard

An SAP system on AWS uses a shared file system via Amazon EFS mounted on multiple EC2 instances. Users report that file operations are slow. Which metric in Amazon CloudWatch should be analyzed to determine if the EFS file system's throughput is being throttled?

A.PercentIOLimit
B.BurstCreditBalance
C.DataReadIOBytes
D.MeteredIOBytes
AnswerB

If BurstCreditBalance is low or zero, the file system is throttled.

Why this answer

(BurstCreditBalance) is correct because the BurstCreditBalance metric indicates the remaining burst credits for an EFS file system. When burst credits are exhausted, throughput is throttled. Option A (PercentIOLimit) is not a standard CloudWatch metric for EFS.

Option C (DataReadIOBytes) measures the number of bytes read, not throttling. Option D (MeteredIOBytes) measures the metered I/O size, not directly related to throttling.

Full explanation →
1106
MCQmedium

An SAP administrator is designing a disaster recovery plan for SAP NetWeaver on AWS. They want to minimize RTO and RPO while keeping costs low. Which strategy should they use?

A.Use AWS Elastic Disaster Recovery (DRS) with SAP HANA system replication
B.Use AWS EC2 Image Builder to create daily AMIs
C.Take manual EBS snapshots every 12 hours
D.Replicate SAP application data to an S3 bucket in another region
AnswerA

DRS provides continuous replication, minimizing RTO and RPO.

Why this answer

AWS Elastic Disaster Recovery (DRS) with SAP HANA system replication is the correct strategy because it provides continuous replication at the block level, enabling sub-minute RPO and RTO of minutes, while minimizing costs by using lower-cost staging resources and only spinning up full-scale instances during a failover. This combination meets the requirement for minimal RTO/RPO and cost efficiency for SAP NetWeaver on AWS.

Exam trap

The trap here is that candidates often assume manual snapshots or AMI-based backups are sufficient for disaster recovery, but they fail to recognize that these methods cannot achieve the sub-minute RPO and low RTO required for critical SAP workloads, and they overlook the cost efficiency of DRS's staging architecture.

How to eliminate wrong answers

Option B is wrong because AWS EC2 Image Builder creates AMIs on a schedule, which can only achieve RPO of hours (not sub-minute) and requires launching new instances for recovery, leading to higher RTO; it does not provide continuous replication. Option C is wrong because manual EBS snapshots every 12 hours result in an RPO of up to 12 hours, which is far from minimal, and recovery requires restoring volumes and reconfiguring instances, increasing RTO. Option D is wrong because replicating SAP application data to an S3 bucket in another region does not provide a consistent, crash-consistent recovery point for the entire SAP stack (including database and application), and restoring from S3 requires manual steps, leading to high RTO and potential data loss.

Full explanation →
1107
Multi-Selecthard

Which THREE factors should be considered when designing an SAP HANA backup strategy on AWS? (Select THREE.)

Select 3 answers
A.Encryption of backup data at rest and in transit
B.Security Group rules for backup traffic
C.EC2 instance type for backup server
D.Cross-region replication for disaster recovery
E.Backup frequency and retention period
AnswersA, D, E

Ensures security.

Why this answer

Options A, D, and E are correct. Option A: Encryption of backup data at rest and in transit ensures security and compliance. Option D: Cross-region replication provides disaster recovery capability by storing backups in a different AWS region.

Option E: Backup frequency and retention period directly affect recovery point objective (RPO) and compliance requirements. Option B (Security Group rules for backup traffic) is not a primary factor because backup traffic is typically encrypted and can be controlled via network ACLs or security policies; Security Groups are not the main design consideration. Option C (EC2 instance type for backup server) is irrelevant because AWS manages the underlying infrastructure for backup services like AWS Backup; you do not need to provision a separate EC2 instance for backups.

Full explanation →
1108
MCQeasy

An SAP system uses an Application Load Balancer (ALB) to distribute traffic to web servers. The ALB is configured with a health check that fails, causing the web servers to be marked as unhealthy. What is a possible reason for the health check failure?

A.The instance is in a private subnet
B.The instance type is not supported by the ALB
C.The security group for the ALB does not allow outbound traffic
D.The web server is not configured to respond to the health check path
AnswerD

If the health check path is not configured, the server returns an error.

Why this answer

A common health check failure is when the health check path (e.g., /health) returns a non-200 status code. The security group allowing traffic from the ALB is required. Instance type does not affect health check.

The subnet is not a direct cause.

Full explanation →
1109
MCQhard

A company runs a critical SAP S/4HANA system on AWS. The system uses an SAP HANA database on an EC2 instance with EBS storage. The operations team receives an alert that the database is running out of disk space on the /hana/data volume. The current configuration uses a single 2 TB gp2 EBS volume for /hana/data, which is 85% full. The team needs to resolve the immediate space issue and also plan for future growth. The database is in production and cannot tolerate downtime. The team has enabled Multi-Attach on the volume. Which course of action should the team take?

A.Migrate the data to Amazon EFS and mount it to the EC2 instance.
B.Use the Elastic Volumes feature to modify the size of the existing volume to 4 TB while the instance is running.
C.Attach an additional EBS volume, create a logical volume spanning both volumes, and extend the filesystem without downtime.
D.Take an EBS snapshot of the volume, create a larger volume from the snapshot, and attach it to the instance.
AnswerC

Attaching an additional EBS volume and using LVM to extend the filesystem online allows for capacity increase without any downtime, making it the best choice.

Why this answer

It allows adding a second EBS volume to the instance and creating a logical volume spanning both volumes, then extending the filesystem online without downtime. This is a common approach for increasing space on SAP HANA data volumes without downtime. Option A is incorrect because Amazon EFS has higher latency and is not suitable for SAP HANA database data, which requires high throughput and low latency.

Option B is incorrect because although Elastic Volumes allows resizing online, the existing volume is gp2 and resizing to 4 TB is possible, but the question emphasizes planning for future growth, and adding another volume provides more flexibility. Option D is incorrect because taking an EBS snapshot requires quiescing the database, which would incur downtime.

Full explanation →
1110
MCQeasy

An SAP administrator needs to monitor the CPU utilization of an EC2 instance running SAP HANA. Which AWS service should be used to set an alarm when CPU utilization exceeds 90% for 5 minutes?

A.AWS CloudTrail
B.AWS Trusted Advisor
C.AWS Config
D.Amazon CloudWatch
AnswerD

CloudWatch monitors metrics and can trigger alarms.

Why this answer

Amazon CloudWatch (Option D) is the correct answer because it is the AWS monitoring service that can create alarms on EC2 metrics such as CPUUtilization. When the CPU utilization exceeds a threshold (e.g., 90%) for a specified duration (e.g., 5 minutes), CloudWatch can trigger an alarm and notify via SNS. Option A (AWS CloudTrail) is incorrect because it records API activity, not performance metrics.

Option B (AWS Trusted Advisor) is incorrect because it provides best practice recommendations, not real-time monitoring or alarms. Option C (AWS Config) is incorrect because it tracks resource configuration changes, not operational metrics.

Full explanation →
1111
MCQeasy

A company is migrating a web application from an on-premises data center to AWS. The application uses a MySQL database that is 500 GB in size. The company wants to minimize downtime during the migration. Which approach should the company use?

A.Use an RDS read replica and promote it
B.Use AWS Database Migration Service (DMS) with ongoing replication
C.Stop the database, take a mysqldump, and restore to RDS
D.Use AWS Schema Conversion Tool (SCT) to migrate the schema and data
AnswerB

DMS migrates data while changes are replicated, minimizing downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication (change data capture, CDC) allows you to perform a live migration with minimal downtime. You can start a full load of the 500 GB MySQL database while the source remains operational, then enable CDC to replicate ongoing changes until you cut over to the target RDS instance, reducing the downtime window to seconds.

Exam trap

The trap here is that candidates often confuse AWS DMS with AWS SCT, assuming SCT handles data migration, when in fact SCT only converts schema and code, while DMS is the service that performs the actual data migration with minimal downtime via CDC.

How to eliminate wrong answers

Option A is wrong because an RDS read replica can only be created from an existing RDS instance, not from an on-premises MySQL database, so it cannot be used for migrating from on-premises to AWS. Option C is wrong because stopping the database to take a mysqldump and restore it causes significant downtime (hours for 500 GB), which contradicts the requirement to minimize downtime. Option D is wrong because AWS Schema Conversion Tool (SCT) is designed for heterogeneous migrations (e.g., Oracle to Aurora) or schema conversion, not for minimizing downtime in a homogeneous MySQL-to-RDS migration; it does not provide ongoing replication to reduce cutover time.

Full explanation →
1112
MCQhard

A company runs SAP on AWS and uses AWS Transit Gateway to connect multiple VPCs. They notice that inter-VPC traffic is being dropped. What is a likely cause?

A.Security groups not allowing return traffic.
B.Missing routes in the VPC route tables pointing to the Transit Gateway.
C.Transit Gateway does not support transitive routing.
D.Network ACLs blocking traffic.
AnswerB

Without routes, traffic cannot be forwarded to Transit Gateway.

Why this answer

AWS Transit Gateway requires explicit routes in each VPC's route table pointing to the Transit Gateway attachment ID for traffic to be forwarded between VPCs. Without these routes, the VPCs have no path to reach the Transit Gateway, causing inter-VPC traffic to be dropped at the VPC router level.

Exam trap

The trap here is that candidates often assume Transit Gateway automatically enables inter-VPC routing without requiring explicit VPC route table entries, confusing Transit Gateway's transitive routing capability with the need for proper route propagation in each VPC.

How to eliminate wrong answers

Option A is wrong because security groups are stateful and automatically allow return traffic for permitted outbound flows, so they would not cause inter-VPC traffic drops unless the initial outbound traffic was blocked. Option C is wrong because AWS Transit Gateway does support transitive routing by default, allowing any attached VPC to communicate with any other attached VPC as long as route tables are properly configured. Option D is wrong because network ACLs are stateless and could block traffic, but the question states traffic is being dropped between VPCs, and the most common cause is missing routes to the Transit Gateway, not ACL misconfiguration.

Full explanation →
1113
MCQmedium

An SAP system is running on EC2 instances in an Auto Scaling group. The operations team needs to ensure that when a new instance is launched, it is automatically registered with the SAP Application Server's load balancer. Which approach should be used?

A.Use a lifecycle hook with a Lambda function that runs a script to register the instance with the SAP load balancer.
B.Modify the AMI to include a startup script that registers the instance with the SAP load balancer.
C.Configure the Auto Scaling group to use an Elastic Load Balancer target group, and set health checks.
D.Use an AWS Lambda function triggered by a CloudWatch Events rule for EC2 instance state changes to register the instance.
AnswerA

Lifecycle hooks are designed for this purpose, allowing custom actions during instance launch/termination.

Why this answer

Lifecycle hooks allow the Auto Scaling group to pause instance launch and run custom actions (via Lambda) to register the instance with the load balancer before it becomes healthy.

Full explanation →
1114
Multi-Selectmedium

A company is planning to migrate its SAP ERP system to SAP HANA on AWS. Which TWO AWS services can be used to assess the current on-premises environment and plan the migration?

Select 2 answers
A.AWS Server Migration Service (SMS)
B.AWS Database Migration Service (DMS)
C.AWS Migration Hub
D.AWS CloudEndure Migration
E.AWS Application Discovery Service
AnswersC, E

Migration Hub provides visibility into migration progress and integrates with discovery tools.

Why this answer

AWS Migration Hub provides a single location to track the progress of application migrations across multiple AWS and partner solutions, including SAP HANA migrations. It integrates with AWS Application Discovery Service to collect data about on-premises servers, applications, and dependencies, enabling you to assess the current environment and plan the migration. For SAP ERP to SAP HANA on AWS, Migration Hub helps you visualize the migration status and group servers into migration waves.

Exam trap

The trap here is that candidates often confuse migration execution tools (like SMS, DMS, or CloudEndure) with assessment and planning services, leading them to select a tool that actually performs the migration rather than one that discovers and analyzes the current environment.

Full explanation →
1115
Multi-Selecteasy

A company is planning to migrate its SAP landscape to AWS. They want to use AWS services to reduce operational overhead. Which TWO services can help automate the deployment and configuration of SAP systems? (Choose two.)

Select 2 answers
A.AWS Launch Wizard for SAP
B.Amazon CloudWatch
C.AWS Systems Manager
D.AWS CloudFormation
E.Amazon WorkSpaces
AnswersA, D

Launch Wizard automates the deployment of SAP systems on AWS.

Why this answer

AWS Launch Wizard for SAP is correct because it provides a guided, step-by-step process to size, configure, and deploy SAP systems on AWS, automatically provisioning the necessary EC2 instances, storage, and networking. It reduces operational overhead by automating the deployment and initial configuration of SAP landscapes, including HANA databases and NetWeaver applications.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager's automation capabilities (e.g., Run Command, State Manager) with deployment automation, but Systems Manager is designed for ongoing management and remediation, not for the initial provisioning and configuration of SAP systems.

Full explanation →
1116
MCQmedium

A company has an SAP landscape with multiple instances behind an Application Load Balancer (ALB). The operations team needs to ensure that the ALB targets are deregistered before an instance is terminated during a patching activity. Which AWS service can automate this?

A.Amazon EC2 Auto Scaling lifecycle hooks
B.AWS Systems Manager State Manager
C.AWS Elastic Beanstalk
D.AWS Lambda
AnswerA

Lifecycle hooks can pause instance termination to run custom actions like deregistering from ALB.

Why this answer

Amazon EC2 Auto Scaling lifecycle hooks can automatically deregister instances from an Application Load Balancer before termination. Option B is incorrect because AWS Systems Manager State Manager is used to maintain consistent configuration of instances, not for target deregistration. Option C is incorrect because AWS Elastic Beanstalk is a platform for deploying web applications, not for managing ALB target deregistration for SAP.

Option D is incorrect because AWS Lambda is a compute service that can be used as a target for lifecycle hooks, but the service that inherently provides the lifecycle hook mechanism is Amazon EC2 Auto Scaling.

Full explanation →
1117
Multi-Selecteasy

Which TWO of the following are best practices for operating SAP HANA on AWS?

Select 2 answers
A.Deploy SAP HANA in a Multi-AZ configuration for high availability.
B.Use EBS snapshots for backup and recovery.
C.Use General Purpose SSD (gp2) volumes for HANA data files.
D.Stop the HANA instance during backup to ensure consistency.
E.Disable swap space to improve performance.
AnswersA, B

Multi-AZ provides automatic failover in case of an AZ failure.

Why this answer

Deploying SAP HANA in a Multi-AZ configuration provides high availability by automatically failing over to a standby instance in another Availability Zone if the primary fails. Option B is correct because EBS snapshots are an efficient and consistent backup method for SAP HANA on AWS, supporting point-in-time recovery. Option C is incorrect because General Purpose SSD (gp2) volumes do not provide the consistent low latency and high IOPS required for SAP HANA data files; Provisioned IOPS (io1/io2) are recommended.

Option D is incorrect because stopping the HANA instance during backup is not necessary and causes downtime; EBS snapshots can be taken consistently without stopping the instance using pre-snapshot scripts or SAP HANA snapshot-based backups. Option E is incorrect because disabling swap space can lead to memory pressure issues; SAP HANA recommends having swap space configured for safety.

Full explanation →
1118
MCQeasy

A company is deploying SAP NetWeaver on AWS and needs to ensure that the SAP application servers can automatically scale based on CPU utilization. Which AWS service should they use?

A.AWS Auto Scaling groups with CloudWatch alarms
B.Amazon CloudWatch to monitor CPU and send alerts
C.AWS Lambda to start and stop instances based on a schedule
D.Elastic Load Balancing (ELB) with health checks
AnswerA

Auto Scaling groups can dynamically adjust capacity based on CPU utilization metrics from CloudWatch.

Why this answer

AWS Auto Scaling groups with CloudWatch alarms allow SAP application servers to automatically scale in or out based on CPU utilization thresholds. This is the correct approach because Auto Scaling groups can dynamically adjust the number of EC2 instances in response to CloudWatch metric alarms, which is essential for handling variable SAP workload demands without manual intervention.

Exam trap

The trap here is that candidates often confuse CloudWatch's monitoring and alerting capability with the actual scaling action, forgetting that CloudWatch alone cannot modify the instance count without an Auto Scaling group.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch alone only monitors CPU and sends alerts; it cannot automatically start or stop instances to scale the SAP application tier. Option C is wrong because AWS Lambda scheduled start/stop is for time-based actions, not dynamic scaling based on real-time CPU utilization. Option D is wrong because Elastic Load Balancing distributes traffic and performs health checks but does not automatically scale the number of instances; it requires an Auto Scaling group to handle scaling actions.

Full explanation →
1119
MCQhard

An SAP system on AWS uses a Classic Load Balancer to distribute traffic to web dispatchers. The system is experiencing intermittent timeouts. What is the most likely cause?

A.The security group for the load balancer is blocking traffic.
B.Sticky sessions are enabled on the load balancer.
C.The load balancer health check interval is too short.
D.The load balancer idle timeout setting is too low.
AnswerD

Low idle timeout can cause premature connection termination.

Why this answer

The Classic Load Balancer has a default idle timeout of 60 seconds for TCP connections. If the SAP application or web dispatchers keep connections open longer than this without data transfer (e.g., during long-running reports or user think time), the load balancer will close the connection, causing intermittent timeouts. Increasing the idle timeout to match the application's keep-alive settings resolves this.

Exam trap

The trap here is that candidates confuse health check intervals with idle timeout, assuming a short health check interval causes timeouts, when in reality idle timeout is the direct cause of dropped connections during periods of inactivity.

How to eliminate wrong answers

Option A is wrong because security groups are stateful; if the load balancer's security group were blocking traffic, the issue would be consistent (all traffic blocked), not intermittent. Option B is wrong because sticky sessions (session affinity) do not cause timeouts; they ensure a client is routed to the same backend, which can actually reduce timeouts by maintaining session state. Option C is wrong because a health check interval that is too short would cause the load balancer to mark instances as unhealthy more frequently, leading to dropped connections, but the symptom would be persistent failures, not intermittent timeouts.

Full explanation →
1120
MCQmedium

A company has an SAP HANA database running on an EC2 instance with multiple EBS volumes striped using LVM. The database is experiencing high latency during peak hours. Monitoring shows that the EBS volumes have a high Average Queue Length (avgqueue) and are frequently hitting the IOPS limit. The volumes are gp2 with 3000 IOPS each. The operations team wants to improve performance without increasing storage size. What should they do?

A.Change the volume type to io2 Block Express with higher IOPS.
B.Migrate the database to an instance store-backed instance.
C.Change the volume type to gp3 and increase the IOPS and throughput.
D.Add more gp2 volumes to the LVM stripe set.
AnswerC

This is correct because gp3 offers a baseline of 3000 IOPS regardless of volume size, and allows separate increases in IOPS and throughput without increasing storage, directly addressing the latency and IOPS limit issue.

Why this answer

Gp3 volumes provide a higher baseline IOPS (3000) than gp2 at the same storage size, and allow increasing IOPS and throughput independently without increasing storage. This addresses the high latency and IOPS limit issue without requiring additional volume size. Option A is wrong because io2 Block Express is designed for very high performance and may be excessive for this scenario, also likely increasing cost.

Option B is wrong because instance store is ephemeral and not suitable for persistent database storage. Option D is wrong because adding more gp2 volumes would increase the total IOPS (since each gp2 volume has 3000 IOPS) and could help if the bottleneck is at the volume level, but gp3 provides a more cost-effective and simpler solution without adding more volumes.

Full explanation →
1121
MCQhard

Refer to the exhibit. A company is migrating its data to Amazon S3. The security team has provided this IAM policy for the migration user. However, the migration fails with an Access Denied error when trying to upload files to the bucket. What is the most likely cause?

A.The bucket policy explicitly denies the s3:PutObject action for the IAM user.
B.The IAM policy does not include s3:PutObject permission.
C.The IAM policy does not include kms:Decrypt permission.
D.The bucket has default encryption enabled and the IAM user does not have permission to use the encryption key.
AnswerA

A bucket policy with a deny statement would override the IAM allow, causing Access Denied.

Why this answer

The IAM policy allows s3:PutObject on the specified bucket. However, if the bucket has an explicit deny statement in its bucket policy that denies s3:PutObject for the user or any principal, that deny will override the IAM policy allow. Since the migration fails with Access Denied, the most likely cause is that the bucket policy explicitly denies the s3:PutObject action for the IAM user.

Therefore, Option A is correct. Options B, C, and D are incorrect: Option B is wrong because the IAM policy does include s3:PutObject; Option C is wrong because there is no encryption requirement in the policy; Option D is wrong because default encryption does not cause Access Denied if the user lacks permission to use the key, but the policy does not mention KMS permissions.

Full explanation →
1122
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database size is 2 TB and the network bandwidth between the on-premises data center and AWS is 100 Mbps. The company needs to minimize the migration time and wants to use AWS DMS. Which approach should they take?

A.Use AWS Database Migration Service (DMS) with AWS Direct Connect to increase bandwidth.
B.Use AWS DMS with a full load over the network, then ongoing replication.
C.Use AWS DMS with AWS Snowball Edge for the full load, then ongoing replication.
D.Use AWS Schema Conversion Tool (SCT) to convert the schema and then AWS DMS for full load.
AnswerC

Snowball Edge accelerates initial load; ongoing replication uses DMS.

Why this answer

AWS Snowball Edge can be used with AWS DMS to transfer the full load of large databases over a physical device, avoiding long upload times over limited bandwidth. After the full load, ongoing replication via DMS handles changes. Option A is incorrect because Direct Connect does not increase bandwidth beyond the 100 Mbps limit; it only provides a dedicated connection.

Option B is incorrect because a full load over the network at 100 Mbps would take too long for 2 TB. Option D is incorrect because Schema Conversion Tool (SCT) is used for heterogeneous migrations (e.g., Oracle to PostgreSQL), but here the target is also Oracle (homogeneous), so SCT is unnecessary.

Full explanation →
1123
Multi-Selecteasy

A company is planning to run SAP NetWeaver on AWS. Which TWO services are recommended for monitoring the SAP system? (Choose TWO.)

Select 2 answers
A.Amazon CloudWatch with SAP monitoring agent
B.Amazon Inspector
C.AWS Trusted Advisor
D.SAP Solution Manager
E.AWS Config
AnswersA, D

CloudWatch can collect SAP metrics via custom agents.

Why this answer

Amazon CloudWatch with the SAP monitoring agent is recommended because it collects SAP-specific metrics (e.g., work process usage, dialog response times, and queue lengths) and sends them to CloudWatch for custom dashboards and alarms. This integration is a standard AWS best practice for monitoring SAP NetWeaver health and performance. Additionally, SAP Solution Manager provides comprehensive monitoring and management capabilities for SAP landscapes, including real-time monitoring of SAP systems, alerting, and root cause analysis.

It is an essential SAP tool for monitoring and is fully supported on AWS.

Exam trap

The trap here is that candidates often confuse infrastructure monitoring (CloudWatch) with security or compliance tools (Inspector, Config, Trusted Advisor), forgetting that SAP-specific monitoring requires the SAP monitoring agent to bridge the gap between OS metrics and application-level health.

Full explanation →
1124
MCQhard

A company runs SAP on AWS and uses a Multi-AZ RDS for Oracle as the database. They observe that the database failover took longer than expected during a recent test. What is the most likely cause of the increased failover time?

A.The database had a large number of uncommitted transactions that needed to be rolled back.
B.The DNS TTL was set too high, causing delays in routing to the new primary.
C.The primary instance had a high volume of ongoing transactions that needed to be completed or rolled back before failover could proceed.
D.The standby instance was not in sync because read replicas were used for reads.
AnswerC

RDS waits for pending transactions to complete, which can increase failover time.

Why this answer

In a Multi-AZ RDS deployment, during a failover, the primary instance must complete or roll back any in-flight transactions before the standby can take over. If there is a high volume of ongoing transactions, this process can take longer, increasing failover time. Option A is incorrect because uncommitted transactions are typically rolled back quickly; the issue is more about transactions that need to reach a consistent state.

Option B is incorrect because DNS TTL does not significantly affect RDS failover detection; the failover mechanism uses a CNAME update that is fast. Option D is incorrect because in Multi-AZ RDS, the standby is kept in sync synchronously, and read replicas are not used for Multi-AZ; they are a separate feature.

Full explanation →
1125
MCQhard

An SAP system on AWS is experiencing high CPU ready time on the application server VMs. Which configuration change is most likely to reduce CPU contention?

A.Increase the number of vCPUs assigned to the instance
B.Move the instance to a dedicated host
C.Change instance tenancy to default
D.Increase the instance memory
AnswerB

Dedicated host provides dedicated physical cores, reducing contention.

Why this answer

CPU ready time indicates that the VM is ready to process instructions but is waiting for the physical CPU to become available, which is a symptom of CPU overcommitment on the host. Moving the instance to a dedicated host eliminates resource contention with other AWS customers' VMs by providing the instance with exclusive access to the physical CPU cores, thereby reducing or eliminating CPU ready time.

Exam trap

The trap here is that candidates often assume adding more vCPUs (Option A) will solve performance issues, but CPU ready time is a scheduling contention problem that requires physical isolation, not more virtual resources.

How to eliminate wrong answers

Option A is wrong because increasing the number of vCPUs does not address the underlying contention for physical CPU cycles; it may even worsen the problem by requiring more physical cores to be scheduled. Option C is wrong because changing instance tenancy to default (shared tenancy) would place the instance on a multi-tenant host where CPU overcommitment is more likely, increasing rather than decreasing CPU ready time. Option D is wrong because increasing instance memory does not affect CPU scheduling or contention; CPU ready time is a CPU-bound metric, not memory-bound.

Full explanation →
Page 14

Page 15 of 22

Page 16

All pages

12345678910111213141516171819202122

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWSTechnologyMigrationOperations and Maintenance
See all domains with question counts →