Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 1351–1425

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 19 of 22

1351

MCQeasy

A company plans to migrate their SAP HANA database to AWS. They require the highest availability with automatic failover in case of an AZ failure. Which architecture should they use?

A.Multi-AZ with HANA System Replication in sync mode and automatic failover.

B.Single AZ with HANA System Replication to a standby in the same AZ.

C.Single AZ with daily backups to Amazon S3.

D.Multi-AZ with HANA System Replication in async mode and manual failover.

AnswerA

Provides automatic failover across AZs.

Why this answer

It meets the requirement for highest availability with automatic failover in case of an AZ failure. HANA System Replication (HSR) in synchronous mode ensures zero data loss (RPO=0) by committing transactions only after they are replicated to the standby, and when combined with Multi-AZ deployment, it provides automatic failover across Availability Zones. This architecture is the AWS-recommended pattern for SAP HANA high availability, leveraging the AWS Multi-AZ concept with HSR's built-in automatic takeover capability.

Exam trap

The trap here is that candidates often confuse 'high availability' with 'disaster recovery' and select a backup-only option (C) or a Single AZ option (B), failing to recognize that automatic failover across AZs requires both Multi-AZ deployment and synchronous replication with automated takeover.

How to eliminate wrong answers

Option B is wrong because Single AZ deployment cannot protect against an AZ failure; if the entire AZ goes down, both primary and standby are lost. Option C is wrong because daily backups to Amazon S3 provide disaster recovery (point-in-time recovery) but do not offer automatic failover or high availability; recovery time can be hours, not seconds. Option D is wrong because HSR in async mode may result in data loss (RPO > 0) during a failover, and manual failover does not meet the 'automatic failover' requirement stated in the question.

Full explanation →

1352

MCQhard

A company is migrating an SAP BusinessObjects (BO) system to AWS. The system includes a large number of reports and users. What is the recommended approach to migrate the SAP BO repository?

A.Reinstall SAP BO on AWS and manually copy the report files

B.Use AWS Database Migration Service (DMS) to replicate the repository database

C.Use the SAP BusinessObjects Promotion Management tool to export and import the repository

D.Manually extract the repository files from the database and copy them to AWS

AnswerC

Promotion Management is designed for this purpose.

Why this answer

SAP BusinessObjects provides a built-in Promotion Management tool for exporting and importing the repository, ensuring a clean migration of reports, users, and other content. Option A is incorrect because reinstalling and manually copying report files is error-prone and misses the repository structure. Option B is incorrect because AWS DMS is designed for database migration, not for SAP BO application-level content.

Option D is incorrect because manual extraction is not recommended and lacks integrity checks.

Full explanation →

1353

MCQmedium

A company is migrating its SAP HANA database to AWS. The SAP HANA database requires high throughput and low latency for data persistence. Which AWS storage solution should be used for the HANA data volume to meet performance requirements?

A.Use Amazon FSx for Lustre as primary persistent storage for HANA data.

B.Use Provisioned IOPS SSD (io1 or io2) EBS volumes for the data volume.

C.Use General Purpose SSD (gp2) EBS volumes for the data volume.

D.Use Throughput Optimized HDD (st1) EBS volumes for the data volume.

AnswerB

io1/io2 volumes provide consistent low latency and high IOPS for HANA.

Why this answer

SAP HANA is an in-memory database that relies on persistent storage for data volume writes during savepoints and log writes. Provisioned IOPS SSD (io1 or io2) EBS volumes deliver consistent, low-latency performance with configurable IOPS, which is required to meet SAP HANA's strict throughput and latency SLAs. AWS specifically certifies io1/io2 EBS volumes for SAP HANA data volumes in production environments.

Exam trap

The trap here is that candidates often confuse high-throughput file systems like FSx for Lustre with block storage requirements for databases, or assume that gp2's burst capability is sufficient for sustained SAP HANA workloads without considering the burst credit exhaustion under continuous load.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Lustre is a high-performance file system designed for HPC and batch processing, not for persistent database storage; it lacks the block-level consistency and durability guarantees required for SAP HANA data volumes. Option C is wrong because General Purpose SSD (gp2) EBS volumes use a burst-bucket model that cannot sustain high IOPS under continuous load, leading to latency spikes during savepoints. Option D is wrong because Throughput Optimized HDD (st1) volumes are optimized for sequential throughput, not random I/O, and have high latency that violates SAP HANA's performance requirements.

Full explanation →

1354

MCQeasy

During a migration of an SAP system to AWS, the SAP application team reports that batch jobs are failing with an error 'RFC connection refused'. The on-premises system and AWS are connected via a VPN. What is the MOST likely cause?

A.The security group attached to the SAP instance does not allow inbound RFC traffic

B.The VPN bandwidth is insufficient causing timeouts

C.The network ACLs are blocking the RFC ports

D.The route table does not have a route to the on-premises network

AnswerA

Security group rules control inbound traffic to the instance.

Why this answer

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic. If the security group for the SAP instance does not allow inbound RFC traffic (e.g., on ports 3300 or 3200 for SAP RFC), connections will be refused. Option B (VPN bandwidth) would cause timeouts or slow transfers, not immediate connection refusal.

Option C (network ACLs) operates at the subnet level and stateless; they could block RFC ports, but since the error is specifically 'RFC connection refused' and it's a common misconfiguration, security groups are more likely the culprit. Option D (route table) is for routing traffic between networks; if there were no route to on-premises, traffic would not reach AWS at all, rather than being refused.

Full explanation →

1355

Multi-Selecthard

Which THREE considerations are important when designing an SAP HANA multi-node (scale-out) deployment on AWS? (Choose three.)

Select 3 answers

A.Use a cluster placement group for low-latency network.

B.Use EBS Multi-Attach to share volumes between nodes.

C.The number of nodes is limited by the instance type's network and EBS performance.

D.Use a single large EC2 instance with many vCPUs.

E.Each node should have its own EBS volume for data.

AnswersA, C, E

Placement groups ensure low latency between nodes.

Why this answer

A cluster placement group provides low-latency network connectivity between EC2 instances by placing them in a single Availability Zone with non-blocking, fully bisectional bandwidth. For SAP HANA multi-node (scale-out) deployments, this low-latency, high-throughput network is essential for the internal communication between nodes, as HANA relies on fast inter-node data exchange for distributed queries and replication.

Exam trap

The trap here is that candidates may confuse EBS Multi-Attach with shared storage solutions like Amazon EFS or FSx, or mistakenly think that a single large instance can replace a multi-node deployment, but SAP HANA scale-out explicitly requires multiple instances with dedicated storage and low-latency networking.

Full explanation →

1356

MCQhard

An SAP system on AWS is experiencing high latency in database transactions. The SAP HANA database is running on an r5.24xlarge instance with GP3 EBS volumes. CloudWatch metrics show high Write IOPS but low Read IOPS. The application team expects high write throughput. What should be changed to improve write performance?

A.Increase the EBS read throughput

B.Use a larger instance type like r6i.32xlarge

C.Increase the GP3 volume IOPS

D.Switch to io2 Block Express volumes with higher IOPS

AnswerD

io2 provides consistent high IOPS for write-heavy workloads.

Why this answer

The workload requires high write throughput, and GP3 volumes have a baseline IOPS of 16,000 with a maximum of 16,000 IOPS at no additional cost, but burst credits are limited. io2 Block Express volumes offer up to 256,000 IOPS with consistent sub-millisecond latency, which directly addresses the high write IOPS demand without throttling. This aligns with SAP HANA's requirement for predictable, high-performance storage for database transactions.

Exam trap

The trap here is that candidates assume increasing GP3 IOPS (Option C) is sufficient, but they overlook that GP3's maximum IOPS (16,000) and throughput limits may still be inadequate for sustained high write throughput, whereas io2 Block Express is the only option that guarantees both high IOPS and low latency for SAP HANA workloads.

How to eliminate wrong answers

Option A is wrong because increasing EBS read throughput does not address high write IOPS; read throughput is irrelevant to write performance. Option B is wrong because upgrading to a larger instance type like r6i.32xlarge increases compute and memory but does not resolve EBS volume-level IOPS limitations; the bottleneck is storage, not instance capacity. Option C is wrong because GP3 volumes have a maximum IOPS of 16,000 (with additional cost up to 16,000 IOPS), which may still be insufficient for high write throughput; GP3 also has a throughput limit of 1,000 MiB/s, and increasing IOPS alone does not guarantee sustained write performance under heavy load.

Full explanation →

1357

MCQeasy

A manufacturing company is planning to migrate a legacy inventory application from a data center to AWS. The application runs on Windows Server 2012 R2 and uses a SQL Server 2014 database. The application requires low-latency access to a shared file system for storing CAD drawings. The current on-premises environment uses a SAN-based storage array for the database and a Windows File Server for the CAD files. The company wants to minimize operational overhead and avoid refactoring the application. The migration must be completed within 3 months. The company has already established a Direct Connect connection between the data center and AWS. Which migration strategy should the company use?

A.Use AWS App2Container to containerize the Windows application and deploy it on Amazon ECS. Migrate the database to Amazon RDS for SQL Server. Use Amazon EFS for the CAD file share.

B.Use AWS Database Migration Service (DMS) to migrate the SQL Server database to Amazon RDS for SQL Server. Use AWS Server Migration Service (SMS) to replicate the Windows server to an EC2 instance. Use AWS Storage Gateway file gateway to present the CAD files from Amazon S3.

C.Use AWS Application Migration Service (AWS MGN) to replicate the Windows server to an EC2 instance. Migrate the SQL Server database using native backup and restore. Use Amazon S3 with a VPC endpoint for the CAD file share, and mount S3 as a network drive using an S3 file gateway.

D.Use AWS Application Migration Service (AWS MGN) to replicate the on-premises Windows server to an EC2 instance. Migrate the SQL Server database using native backup and restore. Use Amazon FSx for Windows File Server to replace the on-premises file server, and mount the file share via SMB.

AnswerD

This minimizes refactoring, uses a managed file service, and supports SMB protocol required by the application.

Why this answer

It uses AWS Application Migration Service (AWS MGN) to lift-and-shift the Windows Server 2012 R2 instance without refactoring, native backup/restore for SQL Server 2014 to minimize complexity, and Amazon FSx for Windows File Server to provide a fully managed SMB file share with low-latency access for CAD drawings. This approach meets the 3-month timeline, avoids application refactoring, and reduces operational overhead by replacing the SAN and Windows File Server with managed AWS services.

Exam trap

The trap here is that candidates often choose Amazon EFS or S3 File Gateway for file shares, but they fail to recognize that the legacy Windows application requires SMB protocol and Windows-native features, which only Amazon FSx for Windows File Server provides without refactoring or additional complexity.

How to eliminate wrong answers

Option A is wrong because App2Container requires containerizing the application, which involves refactoring and does not meet the 'avoid refactoring' requirement; also, Amazon EFS uses NFS, not SMB, so it cannot natively replace a Windows File Server for CAD drawings without additional configuration. Option B is wrong because AWS Server Migration Service (SMS) has been deprecated and is not recommended for new migrations; additionally, AWS Storage Gateway file gateway introduces latency for low-latency CAD file access compared to a native SMB file share. Option C is wrong because mounting Amazon S3 as a network drive via S3 File Gateway uses NFS or SMB but incurs higher latency and lacks the native Windows file-sharing features (e.g., SMB protocol, Windows ACLs) required for CAD drawings; also, using a VPC endpoint for S3 does not provide a file-system interface.

Full explanation →

1358

Multi-Selecteasy

A company is migrating an SAP system to AWS. They want to use an AWS service to automate the deployment of SAP applications according to best practices. Which TWO services can be used for this purpose? (Choose TWO.)

Select 2 answers

A.AWS OpsWorks

B.AWS Elastic Beanstalk

C.AWS CodeDeploy

D.AWS CloudFormation

E.AWS Launch Wizard

AnswersD, E

Can deploy SAP infrastructure as code.

Why this answer

AWS Launch Wizard and AWS CloudFormation can automate SAP deployments according to best practices. Option A (AWS OpsWorks) is for configuration management, not SAP-specific deployment. Option B (AWS Elastic Beanstalk) is for general web applications, not SAP.

Option C (AWS CodeDeploy) is for application deployment, not infrastructure provisioning. Options D and E are correct.

Full explanation →

1359

Multi-Selecthard

Which THREE services can be used together to implement a disaster recovery solution for SAP S/4HANA on AWS with a recovery time objective (RTO) of less than 1 hour and a recovery point objective (RPO) of less than 15 minutes?

Select 3 answers

A.SAP HANA System Replication across regions.

B.AWS CloudEndure Disaster Recovery.

C.AWS Database Migration Service (DMS) for ongoing replication.

D.Amazon S3 Glacier for long-term backups.

E.Amazon S3 for storing HANA log backups.

AnswersA, B, E

HSR provides low RPO.

Why this answer

SAP HANA System Replication (HSR) across AWS regions provides synchronous or near-synchronous replication of HANA databases, enabling an RPO of less than 15 minutes and an RTO under 1 hour when combined with automated failover. This is the primary mechanism for achieving low RPO/RTO in SAP S/4HANA disaster recovery on AWS.

Exam trap

The trap here is that candidates often confuse AWS DMS with native SAP HANA replication, but DMS does not support SAP HANA as a source for ongoing replication with low RPO, and Glacier's retrieval latency makes it unsuitable for sub-1-hour RTO.

Full explanation →

1360

MCQeasy

A company is migrating its SAP environment to AWS and wants to ensure that the migration complies with SAP's software licensing requirements. What is the most important consideration regarding SAP license mobility?

A.Use SAP's Bring Your Own License (BYOL) program for Amazon RDS

B.Ensure that the AWS account is linked to SAP's licensing portal

C.Purchase a new SAP license from the AWS Marketplace

D.Confirm that the SAP license agreement allows running on AWS and that the target instance types are SAP certified

AnswerD

SAP license mobility requires certification and support.

Why this answer

SAP license mobility allows customers to run their existing SAP licenses on AWS, but only if the license agreement explicitly permits it. Additionally, the target AWS instance types must be SAP certified to ensure compliance with SAP's technical requirements. Option D is correct because it addresses both contractual and technical prerequisites.

Option A is incorrect because Amazon RDS does not support SAP BYOL; SAP databases on AWS use EC2. Option B is incorrect because linking AWS account to SAP's portal is not a licensing requirement. Option C is incorrect because purchasing a new license from AWS Marketplace is not necessary for license mobility.

Full explanation →

1361

MCQeasy

A company is running SAP on AWS and wants to automate the deployment of new SAP application servers. The company uses AWS CloudFormation to manage infrastructure. Which AWS service should they use to run custom scripts during the CloudFormation stack creation to configure the SAP application?

A.AWS Systems Manager Run Command

B.AWS CodeDeploy

C.AWS Lambda

D.AWS OpsWorks

AnswerC

Lambda can be used as a custom resource in CloudFormation to run scripts.

Why this answer

AWS CloudFormation supports custom resources, which can invoke AWS Lambda functions to run custom scripts during stack creation, making it suitable for configuring SAP applications. Option A is wrong because AWS Systems Manager Run Command is not directly integrated into CloudFormation as a custom resource; it can be invoked via Lambda or other means but not natively. Option B is wrong because AWS CodeDeploy is used for code deployments to existing instances, not for initial configuration during CloudFormation stack creation.

Option D is wrong because AWS OpsWorks is a configuration management service using Chef/Puppet, not directly integrated with CloudFormation for running custom scripts.

Full explanation →

1362

MCQhard

Refer to the exhibit. A CloudFormation stack creation failed with the message 'WaitCondition received failed signal'. What is the most likely cause?

A.The security group rules are blocking the cfn-signal communication

B.The stack creation timed out after 1 hour

C.The script executed via cfn-signal failed to complete successfully

D.The EC2 instance type is not supported in the region

AnswerC

The WaitCondition expects a success signal; failure indicates script error.

Why this answer

The `WaitCondition` resource in CloudFormation is designed to pause stack creation until it receives a success signal from a resource, typically an EC2 instance running a cfn-init script. The 'WaitCondition received failed signal' error indicates that the signal sent was explicitly a failure signal (e.g., via `cfn-signal --exit-code 1`), not that the signal was lost or blocked. This most commonly occurs when the script executed by cfn-init or a user-data script encounters an error and exits with a non-zero exit code, causing cfn-signal to send a failure signal to the WaitCondition.

Exam trap

The most common pitfall is confusing a timeout (no signal received) with a failed signal (signal with non-zero exit code). Candidates often assume network issues like security groups blocking cfn-signal, but the error explicitly states a failed signal was received, indicating a script error on the instance.

How to eliminate wrong answers

Option A is wrong because if security group rules were blocking cfn-signal communication, the WaitCondition would likely time out (never receive a signal) rather than receive a failed signal; the error message explicitly states a failed signal was received, not that it was missing. Option B is wrong because a stack creation timeout would produce a different error message (e.g., 'WaitCondition timed out' or 'Stack creation failed due to timeout'), not a 'received failed signal' error. Option D is wrong because an unsupported EC2 instance type would cause a stack creation failure with an error like 'Instance type not supported' during resource creation, not a WaitCondition signal failure.

Full explanation →

1363

Multi-Selecthard

Which THREE of the following are best practices for operating an SAP HANA database on AWS in a production environment?

Select 3 answers

A.Configure a swap partition on the instance store.

B.Ensure the EC2 instance is EBS-optimized.

C.Separate data and log files onto different EBS volumes.

D.Use a single large EBS volume for both data and logs to simplify management.

E.Use multiple EBS volumes striped with LVM or RAID 0 for data and log files.

AnswersB, C, E

EBS-optimized instances provide dedicated network bandwidth to EBS.

Why this answer

EBS-optimized instances provide dedicated bandwidth for EBS, which is essential for HANA workloads. Option C is correct because separating data and log files onto different EBS volumes is a best practice recommended by SAP to improve performance and manageability. Option E is correct because using multiple EBS volumes striped with LVM or RAID 0 aggregates IOPS and throughput, providing the high performance required for production HANA databases.

Option A is incorrect because configuring a swap partition on the instance store is not recommended for HANA; HANA relies on memory and swap usage is discouraged. Option D is incorrect because using a single large EBS volume for both data and logs can lead to performance bottlenecks and is not a best practice.

Full explanation →

1364

MCQmedium

An SAP Basis administrator needs to monitor the health of SAP application servers running on EC2. The administrator wants to receive alerts when a server becomes unreachable or when critical SAP processes stop. Which AWS service should be used to create a custom dashboard and set up alarms?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Config

D.AWS Trusted Advisor

AnswerB

CloudWatch monitors instances and can trigger alarms on metrics like status checks or custom process metrics.

Why this answer

CloudWatch can monitor EC2 instances and create alarms based on custom metrics, including process status. Option A is wrong because CloudTrail is for auditing API calls. Option C is wrong because Config is for resource compliance.

Option D is wrong because Trusted Advisor provides best-practice checks but not custom monitoring.

Full explanation →

1365

MCQhard

A company is migrating an SAP HANA system from on-premises to AWS. The HANA system uses a large amount of memory (2 TB). Which EC2 instance type is most suitable for this workload?

A.x2iedn.32xlarge

B.c5n.18xlarge

C.m5n.24xlarge

D.r5.24xlarge

AnswerA

The x2iedn.32xlarge instance is memory-optimized and can support up to 4 TB of memory, making it ideal for large SAP HANA deployments.

Why this answer

(x2iedn.32xlarge) is correct because it is a memory-optimized instance with up to 4 TB of memory, making it suitable for SAP HANA workloads requiring 2 TB of memory. Option B (c5n.18xlarge) is wrong because c5n instances are compute-optimized and have less memory. Option C (m5n.24xlarge) is wrong because m5n instances are general-purpose and cannot support 2 TB of memory.

Option D (r5.24xlarge) is wrong because r5 instances have a maximum memory of 768 GB.

Full explanation →

1366

MCQmedium

A company is migrating an SAP HANA database to AWS using the SAP HANA System Replication (HSR) with asynchronous mode. The database size is 5 TB. The migration must be completed within 8 hours. Which AWS resource is most critical to ensure the initial data synchronization completes within the time window?

A.EC2 instance with high network bandwidth and Enhanced Networking

B.EBS snapshots for the initial data copy

C.EBS gp3 volumes with sufficient IOPS

D.Amazon S3 multipart upload for initial data

AnswerA

HSR initial sync is network-bound; high bandwidth instances reduce sync time.

Why this answer

The initial data synchronization in SAP HANA System Replication (HSR) is network-intensive, as it transfers the full 5 TB database from the source to the target. High network bandwidth (e.g., using Enhanced Networking with ENA) directly reduces transfer time, making it the most critical resource to meet the 8-hour window. While EBS gp3 volumes (Option C) provide sufficient IOPS, they are secondary because the bottleneck is network throughput, not storage performance.

Option B (EBS snapshots) is not used in HSR, and Option D (S3 multipart upload) is irrelevant for HSR.

Full explanation →

1367

MCQmedium

An SAP Basis administrator is troubleshooting a performance issue on an SAP HANA database running on AWS. The database is on an EC2 instance of type r5.12xlarge with 8 x 1 TB EBS io2 Block Express volumes configured for maximum IOPS. The application team reports that batch jobs are taking longer than expected. The administrator checks Amazon CloudWatch metrics and sees that the EBS write latency averages 2 ms, which is within the expected range. However, the CPU utilization is at 95% consistently during batch runs. The HANA index server is using 70% of the CPU. The administrator also notices that the HANA threads are mostly waiting on 'lock wait' events. What is the MOST likely cause of the performance issue?

A.The EBS volumes are not providing enough IOPS for the workload.

B.The HANA parameter 'max_concurrency' is set too low.

C.There are SQL statement contention and locking issues in the HANA database.

D.The EC2 instance type is undersized for the HANA workload.

AnswerC

Lock waits indicate contention, often from poor SQL or application design.

Why this answer

The high CPU utilization (95%) combined with HANA threads waiting on 'lock wait' events indicates that SQL statement contention and locking issues are the primary bottleneck. Lock waits occur when multiple transactions compete for the same database resources, causing threads to spin or block, which consumes CPU cycles without making progress. This explains why CPU is saturated despite EBS write latency being normal (2 ms) and IOPS being sufficient.

Exam trap

The trap here is that candidates may attribute high CPU utilization to an undersized instance or insufficient IOPS, when in fact the CPU is busy spinning on lock waits, a classic symptom of application-level contention rather than infrastructure limits.

How to eliminate wrong answers

Option A is wrong because EBS write latency is only 2 ms, which is well within the expected range for io2 Block Express volumes, and the volumes are configured for maximum IOPS, so IOPS is not the bottleneck. Option B is wrong because 'max_concurrency' controls the number of parallel query execution threads, but lock waits are caused by contention on database objects (e.g., rows, tables), not by a limit on concurrency; lowering max_concurrency would reduce parallelism but not resolve lock contention. Option D is wrong because an r5.12xlarge instance provides 48 vCPUs and 384 GB of memory, which is a standard size for SAP HANA workloads, and the CPU is being fully utilized due to lock contention rather than being undersized for the workload.

Full explanation →

1368

MCQhard

An SAP administrator notices that the SAP application server performance degrades during peak hours. The application servers are running on EC2 instances with gp2 EBS volumes. The administrator suspects the EBS volumes are experiencing burst bucket depletion. Which action should the administrator take to improve performance?

A.Change the volume type to gp3 and adjust the IOPS and throughput settings.

B.Increase the size of the gp2 volumes to increase the baseline IOPS.

C.Move the data to instance store volumes for better performance.

D.Change the volume type to io1 and provision high IOPS.

AnswerA

gp3 provides baseline performance without burst credits.

Why this answer

The gp2 volume type uses a credit-based burst model where performance degrades once the burst bucket is depleted, especially under sustained high I/O. Changing to gp3 provides a baseline performance that does not rely on burst credits, and you can independently provision higher IOPS and throughput without increasing storage size, directly addressing the performance degradation during peak hours.

Exam trap

The trap here is that candidates may assume increasing gp2 volume size (Option B) is the only way to improve baseline IOPS, overlooking that gp3 provides a simpler, more cost-effective solution that directly addresses burst bucket depletion without requiring storage resizing.

How to eliminate wrong answers

Option B is wrong because increasing the size of gp2 volumes raises the baseline IOPS (at 3 IOPS per GB), but this is an indirect and potentially costly approach that still relies on burst credits for peak performance; it does not eliminate the burst bucket depletion issue. Option C is wrong because instance store volumes are ephemeral and data is lost on instance stop/termination, making them unsuitable for persistent SAP application data; they also do not solve the burst bucket depletion problem. Option D is wrong because io1 volumes are a provisioned IOPS SSD type that can provide consistent performance, but they are more expensive than gp3 and require manual provisioning of IOPS; gp3 is the more cost-effective and modern alternative that also avoids burst bucket depletion.

Full explanation →

1369

MCQeasy

Refer to the exhibit. An SAP administrator is configuring Route 53 to point a custom domain name to an Application Load Balancer (ALB) that fronts SAP Web Dispatchers. The record set is configured as shown. However, when users access sap.example.com, they receive a 503 error. What is the MOST likely cause?

A.The EvaluateTargetHealth is set to true, which is causing the record to be marked as unhealthy.

B.The security group for the ALB is not allowing inbound traffic on port 443 from the internet.

C.The Alias Target is incorrect; it should be the ALB's DNS name without 'dualstack'.

D.The health check for the ALB target group is failing, causing Route 53 to return 503.

AnswerB

If the ALB security group blocks inbound HTTPS traffic from the internet, users cannot connect, resulting in a 503 error.

Why this answer

A 503 error from an ALB typically indicates that the ALB is not receiving traffic or that the target group is unhealthy. However, in this scenario, the correct answer is B: the security group for the ALB is not allowing inbound traffic on port 443 from the internet. Without that rule, the ALB cannot accept HTTPS requests, resulting in a 503.

EvaluateTargetHealth being true (Option A) is a correct configuration for alias records and does not cause a 503. The Alias Target (Option C) is correctly set to the ALB's DNS name; 'dualstack' is part of that DNS name and is legitimate. A failing target group health check (Option D) would cause a 503, but the question specifies that users receive 503 when accessing the domain, and the most likely cause given the exhibit is the missing security group rule on the ALB.

Full explanation →

1370

MCQhard

An SAP system on AWS is experiencing performance degradation. Amazon CloudWatch metrics show high CPU utilization on the application server, but the database server (RDS) metrics are normal. The application team suspects a memory leak. Which action should the operations team take FIRST to confirm the issue?

A.Review the existing CloudWatch CPU utilization and memory metrics for the application server.

B.Install the CloudWatch agent on the application server and enable memory metrics.

C.Reboot the application server and monitor performance after reboot.

D.Increase the instance size of the application server to handle the load.

AnswerB

Installing the agent allows collection of memory metrics, which can confirm a memory leak.

Why this answer

CloudWatch cannot see inside the OS without the CloudWatch agent. Installing the agent and collecting memory metrics is the first step to confirm a memory leak. Option A is wrong because CloudWatch does not provide memory metrics by default.

Option C is wrong because rebooting is disruptive and does not help diagnose. Option D is wrong because switching to a larger instance is a reactive fix, not diagnostic.

Full explanation →

1371

MCQmedium

An SAP administrator wants to automate the creation of a DR environment for SAP HANA on AWS. The DR site should be in a different region and must be started only during a disaster. Which AWS service should be used to orchestrate the DR process?

A.AWS Systems Manager Automation to run DR scripts.

B.AWS CloudFormation StackSets to deploy the environment in the DR region.

C.Amazon S3 Cross-Region Replication to replicate SAP application data.

D.AWS Elastic Disaster Recovery (DRS) to replicate and orchestrate failover.

AnswerD

Elastic Disaster Recovery provides automated replication and orchestrated failover.

Why this answer

AWS Elastic Disaster Recovery (DRS) is the correct service because it provides continuous block-level replication for SAP HANA servers and includes built-in orchestration for failover and failback. This allows the DR environment to remain stopped until a disaster occurs, minimizing costs while ensuring rapid recovery.

Exam trap

The trap here is that candidates often confuse infrastructure deployment (CloudFormation) or data replication (S3 CRR) with the need for a fully orchestrated DR solution that includes both replication and automated failover, which only AWS DRS provides.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Automation is designed for operational tasks like patching and configuration, not for orchestrating full DR failover with continuous replication and automated recovery. Option B is wrong because AWS CloudFormation StackSets deploy infrastructure templates across multiple accounts/regions but do not handle data replication, state management, or the orchestrated failover process required for SAP HANA DR. Option C is wrong because Amazon S3 Cross-Region Replication only replicates objects in S3 buckets, not the block-level storage volumes or SAP HANA database files needed for a complete DR environment.

Full explanation →

1372

Matchingmedium

Match the AWS service to its primary use in an SAP environment.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Shared file storage for SAP NetWeaver

High-performance NFS for SAP HANA

Centralized backup management for SAP workloads

DNS resolution for SAP systems

Why these pairings

In SAP on AWS, Amazon EC2 provides compute, Amazon EBS provides block storage, Amazon S3 is used for backup/archive, and Amazon FSx for Windows File Server provides shared file storage. Distractors swap these roles.

Full explanation →

1373

MCQeasy

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

A.Modify the security group to allow all traffic temporarily

B.Review CloudWatch metrics for the instance and the ALB target group

C.Terminate the instance and let Auto Scaling launch a new one

D.Attach an additional Elastic Network Interface (ENI) to the instance

AnswerB

CloudWatch metrics provide baseline data for troubleshooting connectivity issues.

Why this answer

Reviewing CloudWatch metrics for the instance and the ALB target group is the correct first step because it provides immediate visibility into the root cause of intermittent connectivity issues. Metrics such as TargetResponseTime, RequestCount, and HealthyHostCount can reveal whether the problem is due to high latency, request failures, or the instance being marked unhealthy by the ALB health checks. This data-driven approach avoids unnecessary changes and aligns with the AWS Well-Architected Framework's principle of observability.

Exam trap

The trap here is that candidates often jump to reactive actions like terminating the instance or modifying security groups, failing to recognize that CloudWatch metrics provide the non-invasive, systematic starting point for diagnosing intermittent issues in an Auto Scaling group behind an ALB.

How to eliminate wrong answers

Option A is wrong because modifying the security group to allow all traffic temporarily bypasses security controls without providing diagnostic information; connectivity issues are rarely caused by overly restrictive security groups in a production environment, and this action could introduce a security risk. Option C is wrong because terminating the instance and letting Auto Scaling launch a new one is a reactive, disruptive action that destroys the evidence needed to diagnose the intermittent issue, and it does not address the underlying cause. Option D is wrong because attaching an additional Elastic Network Interface (ENI) to the instance adds complexity and does not help diagnose connectivity problems; it is typically used for specialized networking scenarios like dual-homed instances or network appliances, not for troubleshooting intermittent ALB connectivity.

Full explanation →

1374

MCQhard

An administrator runs the command shown in the exhibit to check the status of an EBS volume attached to an SAP HANA instance. The volume is 200 GB gp3 and is attached to instance i-0a1b2c3d4e5f67890. The administrator wants to increase the I/O performance. The volume is currently set to 3000 IOPS (baseline for gp3). Which action will increase IOPS without downtime?

A.Modify the volume's IOPS setting to a higher value (e.g., 6000) using the modify-volume API.

B.Detach the volume, increase the size to 500 GB, and reattach.

C.Modify the volume type to io2 Block Express and increase IOPS.

D.Take a snapshot of the volume and create a new volume with higher IOPS from the snapshot.

AnswerA

gp3 supports modifying IOPS without downtime.

Why this answer

Gp3 volumes allow modifying IOPS independently of size without detaching or downtime. Option B is incorrect because increasing the size does not directly increase IOPS; gp3 IOPS can be modified independently. Option C is incorrect because changing to io2 Block Express would require detaching or stopping the instance, causing downtime.

Option D is incorrect because creating a new volume from a snapshot requires detaching the original volume, causing downtime, and does not directly increase IOPS on the existing volume.

Full explanation →

1375

MCQhard

A company is migrating a legacy SAP ECC 6.0 system to SAP S/4HANA on AWS. The current database is IBM Db2. Which AWS service should be used to assess the source system and plan the migration?

A.AWS Migration Evaluator

B.AWS Application Discovery Service

C.AWS CloudEndure Migration

D.AWS Database Migration Service (DMS)

AnswerA

It provides business case analysis for SAP migrations.

Why this answer

AWS Migration Evaluator (formerly TSO Logic) is the correct service for assessing the source SAP ECC 6.0 system and planning the migration to SAP S/4HANA. It provides a data-driven business case, including SAP-specific insights such as system sizing, licensing, and total cost of ownership. AWS Application Discovery Service is used for server-level discovery and dependency mapping, not SAP-specific assessment.

AWS CloudEndure Migration is for lift-and-shift migration, not assessment. AWS Database Migration Service (DMS) is for migrating databases, not assessment.

Full explanation →

1376

Multi-Selectmedium

Which TWO of the following are valid methods to monitor the health of an SAP HANA database running on AWS?

Select 2 answers

A.Amazon CloudWatch alarms based on EC2 instance metrics

B.AWS Trusted Advisor checks for HANA best practices

C.AWS Config rules to check HANA configuration

D.SAP HANA SQL queries to check service status

E.AWS CloudTrail logs for HANA API calls

AnswersA, D

Amazon CloudWatch can monitor EC2 instance metrics such as CPU utilization and memory, providing insight into the health of the underlying OS and the HANA database.

Why this answer

Amazon CloudWatch can monitor EC2 instance metrics such as CPU utilization and memory, which are relevant to HANA database health. Option D is correct because SAP HANA provides built-in SQL queries to check service status and perform health checks. Option B is wrong because AWS Trusted Advisor checks for general best practices (e.g., security, cost optimization) and does not include HANA-specific health monitoring.

Option C is wrong because AWS Config is designed for configuration compliance tracking, not real-time health monitoring. Option E is wrong because AWS CloudTrail logs API calls for auditing purposes, not health metrics.

Full explanation →

1377

Multi-Selecteasy

An SAP system administrator needs to monitor the health of Amazon RDS for SAP ASE database instances. Which TWO CloudWatch metrics should be used to detect if the database is under memory pressure?

Select 2 answers

A.`WriteIOPS`

B.`ReadIOPS`

C.`FreeableMemory`

D.`SwapUsage`

E.`DatabaseConnections`

AnswersC, D

Low freeable memory indicates the database is using most of the available memory.

Why this answer

`FreeableMemory` shows available memory, and `SwapUsage` indicates memory pressure when swap is used.

Full explanation →

1378

Multi-Selectmedium

A company is running SAP HANA on AWS and wants to implement a disaster recovery strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The primary site is in us-east-1, and the DR site is in us-west-2. Which two actions should the company take to meet these objectives? (Choose TWO.)

Select 2 answers

A.Set up SAP HANA System Replication (HSR) in async mode between the two regions.

B.Take daily snapshots of the HANA volumes and copy them to the DR region.

C.Use AWS CloudEndure Disaster Recovery to replicate the entire server.

D.Use AWS Backup to schedule cross-region backups of the HANA database.

E.Pre-configure EC2 instances in the DR region with the same SAP HANA software and configuration.

AnswersA, E

SAP HANA System Replication (HSR) in async mode provides continuous log shipping, enabling an RPO of 15 minutes or less.

Why this answer

SAP HANA System Replication (HSR) in async mode can achieve an RPO of less than 15 minutes by continuously replicating log data to the DR region. Option E is correct because pre-configuring EC2 instances with the same SAP HANA software and configuration in the DR region minimizes the time needed to bring up the DR system, helping meet the 2-hour RTO. Option B is incorrect because daily snapshots cannot achieve a 15-minute RPO.

Option C is incorrect because AWS CloudEndure Disaster Recovery is not optimized for SAP HANA and may not meet the RPO/RTO requirements. Option D is incorrect because AWS Backup does not support HANA log replication and cannot achieve the required RPO.

Exam trap

Many candidates think that any cross-region backup solution can achieve a 15-minute RPO, but only continuous replication like HSR works.

Full explanation →

1379

Matchingmedium

Match the SAP system type to its typical AWS deployment pattern.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Single small instance, no HA

Medium instances, minimal redundancy

Medium instances, some HA

Large instances, multi-AZ, HA and DR

Why these pairings

SAP production systems require high availability and are typically deployed across multiple AZs. Development and sandbox systems have lower availability needs and are often in single AZs.

Full explanation →

1380

Multi-Selecteasy

Which TWO are best practices for designing high availability for SAP NetWeaver on AWS? (Choose two.)

Select 2 answers

A.Use T2 or T3 burstable instances for cost savings.

B.Deploy SAP ASCS and PAS instances in separate Availability Zones.

C.Use EBS Multi-Attach volumes for the SAP application data.

D.Configure multiple Application Load Balancers in a failover configuration.

E.Use an Elastic Load Balancer to distribute traffic to multiple Web Dispatchers.

AnswersB, E

Multiple AZs provide failover if one AZ becomes unavailable.

Why this answer

Deploying SAP ASCS (ABAP SAP Central Services) and PAS (Primary Application Server) instances in separate Availability Zones ensures that if one AZ fails, the other can continue processing, providing high availability. This aligns with AWS best practices for SAP NetWeaver, which recommend distributing critical SAP components across AZs to achieve a Recovery Time Objective (RTO) of minutes and a Recovery Point Objective (RPO) of near-zero using SAP enqueue replication and failover mechanisms.

Exam trap

The trap here is that candidates often confuse high availability with cost optimization or assume that burstable instances are suitable for SAP production workloads, ignoring SAP's strict performance and certification requirements.

Full explanation →

1381

MCQmedium

An SAP administrator is migrating an on-premises SAP system to AWS using this IAM policy. When attempting to launch a new EC2 instance from an AMI stored in the S3 bucket, the launch fails. What is the likely cause?

A.The policy does not allow stopping or starting instances.

B.The IAM policy does not include ec2:RunInstances.

C.The S3 bucket policy does not allow reading the AMI object.

D.The policy does not allow describing EC2 instances.

AnswerB

Correct. ec2:RunInstances is required to launch EC2 instances and is missing from the policy.

Why this answer

The launch fails because the IAM policy does not include the ec2:RunInstances permission, which is required to launch new EC2 instances. Option A is incorrect because the ability to stop or start instances is not relevant to launching new instances. Option C is incorrect because the failure is due to the IAM policy, not the S3 bucket policy; the IAM policy may allow s3:GetObject but that does not overcome the lack of ec2:RunInstances.

Option D is incorrect because describing instances is not a prerequisite for launching.

Full explanation →

1382

MCQhard

An SAP system uses a shared file system mounted via EFS from multiple EC2 instances. The operations team notices that the file system is not performing well during peak loads. What is the most effective way to improve throughput without changing the application?

A.Enable Provisioned Throughput on the EFS file system

B.Replace EFS with an EBS Multi-Attach volume

C.Migrate the file system to Amazon FSx for Lustre

D.Change the EFS performance mode from General Purpose to Max I/O

AnswerD

Changing to Max I/O performance mode increases throughput for parallel workloads, directly addressing the performance issue without altering the application.

Why this answer

Changing the EFS performance mode from General Purpose to Max I/O increases throughput for parallel workloads, improving performance without modifying the application. Option A (Provisioned Throughput) provides consistent throughput but does not change performance mode. Option B (EBS Multi-Attach) is not suitable for high-throughput shared file systems due to limited concurrent access and throughput constraints.

Option C (FSx for Lustre) is designed for HPC and not typically aligned with SAP shared storage requirements.

Exam trap

Candidates often confuse throughput modes or believe Provisioned Throughput is the only way to improve performance, but changing from General Purpose to Max I/O can significantly enhance throughput for parallel access patterns.

Full explanation →

1383

Multi-Selecthard

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Select 2 answers

A.Assign the patch baseline to the instance IDs directly.

B.Ensure that the instances have the appropriate IAM role that allows them to be patched.

C.Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.

D.Check the output of the AWS-RunPatchBaseline SSM document in the Systems Manager Run Command history for the failed instances.

E.Configure a Maintenance Window for the patching operation.

AnswersC, D

The SSM Agent must be online to execute patching commands.

Why this answer

If the SSM Agent is not running or cannot communicate with the AWS Systems Manager service, Patch Manager cannot execute the patching commands. The agent must be in a healthy state and have network connectivity (e.g., via VPC endpoints or internet gateway) to receive the patch baseline and report status. Option D is correct because the AWS-RunPatchBashelline SSM document execution history in Run Command provides detailed logs and error messages for each instance, allowing the team to identify why the patching failed, such as missing dependencies or timeout issues.

Exam trap

The trap here is that candidates may assume the IAM role (Option B) is the primary cause of failure, but the question already indicates the SSM Agent is installed and the instances show a 'Failed' status, which often points to agent communication or execution errors rather than missing permissions.

Full explanation →

1384

MCQmedium

A company is running SAP on AWS and wants to implement a patching strategy for the operating system of EC2 instances with minimal downtime. The instances are part of an Auto Scaling group. Which of the following approaches is the MOST appropriate?

A.Apply patches directly to the running instances using AWS Systems Manager Patch Manager and reboot each instance one at a time.

B.Stop the Auto Scaling group, patch the instances, and start the group again.

C.Use AWS Systems Manager Patch Manager to patch all instances at the same time during a maintenance window.

D.Create a new Amazon Machine Image (AMI) with the latest patches, update the launch configuration, and perform a rolling update of the Auto Scaling group.

AnswerD

This approach replaces instances with patched ones without downtime as the Auto Scaling group launches new instances before terminating old ones.

Why this answer

Creating a new AMI with the latest patches, updating the launch configuration, and performing a rolling update of the Auto Scaling group replaces instances with patched AMIs without downtime. Option A is incorrect because applying patches directly to running instances using AWS Systems Manager Patch Manager requires reboots, causing downtime for each instance. Option B is incorrect because stopping the Auto Scaling group stops all instances, resulting in full downtime.

Option C is incorrect because using Patch Manager to patch all instances at the same time during a maintenance window would cause simultaneous reboots, leading to downtime.

Full explanation →

1385

MCQhard

An SAP HANA database is running on an EC2 instance with 16 EBS volumes in a striped RAID 0 configuration. The system administrator notices that one of the volumes is degraded in the RAID array. How can the administrator recover the array with minimal downtime?

A.Detach the degraded volume, create a new volume of the same size and type, attach it to the instance, and add it to the RAID array.

B.Detach the degraded volume and attach a new volume with the same device name.

C.Take a snapshot of the degraded volume and restore it to a new volume.

D.Run a filesystem repair on the degraded volume while it is still attached.

AnswerA

This is the correct procedure. It allows minimal downtime as the array can be rebuilt after adding the new volume.

Why this answer

It outlines the proper procedure to replace a degraded volume in a RAID 0 array with minimal downtime: detach the faulty volume, create a new EBS volume of the same size and type, attach it to the instance, and add it to the RAID array. This approach avoids disrupting the remaining volumes and allows the array to be rebuilt quickly. Option B is incomplete because simply attaching a new volume with the same device name does not automatically incorporate it into the RAID array.

Option C is not optimal as creating a snapshot and restoring it introduces unnecessary steps and longer downtime. Option D is ineffective because filesystem repair cannot fix a physical volume failure.

Full explanation →

1386

MCQhard

A company is migrating its SAP production system to AWS and needs to ensure that the migration does not exceed the allowed downtime window of 4 hours. The source database is 5 TB. Which migration strategy should be used?

A.Homogeneous migration using AWS Schema Conversion Tool (SCT) and AWS DMS

B.Heterogeneous migration using AWS DMS with ongoing replication

C.AWS Snowball Edge for offline data transfer

D.AWS Application Migration Service (MGN) replication

AnswerB

DMS with ongoing replication minimizes downtime.

Why this answer

Heterogeneous migration using AWS DMS with ongoing replication allows near-zero downtime by continuously replicating changes from the source to the target database during the migration, enabling a short cutover window. Option A is incorrect because homogeneous migration using AWS SCT and DMS is typically for same-database-engine migrations, but SCT is unnecessary for homogeneous, and the combination may not achieve the 4-hour window without ongoing replication. Option C is incorrect because AWS Snowball Edge is an offline data transfer method that involves shipping physical devices, which takes days to transfer 5 TB, exceeding the 4-hour window.

Option D is incorrect because AWS Application Migration Service (MGN) is designed for server migration (rehosting), not database migration, and does not provide the database-level replication needed for this scenario.

Full explanation →

1387

MCQhard

A company runs SAP S/4HANA on AWS using an ASCS and PAS cluster with SUSE Linux Enterprise Server. The cluster fails over unexpectedly several times a day. What is the most likely cause and solution?

A.High network latency between nodes; use placement groups

B.Cluster quorum loss due to insufficient votes; add a third node or configure a witness

C.Insufficient memory on the cluster nodes; increase memory

D.Incorrect ASCS instance configuration; verify SAP profiles

AnswerB

Quorum loss triggers failover; adding a node stabilizes the cluster.

Why this answer

In a two-node SAP cluster, if the quorum vote count is insufficient, the cluster may lose quorum and trigger unnecessary failovers. The solution is to add a third node as a quorum device or configure a witness (e.g., an S3 bucket as a quorum disk in SUSE HAE). Option A is incorrect because high network latency would cause communication delays, not frequent failovers.

Option C is incorrect because insufficient memory would cause performance issues, not cluster failovers. Option D is incorrect because incorrect ASCS instance configuration would cause SAP startup failures, not cluster failovers.

Full explanation →

1388

MCQmedium

Refer to the exhibit. An SAP administrator checks the configuration of an EBS volume. The volume is attached to an SAP HANA instance. What is the potential performance bottleneck?

A.The IOPS and throughput are too low for SAP HANA

B.The volume is attached to an instance in a different Availability Zone

C.The DeleteOnTermination flag is set to false

D.The volume is not encrypted

AnswerA

SAP HANA typically requires higher IOPS and throughput than gp3 baseline.

Why this answer

The volume type is gp3 with 3000 IOPS and 125 MB/s throughput. SAP HANA requires high IOPS and throughput. With only 3000 IOPS and 125 MB/s, this volume may be a bottleneck for production HANA workloads.

The DeleteOnTermination setting is not a performance issue. The size and snapshot are not immediate concerns.

Full explanation →

1389

MCQmedium

A company is deploying SAP S/4HANA on AWS and needs to ensure that the system can be recovered within 4 hours in case of a disaster in the primary region. The secondary region is in a different AWS region. Which approach should be used to meet the recovery time objective (RTO)?

A.Configure SAP HANA system replication to a secondary region with a pre-provisioned standby instance

B.Use cross-region EBS snapshots and restore them in the secondary region

C.Back up SAP HANA to Amazon S3 and restore in the secondary region

D.Set up a pilot light environment using application-level replication

AnswerA

HANA system replication with pre-provisioned standby allows fast failover, potentially within minutes, meeting the RTO.

Why this answer

Replicating SAP HANA to a standby instance in another region using HANA system replication with pre-provisioned infrastructure allows fast failover. Cross-region EBS snapshots take time to restore. Backup and restore from S3 may be slower.

Pilot light with application-level replication is not sufficient for HANA.

Full explanation →

1390

MCQeasy

An IAM policy is attached to a user. The user attempts to upload a file to s3://my-bucket/restricted/data.txt. What is the outcome?

A.The upload succeeds because there is no explicit Deny for the specific object.

B.The upload succeeds because the Allow statement for s3:GetObject implies PutObject.

C.The upload fails because the explicit Deny overrides the Allow.

D.The upload succeeds because the Allow for s3:GetObject is on all resources.

AnswerC

Explicit Deny always overrides Allow.

Why this answer

C is correct because IAM policy evaluation follows a default-deny model where an explicit Deny always overrides any Allow. Even though the user has an Allow for s3:GetObject on all resources, the explicit Deny for the specific object path s3://my-bucket/restricted/* takes precedence, causing the upload (which requires s3:PutObject) to fail.

Exam trap

The PAS-C01 exam often tests the misconception that an Allow on one action (like s3:GetObject) somehow implies or grants permissions for other actions (like s3:PutObject), or that the absence of an explicit Deny means the request will succeed, ignoring the explicit Deny's overriding effect.

How to eliminate wrong answers

Option A is wrong because the absence of an explicit Deny for the specific object does not guarantee success; the default implicit deny would block the action if no Allow applies, but here an explicit Deny exists for the prefix. Option B is wrong because s3:GetObject does not imply s3:PutObject; they are distinct actions with separate permissions, and the Allow for GetObject does not grant upload rights. Option D is wrong because the Allow for s3:GetObject on all resources does not cover the s3:PutObject action required for uploading, and the explicit Deny overrides any Allow regardless of resource scope.

Full explanation →

1391

MCQmedium

A company runs SAP on AWS with an SAP HANA database on a single EC2 instance. They want to implement a disaster recovery solution with a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. The DR site is in a different AWS Region. Which approach meets these requirements?

A.Set up an automated process to copy the EC2 instance AMI to the DR Region every hour.

B.Use Amazon S3 Cross-Region Replication to replicate the HANA data directory to the DR Region.

C.Perform periodic HANA database backups to S3 and restore in the DR Region when needed.

D.Configure SAP HANA System Replication to a secondary instance in the DR Region and use automated EBS snapshots for cross-Region replication.

AnswerD

HANA System Replication plus cross-Region snapshots meets RPO and RTO.

Why this answer

SAP HANA System Replication provides synchronous or asynchronous data replication to a secondary instance in another AWS Region, meeting the RPO of 1 hour and RTO of 15 minutes when combined with automated EBS snapshots for cross-Region replication. This approach ensures near-continuous database replication and rapid failover, while EBS snapshots provide additional consistency and recovery points.

Exam trap

The trap here is that candidates often confuse backup-based approaches (like AMI copies or S3 backups) with true replication, failing to recognize that only SAP HANA System Replication provides the low RTO and RPO required for disaster recovery in a different AWS Region.

How to eliminate wrong answers

Option A is wrong because copying an EC2 AMI every hour does not provide database-consistent recovery points; AMIs capture the entire instance state but cannot guarantee HANA transaction consistency, and the RPO of 1 hour is not reliably met due to AMI creation time. Option B is wrong because Amazon S3 Cross-Region Replication replicates objects at the S3 bucket level, not the HANA data directory; it does not ensure database consistency or support point-in-time recovery for HANA. Option C is wrong because periodic HANA backups to S3, while useful for backup, cannot achieve an RTO of 15 minutes due to the time required to restore a full database backup in the DR Region, and the RPO of 1 hour may be missed if backup intervals are not precisely aligned.

Full explanation →

1392

Multi-Selecthard

Which THREE are valid steps when performing a cross-Region disaster recovery failover for SAP HANA using AWS? (Choose THREE.)

Select 3 answers

A.Create an EBS snapshot of the primary database volume

B.Start the SAP HANA database on the secondary instance

C.Stop the SAP HANA database on the primary instance

D.Configure SAP HANA System Replication (HSR) between primary and secondary Regions

E.Update DNS records to point to the secondary instance

AnswersB, D, E

The secondary database must be started to serve requests.

Why this answer

Starting the SAP HANA database on the secondary instance is a required step during a cross-Region disaster recovery failover. After promoting the secondary system replication target to primary, the SAP HANA database must be started to make it available for client connections and resume operations.

Exam trap

The trap here is that candidates may mistakenly think creating EBS snapshots is a valid DR failover step, but snapshots are for backup and not part of the SAP HANA System Replication failover process, which relies on log-based replication instead.

Full explanation →

1393

MCQeasy

A company wants to migrate a 50 TB SAP HANA database to AWS with minimal downtime. Which migration approach should be used?

A.Configure SAP HANA System Replication (HSR) between source and target.

B.Export the database to a file and upload to Amazon S3, then restore on RDS for HANA.

C.Use AWS SCT to convert the HANA schema to Aurora.

D.Use AWS DMS with ongoing replication from HANA to HANA.

AnswerA

HSR provides near-zero downtime replication.

Why this answer

SAP HANA System Replication (HSR) is the recommended method for migrating large HANA databases with minimal downtime, typically achieving near-zero downtime by replicating data continuously. Option B is incorrect because exporting the database to a file and uploading to S3 involves significant downtime for the export and restore process. Option C is incorrect because AWS SCT is used for schema conversion to different database engines, not for migrating HANA to HANA; converting to Aurora would change the database system and incur additional complexity and downtime.

Option D is incorrect because AWS DMS does not support SAP HANA as a source for ongoing replication, and even if it did, HSR is more efficient for HANA-to-HANA migration.

Full explanation →

1394

MCQeasy

A company plans to migrate its SAP systems to AWS and needs to set up a secure connection to the corporate data center. The company requires consistent network performance and low latency. Which AWS service should be used?

A.AWS Transit Gateway

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.AWS Client VPN

AnswerC

Direct Connect provides a dedicated, consistent network connection with low latency.

Why this answer

(AWS Direct Connect) is correct because it provides a dedicated private network connection from the corporate data center to AWS, ensuring consistent network performance and low latency. Option A (AWS Transit Gateway) is a network transit hub but does not itself provide a direct connection; it can be used with Direct Connect or VPN attachments. Option B (AWS Site-to-Site VPN) uses the public internet, which can lead to variable performance and latency.

Option D (AWS Client VPN) is designed for individual remote clients, not for site-to-site connectivity.

Full explanation →

1395

MCQmedium

A company runs SAP HANA on AWS and needs to perform a backup of the HANA database to Amazon S3. Which AWS service should be used to orchestrate the backup and ensure consistency?

A.AWS Backup with pre- and post-backup scripts for application-consistent backups.

B.Amazon S3 Lifecycle policies to transition backups to Glacier.

C.Amazon Data Lifecycle Manager (DLM) to schedule EBS snapshots.

D.AWS Storage Gateway file gateway to back up to S3.

AnswerA

AWS Backup with pre- and post-backup scripts can orchestrate application-consistent backups of SAP HANA databases to S3.

Why this answer

AWS Backup supports SAP HANA on EC2 with pre- and post-scripts for application-consistent backups. Option B is wrong because S3 Lifecycle policies manage object lifecycle, not backups. Option C is wrong because DLM manages EBS snapshots, not application-consistent backups.

Option D is wrong because Storage Gateway is for hybrid storage, not SAP HANA backups.

Full explanation →

1396

MCQeasy

A company runs SAP Business Suite on AWS. The database size is 2 TB. They need to restore the database to a point-in-time from the last 24 hours. Which AWS service should be used to achieve this with minimal impact on production performance?

A.Use AWS Backup with a backup plan for the EC2 instance.

B.Use Amazon EBS snapshots of the database volume.

C.Configure SAP HANA Backup & Recovery using Backint agent to Amazon S3.

D.Use AWS Database Migration Service (DMS) for continuous replication.

AnswerC

Backint allows online backups to S3 with point-in-time recovery.

Why this answer

SAP HANA Backup & Recovery using the Backint agent to Amazon S3 is the native, AWS-integrated method for performing point-in-time recovery (PITR) of SAP HANA databases. Backint offloads backup and restore operations directly to S3, bypassing the EC2 instance's I/O stack, which minimizes performance impact on production workloads. This approach supports incremental and log backups, enabling precise PITR within the last 24 hours without requiring full-volume snapshots.

Exam trap

The trap here is that candidates often confuse crash-consistent EBS snapshots (Option B) with application-consistent backups, failing to recognize that SAP HANA requires log-based PITR via Backint to avoid database corruption and minimize production impact.

How to eliminate wrong answers

Option A is wrong because AWS Backup for EC2 instances performs full machine-level backups, which are not database-consistent for SAP HANA without pre- and post-scripts, and cannot provide granular point-in-time recovery at the database level. Option B is wrong because Amazon EBS snapshots capture the entire volume state, but they are crash-consistent, not application-consistent, and restoring a 2 TB database from snapshots would require stopping the database and could take hours, causing significant production impact. Option D is wrong because AWS Database Migration Service (DMS) is designed for continuous replication and migration between database engines, not for native SAP HANA backup and restore; it does not support point-in-time recovery of SAP HANA databases and would introduce latency and schema conversion issues.

Full explanation →

1397

MCQmedium

A company is migrating a large SAP HANA workload to AWS. They need to ensure the fastest network throughput for data transfer between on-premises and AWS. Which AWS service or feature should they use?

A.AWS Snowball Edge

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.AWS Client VPN

AnswerC

Direct Connect provides dedicated, high-speed connectivity for large data transfers.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, ensuring consistent high throughput and low latency—ideal for large SAP HANA migrations. Option A (Snowball Edge) is a physical device for offline data transfer, not suitable for real-time network throughput. Option B (Site-to-Site VPN) uses the public internet and may have variable performance, making it less optimal than Direct Connect.

Option D (Client VPN) is designed for individual user remote access, not for high-volume data transfer.

Full explanation →

1398

Multi-Selecteasy

Which TWO AWS services can be used to automate the backup of SAP HANA databases? (Choose two.)

Select 2 answers

A.AWS Lambda

B.AWS Storage Gateway

C.Amazon EBS Snapshots

D.Amazon S3

E.AWS Backup

AnswersC, E

EBS Snapshots can be automated using lifecycle policies.

Why this answer

Amazon EBS Snapshots are correct because they provide point-in-time, incremental backups of the underlying block storage volumes that host SAP HANA data and log files. AWS Backup is correct because it offers a fully managed, policy-driven backup service that can orchestrate EBS Snapshots and other resources, supporting SAP HANA backup automation with centralized scheduling and retention management.

Exam trap

The trap here is that candidates may confuse Amazon S3 as a backup automation service when it is merely a storage target, or think AWS Lambda alone qualifies as a backup automation solution, but the question specifically asks for services that 'automate' the backup process, which AWS Backup and EBS Snapshots directly provide.

Full explanation →

1399

Multi-Selectmedium

A company is migrating its SAP landscape to AWS. They need to choose a migration method for each system. Which TWO factors are most important to consider when selecting a migration method for SAP systems? (Choose TWO.)

Select 2 answers

A.Total cost of migration

B.Frequency of database backups

C.Source and target platform (OS, DB)

D.Number of SAP users

E.SAP release and database version

AnswersC, E

Affects tool choice (e.g., HSR for HANA).

Why this answer

Options C and E are correct. The source and target platform (OS, DB) and SAP release/database version are critical because they determine the availability and compatibility of migration tools (e.g., SUM, DMO, SWPM). Option A (total cost) is a business consideration, not a technical factor for method selection.

Option B (backup frequency) relates to operational planning, not method choice. Option D (number of SAP users) affects sizing but not the migration method itself.

Exam trap

Candidates may confuse business factors (cost, users) with technical prerequisites. Remember: migration method depends on platform and version compatibility, not on user count or backup schedules.

Full explanation →

1400

MCQmedium

Refer to the exhibit. An SAP administrator is reviewing the EBS volume configuration for a SAP HANA /hana/data volume. The volume is 500 GB gp2 with DeleteOnTermination set to false. The instance is in us-east-1a. Which action should the administrator take to improve performance for SAP HANA?

A.Take a snapshot and create a new volume in us-east-1b.

B.Enable encryption on the volume.

C.Modify the volume to gp3 and provision 5000 IOPS.

D.Set DeleteOnTermination to true.

AnswerC

gp3 allows provisioning higher IOPS independently of size.

Why this answer

SAP HANA requires a minimum of 5000 IOPS for /hana/data. The gp2 volume provides 1500 IOPS (3 IOPS per GB). The administrator should either increase the volume size to at least 1667 GB to get 5000 IOPS, or change to gp3 with provisioned IOPS of 5000 or more.

The best practice for SAP HANA is to use multiple volumes in RAID 0, but the question asks about improving performance for this volume. Changing to gp3 with higher IOPS is a direct improvement.

Full explanation →

1401

Multi-Selectmedium

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The DR region must have the SAP application stack ready but the database can be replayed from backups. Which TWO actions should be taken to meet these requirements? (Choose two.)

Select 2 answers

A.Use a single-region Multi-AZ deployment for the database.

B.Use S3 cross-region replication for the application log files.

C.Set up a cross-region read replica for the Aurora PostgreSQL database.

D.Take daily snapshots of the database and copy them to the DR region.

E.Pre-provision EC2 instances with the SAP application stack in the DR region.

AnswersC, E

Cross-region read replicas provide low RPO (usually seconds) and can be promoted quickly.

Why this answer

Options C and E are correct. A cross-region read replica for Aurora PostgreSQL provides near-real-time replication, meeting the 15-minute RPO. Pre-provisioning EC2 instances with the SAP application stack in the DR region reduces RTO to within 2 hours.

Option A (single-region Multi-AZ) does not provide DR across regions. Option B (S3 cross-region replication for logs) is not sufficient for database recovery. Option D (daily snapshots copied to DR) would exceed the 15-minute RPO.

Full explanation →

1402

Multi-Selecthard

A company runs SAP on AWS and needs to monitor the performance of its SAP HANA database. The operations team wants to receive alerts when the CPU utilization exceeds 90% for more than 5 minutes. Which TWO steps should be taken to set up this monitoring and alerting?

Select 2 answers

A.Configure an Amazon SNS topic to send email or SMS notifications when the alarm state is reached.

B.Create a CloudWatch alarm that triggers when CPU utilization exceeds 90% for 5 consecutive minutes.

C.Create a CloudWatch metric filter on the HANA host's CPU utilization.

D.Enable CloudWatch Logs for the SAP application logs to detect performance issues.

E.Install the SAP Host Agent on the HANA instance and configure it to send metrics to SAP Solution Manager.

AnswersA, B

Correct. Amazon SNS is used to send notifications from CloudWatch alarms. Configuring an SNS topic for email or SMS alerts the operations team when the CPU utilization alarm triggers.

Why this answer

Amazon SNS is the standard AWS service for distributing notifications from CloudWatch alarms. By configuring an SNS topic to send email or SMS, the operations team receives alerts when the CPU utilization alarm triggers. Option B is correct because a CloudWatch alarm can be created to monitor the EC2 instance's CPU utilization metric directly; no metric filter is needed.

Option C is not required: CPU utilization is a pre-existing EC2 metric, not a log-based metric, so a metric filter is unnecessary. Option D is wrong because SAP application logs are not needed for CPU utilization monitoring. Option E is wrong because SAP Host Agent is not required for basic CloudWatch monitoring; CloudWatch and SNS provide a simpler native solution.

Exam trap

The trap is that candidates may assume they need to create a CloudWatch metric filter to capture CPU utilization, but CPU utilization is a standard EC2 metric available by default in CloudWatch. No metric filter is needed.

Full explanation →

1403

MCQhard

An SAP administrator receives an alert that the SAP application server is not responding. The administrator checks the EC2 console and sees that the instance state is 'running' but the status checks have failed. Which step should be taken first to restore the SAP application?

A.Terminate the instance and launch a new one using the same AMI.

B.Use the EC2 console to stop and start the instance, which will move it to new underlying hardware.

C.Reboot the EC2 instance from the AWS Management Console.

D.Create a new EC2 instance from the latest AMI and attach the existing EBS volumes.

AnswerB

Stop/start recovers from hardware issues and preserves the instance ID, EBS volumes, and Elastic IP.

Why this answer

When status checks fail, the instance may have underlying hardware issues. Stopping and starting the instance (Option B) moves it to new hardware, which can resolve hardware-related failures and restore the SAP application. Option A is incorrect because terminating the instance loses the existing configuration and EBS volumes (unless termination protection is disabled and volumes are set to survive).

Option C is incorrect because rebooting only restarts the OS; it does not change the underlying hardware, so hardware issues persist. Option D is incorrect because creating a new instance and attaching existing volumes is more time-consuming and complex; the simpler stop/start action should be attempted first.

Full explanation →

1404

Multi-Selecthard

Which TWO AWS services can be used to monitor SAP system availability and send notifications when a system goes down? (Choose two.)

Select 2 answers

A.AWS Trusted Advisor

B.Amazon CloudWatch Events

C.Amazon S3 event notifications

D.Amazon CloudWatch Alarms

E.AWS Config

AnswersB, D

Can trigger notifications based on events.

Why this answer

Amazon CloudWatch Events (now part of Amazon EventBridge) can monitor SAP system health by capturing state changes or custom events emitted by SAP via the SAP Cloud Platform Integration or AWS Lambda, and route them to targets like SNS or Lambda for notification. Amazon CloudWatch Alarms can monitor SAP-specific metrics (e.g., from SAP Host Agent or custom metrics published via the CloudWatch agent) and trigger actions such as sending an SNS notification when a threshold (e.g., system down) is breached. Together, they provide event-driven and metric-based monitoring and alerting for SAP availability.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks resource configuration changes) with a monitoring and alerting service, or they incorrectly assume S3 event notifications can be used for application-level health checks, when in fact only CloudWatch Events and CloudWatch Alarms provide the necessary event-driven and metric-based monitoring for SAP availability.

Full explanation →

1405

MCQeasy

A company is migrating an SAP S/4HANA system to AWS and needs to choose the storage for the HANA database. The database requires high IOPS and low latency. Which AWS storage solution is most suitable?

A.Amazon EFS

B.Amazon EBS io2 Block Express volumes

C.Amazon S3

D.Amazon EBS st1 volumes

AnswerB

Amazon EBS io2 Block Express volumes deliver up to 256,000 IOPS per volume with single-digit millisecond latency, satisfying the SAP HANA database’s requirement for high IOPS and low latency. This is achieved through a dedicated Nitro system controller that bypasses the hypervisor for storage I/O, reducing jitter and ensuring consistent performance for latency-sensitive SAP workloads.

Why this answer

Amazon EBS io2 Block Express volumes are designed for mission-critical SAP HANA workloads, offering up to 256,000 IOPS per volume and sub-millisecond latency. They provide 99.999% durability and are the only EBS volume type certified by SAP for production HANA databases on AWS, meeting the high IOPS and low latency requirements.

Exam trap

The trap here is that candidates often confuse high-throughput HDD volumes (st1) with high-IOPS requirements, or mistakenly think that any EBS volume type can support SAP HANA, but only io2 Block Express meets SAP's certification and the specific low-latency, high-IOPS demands.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a shared file system (NFS) that does not provide the consistent, low-latency block-level IOPS required for SAP HANA database storage; it is suitable for shared file storage, not database volumes. Option C is wrong because Amazon S3 is an object storage service with higher latency and no support for database block-level operations; it cannot be used as the primary storage for a running HANA database. Option D is wrong because Amazon EBS st1 volumes are throughput-optimized HDD volumes designed for large, sequential workloads like big data and log processing, not for the high IOPS and low latency needed by SAP HANA; they cannot meet the performance requirements.

Full explanation →

1406

Multi-Selecthard

Which THREE steps should an administrator take to troubleshoot an issue where an SAP application server cannot connect to the database server after a security group change? (Choose THREE.)

Select 3 answers

A.Check the outbound rules of the application server's security group

B.Modify the route tables to ensure direct communication

C.Restart both the application and database servers

D.Review the network ACL rules for the subnets

E.Verify the inbound rules of the database server's security group allow traffic from the application server

AnswersA, D, E

Security groups are stateful, but outbound rules can affect traffic if not configured properly.

Why this answer

The first step is to verify the security group rules. Then check network ACLs. VPC Flow Logs can confirm if traffic is allowed or denied.

Checking the OS firewall is also important. Restarting instances and changing route tables are too disruptive and unlikely to be the root cause. Changing security groups again without analysis is guesswork.

Full explanation →

1407

MCQmedium

A company is migrating a Windows-based .NET application to AWS. The application currently uses Active Directory for authentication. Which AWS service should they use to maintain a similar authentication experience?

A.AWS Directory Service for Microsoft Active Directory

B.AWS Directory Service Simple AD

C.AWS Identity and Access Management (IAM)

D.Amazon Cognito

AnswerA

Provides managed AD compatible with Windows apps.

Why this answer

AWS Directory Service for Microsoft Active Directory provides a managed Microsoft Active Directory in the AWS cloud, allowing the application to authenticate against Active Directory without changes. Option A is correct. Option B (Simple AD) is a Samba-based directory, not fully compatible with all .NET AD features.

Option C (IAM) manages access to AWS resources, not application authentication. Option D (Cognito) is for external user pools, not enterprise AD integration.

Full explanation →

1408

MCQmedium

A retail company is migrating its SAP ERP system from on-premises to AWS. The system includes an SAP HANA database (2 TB) and an SAP NetWeaver application server. The migration strategy is to use SAP HANA System Replication (HSR) to replicate the database to an EC2 instance running SAP HANA, then perform a takeover. The application server will be migrated using AWS Application Migration Service (MGN). The network connection is AWS Direct Connect with 1 Gbps bandwidth. During a test migration, the HSR replication is working, but the application server replication through MGN is taking much longer than expected. The MGN console shows that the data replication progress is stuck at 45% for several hours. The source server is a physical server with a 500 GB disk, 75% utilized. Which action is most likely to resolve the issue?

A.Increase the disk queue depth on the source server or add additional disks to improve I/O performance.

B.Convert the source disks to dynamic disks to improve replication speed.

C.Increase the staging area size in the MGN replication settings.

D.Increase the Direct Connect bandwidth to 10 Gbps.

AnswerA

Increasing the disk queue depth (option A) can improve I/O performance and resolve the stall, as the MGN data replication process is stuck at 45% due to a source disk I/O bottleneck.

Why this answer

The MGN data replication process is stuck at 45%, indicating a source disk I/O bottleneck. This often occurs when the source server's disk queue depth is insufficient to keep up with the rate of change. Increasing the disk queue depth (option A) can improve I/O performance and resolve the stall.

Option B is incorrect because converting to dynamic disks does not address I/O throughput; MGN works with static disks. Option C is incorrect because increasing the staging area size would not help if the issue is I/O; the staging area is used for caching changes, but the problem is the source disk cannot read/write fast enough. Option D is incorrect because increasing Direct Connect bandwidth would not affect source I/O performance; the bottleneck is local to the source server.

Full explanation →

1409

MCQmedium

A company is migrating on-premises servers to AWS. After migrating, the administrator runs the AWS CLI command shown in the exhibit. The company wants to ensure that all EC2 instances are in the 'running' state. Which action should the administrator take?

A.Run aws ec2 start-instances --instance-ids i-1a2b3c4d5e6f7g8h

B.Run aws ec2 stop-instances --instance-ids i-0a1b2c3d4e5f6g7h

C.Run aws ec2 reboot-instances --instance-ids i-2a3b4c5d6e7f8g9h

D.Run aws ec2 terminate-instances --instance-ids i-2a3b4c5d6e7f8g9h

AnswerA

Starts the stopped instance.

Why this answer

The instance with ID i-1a2b3c4d5e6f7g8h is in a stopped state. To transition it to the 'running' state, the administrator should use the start-instances command. Option A is correct because it starts the stopped instance.

Option B (stop-instances) would stop running instances, which is not the desired action. Option C (reboot-instances) would reboot a running instance, but this instance is stopped. Option D (terminate-instances) would permanently delete the instance, which is not the goal.

Full explanation →

1410

MCQeasy

A company is migrating an SAP BusinessObjects environment to AWS. The migration must ensure that the legacy reporting system remains accessible during the transition. Which AWS service can help facilitate this by allowing the company to redirect traffic gradually?

A.Amazon CloudFront

B.Elastic Load Balancer (ELB)

C.AWS Global Accelerator

D.Amazon Route53 with weighted routing policies

AnswerD

Weighted routing allows gradual redirection of traffic.

Why this answer

Amazon Route53 with weighted routing policies can gradually shift traffic from on-premises to AWS by assigning weights to DNS records. Option A (Amazon CloudFront) is a content delivery network, not for traffic shifting. Option B (Elastic Load Balancer) distributes traffic within AWS, not for gradual migration.

Option C (AWS Global Accelerator) improves performance but does not provide weighted routing. Option D (Amazon Route53 with weighted routing policies) is correct because it allows incremental traffic redirection during migration.

Full explanation →

1411

MCQmedium

A company is migrating an SAP HANA database to AWS and needs to ensure high availability with automatic failover. Which solution meets this requirement with the least administrative overhead?

A.Configure SAP HANA System Replication across two EC2 instances in different Availability Zones and use a custom script for failover.

B.Use AWS SAP HANA Multi-AZ deployment.

C.Deploy a single EC2 instance with an EBS volume and take regular snapshots.

D.Use an Application Load Balancer to distribute traffic to multiple HANA instances.

AnswerA

SAP HANA System Replication with automatic failover is the standard approach for high availability, providing the least administrative overhead when properly configured.

Why this answer

SAP HANA System Replication is the native, widely-used method for high availability with automatic failover. While it requires some initial scripting for failover automation, it has the least administrative overhead among the given options. Option B is not a real AWS service, so it is invalid.

Option C offers no automatic failover, and Option D is not designed for database high availability.

Full explanation →

1412

MCQhard

A company is running SAP ERP on a single EC2 instance with an SAP HANA database. The operations team receives an alert that the /hana/data filesystem is 85% full. The filesystem is mounted from an EBS volume. Which of the following actions should be taken to resolve the issue with MINIMAL downtime?

A.Increase the size of the existing EBS volume and extend the filesystem.

B.Add an additional EBS volume and mount it to /hana/data2, then relocate some data.

C.Delete unnecessary log files from the /hana/data directory.

D.Create a new, larger EBS volume, attach it to the instance, and copy the data.

AnswerA

EBS volumes can be resized online, and the filesystem can be extended without stopping the instance.

Why this answer

You can increase the size of an EBS volume and extend the filesystem while the instance is running, without any downtime. The filesystem can be extended online using commands like xfs_growfs for XFS or resize2fs for ext4. Option B is incorrect because adding a new volume and relocating data would require more complex configuration and potential downtime, and it doesn't resolve the issue of the existing filesystem being full.

Option C is incorrect because deleting log files is not a sustainable solution and may not free up enough space, and it is not a best practice for production systems. Option D is incorrect because creating a new larger volume and copying data would require the instance to be stopped to swap volumes, causing downtime.

Full explanation →

1413

MCQhard

A financial services company is migrating its SAP HANA-based system from on-premises to AWS. The system is critical and must have a recovery point objective (RPO) of less than 1 minute and recovery time objective (RTO) of less than 15 minutes. The migration strategy is to use SAP HANA System Replication (HSR) in synchronous mode to an EC2 instance in the same region, then perform a takeover. However, during the test, the HSR replication latency is consistently above 100 ms, which prevents synchronous replication from working. The network between on-premises and AWS uses AWS Direct Connect with 1 Gbps bandwidth, and the physical distance is about 50 miles. Which action should the administrator take to achieve the RPO/RTO requirements?

A.Deploy the target EC2 instance in an AWS Local Zone closer to the on-premises data center.

B.Use a Site-to-Site VPN instead of Direct Connect.

C.Use asynchronous HSR mode instead of synchronous.

D.Increase the Direct Connect bandwidth to 10 Gbps.

AnswerA

Local Zones reduce physical distance and latency.

Why this answer

Synchronous HSR over long distance is challenging due to latency. Option A is correct because AWS Local Zones reduce latency by placing the target closer to on-premises. Option B is wrong because using a Site-to-Site VPN adds more latency compared to Direct Connect.

Option C is wrong because asynchronous mode does not meet the RPO of less than 1 minute. Option D is wrong because increasing bandwidth to 10 Gbps does not reduce latency; the issue is distance, not bandwidth.

Full explanation →

1414

MCQhard

An SAP customer is using AWS Direct Connect to connect their on-premises network to AWS. They have multiple SAP systems in different VPCs. The network team wants to centralize connectivity and simplify routing. Which AWS service should they use to connect all VPCs to the on-premises network?

A.Use a VPN connection from each VPC to the on-premises network

B.Use VPC Peering between each VPC and the Direct Connect VIF

C.Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway

D.Use AWS PrivateLink to connect services across VPCs

AnswerC

Transit Gateway provides a hub for multiple VPCs and Direct Connect.

Why this answer

AWS Transit Gateway acts as a central hub that interconnects VPCs and on-premises networks via a Direct Connect Gateway. This allows the customer to attach multiple VPCs to a single Transit Gateway and connect that Transit Gateway to the Direct Connect Gateway, simplifying routing and eliminating the need for multiple Direct Connect Virtual Interfaces (VIFs) or complex peering arrangements.

Exam trap

The trap here is that candidates often confuse VPC Peering with transitive routing, mistakenly thinking that peering multiple VPCs to a Direct Connect VIF can centralize connectivity, but VPC Peering does not support transitive routing and cannot connect to a Direct Connect VIF directly.

How to eliminate wrong answers

Option A is wrong because using a VPN connection from each VPC to the on-premises network introduces multiple VPN tunnels, adds latency, and does not centralize connectivity or simplify routing; it also bypasses the existing Direct Connect investment. Option B is wrong because VPC Peering is a one-to-one connection between two VPCs and cannot be used to connect a VPC directly to a Direct Connect VIF; VPC Peering does not support transitive routing, so it cannot centralize connectivity to on-premises. Option D is wrong because AWS PrivateLink is designed to expose services privately across VPCs or on-premises via Network Load Balancers and ENIs, not to route traffic between multiple VPCs and an on-premises network; it does not provide a hub-and-spoke routing architecture.

Full explanation →

1415

Multi-Selecteasy

A company is migrating an SAP ERP system to AWS. The migration must be completed within a limited time window. Which THREE services can be used to accelerate the migration? (Choose three.)

Select 3 answers

A.AWS CloudEndure Migration

B.AWS Database Migration Service (DMS)

C.AWS Server Migration Service (SMS)

D.AWS Trusted Advisor

E.AWS CloudFormation

AnswersA, B, C

CloudEndure provides continuous replication for servers.

Why this answer

Options A, B, and C are correct: AWS SMS (now MGN) can automate server replication, AWS DMS can migrate databases, and AWS CloudEndure (now part of MGN) can replicate servers. Option D is incorrect because Trusted Advisor is for optimization, not migration. Option E is incorrect because CloudFormation is for infrastructure provisioning, not data migration.

Full explanation →

1416

Multi-Selectmedium

Which TWO of the following are best practices for securing SAP workloads on AWS?

Select 2 answers

A.Use IAM roles to grant EC2 instances access to AWS services.

B.Use security groups to control traffic to SAP application servers.

C.Disable encryption in transit between application and database tiers.

D.Allow SSH access from the internet for administration.

E.Store SAP backup files in a public S3 bucket for easy access.

AnswersA, B

IAM roles are secure and avoid storing credentials.

Why this answer

IAM roles allow EC2 instances to securely access AWS services (e.g., S3, DynamoDB) without embedding long-term credentials. By attaching an IAM role to an EC2 instance, the instance can obtain temporary credentials via the instance metadata service, which is a best practice for securing SAP workloads on AWS.

Exam trap

The trap here is that candidates might think disabling encryption in transit is acceptable for performance reasons, but AWS best practices mandate encryption in transit for all SAP data flows, especially between application and database tiers.

Full explanation →

1417

MCQmedium

A company is running a production SAP HANA database on an AWS EC2 instance with multiple EBS volumes. The operations team notices that the database performance degrades during peak hours. Which AWS service can be used to analyze the disk I/O performance and identify bottlenecks?

A.AWS Trusted Advisor

B.AWS Config

C.Amazon CloudWatch

D.AWS Config

AnswerC

CloudWatch provides detailed EBS metrics for performance analysis.

Why this answer

CloudWatch provides metrics for EBS volumes including read/write throughput and IOPS, which can be used to analyze disk I/O performance. Option A (AWS Trusted Advisor) is wrong because it provides best-practice checks but not real-time performance analysis. Option B (AWS Config) is wrong because it tracks configuration changes, not performance.

Option C is correct. Option D is a duplicate of Option B and is also wrong for the same reason.

Full explanation →

1418

MCQhard

A company is migrating a critical SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which AWS service can be used to manage the virtual IP address required for the SAP high availability setup?

A.AWS Transit Gateway

B.Elastic Load Balancer (ELB)

C.Amazon Route 53 Application Recovery Controller

D.AWS Global Accelerator

AnswerB

Elastic Load Balancer (specifically Network Load Balancer) provides a static IP address that can be used as the virtual IP for SAP HA, supporting health checks and failover routing.

Why this answer

For SAP high availability on AWS, the virtual IP (VIP) for ASCS/ERS is typically managed using a Network Load Balancer (NLB), which provides a static IP address that can be used as the VIP. NLB supports health checks and automatic failover between active and passive instances. Amazon Route 53 Application Recovery Controller is designed for multi-region recovery and DNS-level failover, not for managing a VIP within a single region.

AWS Transit Gateway handles network connectivity between VPCs, and AWS Global Accelerator provides static IPs for global traffic optimization, not for SAP HA VIP management.

Full explanation →

1419

MCQhard

An SAP administrator runs the command shown in the exhibit. The volume is attached to an EC2 instance. The administrator plans to increase the volume size to 1000 GiB. After resizing, the volume type remains gp2. What is the expected baseline IOPS for the resized volume?

A.4500 IOPS

B.16,000 IOPS

C.3000 IOPS

D.1500 IOPS

AnswerC

Baseline IOPS = 3 * 1000 = 3000.

Why this answer

Gp2 volumes have a baseline IOPS of 3 IOPS per GiB, up to a maximum of 16,000 IOPS. For a 1000 GiB gp2 volume, the calculation is 1000 × 3 = 3000 IOPS, which is below the 16,000 IOPS cap, so the expected baseline IOPS is exactly 3000.

Exam trap

The trap here is that candidates often confuse the gp2 baseline IOPS calculation (3 IOPS/GiB) with the gp3 baseline (3000 IOPS fixed for any size) or mistakenly apply the 16,000 IOPS cap as a default value for all gp2 volumes, rather than recognizing it as a maximum that only applies at larger sizes.

How to eliminate wrong answers

Option A is wrong because 4500 IOPS would correspond to a 1500 GiB gp2 volume (1500 × 3 = 4500), not a 1000 GiB volume. Option B is wrong because 16,000 IOPS is the maximum baseline IOPS for gp2 volumes, but this cap only applies when the volume size is 5334 GiB or larger (5334 × 3 ≈ 16,000); a 1000 GiB volume does not reach that cap. Option D is wrong because 1500 IOPS would be the baseline for a 500 GiB gp2 volume (500 × 3 = 1500), not for 1000 GiB.

Full explanation →

1420

MCQmedium

An SAP system is running on AWS and uses Amazon EFS for the /sapmnt directory. The system is experiencing high latency during file operations. Which configuration change could improve the performance of the EFS file system?

A.Enable the Max I/O performance mode on the EFS file system.

B.Change the performance mode from Max I/O to General Purpose.

C.Migrate the /sapmnt directory to an Amazon EBS volume.

D.Increase the provisioned throughput of the EFS file system.

AnswerA

Max I/O mode provides higher throughput for large-scale workloads.

Why this answer

The Max I/O performance mode is designed for highly parallel, throughput-intensive workloads like SAP /sapmnt, which involves many concurrent file operations. It scales to higher levels of aggregate throughput and IOPS by distributing data across multiple servers, reducing latency under heavy load. General Purpose mode, while suitable for latency-sensitive workloads, cannot match the parallel throughput capabilities required by SAP systems.

Exam trap

The trap here is that candidates assume General Purpose mode is always better for latency, but for highly concurrent SAP workloads, Max I/O mode's parallelism actually reduces overall latency despite higher metadata latency.

How to eliminate wrong answers

Option B is wrong because changing from Max I/O to General Purpose would reduce the file system's ability to handle high concurrency and throughput, worsening latency for SAP workloads. Option C is wrong because migrating /sapmnt to an Amazon EBS volume would introduce a single-point-of-failure and lack the shared, multi-instance access that EFS provides for SAP's distributed architecture. Option D is wrong because increasing provisioned throughput addresses throughput limits but does not reduce latency caused by the file system's performance mode; Max I/O mode directly improves parallelism and reduces latency for high-concurrency operations.

Full explanation →

1421

Multi-Selecteasy

Which TWO of the following are valid methods for monitoring SAP system performance on AWS? (Choose two.)

Select 2 answers

A.Enable AWS CloudTrail to capture system performance logs.

B.Configure SAP Solution Manager to send monitoring data to Amazon CloudWatch via the SAP Cloud Platform.

C.Use AWS Trusted Advisor to monitor real-time CPU utilization.

D.Use Amazon CloudWatch custom metrics to monitor SAP application metrics.

E.Use VPC Flow Logs to monitor database query performance.

AnswersB, D

Solution Manager integration provides comprehensive monitoring.

Why this answer

SAP Solution Manager can be configured to forward monitoring data to Amazon CloudWatch via the SAP Cloud Platform (now SAP BTP) using the Cloud Management Gateway or direct integration. This allows SAP-specific metrics like system load, work process usage, and response times to be visualized and alerted on in CloudWatch, enabling unified monitoring alongside AWS infrastructure metrics.

Exam trap

The trap here is that candidates confuse AWS CloudTrail (audit logging) with performance monitoring, or assume VPC Flow Logs can measure database query performance when they only capture network-level metadata.

Full explanation →

1422

Multi-Selecthard

A company runs SAP S/4HANA on AWS using a multi-ABAP application server setup with a central services instance (ASCS) and enqueue replication. After a recent OS patching, the secondary application server fails to start, with errors indicating it cannot connect to the enqueue replication server (ERS). The ERS process is running on the ASCS instance. The network team confirms that security groups and NACLs are properly configured. Which THREE steps should be taken to resolve this issue? (Choose three.)

Select 3 answers

A.Change the secondary application server instance type to a larger size.

B.Check the SAP instance profile for the enqueue replication parameters (e.g., rdisp/enq_repl_server).

C.Confirm that the ERS process (enre) is running on the ASCS instance and is listening on the correct port.

D.Verify that the DNS or /etc/hosts file on the secondary application server resolves the ERS hostname correctly.

E.Update the SAP kernel on the secondary application server to the latest version.

AnswersB, C, D

Profile parameters define ERS connection details.

Why this answer

The SAP instance profile on the secondary application server may have lost or misconfigured the enqueue replication parameters (e.g., rdisp/enq_repl_server) during the OS patching, which would prevent it from connecting to the ERS. Option C is correct because the ERS process (enre) must be running on the ASCS instance and listening on the correct port; if it stopped or changed ports after patching, connectivity fails. Option D is correct because the secondary application server needs to resolve the ERS hostname correctly via DNS or /etc/hosts; patching may have altered hostname resolution.

Option A is incorrect because changing the instance type does not address connectivity to the ERS; the issue is network or configuration, not sizing. Option E is incorrect because the SAP kernel version is unlikely to change due to OS patching, and updating the kernel is not a standard troubleshooting step for this specific ERS connection issue.

Full explanation →

1423

MCQeasy

An SAP administrator needs to back up an SAP HANA database running on an Amazon EC2 instance. The requirement is to perform daily backups to Amazon S3 with minimal cost and impact on database performance. Which backup strategy should be used?

A.Use AWS Backup with the SAP HANA plugin

B.Use SAP HANA Backint integration to back up to S3

C.Create EBS snapshots of the database volumes

D.Configure S3 Lifecycle policies to move logs

AnswerB

Backint agent sends data directly to S3 with low overhead.

Why this answer

SAP HANA Backint integration allows direct, streaming backups from the HANA database to Amazon S3, which minimizes performance impact by offloading backup processing to the Backint agent and avoids intermediate storage. This approach is cost-effective as it uses S3's low-cost storage and eliminates the need for additional infrastructure, meeting the requirement for daily backups with minimal cost and database performance impact.

Exam trap

The trap here is that candidates often confuse EBS snapshots as a simple, low-cost backup method for databases, but they fail to recognize the performance impact and lack of application consistency without additional configuration, making Backint integration the correct choice for SAP HANA on AWS.

How to eliminate wrong answers

Option A is wrong because AWS Backup with the SAP HANA plugin is not natively supported; AWS Backup does not have a direct SAP HANA plugin for Backint integration, and using it would require additional scripting or third-party tools, increasing complexity and cost. Option C is wrong because creating EBS snapshots of the database volumes captures the entire block-level data, which can cause performance degradation due to I/O freezing or snapshot latency, and does not provide application-consistent backups without additional steps like pre-freeze scripts. Option D is wrong because S3 Lifecycle policies are used for managing object lifecycle transitions and deletions, not for performing backups; they cannot initiate or manage the backup process of an SAP HANA database.

Full explanation →

1424

Multi-Selecthard

A company is designing a disaster recovery solution for SAP S/4HANA. They need to meet an RPO of 15 minutes and an RTO of 2 hours. Which THREE components should be included in the DR plan? (Choose 3.)

Select 3 answers

A.EBS snapshots taken every 15 minutes

B.SAP HANA System Replication in async mode

C.AWS CloudEndure Disaster Recovery

D.Amazon Route 53 DNS failover

E.Pre-built AMIs for SAP application servers

AnswersB, D, E

Async replication can achieve RPO of minutes.

Why this answer

SAP HANA System Replication in async mode is correct because it can achieve an RPO of 15 minutes by asynchronously replicating log buffers from the primary to the DR HANA instance, and combined with a pre-configured DR system, it supports an RTO of 2 hours. This native SAP replication mechanism is optimized for HANA databases and avoids the overhead of storage-level snapshots or third-party tools.

Exam trap

The trap here is that candidates often assume storage-level snapshots (EBS) are sufficient for SAP HANA DR, but they fail to account for the database consistency requirements and the long restore times that make them unsuitable for a 2-hour RTO.

Full explanation →

1425

MCQmedium

A company is migrating an SAP system to AWS and wants to use AWS Systems Manager for patching. The SAP application server is running Windows. What is a prerequisite for Systems Manager to manage the instance?

A.Install the AWS Systems Manager Agent (SSM Agent) on the instance

B.Install the Amazon CloudWatch agent on the instance

C.Enable AWS Config on the instance

D.Assign a public IP address to the instance

AnswerA

SSM Agent is required for Systems Manager to manage the instance.

Why this answer

AWS Systems Manager requires the SSM Agent to be installed and running on managed instances to perform patching and other management operations. The SSM Agent processes Systems Manager requests, executes run commands, and reports instance state back to the Systems Manager service. Without the agent, the instance cannot communicate with the Systems Manager endpoint or receive patching instructions.

Exam trap

The trap here is that candidates often confuse the SSM Agent with the CloudWatch agent or assume a public IP is necessary for AWS management, but Systems Manager can manage instances in private subnets using VPC endpoints or a managed instance gateway.

How to eliminate wrong answers

Option B is wrong because the Amazon CloudWatch agent is used for collecting metrics and logs, not for Systems Manager patching operations; patching relies on the SSM Agent. Option C is wrong because AWS Config is a service for resource inventory and compliance auditing, not a prerequisite for Systems Manager instance management; it does not install any agent on the instance. Option D is wrong because a public IP address is not required; Systems Manager can manage instances in private subnets using VPC endpoints (AWS Systems Manager VPC endpoints) or through a managed instance gateway.

Full explanation →

Page 19 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →