Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 1276–1350

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 18 of 22

1276

MCQeasy

A company wants to migrate its SAP HANA database to AWS and needs to minimize downtime. Which AWS service should be used for a near-zero downtime migration?

A.AWS Direct Connect

B.AWS Snowball

C.AWS Database Migration Service (DMS)

D.AWS Server Migration Service (SMS)

AnswerC

DMS supports continuous replication for minimal downtime.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication and can migrate SAP HANA to AWS with minimal downtime. Server Migration Service (SMS) is for server migrations, Snowball is for large data transfers offline, and Direct Connect is for network connectivity.

Full explanation →

1277

MCQmedium

An SAP HANA database is running on a Dedicated Host in us-east-1a. The system requires a disaster recovery site in us-west-2. What limitation does the use of a Dedicated Host impose on the DR setup?

A.The DR site must also use a Dedicated Host, which cannot be reserved in advance.

B.The DR site requires a separate Dedicated Host in us-west-2, increasing cost.

C.The Dedicated Host cannot be used with SAP HANA System Replication.

D.The HANA instance cannot be migrated to a different host, so DR is not possible.

AnswerB

Dedicated Hosts are per-AZ, so a new host is needed in the DR region.

Why this answer

A Dedicated Host in us-east-1a is a physical server dedicated to your use, and to set up disaster recovery in us-west-2, you must provision a separate Dedicated Host in that region. This increases costs as you are paying for two Dedicated Hosts instead of one, and the DR host cannot be shared or reserved in advance for a specific instance type without an active allocation.

Exam trap

The trap here is that candidates assume Dedicated Hosts are regionally bound or that DR can reuse the same host, but AWS requires a separate Dedicated Host per region, which directly impacts cost and provisioning planning.

How to eliminate wrong answers

Option A is wrong because Dedicated Hosts can be reserved in advance via a Dedicated Host Reservation, which offers a billing discount for a 1- or 3-year term; the limitation is not about inability to reserve but about the requirement for a separate host. Option C is wrong because SAP HANA System Replication works over the network and does not require both hosts to be on the same Dedicated Host; it can replicate across regions regardless of the underlying host type. Option D is wrong because HANA instances can be migrated to different hosts using AWS tools like AWS Launch Wizard or manual stop/start on a different Dedicated Host, and DR is fully possible with cross-region replication.

Full explanation →

1278

MCQhard

During an SAP system refresh, the operations team needs to restore an SAP HANA database from an S3 backup to a new EC2 instance. The backup was created using SAP HANA Backint. Which AWS service is required to read the backup from S3?

A.Amazon EBS snapshots

B.AWS Backup

C.AWS Storage Gateway

D.SAP HANA Backint agent for Amazon S3

AnswerD

The SAP HANA Backint agent for Amazon S3 is the correct tool to read and restore backups made with Backint, as it handles the S3 integration natively.

Why this answer

SAP HANA Backint agent for Amazon S3. When a backup is created using SAP HANA Backint, the Backint agent is the component that integrates with Amazon S3 to read the backup data. It provides a certified interface for SAP HANA to directly access S3.

Option A is incorrect because Amazon EBS snapshots are block-level backups and are not used with Backint. Option B is incorrect because AWS Backup offers SAP HANA backup support but uses its own backup method, not the Backint interface. Option C is incorrect because AWS Storage Gateway is a hybrid storage service and is not designed for Backint operations.

Full explanation →

1279

MCQeasy

An SAP application on AWS needs to access an S3 bucket containing sensitive data. Which IAM policy element should be used to enforce encryption in transit?

A."Condition": {"Bool": {"aws:SecureTransport": "true"}}

B."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "AES256"}}

C."Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}

D."Condition": {"IpAddress": {"aws:SourceIp": "10.0.0.0/8"}}

AnswerA

This ensures requests are made over HTTPS.

Why this answer

The `aws:SecureTransport` condition key in an IAM policy enforces that all requests to the S3 bucket must be made over HTTPS (TLS), ensuring encryption in transit. For an SAP application handling sensitive data, this prevents data exposure during transmission over the network. The `Bool` condition evaluates to `true` only when the request uses SSL/TLS.

Exam trap

The trap here is confusing encryption in transit (HTTPS/TLS) with encryption at rest (server-side encryption), leading candidates to select Option B, which addresses data encryption on disk, not during network transfer.

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption` enforces encryption at rest (server-side encryption with AES256), not encryption in transit. Option C is wrong because `aws:MultiFactorAuthPresent` enforces multi-factor authentication, which is an access control measure, not a transport encryption requirement. Option D is wrong because `aws:SourceIp` restricts requests based on IP address range, which controls network access but does not enforce encryption in transit.

Full explanation →

1280

MCQmedium

A company is designing an SAP HANA workload on AWS. They need to ensure high availability for the SAP HANA database with automatic failover in case of an instance failure. Which AWS service should they use to achieve this?

A.Amazon RDS for SAP HANA

B.Pacemaker cluster on Amazon EC2 with EBS multi-attach

C.AWS Elastic Beanstalk

D.Amazon Route 53 health checks with DNS failover

AnswerB

Correct. Pacemaker coordinates failover using shared storage via EBS multi-attach.

Why this answer

Pacemaker is a high-availability cluster resource manager that, when combined with Amazon EC2 and EBS Multi-Attach, enables automatic failover for SAP HANA. EBS Multi-Attach allows the same EBS volume to be attached to multiple EC2 instances in the same Availability Zone, which is required for SAP HANA's shared-storage-based scale-up or scale-out HA configurations. This setup supports the SAP HANA system replication or storage replication failover mechanism, ensuring automatic recovery upon instance failure.

Exam trap

The trap here is that candidates confuse DNS-level failover (Route 53) with true database-level high availability, or assume a managed service like RDS exists for SAP HANA, when in fact SAP HANA on AWS requires self-managed clustering with Pacemaker and EBS Multi-Attach.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for SAP HANA does not exist; AWS does not offer a managed RDS service for SAP HANA, and SAP HANA must be deployed on EC2 instances. Option C is wrong because AWS Elastic Beanstalk is a PaaS service for web applications and containers, not designed for running SAP HANA workloads or providing database-level high availability with automatic failover. Option D is wrong because Amazon Route 53 health checks with DNS failover only redirect traffic at the DNS level, which cannot handle the synchronous replication and automatic failover required for SAP HANA database instances; it lacks the cluster management and fencing capabilities needed for database-level HA.

Full explanation →

1281

MCQeasy

A company is migrating their SAP Business Warehouse (BW) system to AWS. They want to use Amazon S3 for BW near-line storage (NLS). They have set up an S3 bucket and configured the SAP BW NLS connection. However, when they test the connection, it fails. What is the MOST likely cause?

A.The S3 bucket is encrypted with AWS KMS and SAP cannot access it

B.The S3 bucket name does not match the AWS region

C.The S3 bucket is not configured for multipart uploads

D.Missing AWS Storage Gateway File Gateway setup between SAP and S3

AnswerD

SAP BW NLS needs a file interface like File Gateway.

Why this answer

SAP BW near-line storage (NLS) requires an S3-compatible interface. AWS Storage Gateway File Gateway provides a file system interface that SAP can mount and use as NLS, bridging the gap between SAP's NFS-based requirements and Amazon S3 object storage. Option A is incorrect: KMS encryption does not block SAP access; SAP can be configured to access encrypted buckets.

Option B is incorrect: S3 bucket names are globally unique, so a name mismatch with region is not possible. Option C is incorrect: Multipart uploads are enabled by default for all S3 buckets and are not a prerequisite for NLS.

Full explanation →

1282

MCQmedium

A company is designing a disaster recovery solution for a critical SAP HANA database running on AWS. The primary site is in us-east-1 and the recovery site must be in us-west-2. The database must have a Recovery Point Objective (RPO) of less than 15 minutes and a Recovery Time Objective (RTO) of less than 2 hours. Which approach meets these requirements with the least operational overhead?

A.Use AWS Backup to take snapshots of the HANA data volume every 5 minutes and copy them to us-west-2.

B.Use Amazon S3 Cross-Region Replication to copy HANA data files to us-west-2.

C.Set up AWS Database Migration Service (DMS) with ongoing replication from the primary to a secondary HANA database.

D.Configure SAP HANA System Replication (HSR) in active/standby mode between the primary and secondary regions.

AnswerD

HSR provides synchronous or near-synchronous replication with low RPO and fast failover, meeting requirements.

Why this answer

SAP HANA System Replication (HSR) in active/standby mode is the native, AWS-recommended disaster recovery solution for SAP HANA databases. It provides synchronous or asynchronous replication of the entire in-memory database to a standby instance in us-west-2, enabling an RPO of less than 15 minutes (asynchronous mode) and an RTO of under 2 hours through a controlled takeover. This approach minimizes operational overhead because it is built into SAP HANA, requires no external services, and automates log shipping and data synchronization.

Exam trap

The trap here is that candidates assume AWS-managed services like AWS Backup or DMS are always simpler, but for SAP HANA, the native HSR replication is actually the lowest-overhead option because it avoids the complexity of external tools and leverages HANA's own log shipping and takeover mechanisms.

How to eliminate wrong answers

Option A is wrong because AWS Backup snapshots of HANA data volumes taken every 5 minutes cannot guarantee an RPO of less than 15 minutes due to snapshot scheduling delays and the time required to copy snapshots across regions, plus restoring from snapshots would exceed the 2-hour RTO. Option B is wrong because Amazon S3 Cross-Region Replication copies only object-level data in S3, not live HANA database files or logs, and HANA cannot directly read/write its data files to S3 in a way that supports continuous replication with sub-15-minute RPO. Option C is wrong because AWS DMS with ongoing replication is designed for homogeneous or heterogeneous database migrations, not for SAP HANA native replication; it introduces significant overhead, latency, and complexity, and does not support the in-memory replication semantics required for HANA's ACID compliance.

Full explanation →

1283

MCQmedium

A company is migrating an SAP HANA database to AWS. The source system uses a Linux filesystem with a specific block size. After migration, the performance is lower than expected. What is the most likely cause?

A.The EC2 instance is not in a placement group

B.The Amazon EBS volume is not provisioned with enough IOPS

C.The Amazon EBS volume block size does not match the SAP HANA requirements

D.The EBS volume encryption is enabled, causing overhead

AnswerC

SAP HANA requires 4 KiB block size on AWS, mismatch reduces performance.

Why this answer

SAP HANA on AWS requires the EBS volume to have a block size that matches SAP HANA's requirements (typically 4 KiB). If the source system used a different block size (e.g., 512 bytes), performance degradation can occur. Option A (placement group) affects network latency, not block size performance.

Option B (IOPS) is provisioned, but even with sufficient IOPS, block size mismatch can cause poor performance. Option D (encryption) does not impact block size or performance significantly.

Full explanation →

1284

Multi-Selecteasy

A company is migrating an on-premises data center to AWS. The company needs to transfer 50 TB of data to Amazon S3. Which TWO AWS services can be used for this data transfer?

Select 2 answers

A.AWS Snowball Edge

B.AWS Application Migration Service (MGN)

C.AWS CloudFormation

D.AWS DataSync

E.AWS Database Migration Service (DMS)

AnswersA, D

Physical device for offline transfer.

Why this answer

AWS Snowball Edge is a petabyte-scale data transport solution that uses secure physical devices to transfer large amounts of data into and out of AWS. For a 50 TB migration, Snowball Edge provides a faster and more reliable option than internet-based transfers, as it avoids bandwidth limitations and long transfer times. The device is shipped to the customer, data is copied locally, and then returned to AWS for ingestion into Amazon S3.

Exam trap

The trap here is that candidates may confuse AWS DataSync with AWS DMS or think that AWS Application Migration Service can handle bulk file transfers, but DataSync is specifically optimized for large-scale file and object transfers to S3, while Snowball Edge is the offline alternative for very large datasets.

Full explanation →

1285

Multi-Selecthard

A company is using SAP S/4HANA on AWS and wants to optimize costs. Which THREE actions would help reduce costs without impacting performance? (Choose THREE.)

Select 3 answers

A.Implement automatic start/stop for development and test instances

B.Use AWS Compute Optimizer to right-size EC2 instances

C.Use Dedicated Hosts for better isolation

D.Replace io2 Block Express volumes with gp2 volumes

E.Purchase Reserved Instances for the production database server

AnswersA, B, E

Stopping instances when not in use reduces costs.

Why this answer

Development and test instances for SAP S/4HANA do not require 24/7 availability. Implementing automatic start/stop schedules using AWS Instance Scheduler or AWS Lambda reduces compute costs by up to 70% for these non-production instances without affecting production performance, as the instances are only active during business hours or testing windows.

Exam trap

The trap here is that candidates may confuse Dedicated Hosts with cost optimization, but Dedicated Hosts are primarily for licensing compliance and actually increase costs, while gp2 volumes are often mistakenly considered acceptable for SAP workloads despite their inability to meet the performance requirements of SAP S/4HANA.

Full explanation →

1286

MCQeasy

An SAP NetWeaver administrator needs to patch the operating system of an SAP application server running in an Auto Scaling group. The instances are behind an Application Load Balancer. What is the correct procedure to minimize downtime?

A.Use an Auto Scaling rolling update with lifecycle hooks to launch new instances from a patched AMI and gradually deregister old ones.

B.Detach one instance from Auto Scaling, patch it, test, then reattach.

C.Stop accepting traffic at the ALB, patch all instances manually, then re-enable traffic.

D.Terminate all instances at once and let Auto Scaling launch new ones with a patched AMI.

AnswerA

This minimizes downtime by replacing instances one at a time while maintaining capacity.

Why this answer

It uses Auto Scaling rolling updates with lifecycle hooks to replace instances one by one, minimizing downtime by ensuring new instances are healthy before old ones are terminated. Option B is wrong because manually detaching and patching does not leverage Auto Scaling's automation and can lead to inconsistent AMIs. Option C is wrong because stopping traffic at the ALB causes full downtime during patching.

Option D is wrong because terminating all instances at once causes full downtime, and the new instances may not be immediately available.

Exam trap

A common mistake is to think that stopping traffic to the ALB or manually patching instances is acceptable, but the correct approach uses Auto Scaling rolling updates with lifecycle hooks to automate the process and minimize downtime.

Full explanation →

1287

Multi-Selectmedium

Which TWO actions should be taken to improve the performance of an SAP HANA database running on AWS? (Choose TWO.)

Select 2 answers

A.Increase the size of the HANA instance to allocate more memory.

B.Enable termination protection on EC2 instances.

C.Use an Application Load Balancer to distribute traffic.

D.Use EBS-optimized instances to ensure dedicated network bandwidth for EBS.

E.Enable detailed monitoring on EC2 instances.

AnswersA, D

More memory improves HANA performance.

Why this answer

Options A and D are correct. Increasing memory (A) directly benefits SAP HANA which is memory-intensive. Using EBS-optimized instances (D) dedicates network bandwidth to EBS, improving I/O performance for HANA data volumes.

Option C (ALB) distributes traffic but does not help HANA performance. Option B (termination protection) and Option E (detailed monitoring) are not performance improvements.

Full explanation →

1288

Multi-Selecteasy

Which TWO AWS services can be used to provide shared storage for SAP systems running on multiple EC2 instances?

Select 2 answers

A.EC2 Instance Store

B.Amazon S3

C.Amazon EBS

D.Amazon FSx for NetApp ONTAP

E.Amazon EFS

AnswersD, E

FSx for ONTAP provides shared NFS/SMB storage.

Why this answer

Amazon FSx for NetApp ONTAP provides a fully managed, shared file system with NFS and SMB support, offering features like deduplication and snapshots ideal for SAP clustered deployments. Amazon EFS also provides a shared NFSv4.1 file system accessible from multiple EC2 instances concurrently, making it suitable for SAP workloads that require shared storage. Both services enable shared storage for SAP systems running on multiple instances, while EC2 Instance Store is ephemeral, S3 is object storage, and EBS volumes are single-instance attached.

Exam trap

A common trap is assuming that only Amazon FSx for NetApp ONTAP can serve as shared storage for SAP, but Amazon EFS is also a valid option. Candidates may incorrectly choose S3 (object storage, not a file system) or EBS (block storage attached to a single instance) or EC2 Instance Store (ephemeral). The correct choices are both EFS and FSx for ONTAP because both provide network-attached, concurrent file access to multiple EC2 instances.

Full explanation →

1289

Multi-Selecthard

An SAP administrator is troubleshooting an issue where the SAP system is not responding. The administrator checks the AWS Management Console and finds that the EC2 instance status checks are failing. Which three actions should the administrator take to recover the instance? (Choose THREE.)

Select 3 answers

A.Change the instance type

B.Check the system logs for errors

C.Attach a new EBS volume

D.Reboot the instance

E.Stop and start the instance

AnswersB, D, E

Logs help identify the cause of failure.

Why this answer

The administrator should first check the system logs (Option B) to gather diagnostic information about the failure. Rebooting the instance (Option D) can resolve transient issues without losing instance state. If the issue persists, stopping and starting the instance (Option E) migrates it to new underlying hardware, which can fix hardware-related failures.

Changing the instance type (Option A) does not address hardware issues causing status checks to fail. Attaching a new EBS volume (Option C) does not help with instance health issues.

Full explanation →

1290

Multi-Selecteasy

Which TWO of the following AWS services can be used to create and manage SAP system backups in an automated manner?

Select 2 answers

A.AWS Backup

B.AWS CloudTrail

C.AWS Systems Manager

D.AWS Lambda

E.AWS CloudFormation

AnswersA, C

AWS Backup is a fully managed backup service that can automate and centrally manage backups across AWS services, including EC2 instances and RDS databases used for SAP.

Why this answer

AWS Backup is a fully managed backup service that can automate and centrally manage backups across AWS services, including EC2 instances and RDS databases used for SAP. Option C is correct because AWS Systems Manager can automate backup tasks through its Automation capabilities, including creating snapshots and managing backup schedules for SAP systems. Option B is wrong because AWS CloudTrail is an auditing service that records API activity, not a backup service.

Option D is wrong because AWS Lambda is a compute service that can run custom code but is not a dedicated backup management service. Option E is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not for backup management.

Full explanation →

1291

Multi-Selecteasy

An SAP administrator is setting up backup for an SAP HANA database running on an EC2 instance. The database is 1 TB in size. Which TWO AWS services can be used to create a cost-effective backup strategy?

Select 2 answers

A.AWS Database Migration Service (DMS)

B.AWS Storage Gateway

C.AWS Backup

D.Amazon EBS snapshots

E.Amazon S3 with lifecycle policies

AnswersC, D

AWS Backup integrates directly with SAP HANA on EC2 via the Backint agent, enabling full, incremental, and differential backups to Amazon S3 without requiring separate backup software. This satisfies the 1 TB database size constraint by using S3’s low-cost storage tiers (e.g., S3 Standard-IA or Glacier) for long-term retention, reducing costs compared to EBS snapshots alone.

Why this answer

Options C and D are correct. AWS Backup is a managed service that can automate and centralize backups of EBS volumes, including those used by SAP HANA on EC2. Amazon EBS snapshots directly back up the volumes hosting the HANA database; incremental snapshots are cost-effective for a 1 TB database.

Option A (AWS DMS) is for database migration, not backup. Option B (AWS Storage Gateway) is for hybrid cloud storage integration, not directly for backing up HANA databases on EC2. Option E (Amazon S3 with lifecycle policies) is not directly used for HANA backups without additional tools like backint.

Full explanation →

1292

MCQmedium

A company runs SAP S/4HANA on AWS with a High Availability (HA) cluster spanning two Availability Zones (us-east-1a and us-east-1b). The cluster uses an Amazon FSx for NetApp ONTAP file system for the global transport directory. Recently, the cluster experienced a split-brain situation, leading to data corruption. The administrator wants to prevent this from recurring. The current setup uses a single FSx file system mounted on both cluster nodes. What should the administrator do to prevent split-brain?

A.Add a third cluster node in a third Availability Zone

B.Increase the memory on both EC2 instances

C.Configure a STONITH (Shoot The Other Node In The Head) mechanism using AWS Lambda

D.Set up cross-region replication for the FSx file system

AnswerC

STONITH ensures a failed node is terminated, preventing split-brain.

Why this answer

STONITH (Shoot The Other Node In The Head) is a fencing mechanism that ensures a failed node is forcefully isolated or powered off before the other node takes over, preventing split-brain scenarios in High Availability clusters. Option A is incorrect because adding a third node increases complexity without addressing the root cause of split-brain. Option B is incorrect because increasing memory does not affect cluster communication or fencing.

Option D is incorrect because cross-region replication is for disaster recovery, not for preventing split-brain.

Full explanation →

1293

MCQmedium

A company runs SAP on AWS using an SAP HANA database on an R5.8xlarge EC2 instance. The SAP application generates alerts about high disk I/O latency. Which AWS service should the administrator use to identify the root cause?

A.AWS Trusted Advisor

B.Amazon CloudWatch

C.AWS Systems Manager

D.AWS Config

AnswerB

CloudWatch collects and monitors disk I/O latency metrics for EC2 instances.

Why this answer

Amazon CloudWatch provides detailed metrics for disk I/O, including latency. Option A is wrong because AWS Trusted Advisor provides best-practice checks, not real-time performance metrics. Option C is wrong because AWS Systems Manager automates operational tasks, not performance monitoring.

Option D is wrong because AWS Config is for resource compliance.

Full explanation →

1294

MCQeasy

A company is migrating a custom CRM application to AWS. The application uses a PostgreSQL database. Which migration approach minimizes downtime?

A.Use AWS Database Migration Service (DMS) with ongoing replication (CDC).

B.Use AWS Backup to create a snapshot and restore to RDS.

C.Take a full backup of the source database, restore to RDS for PostgreSQL, and then cut over.

D.Use pg_dump to export the database and pg_restore to import into RDS.

AnswerA

DMS with CDC allows continuous sync and minimal downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing change data capture (CDC) enables near-zero downtime migration by continuously replicating changes from the source to the target until cutover. Options B, C, and D all require taking the source database offline for backup or export, resulting in significant downtime.

Full explanation →

1295

MCQmedium

An SAP Basis administrator is monitoring the health of an SAP HANA database on AWS. The administrator wants to receive alerts when the CPU utilization of the HANA instance exceeds 90% for 5 consecutive minutes. Which combination of AWS services should be used?

A.AWS X-Ray and Amazon CloudWatch Logs

B.AWS CloudTrail and AWS Lambda

C.AWS Config and Amazon Simple Email Service (SES)

D.Amazon CloudWatch metrics and CloudWatch Alarms with Amazon SNS

AnswerD

CloudWatch monitors CPU, alarms trigger on threshold, SNS sends notifications.

Why this answer

Amazon CloudWatch collects the CPU utilization metric for the HANA instance. A CloudWatch Alarm can be configured to trigger when the metric exceeds 90% for 5 consecutive minutes, and the alarm action sends a notification via Amazon SNS (e.g., email or SMS). Option A is incorrect because AWS X-Ray is for distributed tracing, and CloudWatch Logs is for log data, not for CPU metrics or alarms.

Option B is incorrect: AWS CloudTrail logs API calls and is not used for monitoring resource metrics; AWS Lambda could be used but is unnecessary for a simple threshold alarm. Option C is incorrect: AWS Config is for configuration compliance and auditing, not real-time metric monitoring; SES is an email service but not the standard integration for CloudWatch Alarms (SNS is used for notifications).

Full explanation →

1296

Multi-Selecthard

An administrator deploys the CloudFormation stack above. The EC2 instance launches but the s3fs mount fails. Which TWO actions are needed to fix the issue? (Choose two.)

Select 2 answers

A.Create an IAM role with permissions to access the S3 bucket and attach it to the EC2 instance.

B.Add an IAM instance profile to the EC2 instance resource in the CloudFormation template.

C.Modify the security group to allow outbound HTTPS traffic.

D.Ensure the S3 bucket is in the same region as the EC2 instance.

E.Add 'sudo' before the s3fs command in the UserData script.

AnswersA, B

s3fs requires IAM credentials; an instance profile provides them.

Why this answer

Options A and B are correct. The EC2 instance needs an IAM role with S3 bucket permissions (A) and the role must be attached via an IAM instance profile in the CloudFormation template (B). Option C is incorrect because outbound HTTPS is already allowed by default security group rules and S3 uses HTTPS.

Option D is incorrect because bucket region does not affect access; cross-region access works. Option E is incorrect because the UserData script runs as root, so 'sudo' is unnecessary and may cause the command to fail if sudo is not configured.

Full explanation →

1297

MCQmedium

A company is migrating its SAP Business Warehouse (BW) system to AWS. The source system runs on an on-premises IBM AIX server with an Oracle database. The target AWS environment will use SAP HANA as the database. The migration tool is SAP Software Provisioning Manager (SWPM). The company has a requirement to minimize downtime during the migration. The SAP BW system has 5 TB of data. The network bandwidth between on-premises and AWS is 1 Gbps. The migration team plans to use AWS Direct Connect for the data transfer. They estimate that the initial data load will take approximately 12 hours. However, the cutover window is limited to 8 hours. What should the migration team do to meet the cutover window?

A.Use AWS DataSync to accelerate the data transfer and then import into HANA.

B.Use SAP Landscape Transformation (SLT) to replicate data in real-time after the initial load, and then perform a final delta sync during the cutover window.

C.Perform a HANA system replication from the source to the target after the initial load.

D.Request a higher bandwidth Direct Connect connection to reduce the initial load time to under 8 hours.

AnswerB

SLT enables delta replication, reducing cutover time.

Why this answer

SAP Landscape Transformation (SLT) can replicate data in near real-time from the source Oracle database to the target SAP HANA using trigger-based replication. After the initial 12-hour data load is completed before the cutover window, SLT captures ongoing changes and applies them during the final delta sync within the 8-hour cutover window, minimizing downtime. This approach decouples the lengthy initial load from the limited cutover period, meeting the requirement.

Exam trap

The trap here is that candidates may assume increasing network bandwidth (Option D) is the only solution to meet the cutover window, overlooking the fact that the initial data load time is dominated by database export and import processing, not just network transfer speed.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for file-based data transfer, not for direct database replication into SAP HANA; it cannot handle the SAP-specific schema and delta synchronization required for a live migration. Option C is wrong because HANA system replication is a native HANA feature that requires both source and target to be SAP HANA databases, but the source is an Oracle database on IBM AIX, making this incompatible. Option D is wrong because even with increased bandwidth, the initial data load of 5 TB at 1 Gbps is constrained by the 12-hour estimate due to factors like disk I/O and database export overhead, not just network speed; requesting higher bandwidth alone cannot reduce the load time to under 8 hours.

Full explanation →

1298

MCQmedium

A company runs an SAP HANA database on an AWS EC2 instance. The database experiences high latency during peak hours. The operations team suspects network bottlenecks. Which AWS service should be used to analyze network traffic patterns and identify the source of latency?

A.VPC Flow Logs

B.AWS X-Ray

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerA

VPC Flow Logs capture IP traffic information for network interfaces, enabling analysis of traffic patterns and bottlenecks.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces, enabling analysis of traffic patterns and bottlenecks. AWS CloudTrail logs API calls, not network traffic. AWS Trusted Advisor provides best-practice checks but not detailed network analysis.

AWS X-Ray traces application requests, not network-level traffic.

Full explanation →

1299

Multi-Selecteasy

An SAP system on AWS is experiencing performance issues. The operations team wants to set up monitoring to identify bottlenecks. Which AWS service should they use to collect and analyze SAP performance metrics?

Select 1 answer

A.AWS Config

B.AWS X-Ray

C.Amazon CloudWatch

D.AWS CloudTrail

E.AWS Trusted Advisor

AnswersC

CloudWatch can collect and store SAP performance metrics such as CPU, memory, and custom application metrics.

Why this answer

Amazon CloudWatch is correct because CloudWatch can collect custom metrics from SAP and EC2 instances, enabling performance monitoring. The other options are incorrect: AWS Config tracks resource compliance, AWS X-Ray traces microservices, AWS CloudTrail logs API calls for auditing, and AWS Trusted Advisor provides recommendations but not granular performance metrics.

Exam trap

Candidates may wrongly assume CloudTrail can monitor performance because it records API calls, but performance monitoring requires metric collection tools like CloudWatch.

Full explanation →

1300

MCQmedium

An SAP administrator notices that the SAP HANA database on an r5.8xlarge instance is experiencing high swap usage. The instance has 256 GB of RAM. The SAP HANA memory usage is 200 GB. What is the most likely cause?

A.The instance memory is exhausted

B.HANA is using huge pages instead of swap

C.The swap space is too small for the HANA workload

D.Swap is disabled on the instance

AnswerC

HANA recommends swap equal to RAM; 256 GB swap is needed.

Why this answer

High swap usage on an r5.8xlarge instance with 256 GB RAM when SAP HANA is using 200 GB indicates that the system is actively paging memory to disk. SAP HANA is designed to run in-memory and should not normally use swap; however, if the swap space is too small to accommodate the overflow when memory pressure occurs, the system will exhibit high swap activity. The correct answer is C because insufficient swap space forces the kernel to thrash, causing high swap usage even when total memory is not fully exhausted.

Exam trap

The trap here is that candidates assume high swap usage always means memory is exhausted, but in AWS PAS-C01, the focus is on swap sizing best practices for SAP HANA, where even with free RAM, a small swap partition can cause excessive paging.

How to eliminate wrong answers

Option A is wrong because the instance has 256 GB of RAM and HANA is using 200 GB, leaving 56 GB free; memory is not exhausted. Option B is wrong because huge pages are a memory allocation mechanism that reduces TLB misses, not a substitute for swap; HANA uses huge pages to improve performance, but they do not cause or prevent swap usage. Option D is wrong because if swap were disabled, the system would not show high swap usage; it would instead trigger OOM (Out-Of-Memory) killer or fail allocations.

Full explanation →

1301

MCQeasy

An SAP system on AWS is experiencing intermittent connectivity issues between the application server and the HANA database. The application team confirms the database is healthy. Which AWS service should be used to analyze network traffic between the two instances?

A.AWS Config

B.AWS CloudTrail

C.VPC Flow Logs

D.Amazon CloudWatch Logs

AnswerC

VPC Flow Logs capture IP traffic information for network interfaces, enabling analysis of network traffic between instances.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces, allowing analysis of network traffic between the application server and HANA database to identify dropped packets or blocked traffic. AWS Config records resource configurations (not network traffic), CloudTrail logs API calls (not network flows), and CloudWatch Logs aggregates application and system logs (not network-level traffic).

Full explanation →

1302

MCQmedium

An SAP system running on AWS is experiencing performance issues. The operations team suspects that the Amazon EBS volumes attached to the SAP application server are not providing sufficient IOPS. Which AWS service should be used to monitor the IOPS performance of the EBS volumes?

A.AWS Config

B.AWS CloudTrail

C.Amazon Inspector

D.Amazon CloudWatch

AnswerD

Amazon CloudWatch provides detailed metrics for EBS volumes, including IOPS.

Why this answer

Amazon CloudWatch provides detailed monitoring metrics for Amazon EBS volumes, including `VolumeReadOps` and `VolumeWriteOps`, which directly measure IOPS performance. By using CloudWatch metrics, the operations team can track the actual IOPS delivered to the SAP application server and identify whether the volumes are throttled or under-provisioned.

Exam trap

The trap here is that candidates may confuse CloudTrail (auditing) or Config (compliance) with monitoring services, but only CloudWatch provides the granular, real-time performance metrics needed to diagnose EBS IOPS issues.

How to eliminate wrong answers

Option A is wrong because AWS Config is used for resource inventory, compliance auditing, and configuration change tracking, not for real-time performance monitoring of EBS IOPS. Option B is wrong because AWS CloudTrail records API calls and user activity for auditing and security analysis, not for monitoring volume-level performance metrics like IOPS. Option C is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for monitoring storage performance.

Full explanation →

1303

Matchingmedium

Match the SAP transport type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

For ABAP development objects

For configuration changes

Copies transport without original history

Moves objects between systems preserving change history

Why these pairings

Workbench transports carry repository objects (ABAP programs, dictionary objects), while Customizing transports carry client-specific configuration. Transport of Copies duplicates existing transport requests. Common confusions involve swapping these definitions.

Full explanation →

1304

Multi-Selectmedium

Which TWO of the following are valid options for implementing high availability for SAP NetWeaver on AWS?

Select 2 answers

A.Use Amazon RDS Multi-AZ for SAP Central Services.

B.Use Amazon S3 for shared storage and configure manual failover.

C.Deploy two EC2 instances across Availability Zones with a shared file system (EFS) and a cluster manager.

D.Run SAP Central Services on a single large EC2 instance.

E.Use Windows Server Failover Cluster with Amazon FSx for Windows File Server.

AnswersC, E

This is a common HA pattern for SAP.

Why this answer

Deploying two EC2 instances across Availability Zones with a shared file system (Amazon EFS) and a cluster manager (e.g., Pacemaker for Linux or Windows Server Failover Cluster) provides the high-availability architecture required for SAP NetWeaver. The cluster manager monitors the SAP Central Services (ASCS/ERS) and automatically fails over to the standby instance if the primary fails, while EFS provides a shared, highly available file system that both instances can access. This setup meets SAP's HA guidelines for a multi-AZ deployment on AWS.

Exam trap

The trap here is that candidates often confuse SAP Central Services with a database layer and incorrectly assume RDS Multi-AZ can replace the need for a clustered ASCS/ERS setup, or they think S3 can serve as a shared file system for SAP, but S3 lacks the necessary file-locking and low-latency semantics required by SAP NetWeaver.

Full explanation →

1305

MCQmedium

An SAP workload running on AWS is experiencing intermittent performance issues. The operations team suspects that a recent change to a security group is causing traffic to be dropped. Which AWS service should the team use to analyze network traffic patterns and identify the source of the issue?

A.Amazon Inspector

B.AWS Config

C.AWS CloudTrail

D.VPC Flow Logs

AnswerD

VPC Flow Logs capture IP traffic information and can be analyzed to identify dropped packets due to security group rules.

Why this answer

VPC Flow Logs capture IP traffic information and can be used to analyze network traffic patterns, helping to diagnose security group rule issues.

Full explanation →

1306

Multi-Selecteasy

Which TWO AWS services can be used to monitor the health of SAP systems and send notifications? (Select TWO.)

Select 2 answers

A.AWS Config

B.Amazon CloudWatch

C.AWS CloudTrail

D.Amazon Athena

E.Amazon Simple Notification Service (SNS)

AnswersB, E

Amazon CloudWatch monitors metrics and logs, can set alarms, and integrate with SNS for notifications. Correct.

Why this answer

Amazon CloudWatch (option B) is used to monitor metrics and logs from SAP systems, and can trigger alarms based on thresholds. Amazon SNS (option E) is used to send notifications (e.g., email, SMS) when alarms are triggered. AWS Config (A) tracks configuration changes, not health.

AWS CloudTrail (C) logs API calls for auditing. Amazon Athena (D) is a query service, not for monitoring.

Full explanation →

1307

Multi-Selectmedium

Which THREE AWS services can be used to automate the patching of SAP application servers on EC2? (Choose 3).

Select 3 answers

A.AWS Auto Scaling

B.AWS OpsWorks

C.AWS CodeDeploy

D.AWS CloudFormation

E.AWS Systems Manager Patch Manager

AnswersB, C, E

OpsWorks can manage configurations and patching.

Why this answer

AWS OpsWorks is correct because it provides a configuration management service that uses Chef or Puppet to automate the patching and lifecycle management of SAP application servers on EC2. You can define custom recipes or manifests to apply OS and application patches consistently across your SAP infrastructure, ensuring compliance and reducing manual effort.

Exam trap

The trap here is that candidates often confuse infrastructure provisioning tools like CloudFormation with operational automation tools, or assume Auto Scaling can handle patching because it can replace instances with new AMIs, but it does not patch existing instances directly.

Full explanation →

1308

Multi-Selecthard

Which THREE considerations are important when designing a SAP workload for high availability on AWS? (Select three.)

Select 3 answers

A.Use EBS Multi-Attach to share volumes between two EC2 instances

B.Deploy the SAP application across multiple Availability Zones

C.Run the SAP system on a single large instance

D.Use Amazon S3 for long-term backup storage

E.Configure SAP HANA System Replication between primary and standby

AnswersB, D, E

Deploying across multiple Availability Zones provides redundancy and failover capability, which is a core HA principle for SAP systems.

Why this answer

In SAP high availability on AWS, deploying across multiple Availability Zones (Option B) protects against AZ failures, SAP HANA System Replication (Option E) ensures database failover, and using Amazon S3 for long-term backup storage (Option D) is a critical component of disaster recovery, which is integral to overall high availability design. Option A (EBS Multi-Attach) is not a standard HA practice due to limitations with concurrent writes and cluster file system requirements; typical shared storage uses Amazon EFS or FSx. Option C (single large instance) provides no redundancy, thus is not HA.

Exam trap

The trap here is that candidates sometimes exclude backup strategies from high availability design, thinking they are separate from HA. However, backup and disaster recovery are integral to ensuring data availability in an HA architecture.

Full explanation →

1309

MCQhard

Refer to the exhibit. An administrator runs the CLI command to check the status of SAP application instances. The output shows two instances. The administrator needs to stop the running instance and start the stopped instance for a planned migration. Which command should they run?

A.aws ec2 start-instances --instance-ids i-0dcba4321hgfe8765 && aws ec2 stop-instances --instance-ids i-0abcd1234efgh5678

B.aws ec2 start-instances --instance-ids i-0abcd1234efgh5678 && aws ec2 stop-instances --instance-ids i-0dcba4321hgfe8765

C.aws ec2 start-instances --instance-ids i-0abcd1234efgh5678 && aws ec2 stop-instances --instance-ids i-0abcd1234efgh5678

D.aws ec2 stop-instances --instance-ids i-0dcba4321hgfe8765 && aws ec2 start-instances --instance-ids i-0dcba4321hgfe8765

AnswerB

This correctly starts the stopped instance and stops the running instance.

Why this answer

They need to start i-0abcd1234efgh5678 (stopped) and then stop i-0dcba4321hgfe8765 (running). Option A is wrong because the order is reversed. Option C is wrong because they start the wrong instance.

Option D is wrong because they stop the wrong instance.

Full explanation →

1310

Multi-Selectmedium

An SAP system administrator needs to perform a backup of an SAP HANA database running on EC2. Which TWO AWS services can be used together to create consistent backups? (Choose TWO.)

Select 2 answers

A.Amazon S3

B.Amazon EBS snapshots

C.AWS Backup

D.AWS CloudFormation

E.AWS Storage Gateway

AnswersB, C

EBS snapshots provide consistent backups when used with application quiescing.

Why this answer

(Amazon EBS snapshots) captures block-level data and can be made consistent for SAP HANA by using pre/post snapshot scripts. Option C (AWS Backup) can automate and orchestrate EBS snapshots, ensuring consistency and integration with HANA backup processes. Option A (Amazon S3) is an object storage service, not directly used for creating consistent database backups.

Option D (AWS CloudFormation) is for infrastructure as code and does not create backups. Option E (AWS Storage Gateway) is for hybrid cloud storage, not for database backups.

Full explanation →

1311

MCQeasy

An SAP administrator notices that the SAP application performance has degraded over the past week. The system is running on Amazon EC2 with EBS volumes. Which AWS service should be used to analyze the performance impact of the EBS volumes?

A.Amazon Inspector

B.AWS CloudTrail

C.Amazon CloudWatch

D.AWS Trusted Advisor

AnswerC

CloudWatch provides detailed metrics for EBS performance analysis.

Why this answer

(Amazon CloudWatch) is correct because it provides metrics for EBS volumes like throughput, IOPS, and latency. Option A (Amazon Inspector) is for security assessment. Option B (AWS CloudTrail) logs API calls.

Option D (AWS Trusted Advisor) provides best practices but not detailed performance analysis.

Full explanation →

1312

MCQhard

An SAP system on AWS is experiencing high latency for database queries. The administrator notices that the EBS volume used for /hana/log has a baseline IOPS of 5000 but the workload requires 8000 IOPS. What should the administrator do to resolve this?

A.Enable EBS Multi-Attach

B.Enable volume bursting

C.Migrate to an io2 Block Express volume

D.Increase the volume size to gain additional baseline IOPS

AnswerD

Increasing gp3 volume size increases baseline IOPS proportionally.

Why this answer

Increasing the volume size of a gp3 or io1/io2 EBS volume directly increases its baseline IOPS performance. For gp3 volumes, baseline IOPS scales at a rate of 3 IOPS per GiB up to 16,000 IOPS, so increasing the volume size from approximately 1667 GiB (5000/3) to at least 2667 GiB (8000/3) would raise the baseline IOPS to 8000. This ensures consistent performance for /hana/log without relying on burst credits or migrating to a different volume type.

Exam trap

The trap here is that candidates may assume enabling bursting (Option B) solves sustained high IOPS requirements, but AWS EBS bursting is designed for spiky workloads and cannot guarantee consistent performance for a constant 8000 IOPS demand, whereas increasing volume size directly raises baseline IOPS for gp3 volumes.

How to eliminate wrong answers

Option A is wrong because EBS Multi-Attach allows a single volume to be attached to multiple EC2 instances, but it does not increase the IOPS capacity of the volume itself; it is designed for clustered applications like SAP HANA scale-out, not for resolving IOPS deficits. Option B is wrong because enabling volume bursting (available on gp2 volumes) relies on burst credits that can be exhausted, and the question specifies a baseline IOPS of 5000 (typical of gp3 or io1), where bursting is not the mechanism to sustain a constant 8000 IOPS workload; gp3 volumes do not use burst credits for IOPS. Option C is wrong because migrating to an io2 Block Express volume provides higher durability and IOPS per GiB, but it does not inherently grant additional baseline IOPS without also increasing the provisioned IOPS (which incurs cost) or volume size; the question's scenario requires a simple increase in baseline IOPS, which can be achieved by resizing the existing volume.

Full explanation →

1313

MCQhard

A company is migrating a multi-tier application to AWS and wants to ensure high availability. The application has a web tier, application tier, and database tier. The database is currently running on a single on-premises server. Which migration strategy minimizes downtime and provides the HIGHEST availability for the database tier?

A.Use AWS Database Migration Service (DMS) to migrate to Amazon RDS in a single-AZ deployment, then manually take snapshots.

B.Migrate the database to a single large Amazon EC2 instance using AWS Application Migration Service.

C.Use AWS DMS to migrate the database to Amazon RDS Multi-AZ deployment.

D.Migrate to Amazon RDS with Multi-AZ deployment and use DMS for initial load.

AnswerC

DMS can perform the initial migration with minimal downtime, and RDS Multi-AZ provides synchronous standby for automatic failover, ensuring high availability.

Why this answer

AWS DMS can perform a live migration with minimal downtime by continuously replicating changes from the source database to the target Amazon RDS Multi-AZ deployment. Multi-AZ provides automatic failover to a standby replica in a different Availability Zone, ensuring the highest availability for the database tier. This combination minimizes downtime during migration and provides built-in high availability post-migration.

Exam trap

The trap here is that candidates often think migrating to a single-AZ RDS with snapshots is sufficient for high availability, but they overlook that Multi-AZ is required for automatic failover and that DMS should be used for the migration itself, not as an afterthought.

How to eliminate wrong answers

Option A is wrong because a single-AZ RDS deployment does not provide high availability; if the AZ fails, the database becomes unavailable until manual recovery from snapshots, which incurs significant downtime. Option B is wrong because migrating to a single large EC2 instance creates a single point of failure; if the instance or its underlying hardware fails, the database is unavailable, and there is no automatic failover. Option D is wrong because it reverses the recommended order: you should use DMS for the initial load and ongoing replication to a Multi-AZ target, not migrate first and then use DMS; the described approach would require an additional migration step and does not leverage DMS for minimizing downtime.

Full explanation →

1314

MCQeasy

A company is migrating an SAP NetWeaver system to AWS. The system uses SAProuter for secure network communication. What is the recommended approach to preserve the SAProuter functionality during the migration?

A.Deploy SAProuter on an EC2 instance with an Elastic IP address

B.Use an AWS NAT Gateway to route traffic

C.Establish an AWS Site-to-Site VPN connection

D.Use an AWS Application Load Balancer

AnswerA

EC2 with Elastic IP provides a stable endpoint and allows existing SAProuter rules to be reused.

Why this answer

Deploying SAProuter on an EC2 instance with an Elastic IP address preserves the existing SAProuter configuration and ensures a stable endpoint that can be referenced in firewall rules and SAP routing tables. Option B (AWS NAT Gateway) is incorrect because a NAT Gateway is used for outbound internet traffic from private subnets and does not provide a persistent inbound endpoint for SAProuter connections. Option C (AWS Site-to-Site VPN) is incorrect because while a VPN provides secure connectivity between on-premises and AWS, it does not replace the need for SAProuter, which operates at the application layer.

Option D (Application Load Balancer) is incorrect because an ALB is designed for HTTP/HTTPS traffic and cannot handle the proprietary protocol used by SAProuter.

Full explanation →

1315

MCQeasy

An organization is planning a migration of SAP applications to AWS. Which AWS service should be used to track and manage the migration project's tasks and milestones?

A.AWS Config

B.AWS Systems Manager

C.AWS Migration Hub

D.AWS CloudFormation

AnswerC

AWS Migration Hub is designed exactly for this purpose: it tracks migration tasks and milestones across multiple tools.

Why this answer

AWS Migration Hub provides a single location to track migration progress across multiple AWS and partner tools, making it the appropriate service for managing migration project tasks and milestones. AWS Config (Option A) is for compliance and resource tracking, not migration management. AWS Systems Manager (Option B) is for operational management, not migration tracking.

AWS CloudFormation (Option D) is for infrastructure as code. Therefore, Option C is correct.

Exam trap

Trap: Candidates may think AWS Systems Manager (B) is for migration because of its 'Automation' features, but it is not a migration tracking service.

Full explanation →

1316

MCQhard

An SAP application on AWS is experiencing high network latency and packet loss between the SAP application server and the SAP HANA database. The application and database are in the same AWS Region and Availability Zone. What is the most likely cause?

A.Jumbo frames are enabled on the application server but not on the database server.

B.The instances are not in a placement group.

C.TCP segmentation offloading (TSO) is enabled on the HANA database instance.

D.The Elastic Network Adapter (ENA) driver is not installed.

AnswerC

TSO can cause performance issues with HANA; it's recommended to disable it.

Why this answer

C is correct because TCP segmentation offloading (TSO) on the HANA database instance can cause the network interface to deliver oversized TCP segments to the SAP application server, which may not handle them correctly, leading to packet loss and high latency. This is a known issue in SAP on AWS environments where TSO offloads segmentation to the NIC, but if the receiving side lacks proper support or the network path has MTU mismatches, fragmentation and retransmissions occur.

Exam trap

The trap here is that candidates often assume jumbo frames or placement groups are the root cause of latency and packet loss, but the real issue is a TCP offload feature (TSO) causing segment size mismatches, which is a subtle but common problem in SAP HANA on AWS deployments.

How to eliminate wrong answers

Option A is wrong because jumbo frames (MTU 9001) are supported on both instances in the same Availability Zone, and enabling them on one but not the other would cause fragmentation only if the path MTU is mismatched, but the question states they are in the same AZ and the symptom is packet loss, not fragmentation; jumbo frames are actually recommended for SAP HANA to reduce overhead. Option B is wrong because placement groups improve network throughput and reduce latency by ensuring instances are in close proximity, but they are not required for low latency in the same AZ; the issue is packet loss, not placement. Option D is wrong because the ENA driver is essential for high-performance networking on supported instance types, but its absence would cause reduced throughput or connectivity issues, not specifically packet loss and high latency between two instances in the same AZ; the symptom described matches TSO misconfiguration.

Full explanation →

1317

MCQeasy

A company has an SAP system running on AWS with a production database on an RDS for SAP ASE instance. The operations team needs to perform a minor version upgrade of the database engine. The upgrade must be applied with minimal downtime. The team has a maintenance window scheduled for the upcoming weekend. Which action should the team take to apply the upgrade?

A.Enable auto minor version upgrade on the DB instance and let the upgrade occur during the maintenance window.

B.Manually upgrade the DB instance using the AWS Management Console immediately.

C.Modify the DB instance to specify the new engine version and apply immediately.

D.Create a new DB instance with the new version and migrate the data.

AnswerA

This minimizes downtime and is automated.

Why this answer

Setting the AutoMinorVersionUpgrade flag to true allows RDS to apply minor upgrades automatically during the maintenance window with minimal downtime. Option B is wrong because manual upgrade via the console can cause downtime if not done during a maintenance window. Option C is wrong because modifying the DB instance to a new version immediately can cause downtime.

Option D is wrong because creating a new instance and migrating requires additional setup and downtime.

Full explanation →

1318

MCQmedium

A company runs its SAP HANA database on an EC2 instance in a single Availability Zone. The system is critical and requires high availability. The current setup uses an EBS volume for data storage. During a recent failure simulation, the database took 45 minutes to recover because the EBS volume had to be reattached and the database had to replay logs. The operations team wants to reduce recovery time to less than 15 minutes. Which solution should they implement?

A.Deploy a second EC2 instance in a different Availability Zone and configure SAP HANA system replication.

B.Use AWS Backup to create more frequent snapshots.

C.Increase the provisioned IOPS of the EBS volume.

D.Move the database to Amazon S3 for faster access.

AnswerA

Deploying a second EC2 instance in a different AZ with SAP HANA system replication ensures a synchronous standby that can take over within minutes, reducing RTO to under 15 minutes.

Why this answer

Deploying a second EC2 instance in a different Availability Zone with SAP HANA system replication (synchronous replication) provides a standby database that can be promoted quickly, reducing recovery time to minutes. Option B is incorrect because more frequent snapshots still require restoring and log replay, which takes longer. Option C is incorrect because increasing provisioned IOPS improves performance but does not affect recovery time during failure.

Option D is incorrect because Amazon S3 is an object storage service not suitable for low-latency database operations like SAP HANA.

Full explanation →

1319

MCQmedium

An SAP system on AWS uses a large memory instance (x1e.32xlarge) for HANA. The administrator notices that the system is experiencing high swap usage. The HANA memory usage is at 90% of physical RAM. The instance has 4 TB of RAM, and the HANA data size is 3.8 TB. The administrator wants to avoid swap usage to maintain performance. Which solution should be implemented?

A.Migrate to a larger instance type, such as u-6tb1, with more RAM.

B.Enable swap space on the instance store volumes to offload memory pressure.

C.Optimize HANA column store compression to reduce memory footprint.

D.Increase the provisioned IOPS on the EBS volumes to reduce I/O latency.

AnswerA

More RAM eliminates need for swap.

Why this answer

The x1e.32xlarge instance has 4 TB of RAM, and with HANA using 90% (3.6 TB) and the data size at 3.8 TB, the memory is insufficient to hold the entire dataset, causing swap usage. Migrating to a u-6tb1 instance with 6 TB of RAM provides enough physical memory to accommodate the full HANA data footprint, eliminating the need for swap and maintaining performance.

Exam trap

The trap here is that candidates may think compression (Option C) is a quick fix, but they overlook that HANA's memory usage already includes compressed data, and the instance's RAM is simply too small for the dataset, making a larger instance the only viable solution.

How to eliminate wrong answers

Option B is wrong because enabling swap on instance store volumes does not resolve the root cause—it merely shifts swap to faster storage, but swap usage still degrades HANA performance due to latency. Option C is wrong because while column store compression can reduce memory footprint, the data size (3.8 TB) already exceeds physical RAM (4 TB), and compression gains are typically modest (20-30%), not enough to fit 3.8 TB into 3.6 TB of available memory. Option D is wrong because increasing EBS IOPS addresses I/O latency for storage operations, not memory pressure or swap usage, which is a RAM capacity issue.

Full explanation →

1320

MCQmedium

A company is designing a disaster recovery (DR) strategy for SAP S/4HANA on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The SAP HANA database is 2 TB and requires Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 4 hours. Which solution meets these requirements?

A.Use AWS S3 Cross-Region Replication to copy database backups every 15 minutes.

B.Configure SAP HANA System Replication (HSR) to an EC2 instance in us-west-2 with log replication in sync mode.

C.Take EBS snapshots of the HANA data volume every hour and copy them to us-west-2.

D.Use AWS Database Migration Service (DMS) to continuously replicate changes to a HANA instance in us-west-2.

AnswerB

HSR provides near real-time replication, meeting RPO.

Why this answer

SAP HANA System Replication (HSR) with synchronous log replication meets the RPO of 15 minutes and RTO of 4 hours because it continuously replicates transaction logs to the DR site in us-west-2, ensuring near-zero data loss. In sync mode, the primary waits for the secondary to acknowledge log writes, which keeps the DR database consistent and ready for takeover within minutes, well under the 4-hour RTO. This is the only option that provides continuous, database-level replication with the required recovery objectives.

Exam trap

The trap here is that candidates often confuse asynchronous backup-based solutions (like S3 CRR or EBS snapshots) with continuous replication, failing to recognize that only SAP HANA System Replication provides the sub-15-minute RPO and fast failover required for enterprise SAP DR scenarios.

How to eliminate wrong answers

Option A is wrong because S3 Cross-Region Replication (CRR) copies objects asynchronously and can take minutes to hours to propagate, making it impossible to guarantee a 15-minute RPO; additionally, it only replicates backup files, not live database changes, so recovery would require restoring from those backups, which exceeds the 4-hour RTO. Option C is wrong because EBS snapshots taken every hour cannot achieve a 15-minute RPO, and copying snapshots across regions adds further delay; moreover, restoring from snapshots requires stopping the database and replaying logs, which typically takes longer than 4 hours for a 2 TB HANA database. Option D is wrong because AWS DMS does not support SAP HANA as a target for continuous change data capture (CDC) replication in a way that maintains transactional consistency for HSR; DMS is designed for heterogeneous migrations, not for real-time HANA-to-HANA replication with the required RPO/RTO.

Full explanation →

1321

MCQmedium

A company is migrating its SAP ERP system to AWS and wants to use storage that offers the highest IOPS for the SAP HANA database. Which storage option should be used?

A.General Purpose SSD (gp3) volumes

B.Provisioned IOPS SSD (io2) volumes

C.Instance Store volumes

D.Throughput Optimized HDD (st1) volumes

AnswerB

io2 volumes provide the highest IOPS and are recommended for production SAP HANA databases.

Why this answer

For SAP HANA databases on AWS, the highest IOPS is achieved using Provisioned IOPS SSD (io2) volumes, which are designed for latency-sensitive, I/O-intensive workloads. io2 volumes offer up to 256,000 IOPS per volume with 99.999% durability, making them the optimal choice for SAP HANA's demanding performance requirements.

Exam trap

The trap here is that candidates often confuse General Purpose SSD (gp3) as sufficient for SAP HANA due to its lower cost, but fail to recognize that SAP HANA's certified configurations on AWS explicitly require io1/io2 volumes for production workloads to meet the strict IOPS and latency SLAs.

How to eliminate wrong answers

Option A is wrong because General Purpose SSD (gp3) volumes provide a baseline of 3,000 IOPS with a maximum of 16,000 IOPS per volume, which is insufficient for the high IOPS demands of SAP HANA. Option C is wrong because Instance Store volumes are ephemeral and do not persist data across instance stops or terminations, making them unsuitable for a production SAP HANA database that requires durable, persistent storage. Option D is wrong because Throughput Optimized HDD (st1) volumes are designed for throughput-intensive workloads with low IOPS (maximum 500 IOPS per volume) and are not suitable for the random I/O patterns and high IOPS requirements of SAP HANA.

Full explanation →

1322

MCQeasy

An SAP administrator needs to ensure that an EC2 instance hosting SAP HANA is rebooted automatically after a hardware failure. Which AWS feature provides this capability?

A.Placement group

B.Auto Scaling group

C.EC2 Auto Recovery

D.Elastic IP address

AnswerC

Auto Recovery automatically recovers an instance from hardware failure.

Why this answer

EC2 Auto Recovery is the correct AWS feature because it automatically recovers an EC2 instance when a hardware failure on the underlying physical host is detected. For SAP HANA workloads, this ensures the instance is rebooted on a healthy host without manual intervention, maintaining high availability for critical database operations.

Exam trap

The trap here is that candidates often confuse Auto Scaling groups (which replace instances) with EC2 Auto Recovery (which recovers the same instance), leading them to choose Auto Scaling for automatic reboot, but Auto Scaling does not reboot the same instance and can cause data loss for stateful applications like SAP HANA.

How to eliminate wrong answers

Option A is wrong because a placement group controls the physical proximity of instances (e.g., cluster placement groups for low-latency networking) but does not provide automatic recovery from hardware failures. Option B is wrong because an Auto Scaling group replaces instances based on scaling policies or health checks, but it does not reboot the same instance; it terminates and launches a new one, which would lose the SAP HANA instance's state and attached EBS volumes unless properly configured. Option D is wrong because an Elastic IP address is a static public IPv4 address that can be remapped to another instance, but it has no capability to detect or recover from hardware failures.

Full explanation →

1323

Multi-Selecteasy

Which TWO AWS services can be used to perform automated backups of an SAP HANA database running on EC2? (Choose 2.)

Select 2 answers

A.Amazon CloudWatch Events

B.Amazon S3

C.AWS CloudTrail

D.AWS Backup

E.Amazon Data Lifecycle Manager

AnswersD, E

AWS Backup supports HANA backups via pre-scripts.

Why this answer

The correct options are D (AWS Backup) and E (Amazon Data Lifecycle Manager). AWS Backup provides automated backup for SAP HANA databases through its integration with SAP HANA Backup. Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots, which can be used for backing up HANA data.

CloudWatch Events (A) can trigger responses but does not perform backups. Amazon S3 (B) is object storage, not a backup automation service. AWS CloudTrail (C) is for auditing API calls, not backups.

Full explanation →

1324

Multi-Selecthard

A company is migrating its SAP landscape to AWS and plans to use an SAP HANA multi-node scale-out configuration. Which THREE considerations are important for the network design?

Select 3 answers

A.Use a placement group to ensure nodes are in close proximity

B.Dedicate a separate network interface for HANA inter-node traffic

C.Use a NAT Gateway for inter-node traffic

D.Use public IP addresses for inter-node communication

E.Ensure low latency (less than 1ms RTT) between all nodes

AnswersA, B, E

Placement groups reduce latency between instances.

Why this answer

For SAP HANA multi-node scale-out on AWS, three key network considerations are: using a placement group to ensure all nodes are in close physical proximity (option A), dedicating a separate network interface for HANA inter-node traffic to maximize performance (option B), and ensuring less than 1ms RTT latency between all nodes to meet HANA's strict requirements (option E). Option C (NAT Gateway) is incorrect because NAT Gateways provide outbound internet access, not inter-node connectivity. Option D (public IP addresses) is unnecessary and insecure for inter-node communication; private IPs with placement groups and low latency are sufficient.

Full explanation →

1325

MCQhard

A company is migrating a large SAP S/4HANA system (8 TB total data, high I/O) from on-premises to AWS. The SAP system runs on HANA database and uses a three-tier architecture with application servers and database servers. The migration plan must minimize downtime and ensure data consistency. The company has a 10 Gbps direct connection to AWS. They have considered using AWS DMS, but the database is SAP HANA, which is not supported as a source by DMS. The migration team needs to transfer the HANA database and also the application files. They also need to replicate ongoing changes to minimize downtime. Which combination of AWS services should the migration team use? (Choose the best answer.)

A.Use AWS Application Migration Service (MGN) for the application servers. Use HANA Backint agent to back up the database to S3 and perform incremental backups for ongoing replication.

B.Use AWS DataSync to copy the entire HANA database files (data and log volumes) and application files to AWS. Then restore from the copied files.

C.Use AWS Database Migration Service (DMS) with SAP HANA as a source by installing a custom connector. Use AWS DataSync for application files.

D.Use AWS DMS for the HANA database using a homogeneous migration. Use AWS MGN for the application servers.

AnswerA

MGN can replicate the application servers with minimal downtime. HANA Backint to S3 allows full and incremental backups, enabling point-in-time recovery and minimal downtime.

Why this answer

AWS DMS does not support SAP HANA as a source, eliminating options C and D. Option B (DataSync) can copy files but lacks ongoing replication to minimize downtime. Option A uses AWS MGN to replicate application servers continuously, and HANA Backint agent to back up the HANA database to S3 with incremental backups, enabling point-in-time recovery and minimal downtime.

This combination addresses both the database and application migration requirements effectively.

Full explanation →

1326

MCQeasy

A company is running SAP on AWS and wants to automate the creation of consistent snapshots of EBS volumes attached to SAP HANA instances. Which AWS service is BEST suited for this task?

A.AWS Lambda

B.AWS CloudFormation

C.Amazon S3

D.AWS Backup

AnswerD

AWS Backup is a fully managed backup service that can automate EBS snapshots with scheduling.

Why this answer

(AWS Backup) is correct because it is a fully managed backup service that can automate scheduled backups of EBS volumes, including those attached to SAP HANA instances. Option A is wrong because AWS Lambda would require custom scripting to manage snapshot creation and retention. Option B is wrong because AWS CloudFormation is for infrastructure as code, not backup automation.

Option C is wrong because Amazon S3 is object storage, not for EBS snapshots.

Full explanation →

1327

MCQhard

An SAP administrator attaches this IAM policy to a user. Which action will the user be allowed to perform on an EC2 instance with the tag 'Environment: Production'?

A.Start the instance

B.Terminate the instance

C.Reboot the instance

D.Modify the instance type

AnswerC

Correct. The policy grants ec2:RebootInstances with a condition that the resource must have the tag 'Environment: Production'. Therefore, the user is allowed to reboot instances with that tag.

Why this answer

The IAM policy grants the ec2:RebootInstances action with a condition that the resource must have the tag 'Environment: Production'. Therefore, the user is allowed to reboot any EC2 instance that carries that tag. The other actions (start, terminate, modify instance type) are not explicitly allowed by the policy, so they are denied by default.

Exam trap

The trap here is that candidates assume the policy implicitly allows all actions on tagged instances, but IAM requires each action to be explicitly listed; the presence of a condition does not expand the allowed actions beyond those specified.

How to eliminate wrong answers

Option A is wrong because the policy does not include the ec2:StartInstances action; without an explicit Allow, the request is denied by default. Option B is wrong because the policy does not include ec2:TerminateInstances, and termination requires explicit permission. Option D is wrong because modifying the instance type requires ec2:ModifyInstanceAttribute, which is not listed in the policy.

Full explanation →

1328

MCQhard

An SAP administrator is troubleshooting a performance issue on an SAP HANA database running on an r5.24xlarge instance. The database is I/O bound during high load periods. The administrator has already verified that the EBS volumes are not saturated. What should the administrator check next?

A.Verify that EBS optimization is enabled

B.Increase the SWAP space on the instance

C.Upgrade to a compute-optimized instance like c5.24xlarge

D.Check the Elastic Network Adapter (ENA) settings and consider tuning the ring buffer size

AnswerD

Tuning ENA can improve network throughput, which may be the bottleneck for I/O bound operations.

Why this answer

On an r5.24xlarge instance, EBS optimization is always enabled by default, so verifying it again is unnecessary. The issue is I/O bound during high load, but EBS volumes are not saturated, indicating the bottleneck is likely at the network layer. The Elastic Network Adapter (ENA) ring buffer size can become overwhelmed under high network traffic, causing packet drops and increased latency, which manifests as I/O wait.

Tuning the ring buffer size (e.g., using `ethtool -G eth0 rx 4096 tx 4096`) can reduce drops and improve throughput for SAP HANA's network-intensive operations.

Exam trap

The trap here is that candidates assume EBS optimization must be manually verified or enabled, but on modern Nitro-based instances like r5, it is always active, so the real bottleneck is often the network adapter configuration.

How to eliminate wrong answers

Option A is wrong because EBS optimization is always enabled on r5.24xlarge instances by default; checking it again would not resolve an I/O performance issue when EBS volumes are not saturated. Option B is wrong because increasing SWAP space would only help with memory pressure, not I/O-bound performance; in fact, swapping can worsen I/O issues by adding disk writes. Option C is wrong because upgrading to a compute-optimized instance like c5.24xlarge would reduce CPU resources (c5 instances have fewer vCPUs and less memory than r5 instances) and is not designed for memory-intensive SAP HANA workloads; the bottleneck is network-related, not CPU-related.

Full explanation →

1329

MCQeasy

A company is migrating an on-premises application to AWS. The application requires low-latency access to a shared file system that can be mounted by multiple EC2 instances simultaneously. Which storage solution should they use?

A.Amazon Elastic File System (EFS)

B.Amazon Elastic Block Store (EBS)

C.Amazon Simple Storage Service (S3)

D.Amazon EC2 Instance Store

AnswerA

EFS is a managed NFS file system for multiple instances.

Why this answer

Amazon EFS provides a scalable, shared file system for multiple EC2 instances. Option A is correct. Option B is wrong because EBS volumes can be attached to only one instance.

Option C is wrong because S3 is object storage, not a file system. Option D is wrong because Instance Store is ephemeral.

Full explanation →

1330

MCQhard

A company runs a stateful web application on EC2 instances in an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The application maintains session state in memory on each instance. Users report that they are frequently logged out and lose their session data during scaling events. What should the company do to resolve this issue?

A.Change the scaling policy to a simple scaling policy instead of dynamic scaling

B.Enable sticky sessions (session affinity) on the Application Load Balancer

C.Modify the application to store session state in an Amazon ElastiCache cluster

D.Increase the cooldown period for the Auto Scaling group

AnswerC

ElastiCache provides a centralized session store that persists across instance terminations, ensuring session continuity during scaling events.

Why this answer

Storing session state externally in ElastiCache decouples session data from individual EC2 instances. This ensures that when instances are terminated or added during scaling events, users retain their session state regardless of which instance serves their request. ElastiCache provides a low-latency, in-memory cache that is ideal for session persistence in stateful web applications.

Exam trap

The trap here is that candidates often confuse sticky sessions (session affinity) with true session persistence, not realizing that sticky sessions only route traffic to the same instance but do not protect against instance termination during scaling events.

How to eliminate wrong answers

Option A is wrong because changing to a simple scaling policy does not address the root cause of session loss; simple scaling still terminates instances and does not preserve in-memory session state. Option B is wrong because sticky sessions (session affinity) on the Application Load Balancer only route a user to the same instance, but if that instance is terminated during scale-in, the session is lost and the user cannot be reconnected to the same instance. Option D is wrong because increasing the cooldown period only delays the next scaling activity but does not prevent session loss when instances are eventually terminated.

Full explanation →

1331

MCQeasy

A company is planning to migrate a legacy Oracle database to Amazon RDS for Oracle. The database is 500 GB and has a 24/7 workload. The company needs minimal downtime. Which AWS service should be used for the migration?

A.AWS Command Line Interface (CLI)

B.AWS Schema Conversion Tool (SCT)

C.AWS Snowball

D.AWS Database Migration Service (DMS)

AnswerD

DMS supports minimal-downtime migrations with ongoing replication.

Why this answer

AWS Database Migration Service (DMS). AWS DMS supports homogeneous migrations (Oracle to Oracle) and can perform minimal-downtime migrations by using change data capture (CDC) to replicate ongoing changes after the initial full load. Option A (AWS CLI) is not a migration service; it's a command-line tool for managing AWS services.

Option B (AWS Schema Conversion Tool) is used for converting schema when migrating between different database engines, not for data migration itself. Option C (AWS Snowball) is a physical data transfer device for large datasets, but it does not support minimal-downtime online migrations for a 24/7 workload.

Full explanation →

1332

Multi-Selecthard

Which TWO options are valid strategies for backing up an SAP HANA database running on Amazon EC2? (Choose two.)

Select 2 answers

A.Use Amazon RDS automated backups for SAP HANA.

B.Use SAP HANA Backint to back up to Amazon S3.

C.Use AWS Backup to create EBS snapshots of the HANA data volumes.

D.Use Amazon S3 Lifecycle policies to transition HANA backups to Glacier.

E.Use EC2 instance store to copy HANA data files.

AnswersB, C

Backint is the native SAP HANA backup integration.

Why this answer

SAP HANA Backint is a certified interface for integrating SAP HANA backups directly with Amazon S3, allowing native backup and restore operations without additional infrastructure. Option C is correct because AWS Backup can create crash-consistent EBS snapshots of HANA data volumes, which can be used for recovery if the database is in backup mode or if you use pre- and post-scripts to ensure consistency.

Exam trap

The trap here is that candidates confuse Amazon RDS with SAP HANA on EC2, or assume S3 Lifecycle policies can trigger backups, when in fact they only manage existing objects, and they overlook that instance store is ephemeral and unsuitable for persistent data.

Full explanation →

1333

Multi-Selectmedium

An SAP system administrator is planning to migrate an on-premises SAP ERP system to AWS. The system uses Oracle Database. Which THREE AWS services can be used to migrate the Oracle database to Amazon RDS for Oracle with minimal downtime? (Choose 3)

Select 2 answers

A.Oracle Data Guard

B.AWS Snowball Edge

C.AWS Schema Conversion Tool (SCT)

D.AWS Database Migration Service (DMS)

E.AWS CloudEndure Migration

AnswersC, D

AWS Schema Conversion Tool (SCT) converts the Oracle schema to Amazon RDS for Oracle, ensuring compatibility and can be used in conjunction with DMS for minimal downtime.

Why this answer

Options C and D are the correct AWS services for migrating an Oracle database to Amazon RDS for Oracle with minimal downtime. Option A (Oracle Data Guard) is not an AWS service; it is an Oracle database feature and does not meet the requirement of being an AWS service. Option B (AWS Snowball Edge) is for offline data transfer, not live migration.

Option E (AWS CloudEndure Migration) is for server migration, not database migration. AWS Schema Conversion Tool (SCT) ensures schema compatibility, and AWS Database Migration Service (DMS) performs continuous replication to minimize downtime.

Full explanation →

1334

MCQeasy

An SAP workload is running on an EC2 instance in a private subnet. The application needs to access an S3 bucket for backups. Which AWS service should be used to enable private connectivity without traversing the internet?

A.Internet Gateway

B.NAT Gateway

C.VPC Endpoint (Gateway)

D.AWS Site-to-Site VPN

AnswerC

Gateway VPC Endpoint provides private connectivity to S3 without internet.

Why this answer

A VPC Endpoint (Gateway) allows private connectivity between an EC2 instance in a private subnet and an S3 bucket without traversing the internet. It uses AWS’s internal network and route table entries to direct S3 traffic through the endpoint, ensuring data never leaves the AWS backbone. This is the correct choice for SAP workloads requiring secure, low-latency backups to S3.

Exam trap

The trap here is that candidates often confuse NAT Gateway with providing private connectivity, but NAT Gateway still routes traffic through the internet, whereas a VPC Endpoint keeps traffic entirely within the AWS network.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet, not private connectivity; it would expose the EC2 instance to the public internet. Option B is wrong because a NAT Gateway enables outbound internet access from a private subnet but still routes traffic through the internet, not private connectivity to S3; it also incurs additional data transfer costs. Option D is wrong because AWS Site-to-Site VPN connects on-premises networks to a VPC over the internet via IPsec tunnels, not for VPC-to-S3 private access; it is irrelevant for EC2-to-S3 communication within the same AWS region.

Full explanation →

1335

MCQeasy

A company runs SAP Business Suite on an SAP HANA database on AWS. The database uses EBS gp2 volumes. The operations team notices high latency during peak hours. The metrics show that the volume queue depth is consistently above the recommended threshold. What is the MOST cost-effective change to reduce latency?

A.Migrate from gp2 to io2 EBS volumes with the same size.

B.Modify the volume to use Provisioned IOPS (io1) with a higher IOPS value.

C.Add an additional EBS volume and stripe the volumes using LVM.

D.Increase the size of the existing EBS gp2 volume to a larger size.

AnswerD

Larger gp2 volumes have higher baseline IOPS, reducing queue depth.

Why this answer

Increasing the size of an existing gp2 volume is the most cost-effective solution because gp2 volumes have a baseline performance of 3 IOPS per GB, and they can burst up to 3,000 IOPS for volumes up to 1,000 GB. By increasing the volume size, you raise the baseline IOPS, which reduces the queue depth without incurring the higher per-GB cost of io1 or io2 volumes. This directly addresses the high latency caused by queue depth exceeding the recommended threshold during peak hours.

Exam trap

The trap here is that candidates often assume Provisioned IOPS (io1/io2) is always the solution for high latency, but they overlook the cost-effective burst capability of gp2 volumes when increased in size.

How to eliminate wrong answers

Option A is wrong because migrating to io2 volumes with the same size would increase cost significantly (io2 has a higher per-GB price and requires provisioning IOPS separately) without being necessary—gp2 can achieve the needed performance by simply increasing size. Option B is wrong because modifying to io1 with a higher IOPS value would also increase cost unnecessarily; gp2's burst mechanism can handle peak loads if the volume size is increased, and io1 is generally more expensive than gp2 for equivalent performance. Option C is wrong because adding an additional EBS volume and striping with LVM does not inherently reduce queue depth on the original volume—it distributes I/O across multiple volumes but does not increase the IOPS or throughput of the existing gp2 volume, and it adds complexity without addressing the root cause of queue depth.

Full explanation →

1336

MCQhard

Refer to the exhibit. An EC2 instance is running and has a public IP address. A security engineer needs to verify that the instance is not publicly accessible from the internet. Which additional step is required?

A.Check if the instance has a public IP.

B.Check the route table for an internet gateway.

C.Check the security group inbound rules.

D.Check the network ACL of the subnet.

AnswerC

The security group inbound rules explicitly control which traffic is allowed to reach the instance. To verify that the instance is not publicly accessible, you must check that no inbound rules allow traffic from 0.0.0.0/0 or any other public source.

Why this answer

Security group inbound rules determine whether traffic from the internet is allowed to reach the instance. Option A is incorrect because having a public IP does not guarantee accessibility; the security group must allow inbound traffic. Option B is incorrect because the route table's internet gateway entry is necessary but not sufficient; inbound rules must permit access.

Option D is incorrect because network ACLs provide stateless filtering at the subnet level, but the question specifically requires verifying that the instance is not publicly accessible, which is primarily controlled by security group inbound rules.

Full explanation →

1337

MCQeasy

A company runs SAP on AWS and uses a Multi-AZ RDS for SAP ASE database. The operations team receives an alert that the database instance failed over automatically. After the failover, the SAP application servers are unable to connect to the database. The team checks the RDS console and sees that the DB instance status is 'available' and the endpoint is the same as before. The security groups and network ACLs have not changed. What is the MOST likely reason for the connectivity issue?

A.The RDS endpoint changed after the failover.

B.The application servers have cached the old database IP address and need to flush DNS.

C.The DNS record for the RDS endpoint did not update after the failover.

D.The security group for the database instance no longer allows traffic from the application servers.

AnswerB

Correct. The application servers have cached the old IP address associated with the DNS name. Flushing the DNS cache on the application servers resolves the endpoint to the new IP, allowing connections to the new primary.

Why this answer

The RDS endpoint remains the same after a failover because the DNS record is updated to point to the new primary. However, the application servers may have cached the previous DNS resolution (old IP address). When the failover occurs, the application servers still try to connect to the old IP, which is no longer the primary.

Flushing the DNS cache on the application servers resolves this issue. Option B is correct because the database endpoint DNS name does not change, but the IP address it resolves to changes; DNS caching prevents the application from connecting. Option A is incorrect because the endpoint does not change.

Option C is incorrect because the DNS record is updated; the issue is client-side caching. Option D is incorrect because security groups remain unchanged after a failover.

Full explanation →

1338

MCQmedium

A company is migrating its SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS/ERS) instance. The solution must support automatic failover in case of an instance failure. Which AWS service should be used to manage the floating IP address required for the SAP high availability setup?

A.Amazon Route 53

B.Elastic IP address

C.Amazon CloudFront

D.AWS Global Accelerator

AnswerA

Route 53 with health checks and failover routing can manage floating IP via DNS.

Why this answer

Amazon Route 53 can be configured with health checks and DNS failover to manage the floating IP address required for SAP Central Services (ASCS/ERS) high availability. When the primary ASCS instance fails, Route 53 automatically updates DNS resolution to point to the secondary instance's IP address, enabling automatic failover without requiring a static floating IP.

Exam trap

The trap here is that candidates often assume Elastic IP addresses are the cloud equivalent of a floating IP, but Elastic IPs cannot be automatically reassigned based on health checks and require manual or scripted reattachment, making Route 53 DNS failover the correct AWS-native solution for SAP high availability.

How to eliminate wrong answers

Option B (Elastic IP address) is wrong because Elastic IPs are static public IPv4 addresses that cannot be automatically reassigned between instances during failover without manual intervention or custom scripting, and they do not support health-check-based automatic failover natively. Option C (Amazon CloudFront) is wrong because CloudFront is a content delivery network (CDN) service designed for caching and distributing static/dynamic content at edge locations, not for managing floating IPs or SAP high availability failover. Option D (AWS Global Accelerator) is wrong because it provides static anycast IP addresses for traffic routing to optimal endpoints using the AWS global network, but it does not manage floating IPs for SAP ASCS/ERS failover and lacks the DNS-level health-check-based failover mechanism required for this use case.

Full explanation →

1339

MCQhard

A company uses SAP S/4HANA on AWS with a multi-AZ deployment. The primary database is in us-east-1a and the secondary in us-east-1b. During a failover test, the secondary database becomes active but performance degrades significantly. Which configuration is most likely causing the performance issue?

A.The secondary instance is in a different VPC

B.The secondary instance is a smaller instance type than the primary

C.The secondary instance uses a different storage type (e.g., GP2 instead of Provisioned IOPS)

D.The secondary database is running a different HANA version

AnswerB

Smaller instance type cannot handle the same workload, causing performance degradation.

Why this answer

In a multi-AZ deployment, the secondary instance should match the primary's instance type to ensure consistent performance after failover. If the secondary is smaller, it lacks the CPU, memory, and network resources needed to handle the same workload, leading to performance degradation. Option A is incorrect because both instances should be in the same VPC for proper replication; being in different VPCs would break connectivity.

Option C is incorrect because different storage types (e.g., GP2 vs. Provisioned IOPS) can also cause performance issues, but the question specifically asks about the most likely cause given the scenario. Option D is incorrect because HANA version differences would cause compatibility issues, not necessarily performance degradation.

Full explanation →

1340

MCQmedium

A company is running an SAP HANA database on AWS using an i3.16xlarge instance. The database storage is configured with multiple EBS gp2 volumes in a RAID 0 stripe to meet IOPS requirements. During a workload spike, the application experiences increased latency and the database performance degrades. The CloudWatch metrics show high Average Queue Length (avg_queue_len) on the EBS volumes but not 100% utilization of the CPU. Which design change is MOST likely to resolve the performance issue?

A.Replace gp2 volumes with io2 Block Express volumes to provide consistent IOPS performance.

B.Move the database to an i3en.24xlarge instance to increase network and EBS bandwidth.

C.Enable EBS optimization on the existing instance to improve throughput.

D.Add two additional gp2 volumes to the RAID 0 stripe to increase throughput.

AnswerA

io2 Block Express offers provisioned IOPS with sustained performance, eliminating burst credit exhaustion.

Why this answer

The high Average Queue Length indicates that the EBS volumes are saturating their IOPS capacity, causing requests to queue up. gp2 volumes have a burst-bucket model that can exhaust credits under sustained high I/O, leading to throttled performance. io2 Block Express volumes provide consistent, provisioned IOPS without burst limitations, directly resolving the queuing issue without requiring instance or stripe changes.

Exam trap

The trap here is that candidates assume adding more volumes to a RAID 0 stripe will linearly increase IOPS, but they overlook that gp2 volumes have a shared burst credit pool per volume and that the bottleneck is IOPS credit exhaustion, not throughput.

How to eliminate wrong answers

Option B is wrong because moving to an i3en.24xlarge increases network and EBS bandwidth, but the bottleneck is IOPS saturation on the EBS side, not instance bandwidth or CPU; the CPU is not fully utilized, so a larger instance does not address the root cause. Option C is wrong because EBS optimization is already enabled by default on i3.16xlarge instances; toggling it would not change the IOPS ceiling of gp2 volumes. Option D is wrong because adding more gp2 volumes to the RAID 0 stripe increases total throughput (MB/s) but does not increase the per-volume IOPS credit pool or eliminate the burst-bucket exhaustion; the queue length will still spike once credits are depleted.

Full explanation →

1341

MCQmedium

A company is migrating an SAP system to AWS and needs to ensure that the migration complies with regulatory requirements for data residency. The source system is in Germany and the target AWS Region is Frankfurt. Which step should be taken to address data residency?

A.Use AWS Artifact to review and accept the Data Processing Agreement (DPA) for the Frankfurt region.

B.Enable cross-region replication to the eu-west-1 (Ireland) region for disaster recovery.

C.Use AWS Database Migration Service (AWS DMS) with ongoing replication to a secondary cluster in Frankfurt.

D.Configure AWS Config rules to prevent data from leaving the Frankfurt region.

AnswerA

AWS Artifact provides compliance documents and DPAs that address data residency requirements.

Why this answer

AWS Artifact provides access to the Data Processing Agreement (DPA) for the Frankfurt region. Reviewing and accepting this DPA ensures contractual compliance with EU data residency requirements. Option B is incorrect because enabling cross-region replication to eu-west-1 (Ireland) would move data out of Frankfurt, violating data residency.

Option C is incorrect because using AWS DMS with ongoing replication does not provide a contractual guarantee of data residency; it only enables data movement within or across regions. Option D is incorrect because AWS Config rules can monitor and alert on resource configurations but cannot enforce data residency at a contractual or legal level.

Full explanation →

1342

MCQmedium

An SAP system is running on EC2 and uses a Classic Load Balancer to distribute traffic to web dispatchers. The operations team notices that the load balancer is not distributing traffic evenly. What is the most likely cause?

A.Cross-zone load balancing is disabled.

B.Connection draining is not enabled.

C.The load balancer uses a flow hash algorithm that may not evenly distribute requests with many long-lived connections.

D.The health check interval is set too high.

AnswerC

Classic Load Balancer's flow hash can lead to uneven distribution for persistent connections.

Why this answer

Classic Load Balancers use a flow hash algorithm based on the source IP, destination IP, source port, destination port, and protocol to route requests. This algorithm can cause uneven distribution when many long-lived connections (such as SAP GUI or HTTP persistent connections) are present, because the same flow hash consistently maps to the same backend instance, leading to imbalance. This is the most likely cause given the scenario of an SAP system with web dispatchers.

Exam trap

The trap here is that candidates often assume uneven traffic distribution is always due to misconfigured health checks or cross-zone settings, but the real issue is the flow hash algorithm's behavior with long-lived connections, which is a specific characteristic of Classic Load Balancers.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing affects distribution across Availability Zones, not the evenness of traffic among instances within the same zone; disabling it would cause traffic to only go to instances in the same zone as the client, but the question describes uneven distribution generally, not a zone-level issue. Option B is wrong because connection draining is a feature that allows in-flight requests to complete before an instance is deregistered, and it does not influence how traffic is distributed during normal operation. Option D is wrong because a high health check interval would cause slower detection of unhealthy instances, but it would not cause uneven distribution of traffic among healthy instances; the load balancer would still route traffic to all healthy instances based on the flow hash algorithm.

Full explanation →

1343

MCQhard

During a disaster recovery test, an SAP administrator finds that the SAP application cannot connect to the replicated HANA database in the DR region. The replication is done using SAP HANA System Replication. What is the MOST likely cause?

A.The replication link is down because the source database is not accessible.

B.The application connection string still points to the primary database endpoint.

C.The HANA database in the DR region is not synchronized due to network latency.

D.The application server needs to be restarted to recognize the new database.

AnswerB

After failover, the application must use the DR database endpoint.

Why this answer

In SAP HANA System Replication, the database is replicated to the DR region, but the SAP application's connection string must be updated to point to the DR database endpoint. Without this update, the application will still try to connect to the primary database endpoint, which is not accessible during the DR test. Option A is incorrect because the replication link being down does not cause the application connection failure; the issue is the connection string.

Option C is incorrect because even if the DR database is not fully synchronized (which is typical for async replication), the application could still connect to the DR database if the connection string were correct. Option D is incorrect because simply restarting the application server does not update the connection string; the endpoint configuration needs to be changed.

Full explanation →

1344

MCQhard

A company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances running a web server. The web servers write logs to an Amazon EFS file system mounted across all instances. The operations team reports that the web application is experiencing intermittent high latency and timeouts. Monitoring shows that the ALB's target response time is normal, but the application's internal processing time is high. Further investigation reveals that the EFS performance metrics show high 'BurstCreditBalance' and 'PercentIOLimit' during the latency spikes. The EFS file system is configured with 'Bursting' throughput mode. The team needs to resolve the latency issue with minimal cost. What should they do?

A.Migrate the log files to Amazon S3 and use S3 Transfer Acceleration for writes.

B.Switch the EFS throughput mode to Provisioned Throughput to guarantee higher performance.

C.Add more EC2 instances to the Auto Scaling group to distribute the I/O load.

D.Increase the size of the EFS file system to increase the baseline throughput and burst credits.

AnswerD

Larger EFS file systems have higher baseline throughput and accumulate more burst credits, reducing I/O wait.

Why this answer

Increasing the size of an EFS file system in Bursting mode raises its baseline throughput and burst credit accumulation rate. The high BurstCreditBalance and PercentIOLimit indicate the file system is exhausting its burst credits and hitting its I/O limit, causing throttling and latency. A larger EFS volume provides a higher baseline throughput, reducing reliance on burst credits and smoothing performance without additional cost for Provisioned Throughput.

Exam trap

The trap here is that candidates assume 'Bursting' mode is always sufficient and look to add compute capacity (Option C) or change storage type (Option A), when the real issue is that the file system is too small to sustain the workload's I/O demands, and resizing it is the most cost-effective fix.

How to eliminate wrong answers

Option A is wrong because migrating logs to S3 with S3 Transfer Acceleration does not address the EFS I/O bottleneck; it changes the storage target but the web servers still write to EFS, and S3 Transfer Acceleration is for accelerating uploads over long distances, not for reducing local file system latency. Option B is wrong because switching to Provisioned Throughput would increase cost unnecessarily; the issue is that the current Bursting mode is insufficient due to small file system size, and Provisioned Throughput is a more expensive solution when simply resizing the file system can resolve the problem at lower cost. Option C is wrong because adding more EC2 instances would increase the aggregate I/O load on the same EFS file system, worsening the contention and latency, not resolving it.

Full explanation →

1345

Multi-Selectmedium

Which TWO options are best practices for securing SAP systems on AWS?

Select 2 answers

A.Enable encryption at rest for EBS volumes and RDS databases

B.Use the AWS account root user for daily administration

C.Place SAP application servers in a public subnet with direct internet access

D.Store SAP transport files in a public S3 bucket

E.Use security groups to control traffic to SAP instances

AnswersA, E

Encryption protects data at rest.

Why this answer

Enabling encryption at rest for EBS volumes and RDS databases ensures that SAP data stored on disk is protected using AWS Key Management Service (KMS) or a customer-managed key. This is a fundamental security best practice to meet compliance requirements and protect sensitive SAP data from unauthorized access if the underlying storage is compromised.

Exam trap

The trap here is that candidates often confuse the root user's power with convenience, or assume public subnets are acceptable for SAP application servers if a security group is applied, but the exam strictly requires private subnets and no direct internet exposure for production SAP systems.

Full explanation →

1346

MCQmedium

An organization is migrating a legacy Windows-based .NET application to AWS. The application currently uses IIS and SQL Server on a single server. They want to minimize changes to the application code. Which migration strategy is most appropriate?

A.Replatform by moving to Amazon RDS for SQL Server and Elastic Beanstalk

B.Rehost the application on Amazon EC2 with the same OS and database

C.Refactor the application to use a microservices architecture

D.Repurchase by moving to a SaaS-based application

AnswerB

Rehosting moves the workload as-is, minimizing code changes.

Why this answer

Rehosting (lift-and-shift) involves moving the application to AWS as-is, typically using Amazon EC2, which minimizes code changes. Option B is correct. Option A (Replatform) would involve moving to Amazon RDS for SQL Server and Elastic Beanstalk, which may require some configuration changes.

Option C (Refactor) would require significant code changes to adopt microservices. Option D (Repurchase) means buying a new SaaS product, which is not minimal change.

Full explanation →

1347

MCQhard

Refer to the exhibit. An SAP application load balancer (ALB) is configured with the CloudFormation snippet. The ALB is not distributing traffic to the EC2 instances. What is the most likely cause?

A.The security group does not allow inbound traffic

B.The target type is instance but the instances are not registered

C.The target group is not associated with the load balancer

D.The load balancer scheme is internet-facing but instances are in private subnets

AnswerC

A listener is needed to associate the target group; missing listener prevents traffic distribution.

Why this answer

The snippet does not include a listener for the ALB. Without a listener, the ALB cannot accept traffic. The target group is defined but not associated with the ALB via a listener rule.

The scheme is internet-facing, which is correct. The security group may allow traffic, but no listener exists.

Full explanation →

1348

MCQhard

An SAP system on AWS is experiencing slow performance for batch jobs. The jobs are I/O intensive and write large amounts of data to EBS volumes. CloudWatch metrics show that the EBS volumes are reaching their throughput limits. Which action will MOST effectively improve performance?

A.Add read replicas to offload read traffic.

B.Increase the size of the EBS volumes to improve baseline throughput.

C.Use Multi-AZ for the database.

D.Move the data to instance store volumes.

AnswerB

Larger gp2/gp3 volumes have higher throughput.

Why this answer

Increasing the size of EBS volumes directly improves their baseline throughput performance because EBS throughput scales with volume size. For gp2 volumes, baseline throughput is 128 MiB/s for volumes up to 170 GiB, then increases by 0.5 MiB/s per GiB beyond that; for gp3, baseline throughput is 125 MiB/s regardless of size, but you can provision additional throughput. Since the batch jobs are I/O-intensive and hitting throughput limits, larger volumes provide higher throughput without requiring architectural changes.

Exam trap

The trap here is that candidates may confuse throughput limits with IOPS limits or assume that adding read replicas (Option A) or Multi-AZ (Option C) can improve write performance, when in fact they only address read scaling or availability, not the underlying EBS throughput bottleneck.

How to eliminate wrong answers

Option A is wrong because read replicas offload read traffic from the primary database, but the issue is EBS throughput limits for I/O-intensive batch jobs writing large amounts of data, not read-heavy database queries. Option C is wrong because Multi-AZ provides high availability and failover support, not increased throughput or performance for EBS volumes. Option D is wrong because instance store volumes provide temporary, block-level storage that is physically attached to the host, but they are ephemeral (data is lost on instance stop/termination) and not suitable for persistent SAP data; moreover, they do not address the throughput limit issue directly and may introduce data durability risks.

Full explanation →

1349

MCQhard

A company is migrating a large SAP ERP system to AWS. The system has multiple interfaces with external systems using RFC connections. During the migration, the team needs to minimize changes to the external systems' configurations. What approach should be taken for the RFC connections?

A.Change the external systems to use DNS names instead of IP addresses

B.Use the private IP address of the EC2 instance

C.Use a NAT Gateway to route the RFC traffic

D.Assign an Elastic IP address to the SAP application server

AnswerD

Assigning an Elastic IP address ensures that the public IP address remains the same after migration, so external systems do not need to update their RFC connection configurations.

Why this answer

Assigning an Elastic IP address to the SAP application server ensures that the public IP address remains the same after migration, so external systems do not need to update their RFC connection configurations. Option A (changing external systems to use DNS names) would require changes to external systems, which contradicts the goal of minimizing changes. Option B (using the private IP) would not be reachable from external systems over the internet.

Option C (NAT Gateway) is used for outbound traffic, not for inbound RFC connections. Option D (Elastic IP) correctly provides a static public IP address for inbound RFC traffic.

Full explanation →

1350

MCQmedium

An SAP system is deployed on AWS using an Auto Scaling group of EC2 instances for the SAP application server layer. The application servers are stateless. The company wants to ensure that when a new instance is launched, it automatically registers with the SAP Web Dispatcher. The Web Dispatcher is configured with an Application Load Balancer (ALB). What is the best way to achieve automatic registration?

A.Use Amazon CloudWatch Events to trigger an AWS Lambda function that registers the instance.

B.Use AWS Systems Manager State Manager to run a registration script on the instance.

C.Configure the EC2 instance's user data to run a script that registers with the Web Dispatcher.

D.Attach the Auto Scaling group to an ALB target group.

AnswerD

Auto Scaling automatically registers instances with the target group.

Why this answer

Attaching the Auto Scaling group directly to an ALB target group ensures that any instance launched by the Auto Scaling group is automatically registered with the ALB. Since the SAP Web Dispatcher is configured behind the ALB, this automatically registers the instance with the Web Dispatcher. Option C is incorrect because user data scripts can be used for initial configuration, but relying on them for registration is less reliable and does not integrate with the ALB's health checks.

Option A is incorrect because using CloudWatch Events and Lambda adds unnecessary complexity and latency. Option B is incorrect because AWS Systems Manager State Manager is designed for maintaining consistent state, not for immediate registration upon launch.

Full explanation →

Page 18 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →