Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 1426–1500

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 20 of 22

1426

MCQmedium

An SAP system on AWS needs to be highly available across multiple Availability Zones (AZs). The SAP Central Services (ASCS) and the database are both critical. Which architecture should be used?

A.Use an Application Load Balancer to distribute traffic across AZs.

B.Deploy ASCS with a cluster across two AZs, and use HANA System Replication across two AZs.

C.Place all components in a single AZ to avoid cross-AZ latency.

D.Use Amazon RDS Multi-AZ for the database and a single ASCS instance.

AnswerB

This provides HA for both ASCS and database across AZs.

Why this answer

SAP ASCS requires a cluster (e.g., Pacemaker with SBD fencing) across two AZs to provide failover for the central services, while HANA System Replication (HSR) synchronously replicates the database to a secondary AZ for automatic failover. This dual-cluster architecture ensures both critical components remain highly available, meeting SAP's certified HA patterns on AWS.

Exam trap

The trap here is that candidates often confuse AWS-managed services like RDS Multi-AZ with SAP-certified HA solutions, failing to recognize that SAP HANA requires native replication and that ASCS must be clustered, not simply load-balanced.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer operates at Layer 7 and cannot manage SAP ASCS or HANA database failover; it is designed for HTTP/HTTPS traffic distribution, not SAP-specific cluster heartbeats or replication. Option C is wrong because placing all components in a single AZ creates a single point of failure; AWS best practices require multi-AZ deployment to survive AZ outages, and cross-AZ latency is negligible (typically <1 ms) for SAP workloads. Option D is wrong because Amazon RDS Multi-AZ does not support SAP HANA or SAP-certified databases; SAP requires native HANA System Replication or a certified DBMS, and a single ASCS instance lacks the clustering needed for high availability.

Full explanation →

1427

MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB and has a 4-hour maintenance window. Which AWS service should be used to minimize downtime during the migration?

A.AWS Database Migration Service (DMS)

B.AWS Server Migration Service (SMS)

C.AWS Application Migration Service (MGN)

D.AWS DataSync

AnswerA

DMS supports continuous replication to minimize downtime.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication with minimal downtime by using change data capture (CDC) to synchronize source and target databases continuously. Option B, AWS Server Migration Service (SMS), is designed for migrating entire server volumes, not databases. Option C, AWS Application Migration Service (MGN), automates server migration but is not optimized for database replication.

Option D, AWS DataSync, is for transferring large file sets to or from AWS storage services, not for live database replication.

Full explanation →

1428

MCQeasy

An SAP system is running on an EC2 instance with an instance profile that grants access to an S3 bucket. The application is unable to read a specific object from the bucket. What is the first step to troubleshoot the issue?

A.Check the security group associated with the instance

B.Check the network ACLs

C.Check the IAM policy attached to the instance profile

D.Check the S3 bucket policy

AnswerC

The instance profile's IAM role must have s3:GetObject permission for the object.

Why this answer

The instance profile grants the EC2 instance permissions to access the S3 bucket via IAM roles. If the application cannot read a specific object, the most likely cause is that the IAM policy attached to the instance profile does not include the necessary permissions (e.g., s3:GetObject) for that object. Checking the IAM policy is the first logical step because it directly controls the identity-based access for the instance.

Exam trap

The trap here is that candidates often jump to checking the S3 bucket policy first, forgetting that the instance profile's IAM policy is the primary gatekeeper for EC2-based access, and bucket policies only come into play if the IAM policy allows the action.

How to eliminate wrong answers

Option A is wrong because security groups control network traffic at the instance level (Layer 3/4), not access to S3 objects, which is handled by IAM or bucket policies. Option B is wrong because network ACLs operate at the subnet level and also do not govern S3 object-level permissions. Option D is wrong because while the S3 bucket policy could deny access, the instance profile's IAM policy is the primary authorization mechanism for the EC2 instance; checking it first is more efficient, and bucket policies are typically used for cross-account or public access scenarios.

Full explanation →

1429

MCQhard

A company is migrating an SAP ERP system to AWS and needs to ensure that the SAP application servers can scale automatically based on CPU utilization. Which AWS service should be used to achieve this?

A.AWS Elastic Load Balancing (ELB)

B.AWS Lambda

C.AWS CloudFormation

D.AWS Auto Scaling

AnswerD

Auto Scaling can launch/terminate instances based on CloudWatch alarms.

Why this answer

AWS Auto Scaling can automatically adjust the number of EC2 instances based on CloudWatch alarms for CPU utilization, making it suitable for scaling SAP application servers. Option A is wrong because Elastic Load Balancing distributes traffic but does not scale instances. Option B is wrong because AWS Lambda is for serverless compute, not for running SAP application servers.

Option C is wrong because AWS CloudFormation is an infrastructure-as-code service, not for automatic scaling.

Full explanation →

1430

MCQmedium

An SAP Basis administrator is setting up an SAP HANA database in a Multi-AZ deployment on AWS. They need to ensure that the database remains available during an Availability Zone failure. Which AWS services should be used together to achieve this?

A.AWS CloudWatch alarms and AWS Lambda

B.Auto Scaling groups and Elastic Load Balancer

C.SAP HANA System Replication and Amazon Route 53

D.Amazon RDS Multi-AZ and Route 53

AnswerC

HANA System Replication provides data replication, and Route 53 provides DNS failover.

Why this answer

SAP HANA System Replication (HSR) provides synchronous or asynchronous replication of HANA databases across Availability Zones, ensuring data consistency and failover capability. Amazon Route 53 with health checks and DNS failover routing automatically redirects client traffic to the standby HANA instance in the secondary AZ when the primary fails, together achieving Multi-AZ high availability for SAP HANA.

Exam trap

The trap here is that candidates confuse Amazon RDS Multi-AZ (which is a managed service for traditional databases like MySQL or Oracle) with SAP HANA, but SAP HANA on AWS requires self-managed replication via HSR and DNS-based routing, not RDS.

How to eliminate wrong answers

Option A is wrong because CloudWatch alarms and Lambda can automate responses to metrics but do not provide database-level replication or DNS-based failover for HANA. Option B is wrong because Auto Scaling groups and Elastic Load Balancer are designed for stateless web/application tiers, not for stateful database replication or HANA-specific failover. Option D is wrong because Amazon RDS Multi-AZ is a managed database service that does not support SAP HANA; SAP HANA must be deployed on EC2 with its own replication mechanisms.

Full explanation →

1431

MCQeasy

A company is planning to run SAP Business Suite on AWS. They need to ensure that the SAP systems are backed up according to best practices. Which backup strategy is recommended for SAP HANA databases on AWS?

A.Use AWS Backup to automatically back up the HANA database

B.Schedule HANA backups to Amazon S3 using the HANA backup tool

C.Perform daily full EBS snapshots and store them in Glacier

D.Use only EBS snapshots for all SAP HANA volumes

AnswerB

SAP HANA backups to S3 are recommended for durability and cost-effectiveness, using Backint or similar tools.

Why this answer

SAP HANA backups should be stored on Amazon S3 for durability and cost-effectiveness. EBS snapshots are not sufficient for HANA because they are crash-consistent but not application-consistent for HANA. Combining EBS snapshots with HANA backups ensures both crash consistency and recoverability.

Daily full backups are not required; incremental/differential backups are more efficient.

Full explanation →

1432

MCQeasy

A company is running SAP HANA on AWS and needs to ensure that the database can be recovered to a specific point in time within the last 24 hours. Which backup strategy should be used?

A.Incremental backups using Backint

B.Daily full EBS snapshots

C.Daily SAP HANA full backups

D.Full backups plus log backups every 5 minutes

AnswerD

This combination enables point-in-time recovery by allowing the database to be restored to any point between full backups using log backups.

Why this answer

Full plus log backups enable point-in-time recovery. Option A is wrong because single snapshot does not allow point-in-time. Option B is wrong because full backups only restore to backup time.

Option C is wrong because daily full backups only restore to the time of the backup, not point-in-time.

Full explanation →

1433

MCQeasy

A company is migrating a file server to AWS and needs a scalable, highly available file storage solution that supports the SMB protocol. Which AWS service should be used?

A.Amazon Elastic File System (EFS)

B.AWS Storage Gateway

C.Amazon Simple Storage Service (S3)

D.Amazon FSx for Windows File Server

AnswerD

Supports SMB protocol.

Why this answer

Amazon FSx for Windows File Server supports SMB protocol and provides fully managed Windows file servers. Option A (Amazon EFS) supports NFS, not SMB. Option B (Amazon S3) is object storage.

Option D (AWS Storage Gateway) can present file shares but is not a fully managed file server.

Full explanation →

1434

Multi-Selectmedium

An SAP administrator is designing a backup strategy for SAP HANA on AWS. Which THREE practices should be implemented to ensure reliable backups?

Select 3 answers

A.Store backups in Amazon S3 One Zone-IA

B.Disable encryption on backup targets to reduce latency

C.Take consistent EBS snapshots of HANA volumes after quiescing the database

D.Enable S3 Versioning on the backup bucket

E.Automate backups using AWS Backup with a backup plan

AnswersC, D, E

Consistent snapshots ensure data integrity.

Why this answer

Consistent EBS snapshots of HANA volumes after quiescing the database ensure crash-consistent backups, which are essential for SAP HANA's data integrity. Quiescing flushes all in-memory data to disk and freezes I/O, allowing the snapshot to capture a point-in-time state that HANA can recover from without corruption. Without quiescing, snapshots may be inconsistent and lead to database failures during restore.

Exam trap

The trap here is that candidates may think S3 One Zone-IA is acceptable for backups due to lower cost, but AWS explicitly recommends Standard or Standard-IA for critical backups, and the exam tests awareness of durability requirements for SAP workloads.

Full explanation →

1435

MCQmedium

An SAP system running on EC2 is experiencing intermittent connectivity issues between application servers and the database server. The network team suspects that the security group rules are too restrictive. What is the best approach to identify which traffic is being blocked?

A.Check the SAP application logs for connection errors.

B.Enable AWS CloudTrail and look for security group modification events.

C.Use Amazon CloudWatch to monitor network packets.

D.Enable VPC Flow Logs on the subnet or ENI and review the logs for rejected traffic.

AnswerD

VPC Flow Logs capture information about IP traffic going to and from network interfaces.

Why this answer

VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC. They can show accepted and rejected traffic, making them ideal for identifying blocked traffic. Option A is wrong because SAP application logs only show connection errors from the application's perspective, not network-level blocking.

Option B is wrong because CloudTrail logs API calls (e.g., security group changes), not network traffic. Option C is wrong because CloudWatch metrics aggregate network data but do not provide per-packet detail to identify rejected traffic.

Full explanation →

1436

Multi-Selecteasy

Which TWO of the following are benefits of using SAP HANA System Replication (HSR) on AWS? (Choose 2.)

Select 2 answers

A.Supports replication across AWS Regions for disaster recovery

B.Provides near real-time data replication for high availability

C.Improves query performance by distributing workloads

D.Automatically scales storage based on database growth

E.Automatically load balances read queries between primary and secondary

AnswersA, B

HSR can be configured across regions.

Why this answer

SAP HANA System Replication (HSR) supports asynchronous replication across AWS Regions, enabling disaster recovery by maintaining a secondary system in a different geographic region. This allows failover to the secondary site if the primary region becomes unavailable, meeting RPO and RTO requirements for cross-region DR scenarios.

Exam trap

The trap here is that candidates confuse HSR's ability to support read-enabled secondaries (which is an optional configuration, not automatic load balancing) with the automatic read query distribution seen in other database technologies like Amazon Aurora, leading them to incorrectly select Option E.

Full explanation →

1437

Multi-Selecthard

Which THREE of the following are requirements for running SAP HANA in an AWS multi-zone HA cluster? (Choose three.)

Select 3 answers

A.At least two EC2 instances in different Availability Zones per node type.

B.Separate EBS volumes for /hana/data and /hana/log directories.

C.Use of an Elastic Load Balancer to distribute traffic to the HANA nodes.

D.All nodes must use instance store volumes for the HANA data.

E.The cluster nodes must be within the same AWS region.

AnswersA, B, E

Multi-AZ provides high availability.

Why this answer

SAP HANA in a multi-zone HA cluster requires at least two EC2 instances per node type (e.g., worker, standby) deployed in different Availability Zones to ensure high availability. This architecture allows automatic failover between zones, maintaining SAP HANA system replication and cluster quorum in the event of an AZ failure.

Exam trap

The trap here is that candidates often assume an Elastic Load Balancer is needed for distributing traffic to HANA nodes, but SAP HANA HA uses system replication and cluster-managed virtual IPs, not load balancers, for failover.

Full explanation →

1438

MCQmedium

An SAP administrator is deploying an SAP ASCS instance using CloudFormation. The deployment fails because the instance cannot be reached from other SAP components. Based on the exhibit, what is the most likely cause?

A.The instance type m5.large is not certified for SAP ASCS.

B.The security group does not allow inbound traffic on the required SAP ports.

C.The instance lacks an IAM role to join the SAP domain.

D.The root volume is too small and uses gp2, which is not supported for SAP.

AnswerB

The template does not specify inbound rules; without proper security group rules, other components cannot connect.

Why this answer

The SAP ASCS instance must be reachable by other SAP components (e.g., PAS, AAS) on specific ports for services like the SAP Message Server (port 36xx/TCP) and SAP Enqueue Server (port 32xx/TCP). The exhibit shows the security group lacks inbound rules for these ports, so traffic from other components is blocked, causing the deployment to fail. Without proper inbound access, the ASCS instance cannot participate in the SAP system's communication, leading to the unreachability error.

Exam trap

The trap here is that candidates often focus on instance certification or storage requirements, overlooking the fundamental network connectivity issue caused by missing security group inbound rules for SAP-specific ports.

How to eliminate wrong answers

Option A is wrong because the m5.large instance type is certified for SAP ASCS on AWS, provided it meets the SAPS and memory requirements for the workload. Option C is wrong because SAP ASCS does not require an IAM role to join an SAP domain; IAM roles are used for AWS API access, not for SAP domain membership (which uses SAP-specific authentication). Option D is wrong because the root volume size and gp2 type are supported for SAP on AWS; gp2 is a valid EBS volume type for SAP, and the root volume size (e.g., 20 GiB) is typically sufficient for the OS and SAP binaries, though additional volumes are used for data.

Full explanation →

1439

MCQeasy

A company is migrating a fleet of 200 on-premises Windows servers to AWS. The servers run a mix of custom applications and Microsoft SQL Server databases. The migration plan includes using AWS Server Migration Service (SMS) for the servers and AWS Database Migration Service (DMS) for the databases. During the initial replication, several servers fail with the error 'Unable to create AMI: Insufficient permissions'. The IAM role used by SMS has the following policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:Describe*","ec2:CreateImage","ec2:RegisterImage","s3:PutObject","s3:GetObject","s3:ListBucket"],"Resource":"*"}]}. Which change should be made to resolve the error?

A.Remove the s3:PutObject action from the policy

B.Configure a VPC endpoint for EC2

C.Add ec2:CreateSnapshot action to the policy

D.Add ec2:ImportImage action to the policy

AnswerC

SMS requires CreateSnapshot to create snapshots before creating AMIs.

Why this answer

SMS requires the ec2:CreateSnapshot permission to create snapshots of volumes before creating AMIs. The error 'Unable to create AMI: Insufficient permissions' indicates that this permission is missing from the IAM policy. Option A is incorrect because removing s3:PutObject would not resolve the error; the issue is about EC2 permissions, not S3.

Option B is incorrect because the error is not related to network connectivity; a VPC endpoint for EC2 would not grant the necessary permissions. Option D is incorrect because ec2:ImportImage is used for importing virtual machine images, not for creating AMIs from existing instances via SMS.

Full explanation →

1440

MCQeasy

A company is planning to run SAP applications on AWS. The security team requires that all data transmitted between the SAP application servers and the SAP HANA database be encrypted in transit. The SAP HANA database is on an EC2 instance in the same VPC. The application servers are also in the same VPC. Which configuration should the company implement to meet the encryption requirement with minimal impact on performance?

A.Use AWS PrivateLink to connect the application to the database

B.Enable SAP HANA TLS/SSL encryption for the database connections

C.Use VPC peering between the application and database subnets

D.Set up a VPN connection between the application and database servers

AnswerB

TLS/SSL encryption secures data in transit between SAP application and database servers.

Why this answer

Enabling SAP HANA TLS/SSL encryption encrypts data in transit between application and database servers directly, with minimal performance impact as it is built into the SAP HANA client-server protocol. Option A is incorrect: AWS PrivateLink is used for private connectivity to services across VPCs or to AWS services, not for encrypting internal traffic within the same VPC, and introduces unnecessary complexity. Option C is incorrect: VPC peering connects separate VPCs but does not encrypt traffic by default; it also is not needed when both servers are in the same VPC.

Option D is incorrect: a VPN connection adds network overhead and is designed for connectivity across networks or the internet, which is unnecessary and suboptimal for same-VPC communication.

Full explanation →

1441

Multi-Selectmedium

Which THREE AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose 3)

Select 3 answers

A.AWS Config

B.Amazon CloudWatch Logs

C.SAP HANA built-in monitoring (e.g., SAP HANA Studio, SQL queries)

D.Amazon CloudWatch

E.AWS CloudTrail

AnswersB, C, D

CloudWatch Logs can ingest and monitor SAP HANA trace logs.

Why this answer

Options B, C, and D are correct. Amazon CloudWatch can monitor EC2-level metrics like CPU, memory, and disk I/O, which are critical for SAP HANA performance. Amazon CloudWatch Logs can collect and analyze SAP HANA log files for deeper insights.

SAP HANA built-in monitoring (e.g., SAP HANA Studio) provides detailed database performance metrics. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not performance. Option E (AWS CloudTrail) is incorrect because it tracks API calls, not performance.

Full explanation →

1442

Multi-Selecthard

Which THREE factors must be considered when choosing an EC2 instance type for SAP HANA production workloads?

Select 3 answers

A.Burstable CPU performance (T3 instances)

B.GPU compute capability

C.EBS-optimized support for consistent I/O

D.SAP certification of the instance type

E.Memory (RAM) size required by SAP HANA

AnswersC, D, E

Necessary for HANA performance.

Why this answer

SAP HANA is an in-memory database that requires consistent, low-latency I/O for data persistence and log writes. EBS-optimized instances dedicate network bandwidth to EBS traffic, eliminating contention with other network traffic and ensuring predictable I/O performance, which is critical for production SAP HANA workloads.

Exam trap

The trap here is that candidates may assume burstable instances (T3) are suitable for any workload due to their cost-effectiveness, but SAP HANA requires sustained performance and SAP certification, which T3 instances lack.

Full explanation →

1443

MCQmedium

A company has an SAP HANA database running on an EC2 instance with EBS volumes. The operations team needs to ensure that database backups are stored in Amazon S3 and are automatically deleted after 90 days. What is the most efficient way to achieve this?

A.Use S3 Object Lock with a retention period of 90 days.

B.Enable S3 Versioning and delete old versions manually.

C.Write a script that runs daily to list backups older than 90 days and delete them.

D.Configure an S3 Lifecycle policy to expire objects after 90 days.

AnswerD

Lifecycle policies automate deletion without custom code.

Why this answer

S3 Lifecycle policies can automatically expire objects after a specified number of days, meeting the requirement for automated deletion after 90 days. Option A is incorrect because S3 Object Lock prevents deletion or modification, not automates it. Option B is incorrect because versioning alone does not delete objects; manual deletion would be needed.

Option C is incorrect because a script is less efficient than a built-in lifecycle policy.

Full explanation →

1444

MCQeasy

A company is deploying SAP S/4HANA on AWS and needs to back up the HANA database to Amazon S3. The database is 1 TB and changes frequently. The backup must be completed within 4 hours. What is the most efficient backup method?

A.Take EBS snapshots of the HANA data volumes and copy them to S3.

B.Export the HANA database to a file and manually upload to S3 using AWS CLI.

C.Use AWS Backup to schedule HANA database backups to S3.

D.Configure SAP HANA Backint agent to stream backups directly to Amazon S3.

AnswerD

Backint provides efficient, integrated streaming backups to S3.

Why this answer

SAP HANA Backint for Amazon S3 is the most efficient backup method because it enables direct, integrated streaming of HANA backups to S3 without intermediate files or manual steps. This reduces backup time and complexity. Option A (EBS snapshots) captures entire volumes, not a database-consistent backup, and requires additional steps to copy to S3.

Option B (manual export and upload) is slow and error-prone for a 1 TB database. Option C (AWS Backup) supports HANA but is less integrated than Backint and may not meet the 4-hour window efficiently. Therefore, configuring the SAP HANA Backint agent to stream directly to S3 is the best choice.

Full explanation →

1445

Multi-Selecthard

A company is deploying a mission-critical SAP S/4HANA system on AWS. They need to ensure the highest level of availability and minimize data loss. Which TWO strategies should they implement? (Choose two.)

Select 2 answers

A.Use EC2 Spot Instances for the primary application server

B.Configure automated EBS snapshots every 5 minutes

C.Use Amazon RDS Multi-AZ for the HANA database

D.Set up HANA System Replication in synchronous mode across two Availability Zones

E.Deploy the ASCS and PAS instances in a cluster with Pacemaker across AZs

AnswersD, E

Synchronous replication ensures no data loss and automatic failover.

Why this answer

HANA System Replication in synchronous mode ensures that every committed transaction is written to the primary and replicated to a secondary HANA instance before the commit is acknowledged. This provides near-zero data loss (RPO=0) and, combined with automatic failover, supports high availability across Availability Zones.

Exam trap

The trap here is that candidates often confuse Amazon RDS Multi-AZ with SAP HANA database replication, but SAP HANA is not supported on RDS and must be managed directly on EC2 with HANA System Replication.

Full explanation →

1446

Multi-Selecthard

Which THREE of the following are best practices for securing SAP systems on AWS?

Select 3 answers

A.Encrypt EBS volumes using AWS KMS.

B.Use security groups to restrict traffic between SAP application and database tiers.

C.Use IAM roles for EC2 instances to access AWS services.

D.Place all SAP instances in public subnets for easier access.

E.Store AWS credentials in the SAP application code for API access.

AnswersA, B, C

Encryption protects data at rest.

Why this answer

Encrypting EBS volumes using AWS KMS is a best practice because it ensures data at rest is protected with encryption keys managed by AWS Key Management Service. This is critical for SAP systems that handle sensitive business data, as it meets compliance requirements and prevents unauthorized access to the underlying storage. KMS integration with EBS provides transparent encryption with minimal performance impact, and key rotation policies can be enforced automatically.

Exam trap

The trap here is that candidates may assume placing SAP instances in public subnets simplifies access for administration or external integrations, but AWS explicitly requires private subnets for production workloads to enforce network isolation and security group control.

Full explanation →

1447

MCQmedium

A company runs a critical SAP HANA database on an m5.24xlarge EC2 instance. The database has high transaction volume and requires low latency storage. The current setup uses EBS gp2 volumes with 10,000 IOPS. During peak hours, the database performance degrades due to IOPS burst balance depletion. Which storage solution should the company use to maintain consistent performance?

A.Migrate to EBS gp3 volumes with provisioned IOPS of 10,000.

B.Use EC2 Instance Store (NVMe SSD) for the database data and logs.

C.Provision EBS io2 Block Express volumes with 10,000 provisioned IOPS.

D.Move the database to Amazon EFS with provisioned throughput.

AnswerC

io2 Block Express provides consistent IOPS and is designed for high-performance workloads.

Why this answer

EBS io2 Block Express volumes provide consistent, low-latency performance with provisioned IOPS, making them the recommended choice for SAP HANA workloads. Option A is wrong because although gp3 volumes can provision 10,000 IOPS and would eliminate burst balance depletion, io2 Block Express is specifically designed for high-performance databases like SAP HANA, offering higher durability and consistent low-latency performance. Option B is wrong because Instance Store is ephemeral and data is lost if the instance stops.

Option D is wrong because EFS is a file system, not suitable for block-level database storage.

Full explanation →

1448

MCQhard

A company runs SAP S/4HANA on AWS in a single region with a multi-AZ setup. The SAP HANA database uses HANA System Replication (HSR) for high availability. The primary HANA instance is in us-east-1a and the secondary is in us-east-1b. The application servers are split across both AZs. Recently, during a maintenance window, the primary HANA instance failed unexpectedly. The secondary automatically took over. However, after the failover, the application servers in us-east-1a are experiencing higher latency when connecting to the database, while application servers in us-east-1b have normal latency. The network team confirms that the inter-AZ latency is within normal limits. Which of the following is the MOST likely cause of the increased latency?

A.The secondary HANA instance is using a different instance type with a single Elastic Network Interface (ENI), which limits throughput.

B.The placement group that includes the application servers and the database is now split across AZs, reducing performance.

C.The application servers in us-east-1a are now connecting to the HANA database in us-east-1b, which adds inter-AZ latency.

D.The EBS volumes attached to the old primary instance are still being replicated to the secondary, causing network congestion.

AnswerC

Previously, all connections were within the same AZ; after failover, half the servers must connect across AZs.

Why this answer

After the failover, the secondary HANA instance in us-east-1b became the active database. Application servers in us-east-1a must now connect across AZs to reach the database in us-east-1b, incurring inter-AZ latency. Although the network team confirms normal inter-AZ latency, the additional network hop and physical distance between AZs still introduce higher latency compared to same-AZ connections, which explains the observed increase.

Exam trap

The trap here is that candidates may assume inter-AZ latency is negligible or that the network team's confirmation of 'normal limits' means latency is not the issue, but in SAP HANA workloads, even 1-2 ms of additional latency can cause noticeable performance degradation for cross-AZ database connections.

How to eliminate wrong answers

Option A is wrong because the instance type and number of ENIs affect network throughput, not latency; a single ENI does not inherently cause higher latency, and HSR failover does not change the instance type of the secondary. Option B is wrong because placement groups are not used for SAP HANA multi-AZ setups; they are designed for low-latency within a single AZ, and splitting a placement group across AZs would not be configured in this architecture. Option D is wrong because EBS volume replication is not part of HSR; HSR uses log-based replication over the network, and EBS volumes are not replicated between instances; the old primary's volumes are irrelevant after failover.

Full explanation →

1449

Multi-Selectmedium

An SAP administrator is configuring high availability for SAP HANA on AWS. Which TWO components are essential for a Pacemaker-based cluster?

Select 2 answers

A.A quorum device (e.g., STONITH)

B.An Application Load Balancer

C.Amazon Route 53 health checks

D.A virtual IP address

E.Amazon CloudWatch alarms

AnswersA, D

STONITH ensures node fencing to prevent split-brain.

Why this answer

A quorum device (e.g., STONITH) is essential for a Pacemaker-based cluster because it provides fencing, which ensures that a failed or partitioned node cannot continue to access shared resources or cause data corruption. STONITH (Shoot The Other Node In The Head) acts as the cluster's final arbiter, forcibly isolating or powering off an unresponsive node to maintain data integrity and prevent split-brain scenarios.

Exam trap

The trap here is that candidates often confuse high-availability components like load balancers or DNS health checks with the cluster-internal mechanisms (fencing and VIP) that Pacemaker specifically requires to maintain data consistency and provide a single endpoint for SAP HANA clients.

Full explanation →

1450

Multi-Selectmedium

A company is deploying SAP NetWeaver on AWS and needs to set up high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The company uses a shared file system for the transport directory. Which components are essential for the HA setup? (Choose TWO.)

Select 2 answers

A.Amazon S3 as the transport directory.

B.An internal Application Load Balancer (ALB) to distribute traffic to the ASCS instance.

C.Both ASCS and ERS instances must run on the same EC2 instance.

D.Amazon RDS Multi-AZ for the SAP database.

E.The ASCS and ERS instances must be located in different Availability Zones.

AnswersB, E

ALB provides a virtual IP for ASCS.

Why this answer

An internal Application Load Balancer (ALB) is essential because it provides a virtual IP address and health checks for the SAP ASCS instance. In a multi-AZ HA setup, the ALB routes client traffic to the active ASCS instance and automatically fails over to the standby instance if the primary fails, ensuring continuous access to SAP Central Services.

Exam trap

The trap here is that candidates often confuse the HA requirements for SAP Central Services with those for the database layer, leading them to select Amazon RDS Multi-AZ (Option D) instead of focusing on the ASCS/ERS-specific components like the ALB and multi-AZ placement.

Full explanation →

1451

MCQhard

An organization is migrating an SAP system from on-premises to AWS. The SAP system uses a shared file system (NFS) for transport directories. The company wants a fully managed NFS solution on AWS. Which service should they use?

A.Amazon Elastic Block Store (EBS)

B.Amazon FSx for Windows File Server

C.Amazon Elastic File System (EFS)

D.Amazon S3

AnswerC

Managed NFS file system.

Why this answer

Amazon EFS is a fully managed NFS file system that supports the NFSv4.1 and NFSv4.0 protocols, making it the ideal choice for SAP transport directories that require a shared POSIX-compliant file system. It provides high availability, automatic scaling, and eliminates the need to manage underlying storage infrastructure, directly matching the requirement for a fully managed NFS solution on AWS.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared file system because it can be formatted with a file system, but they overlook that EBS volumes cannot be attached to multiple EC2 instances simultaneously without additional clustering software, making it unsuitable for NFS-based SAP transport directories.

How to eliminate wrong answers

Option A is wrong because Amazon EBS provides block-level storage volumes that can be attached to a single EC2 instance at a time; it does not natively support NFS or multi-instance shared access without additional configuration (e.g., using a cluster file system). Option B is wrong because Amazon FSx for Windows File Server uses the SMB protocol, not NFS, and is designed for Windows-based workloads, not for SAP transport directories that require NFS. Option D is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system with NFS protocol support, and does not provide the POSIX file system semantics required by SAP.

Full explanation →

1452

MCQhard

A company is deploying SAP S/4HANA on AWS and needs to ensure that the system can survive a single Availability Zone failure. Which architecture meets this requirement?

A.Store the database files on Amazon S3 and mount them to the EC2 instance

B.Deploy an active-passive setup with the primary in one AZ and a standby in another AZ, using replication

C.Use Amazon RDS Multi-AZ for the SAP HANA database

D.Deploy a single EC2 instance in one Availability Zone with EBS snapshots

AnswerB

Active-passive with cross-AZ standby ensures availability if one AZ fails.

Why this answer

An active-passive SAP HANA setup with the primary in one Availability Zone (AZ) and a standby in another AZ, using HANA System Replication (HSR) in synchronous mode, ensures zero data loss and automatic failover if a single AZ fails. This architecture meets the SAP S/4HANA requirement for high availability (HA) across AZs, as HSR replicates data at the database level, and the standby can take over within minutes.

Exam trap

The trap here is that candidates often confuse Amazon RDS Multi-AZ with SAP HANA HA, but RDS Multi-AZ is a managed service for non-SAP databases and does not support SAP HANA, which requires self-managed HSR on EC2 for cross-AZ failover.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service that cannot be mounted as a file system to an EC2 instance for SAP HANA database files; SAP HANA requires block storage (e.g., Amazon EBS) with low latency and consistent I/O, and S3 lacks the necessary POSIX file system semantics and performance characteristics. Option C is wrong because Amazon RDS Multi-AZ does not support SAP HANA as a database engine; RDS supports MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB, but SAP HANA must be deployed on EC2 instances with HSR for HA. Option D is wrong because a single EC2 instance with EBS snapshots provides backup and point-in-time recovery, but it cannot survive an AZ failure since there is no standby instance in another AZ; recovery from snapshots takes minutes to hours and involves data loss, not automatic failover.

Full explanation →

1453

MCQeasy

A company wants to monitor the disk space utilization of their SAP application servers. Which AWS service can provide a centralized view of disk space metrics without installing additional agents?

A.AWS Systems Manager Inventory

B.Amazon CloudWatch

C.AWS CloudTrail

D.Amazon Inspector

AnswerA

Systems Manager Inventory collects OS-level information, including disk space, using the SSM Agent which is often pre-installed.

Why this answer

AWS Systems Manager Inventory (Option A) is correct because it can collect disk space utilization metrics from managed instances without requiring the installation of additional agents—the SSM Agent is either pre-installed on many Amazon Machine Images (AMIs) or installed as part of standard Systems Manager setup, so it is not considered an extra agent. In contrast, Amazon CloudWatch (Option B) requires the CloudWatch agent to collect disk metrics, which would be an additional installation. AWS CloudTrail (Option C) records API calls and does not monitor disk space.

Amazon Inspector (Option D) is a vulnerability assessment service and does not provide disk metrics.

Full explanation →

1454

MCQhard

Your company runs SAP ERP on AWS with a multi-AZ deployment. The SAP HANA database is replicated across two Availability Zones using HANA System Replication. The application servers are behind an Application Load Balancer. During a recent Availability Zone failure, the primary HANA instance failed, and the standby took over. However, the application servers continued to try to connect to the primary instance for several minutes, causing downtime. The DNS record for the database endpoint was manually updated after the failover. What is the most effective solution to automate the failover and minimize downtime?

A.Configure a Network Load Balancer in front of the HANA instances

B.Create a custom script on each application server to detect failover and update the connection string

C.Implement Amazon Route 53 DNS failover with health checks on the primary and secondary HANA instances

D.Use an Amazon RDS for SAP HANA instead of self-managed

AnswerC

Route 53 health checks detect primary failure and automatically route to the secondary.

Why this answer

Using Amazon Route 53 with a primary and secondary routing policy and health checks can automatically update DNS to the healthy instance. Option C is correct.

Full explanation →

1455

Multi-Selecthard

A company is migrating an SAP S/4HANA system to AWS. The system requires high availability for the database and application layers. Which THREE components should the company configure to achieve high availability for SAP S/4HANA on AWS?

Select 3 answers

A.Pacemaker cluster for SAP Central Services

B.Multi-AZ deployment for SAP HANA database

C.Single Availability Zone deployment

D.Amazon EFS for SAP transport directory

E.AWS Transit Gateway

AnswersA, B, D

Pacemaker manages failover.

Why this answer

To achieve high availability for SAP S/4HANA on AWS, three components are required. A Pacemaker cluster (option A) manages SAP Central Services (ASCS and ERS) by automating failover. Multi-AZ deployment for SAP HANA (option B) ensures database high availability by replicating across Availability Zones.

Amazon EFS (option D) provides a shared file system for the SAP transport directory, essential for consistent failover. Option C (Single Availability Zone) lacks redundancy, and option E (AWS Transit Gateway) is a networking component unrelated to high availability.

Full explanation →

1456

MCQhard

A company runs SAP S/4HANA in a multi-AZ deployment with a standby database in a different Availability Zone. The primary database fails. What is the expected behavior of the SAP HANA system replication?

A.A new standby database is automatically provisioned in the same AZ.

B.The standby database automatically takes over as the new primary.

C.The primary database is automatically restarted in the same AZ.

D.The administrator must manually promote the standby database.

AnswerB

SAP HANA system replication with sync mode enables automatic failover.

Why this answer

With SAP HANA system replication in synchronous mode, the standby database automatically takes over as the new primary when the primary fails, ensuring high availability. Option A is incorrect because a new standby is not automatically provisioned; the existing standby in the other AZ becomes the new primary. Option C is incorrect because the primary database is not restarted in the same AZ; the failover goes to the standby.

Option D is incorrect because automatic failover eliminates the need for manual intervention.

Full explanation →

1457

MCQeasy

A company wants to use an SAP-certified AMI for a non-production SAP system to reduce deployment time. Which AWS service provides access to SAP-certified AMIs?

A.EC2 Image Builder

B.AWS Systems Manager

C.AWS Marketplace

D.AWS Service Catalog

AnswerC

Marketplace provides SAP-certified AMIs for quick deployment.

Why this answer

AWS Marketplace is the correct service because it provides access to SAP-certified AMIs that have been pre-configured and validated by SAP for running SAP workloads on AWS. These AMIs are published by AWS and SAP partners, ensuring compliance with SAP's certification requirements and reducing deployment time for non-production systems.

Exam trap

The trap here is that candidates may confuse AWS Marketplace with EC2 Image Builder or AWS Service Catalog, assuming that any AMI management or catalog service can provide certified images, but only AWS Marketplace hosts the official SAP-certified AMIs.

How to eliminate wrong answers

Option A is wrong because EC2 Image Builder is used to create and maintain custom AMIs, but it does not provide access to pre-existing SAP-certified AMIs. Option B is wrong because AWS Systems Manager is a management service for operational tasks like patching and automation, not a repository for certified AMIs. Option D is wrong because AWS Service Catalog allows organizations to create and manage a catalog of approved IT services, but it does not host SAP-certified AMIs directly; it can only reference AMIs from sources like AWS Marketplace.

Full explanation →

1458

MCQhard

An architect is designing a disaster recovery (DR) solution for an SAP ERP system on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The SAP application uses an Oracle database. The RTO is 4 hours and RPO is 1 hour. Which solution meets these requirements with the least operational overhead?

A.Set up Oracle Active Data Guard between the primary and DR regions

B.Take daily EBS snapshots of the database volumes and copy them to us-west-2, then restore using the snapshots

C.Use AWS Backup to copy EC2 AMIs and RDS snapshots to us-west-2 every hour

D.Configure AWS Database Migration Service (DMS) with ongoing replication from the primary Oracle database to a standby in us-west-2

AnswerD

DMS provides continuous replication, meeting RPO of 1 hour, and can be automated for failover.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication provides continuous change data capture (CDC) from the primary Oracle database to a standby in us-west-2, meeting the 1-hour RPO and 4-hour RTO with minimal operational overhead. DMS handles schema conversion, replication, and failover without requiring manual intervention or complex Oracle licensing, making it the most efficient choice for cross-region DR.

Exam trap

AWS often tests the misconception that native Oracle replication tools like Data Guard are always the best choice for DR, but the question emphasizes 'least operational overhead,' and DMS avoids the licensing and management burden of Active Data Guard while still meeting the RPO/RTO.

How to eliminate wrong answers

Option A is wrong because Oracle Active Data Guard requires Oracle Database Enterprise Edition with the Active Data Guard option, which adds significant licensing costs and operational complexity for managing Data Guard brokers, log transport, and failover scripts on EC2. Option B is wrong because daily EBS snapshots cannot achieve a 1-hour RPO, as snapshots are taken only once per day and the restore process from snapshots takes hours, exceeding the 4-hour RTO. Option C is wrong because AWS Backup copying EC2 AMIs and RDS snapshots every hour still results in a maximum RPO of 1 hour only if snapshots are taken exactly on the hour, but restoring from AMIs or RDS snapshots typically takes longer than 4 hours due to volume initialization and database recovery, and this approach does not support ongoing replication for near-zero data loss.

Full explanation →

1459

Multi-Selecthard

An SAP administrator is setting up a disaster recovery (DR) site for SAP S/4HANA in a different AWS Region. To minimize data loss, which THREE strategies should be implemented? (Choose THREE.)

Select 3 answers

A.Set up automated EBS snapshots of HANA volumes and copy them to the DR region.

B.Implement cross-Region replication for Amazon EFS file systems used for SAP transport.

C.Configure SAP HANA system replication using asynchronous mode across regions.

D.Use EBS Multi-Attach volumes to share disks between regions.

E.Use Amazon CloudFront to cache HANA data in the DR region.

AnswersA, B, C

Snapshots provide recoverable point-in-time copies in the DR region.

Why this answer

Automated EBS snapshots of HANA volumes can be copied to the DR region using AWS Backup or custom scripts, providing point-in-time recovery with minimal data loss. This strategy ensures that persistent data is asynchronously replicated across regions, which is a standard approach for SAP disaster recovery.

Exam trap

The trap here is that candidates may confuse EBS Multi-Attach (a single-AZ feature) with cross-region replication, or assume CloudFront can serve as a database cache, when in fact it is only for HTTP/HTTPS content delivery and cannot handle SAP HANA data.

Full explanation →

1460

MCQmedium

A company is migrating its SAP ERP system from on-premises to AWS. The migration involves a heterogeneous database migration from Oracle to SAP HANA. Which AWS service should be used to perform the database migration with minimal downtime?

A.AWS Schema Conversion Tool (AWS SCT)

B.AWS Server Migration Service (SMS)

C.AWS Database Migration Service (AWS DMS) with a heterogeneous migration using the SAP HANA target endpoint

D.AWS Database Migration Service (AWS DMS) with a homogeneous migration

AnswerC

DMS supports heterogeneous migrations using the SAP HANA endpoint, allowing schema and data conversion with minimal downtime.

Why this answer

AWS DMS supports heterogeneous migrations, including from Oracle to SAP HANA, by using built-in conversion capabilities or integrating with AWS SCT for schema transformation. This allows continuous data replication with minimal downtime, as DMS can perform ongoing changes from the source during the migration window.

Exam trap

The trap here is that candidates confuse AWS SCT (schema conversion) with AWS DMS (data migration), or assume homogeneous migration is sufficient, not realizing that Oracle to SAP HANA is a heterogeneous migration requiring DMS with a specific SAP HANA target endpoint.

How to eliminate wrong answers

Option A is wrong because AWS SCT is a schema conversion tool, not a data migration service; it generates schema and code conversion scripts but does not perform the actual data replication or handle ongoing changes to minimize downtime. Option B is wrong because AWS Server Migration Service (SMS) is designed for migrating entire virtual machines (VMware, Hyper-V) to AWS, not for heterogeneous database migrations like Oracle to SAP HANA. Option D is wrong because a homogeneous migration (same database engine) does not apply here; the migration is from Oracle to SAP HANA, which are different database engines, requiring heterogeneous migration capabilities.

Full explanation →

1461

MCQmedium

A company runs SAP on AWS with a shared storage solution for transport files. They need a highly available, scalable, and POSIX-compliant file system. Which AWS storage service should they use?

A.Amazon Elastic File System (EFS)

B.Amazon S3

C.Amazon FSx for NetApp ONTAP

D.Amazon Elastic Block Store (EBS) with Multi-Attach enabled

AnswerC

FSx for NetApp ONTAP provides POSIX-compliant, highly available, and scalable file storage ideal for SAP transport files.

Why this answer

Amazon FSx for NetApp ONTAP provides a fully managed, POSIX-compliant shared file system that supports the NFS, SMB, and iSCSI protocols required by SAP transport directories. It offers high availability across multiple Availability Zones, automatic failover, and scalable throughput, making it the correct choice for SAP transport files on AWS.

Exam trap

The trap here is that candidates often assume Amazon EFS is the default POSIX-compliant file system for all Linux workloads, but they overlook that SAP transport files specifically require the advanced NetApp ONTAP features (like iSCSI support and enterprise storage replication) that FSx for ONTAP provides, which EFS cannot offer.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is POSIX-compliant but does not support the iSCSI protocol or the advanced NetApp ONTAP features (e.g., SnapMirror, FlexClone) that SAP transport management often requires; it also lacks the ability to serve as a direct target for SAP's transport directory in many enterprise SAP architectures. Option B is wrong because Amazon S3 is not POSIX-compliant and uses a flat key-value store with eventual consistency for some operations, which cannot meet the strict file-locking and hierarchical namespace requirements of SAP transport files. Option D is wrong because Amazon EBS with Multi-Attach enabled supports only a limited number of Nitro-based EC2 instances (up to 16) and does not provide a fully managed, scalable, POSIX-compliant file system; it also lacks the native NFS/iSCSI protocol support needed for SAP transport directories.

Full explanation →

1462

MCQmedium

A company uses Amazon CloudWatch Logs to store SAP application logs. The Security team requires that logs be encrypted at rest using a customer-managed KMS key (CMK). How can this be achieved?

A.Associate the KMS key with the CloudWatch Logs log group.

B.Enable default encryption on the S3 bucket where logs are exported.

C.Use an encrypted EBS volume for the EC2 instances generating the logs.

D.Enable encryption on the CloudWatch Logs log stream.

AnswerA

CloudWatch Logs allows encryption at rest using a KMS CMK associated with the log group.

Why this answer

CloudWatch Logs supports encryption at rest using a customer-managed KMS key (CMK) by associating the key with the log group. This encrypts all log data stored in the log group. Option B is incorrect because S3 default encryption applies only to data stored in S3, not to CloudWatch Logs data that is not exported.

Option C is incorrect because encrypting the EBS volume of EC2 instances does not encrypt the logs after they are sent to CloudWatch Logs. Option D is incorrect because encryption is configured at the log group level, not the log stream level.

Full explanation →

1463

MCQeasy

An SAP administrator needs to ensure that all API calls made to create, modify, or delete AWS resources are logged for auditing. Which AWS service should be enabled?

A.Amazon CloudWatch

B.AWS CloudTrail

C.AWS Config

D.Amazon GuardDuty

AnswerB

CloudTrail records all API activity for auditing.

Why this answer

AWS CloudTrail logs API calls. Option A (CloudWatch) is for monitoring metrics. Option C (Config) is for resource configuration.

Option D (GuardDuty) is for security threats.

Full explanation →

1464

MCQhard

A company is running an SAP S/4HANA system on AWS. During a planned maintenance window, the operations team needs to apply an SAP kernel patch that requires stopping all SAP instances. Which AWS service can be used to orchestrate the stop/start sequence of multiple EC2 instances and ensure proper dependencies are maintained?

A.AWS Systems Manager Automation

B.AWS Step Functions

C.AWS CloudFormation

D.Amazon EC2 Run Command

AnswerA

Systems Manager Automation can orchestrate stop/start with dependencies and error handling.

Why this answer

(AWS Systems Manager Automation) is correct because it provides runbooks that can orchestrate the stop/start sequence of multiple EC2 instances with dependency management and error handling, ideal for SAP maintenance. Option B (AWS Step Functions) is less suitable because it requires custom Lambda functions to manage EC2 states, adding complexity. Option C (AWS CloudFormation) is for provisioning infrastructure, not ad-hoc operational tasks.

Option D (Amazon EC2 Run Command) is for running individual commands on instances, not for orchestrating multi-step sequences with dependencies.

Full explanation →

1465

Multi-Selectmedium

A company is running SAP on AWS and needs to monitor the health of their SAP application servers. Which TWO AWS services can be used together to achieve this?

Select 2 answers

A.AWS X-Ray

B.Amazon CloudWatch

C.Amazon Route 53

D.AWS CloudTrail

E.Amazon Inspector

AnswersB, C

CloudWatch can collect health check metrics and set alarms.

Why this answer

Options B (Amazon CloudWatch) and C (Amazon Route 53) are correct. CloudWatch can collect and monitor metrics from SAP application servers, and Route 53 health checks can monitor the endpoints of those servers. Option A (AWS X-Ray) is for request tracing, D (AWS CloudTrail) is for API activity logging, and E (Amazon Inspector) is for security vulnerability assessment.

Full explanation →

1466

MCQhard

An SAP system on AWS uses a shared file system via Amazon EFS for transport directory (/usr/sap/trans). The system experiences slow batch jobs. Monitoring shows high read latency on EFS. Which action would most likely reduce latency?

A.Use a larger EC2 instance for the application server

B.Migrate the transport directory to Amazon S3

C.Use EFS Max I/O performance mode or Provisioned Throughput

D.Move the transport directory to instance store volumes

AnswerC

Max I/O increases IOPS; Provisioned Throughput increases throughput.

Why this answer

EFS Max I/O performance mode is designed to scale to higher levels of aggregate throughput and IOPS with lower latencies for workloads like SAP transport directories that experience high concurrency and throughput demands. Provisioned Throughput allows you to specify a higher throughput level independent of the amount of data stored, directly addressing the high read latency issue. This is the most effective action because it optimizes the file system's performance characteristics for the SAP batch job workload.

Exam trap

The trap here is that candidates often confuse EFS performance modes with storage tiers (e.g., Standard vs. Infrequent Access) or assume that increasing compute power (Option A) will fix storage latency, when in fact the bottleneck is the file system's throughput ceiling, not the application server's CPU or memory.

How to eliminate wrong answers

Option A is wrong because increasing the EC2 instance size does not reduce EFS read latency; EFS performance is independent of the compute instance's size and is governed by the file system's throughput and IOPS limits. Option B is wrong because Amazon S3 is an object store, not a POSIX-compliant shared file system, and cannot serve as a drop-in replacement for the SAP transport directory (/usr/sap/trans) which requires NFSv4 semantics, file locking, and low-latency random access. Option D is wrong because instance store volumes are ephemeral and tied to the lifecycle of the EC2 instance; they cannot provide the persistent, shared access required for the transport directory across multiple SAP application servers.

Full explanation →

1467

Multi-Selectmedium

An SAP customer is planning to use AWS for their SAP HANA environment. They need to ensure that the chosen EC2 instance types are certified by SAP for HANA. Which THREE sources can they use to verify SAP HANA certification for AWS instance types? (Select THREE.)

Select 3 answers

A.AWS documentation on SAP HANA certified instances

B.SAP Cloud Appliance Library (CAL)

C.AWS Support Center

D.AWS Pricing Calculator

E.SAP HANA Hardware Directory (SAP website)

AnswersA, B, E

AWS publishes a list of SAP HANA certified instance types.

Why this answer

Options A, B, and E are correct. AWS documentation on SAP HANA certified instances provides a list of certified instance types. The SAP Cloud Appliance Library offers pre-configured HANA environments that are certified.

The SAP HANA Hardware Directory is the official SAP source for certified hardware, including AWS instances. Option C (AWS Support Center) can provide guidance but is not a direct source for certification lists. Option D (AWS Pricing Calculator) does not include certification information.

Full explanation →

1468

MCQhard

A company is migrating its SAP NetWeaver system from on-premises to AWS. The system uses a central instance (ASCS) and multiple dialog instances. The migration must be completed with minimal downtime. Which approach should the company use?

A.Use SAP Software Provisioning Manager (SWPM) to perform a system copy into pre-provisioned EC2 instances with the same sizing.

B.Use AWS CloudEndure Migration to continuously replicate the SAP system.

C.Uninstall SAP from on-premises and perform a fresh installation on AWS, then restore the database backup.

D.Use AWS Application Migration Service (AWS MGN) to replicate the entire on-premises system to AWS.

AnswerA

SWPM system copy is an SAP-certified method for migrating with minimal downtime.

Why this answer

Using SAP Software Provisioning Manager (SWPM) to perform a system copy into pre-provisioned EC2 instances with the same sizing allows for a controlled, minimal-downtime migration. SWPM handles SAP-specific consistency, enabling a homogeneous system copy that can be completed with minimal downtime by pre-loading data and then applying incremental changes. Option B is wrong because AWS CloudEndure Migration (replaced by AWS Application Migration Service) replicates at the block level, which may not maintain SAP application consistency without additional steps.

Option C is wrong because uninstalling and performing a fresh installation requires significant downtime and reconfiguration. Option D is wrong because AWS Application Migration Service replicates at the block level and may not handle SAP application consistency optimally, potentially requiring additional validation and downtime.

Full explanation →

1469

MCQmedium

An SAP system uses AWS Direct Connect to connect to on-premises systems. The SAP application servers are in a private subnet, and the HANA database is in a separate private subnet. Both subnets are in the same VPC. The application servers can connect to the HANA database, but the application servers cannot connect to an on-premises file server via the Direct Connect. The on-premises network team confirms that the file server is reachable from other on-premises resources. The VPC route tables have a route for the on-premises CIDR pointing to the Direct Connect virtual gateway. The security groups allow all outbound traffic. What is the MOST likely cause of the issue?

A.The network ACL for the application subnet is blocking outbound traffic to the on-premises CIDR.

B.The on-premises file server is not reachable because it requires VPN instead of Direct Connect.

C.The Direct Connect virtual interface is in a 'down' state.

D.The route table associated with the application subnet does not have a route to the on-premises CIDR via the virtual gateway.

AnswerD

Missing route prevents traffic from reaching Direct Connect.

Why this answer

The most likely cause is that the route table associated with the application subnet does not have a route to the on-premises CIDR via the virtual gateway. Since the application servers are in a different subnet, they need an explicit route in their subnet's route table to reach the on-premises network through Direct Connect. Without this route, traffic cannot be forwarded to the virtual gateway.

Option A is unlikely because the security groups allow all outbound traffic, and NACLs might be blocking, but the question states security groups allow all outbound, and typically NACLs are configured permissive by default. Option C is not indicated as the on-premises team confirms the file server is reachable from other on-premises resources, implying Direct Connect is up. Option B (VPN) is not relevant; Direct Connect is already in use.

Full explanation →

1470

MCQhard

A company is running SAP ERP on AWS with an Oracle database. The database is hosted on an EC2 instance with multiple EBS volumes. The company wants to encrypt the database at rest using AWS KMS. What is the correct procedure to enable encryption for the existing Oracle database without downtime?

A.Enable EBS encryption on the existing volumes by modifying the volume attribute

B.Migrate the database to Amazon RDS Custom for Oracle with encryption enabled

C.Use Oracle Transparent Data Encryption (TDE) with AWS KMS as the key store

D.Use AWS KMS to encrypt the EBS volumes by creating a new encrypted volume and attaching it

AnswerC

Oracle TDE can be enabled online with minimal downtime and can use AWS CloudHSM or KMS as the key store.

Why this answer

Enabling EBS encryption on a running instance requires creating an encrypted snapshot, restoring a new encrypted volume, and attaching it; this involves downtime. Oracle TDE can be enabled online with minimal impact. AWS KMS does not provide database-level encryption natively; it is used for EBS encryption.

Changing to RDS Custom requires migration.

Full explanation →

1471

MCQmedium

A company is deploying a new SAP S/4HANA system on AWS and needs to ensure that the application servers can communicate with the database servers securely and with low latency. The application servers and database servers are in different VPCs. Which AWS service should be used to connect these VPCs?

A.AWS VPN

B.Amazon API Gateway

C.VPC Peering

D.AWS Direct Connect

AnswerC

VPC Peering provides direct, low-latency connectivity between VPCs.

Why this answer

VPC Peering is the correct choice because it establishes a direct network connection between two VPCs using AWS's internal infrastructure, enabling private IPv4 or IPv6 traffic with low latency and high throughput. For SAP S/4HANA, where application-to-database communication requires consistent sub-millisecond latency and avoids internet transit, VPC Peering provides the necessary Layer-3 connectivity without bandwidth bottlenecks or single points of failure. Unlike VPN or Direct Connect, VPC Peering does not introduce additional hop latency or third-party hardware, making it ideal for this intra-region, cross-VPC scenario.

Exam trap

The trap here is that candidates often confuse VPC Peering with AWS Direct Connect, mistakenly thinking a dedicated connection is required for low latency, but Direct Connect is for on-premises connectivity, not VPC-to-VPC, and VPC Peering provides the same private, low-latency path within a region without additional cost or complexity.

How to eliminate wrong answers

Option A is wrong because AWS VPN creates an encrypted tunnel over the public internet, introducing additional latency and potential throughput variability that is unsuitable for the low-latency, high-performance requirements of SAP S/4HANA database communication. Option B is wrong because Amazon API Gateway is a fully managed service for creating, publishing, and securing RESTful or WebSocket APIs, not a mechanism for connecting VPCs or enabling direct network-layer traffic between application and database servers. Option D is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, designed for hybrid cloud scenarios, and does not connect two VPCs within AWS; using it for VPC-to-VPC connectivity would be unnecessary, costly, and architecturally incorrect.

Full explanation →

1472

Multi-Selecthard

A company runs SAP S/4HANA on AWS in a multi-AZ deployment. The SAP HANA database is 2 TB and uses EBS gp3 volumes. During a monthly patching cycle, the primary database fails over to the secondary, but the secondary takes over 30 minutes to come online. Which TWO changes would most likely reduce the failover time? (Choose two.)

Select 2 answers

A.Increase the provisioned IOPS and throughput on the EBS log volumes.

B.Place the primary and secondary HANA servers in a cluster placement group.

C.Use different EC2 instance types for primary and secondary to balance cost.

D.Deploy all HANA nodes in the same Availability Zone to reduce network latency.

E.Enable EBS optimization on the secondary instance's EBS volumes.

AnswersA, B

Higher log volume performance improves replication throughput.

Why this answer

Increasing the provisioned IOPS and throughput on the EBS log volumes accelerates the replay of redo logs during the takeover process. SAP HANA relies on log replay to bring the secondary database to a consistent state; higher IOPS/throughput reduces the time required to apply pending log entries, directly shortening failover duration.

Exam trap

The trap here is that candidates often focus on network latency or instance placement (Options D and B) as the primary cause of slow failover, when in reality the bottleneck is the I/O performance of the log volumes during log replay.

Full explanation →

1473

MCQmedium

A company is migrating an SAP Business Suite system to AWS. The source database is Oracle. The target is Amazon RDS for Oracle. Which AWS service should be used to automate the schema conversion and data migration?

A.AWS Schema Conversion Tool (SCT)

B.Both AWS SCT and AWS DMS

C.AWS Application Discovery Service

D.AWS Database Migration Service (DMS)

AnswerB

SCT for schema conversion and DMS for data migration.

Why this answer

Schema conversion is handled by AWS Schema Conversion Tool (SCT) and data migration with minimal downtime is handled by AWS Database Migration Service (DMS). Option A is wrong because SCT alone does not migrate data. Option C is wrong because AWS Application Discovery Service is used for discovery, not migration.

Option D is wrong because DMS alone does not convert schemas.

Full explanation →

1474

MCQhard

A company runs SAP Business Suite on AWS. The SAP system frequently crashes with a 'JAVA out of memory' error. The application server is an EC2 instance with 32 GB RAM. Which solution should be implemented to prevent this issue?

A.Increase the EC2 instance memory to 64 GB

B.Reduce the Java heap size in the SAP system

C.Increase the swap space on the EC2 instance

D.Configure Amazon CloudWatch alarms to trigger EC2 Auto Scaling based on memory utilization

AnswerD

Auto scaling adds capacity when memory is high.

Why this answer

By configuring Amazon CloudWatch alarms to trigger EC2 Auto Scaling based on memory utilization, the system can automatically add more application server instances when memory usage is high. This distributes the load and prevents any single instance from running out of Java heap space. Option A is incorrect because manually increasing the EC2 instance memory is a temporary workaround that does not scale automatically.

Option B is incorrect as reducing the Java heap size would increase the likelihood of out-of-memory errors. Option C is incorrect because increasing swap space can cause severe performance degradation and does not resolve the underlying memory shortage.

Full explanation →

1475

MCQhard

A company is migrating an SAP S/4HANA system to AWS. The system uses SAP HANA as its database. The company has a complex networking setup with multiple VPCs and on-premises connectivity via AWS Direct Connect. The SAP HANA system replication will be used for high availability across two Availability Zones. What is the minimum number of Elastic Network Interfaces (ENIs) required per HANA instance to support the recommended network architecture?

A.2

B.1

AnswerA

Correct: The recommended minimum is 2 ENIs to separate client and replication traffic.

Why this answer

The minimum number of ENIs recommended for SAP HANA system replication across Availability Zones is 2. This allows separation of client traffic from HANA system replication traffic, which is a best practice. A single ENI can technically carry all traffic but does not adhere to the recommended network architecture.

Option A (2) is the minimum, while Option B (1) is insufficient.

Full explanation →

1476

Multi-Selectmedium

Which TWO AWS services can be used to migrate an on-premises SAP HANA database to AWS with minimal downtime? (Choose 2.)

Select 2 answers

A.SAP Landscape Transformation (SLT)

B.AWS Backup

C.AWS Database Migration Service (DMS)

D.AWS CloudEndure Migration

E.SAP HANA System Replication (HSR)

AnswersA, E

SLT can replicate data in real-time from HANA to HANA.

Why this answer

(SAP Landscape Transformation) is correct because SLT can replicate data in real-time from an on-premises SAP system to SAP HANA on AWS, enabling minimal downtime migration. Option E (SAP HANA System Replication) is correct because HSR provides native, continuous database replication with automatic failover, allowing migration with minimal downtime. Options B (AWS Backup), C (AWS DMS), and D (CloudEndure) are incorrect: AWS Backup is for backup/restore, not continuous replication; DMS does not support SAP HANA as a source; CloudEndure is not recommended for SAP HANA workloads.

Full explanation →

1477

MCQmedium

An SAP system on AWS uses a Multi-AZ DB instance for its database. The operations team notices that during a recent Availability Zone outage, the database failover did not occur automatically. What is the MOST likely cause?

A.The database is configured with asynchronous replication.

B.The Multi-AZ option is not supported for this database engine.

C.The database is configured as a read replica.

D.The secondary DB instance is in the same Availability Zone as the primary.

AnswerD

Multi-AZ requires instances in different AZs.

Why this answer

In a Multi-AZ DB instance deployment, AWS automatically provisions and maintains a standby DB instance in a different Availability Zone (AZ). If the primary DB instance fails or the AZ becomes unavailable, Amazon RDS automatically fails over to the standby. If the secondary DB instance is in the same AZ as the primary, a failure of that AZ will affect both instances, preventing automatic failover.

This is the most likely cause because the Multi-AZ architecture relies on physical separation of AZs to provide high availability.

Exam trap

The trap here is that candidates may assume Multi-AZ automatically implies different AZs, but the question tests whether you know that a misconfiguration (both instances in the same AZ) will break failover, and they might incorrectly blame replication mode or engine support instead.

How to eliminate wrong answers

Option A is wrong because asynchronous replication is the standard replication mode for Multi-AZ DB instances (using synchronous replication to the standby), and it does not prevent automatic failover; in fact, Multi-AZ uses synchronous replication to ensure data consistency. Option B is wrong because the Multi-AZ option is supported for all major database engines that AWS RDS offers for SAP workloads, including Oracle, SQL Server, and PostgreSQL. Option C is wrong because a read replica is a separate concept from a Multi-AZ standby; a read replica is used for read scaling and does not serve as a failover target, but the question describes a Multi-AZ DB instance, which by definition has a standby that is not a read replica.

Full explanation →

1478

MCQeasy

An SAP system running on AWS is experiencing intermittent network connectivity issues between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. The network ACLs and security groups are properly configured. What is the most likely cause and solution?

A.The security groups are stateful and blocking return traffic; use network ACLs instead

B.The route tables are not correctly configured for cross-AZ traffic; verify and update route tables

C.Use AWS Transit Gateway to connect the subnets in different AZs

D.The network ACLs are blocking traffic between Availability Zones; update the NACLs

AnswerB

Cross-AZ traffic requires appropriate route table entries.

Why this answer

The most likely cause is that the route tables in the subnets do not have routes for the destination CIDR of the other Availability Zone (AZ). By default, each subnet in a VPC is associated with a route table, and for traffic to flow between subnets in different AZs, the route tables must include a local route for the VPC CIDR. If the route tables are misconfigured (e.g., missing the local route or pointing to an incorrect target), cross-AZ traffic will fail, causing intermittent connectivity issues between the application and database servers.

Exam trap

The trap here is that candidates often assume security groups or NACLs are the cause of cross-AZ connectivity issues, but the real culprit is usually route table misconfiguration, as AWS relies on the local route for all intra-VPC traffic regardless of AZ boundaries.

How to eliminate wrong answers

Option A is wrong because security groups are stateful, meaning they automatically allow return traffic for outbound connections; they do not block return traffic, and using network ACLs (which are stateless) would require explicit rules for both inbound and outbound traffic, making this a less likely cause. Option C is wrong because AWS Transit Gateway is used to connect multiple VPCs or on-premises networks, not for routing within a single VPC; using it for cross-AZ subnets in the same VPC is unnecessary and adds complexity. Option D is wrong because network ACLs are stateless and apply at the subnet level, but if they were blocking traffic between AZs, the issue would be consistent (not intermittent) and would affect all traffic, not just specific connections; the problem description states NACLs are properly configured, so this is not the cause.

Full explanation →

1479

MCQeasy

An architect is designing a network topology for an SAP system on AWS. The SAP application servers must be placed in private subnets, and the web dispatchers must be accessible from the internet. Which configuration should the architect use to meet these requirements?

A.Place all SAP servers in public subnets and use security groups to restrict access

B.Place the web dispatchers in private subnets and use a NAT Gateway for internet access

C.Place all servers in private subnets and use an Application Load Balancer for internet access

D.Place the web dispatchers in public subnets, the application servers in private subnets, and use a Network Load Balancer in front of the web dispatchers

AnswerD

This design provides internet access to web dispatchers via a public-facing NLB while keeping application servers private.

Why this answer

Web dispatchers need direct internet accessibility, which is achieved by placing them in public subnets with an Internet Gateway route. The SAP application servers must remain in private subnets for security, and a Network Load Balancer (NLB) in front of the web dispatchers provides layer 4 load balancing and health checks without exposing the dispatchers' IPs directly, while preserving client IP for logging and security.

Exam trap

The trap here is that candidates often assume an Application Load Balancer (ALB) is always the best choice for internet-facing web traffic, but for SAP Web Dispatchers, a Network Load Balancer (NLB) is required because ALBs cannot handle non-HTTP protocols like DIAG and RFC, and they modify headers in ways that break SAP session persistence.

How to eliminate wrong answers

Option A is wrong because placing all SAP servers in public subnets exposes the application servers to the internet, violating the requirement for private subnets and increasing the attack surface; security groups alone do not prevent direct internet routing. Option B is wrong because placing web dispatchers in private subnets with a NAT Gateway allows outbound internet access only, not inbound internet traffic from users, so the web dispatchers would not be accessible from the internet. Option C is wrong because placing all servers in private subnets and using an Application Load Balancer (ALB) for internet access would require the ALB to be in public subnets, but the ALB operates at layer 7 and is not designed to front-end web dispatchers that handle SAP-specific protocols (e.g., DIAG, RFC) which require layer 4 load balancing; additionally, the ALB would terminate TLS and modify headers, which can break SAP Web Dispatcher functionality.

Full explanation →

1480

MCQhard

An SAP system on AWS uses a shared file system for the SAP transport directory. The file system is hosted on an Amazon EFS file system. Recently, the operations team noticed that SAP transports are failing with errors indicating file locking issues. The EFS file system is mounted using the NFS client with default options. What is the most likely cause of the file locking issues?

A.The EFS file system has insufficient throughput for the number of concurrent mounts.

B.The security group for the EFS mount targets does not allow inbound traffic on port 2049.

C.The EFS file system is using access points that restrict permissions.

D.The EFS file system is mounted using NFS version 3, which has limited locking support.

AnswerD

Correct. Default NFS client options often use NFSv3, which has limited locking support. EFS recommends NFSv4.1 for proper file locking, and using NFSv3 can lead to locking failures observed by the operations team.

Why this answer

The default NFS client options typically use NFSv3, which has limited file locking support. SAP transport processes rely on robust file locking to coordinate access to the shared transport directory. NFSv4.1, which EFS recommends, provides proper locking with NFSv4.1 state management and lease-based locking.

Option A is incorrect because insufficient throughput would manifest as performance degradation or timeouts, not file locking failures. Option B is incorrect because a security group blocking inbound traffic on port 2049 (NFS) would cause mount failures or accessibility issues, not specifically locking errors. Option C is incorrect because EFS access points do not affect locking; they manage file system paths and permissions, and restrictions would cause permission errors.

Full explanation →

1481

MCQmedium

An SAP system running on AWS has a recurring issue where the SAP application server becomes unresponsive every evening at 8 PM. The administrator suspects a batch job causing high CPU usage. Which set of AWS services can best help identify the root cause?

A.AWS X-Ray and Amazon CloudWatch

B.Amazon CloudWatch and AWS CloudTrail

C.Amazon CloudWatch and AWS Lambda

D.Amazon CloudWatch and AWS Systems Manager Run Command

AnswerD

CloudWatch monitors metrics, Run Command can collect logs and process information.

Why this answer

(Amazon CloudWatch and AWS Systems Manager Run Command) is correct because CloudWatch monitors CPU metrics (e.g., CPUUtilization) to identify high usage patterns, and Run Command can execute scripts on the EC2 instance to collect OS-level logs, process lists, and batch job details during the incident. This combination provides both metric visibility and remediation/forensic capabilities. Option A (X-Ray) is for application tracing, not OS-level CPU analysis.

Option B (CloudTrail) logs API calls, not OS metrics. Option C (Lambda) lacks native OS command execution; Run Command provides direct, secure access to collect logs without additional setup.

Full explanation →

1482

Multi-Selecthard

A company runs SAP S/4HANA on AWS with a large HANA database (10 TB). The database uses EBS gp3 volumes. The system experiences performance degradation due to high disk I/O. The architect decides to migrate to EBS io2 Block Express volumes. Which THREE factors should the architect consider when planning the migration?

Select 3 answers

A.The maximum IOPS per volume supported by io2 Block Express is 256,000.

B.SAP HANA supports RAID 0 across multiple io2 volumes without additional software.

C.io2 Block Express volumes can be attached to multiple EC2 instances simultaneously using EBS Multi-Attach.

D.To achieve the required throughput, multiple io2 volumes should be striped using LVM.

E.The cost of io2 Block Express volumes is higher than gp3 volumes on a per-GB basis.

AnswersA, D, E

High IOPS per volume is a key benefit for large HANA systems.

Why this answer

Io2 Block Express volumes support a maximum IOPS of 256,000 per volume, which is significantly higher than the 16,000 IOPS limit of gp3. This high IOPS capability is critical for large SAP HANA databases (10 TB) that experience performance degradation due to high disk I/O, as it allows the database to handle bursty workloads without throttling.

Exam trap

The trap here is that candidates may confuse io2 Block Express with standard io2 volumes, assuming Multi-Attach is supported, or incorrectly believe SAP HANA natively supports RAID 0 without additional volume management tools.

Full explanation →

1483

MCQmedium

A company is migrating its SAP ERP system to AWS. The system uses an SAP HANA database and runs on SUSE Linux Enterprise Server (SLES). The company wants to use the same SLES version on AWS and needs to ensure that the instance type supports the required SAP HANA workload. Which AWS resource should the administrator use to find the appropriate instance types?

A.The AWS Well-Architected Framework documentation.

B.The SAP Certified and Supported SAP HANA Hardware Directory on the SAP website.

C.The SAP on AWS Implementation Guide.

D.The AWS Trusted Advisor console.

AnswerB

This directory lists certified hardware including AWS instances.

Why this answer

The SAP Certified and Supported SAP HANA Hardware Directory is the authoritative source that lists all AWS instance types certified for SAP HANA. The administrator can filter by provider (Amazon Web Services), OS (SUSE Linux Enterprise Server), and instance type to find supported options. Option A (AWS Well-Architected Framework) provides general guidance but not certified hardware lists.

Option C (SAP on AWS Implementation Guide) offers deployment guidance but not the exhaustive hardware directory. Option D (AWS Trusted Advisor) checks best practices and cost optimization but does not provide SAP HANA certification details.

Full explanation →

1484

Multi-Selecthard

Which THREE of the following are valid methods to automate the installation of SAP HANA on AWS? (Choose three.)

Select 3 answers

A.AWS Systems Manager Automation

B.AWS Launch Wizard for SAP

C.SAP Cloud Appliance Library

D.AWS OpsWorks

E.AWS CloudFormation with a custom template

AnswersB, C, E

Launch Wizard automates SAP HANA deployment.

Why this answer

AWS Launch Wizard for SAP (Option B) is a valid method to automate SAP HANA installation because it provides a guided, automated deployment experience that collects input for infrastructure sizing, configuration, and software installation, then orchestrates the provisioning of AWS resources and the SAP HANA software setup. It reduces manual effort by automating the deployment of SAP HANA on AWS, making it a correct choice for this question.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Automation (Option A) with a general-purpose automation tool, but it lacks the SAP-specific logic and lifecycle management required for HANA installation, making AWS Launch Wizard for SAP and SAP Cloud Appliance Library the correct SAP-focused automation methods.

Full explanation →

1485

MCQmedium

An SAP system on AWS is experiencing performance degradation. The SAP administrator wants to monitor the EC2 instance's CPU utilization and memory usage. Which AWS service should be used to collect memory metrics?

A.Amazon CloudWatch (default metrics)

B.AWS Systems Manager Inventory

C.AWS Trusted Advisor

D.Amazon CloudWatch Agent

AnswerD

The CloudWatch Agent can collect memory and disk metrics from EC2 instances.

Why this answer

Amazon CloudWatch by default collects only basic metrics like CPU utilization, not memory usage. The Amazon CloudWatch Agent is required to collect custom metrics such as memory utilization from EC2 instances by sending data to CloudWatch via the PutMetricData API. This agent can be installed on the SAP EC2 instance to capture both CPU and memory metrics for performance monitoring.

Exam trap

The trap here is that candidates assume CloudWatch default metrics include memory usage because it is a common monitoring need, but AWS intentionally excludes OS-level metrics from default collection to avoid overhead, requiring the CloudWatch Agent for such data.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch default metrics do not include memory usage; they only capture hypervisor-level metrics like CPU, network, and disk I/O. Option B is wrong because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time performance metrics like memory usage. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations and checks, not real-time metric collection for EC2 instance memory.

Full explanation →

1486

MCQeasy

An SAP administrator needs to monitor the free space of EBS volumes across multiple EC2 instances running SAP. Which AWS service should be used to collect and visualize this data?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Config

D.AWS Trusted Advisor

AnswerB

CloudWatch with the unified agent can collect disk metrics from instances.

Why this answer

Amazon CloudWatch can collect custom metrics from EC2 instances using the CloudWatch agent, enabling monitoring of EBS volume free space. Option A is incorrect because AWS CloudTrail logs API calls, not system metrics. Option C is incorrect because AWS Config tracks configuration changes, not real-time performance data.

Option D is incorrect because AWS Trusted Advisor provides best-practice checks, not real-time monitoring.

Full explanation →

1487

MCQeasy

An SAP system is running on EC2 instances with EBS volumes. The administrator wants to automate the creation of point-in-time snapshots of the EBS volumes for disaster recovery. Which AWS service is best suited for this?

A.AWS Backup

B.Amazon S3 Lifecycle policies

C.Amazon Data Lifecycle Manager (DLM)

D.AWS CloudFormation

AnswerC

DLM automates creation and retention of EBS snapshots.

Why this answer

Amazon Data Lifecycle Manager (DLM) is specifically designed to automate the creation, retention, and deletion of EBS snapshots for backup and disaster recovery. Option A (AWS Backup) can also back up EBS volumes but is a broader service; DLM is more tailored for EBS snapshot lifecycle management. Option B (Amazon S3 Lifecycle policies) manages object lifecycle in S3, not EBS snapshots.

Option D (AWS CloudFormation) provisions infrastructure but does not directly automate snapshot creation.

Full explanation →

1488

MCQhard

A multinational company runs SAP on AWS with a complex landscape including development, quality assurance, and production environments. The production SAP HANA database is running on an r5.8xlarge instance with 3.5 TB of data on EBS gp3 volumes. The operations team has been asked to implement a disaster recovery (DR) strategy that can recover the system in another AWS Region within 4 hours. The maximum acceptable data loss is 30 minutes. The current backup strategy uses daily EBS snapshots stored in the same Region. Which approach should the team take to meet the DR requirements?

A.Take EBS snapshots every 30 minutes and copy them to the DR Region using cross-Region snapshot copy. In the DR Region, have pre-provisioned EC2 instances and EBS volumes ready to attach the restored snapshots

B.Use AWS Backup to schedule daily backups and copy them to the DR Region

C.Set up a pilot light environment in the DR Region with a HANA instance replicating via log shipping

D.Configure SAP HANA System Replication across Regions using a VPN connection

AnswerA

Snapshot copy every 30 minutes meets RPO; pre-provisioning reduces RTO.

Why this answer

Taking EBS snapshots every 30 minutes and copying them cross-Region meets the RPO of 30 minutes, and restoring from snapshots to pre-provisioned instances in the DR Region can achieve an RTO of 4 hours. Option B (AWS Backup daily) fails the RPO of 30 minutes. Option C (pilot light with HANA log shipping) has a longer RTO due to log replay and database recovery.

Option D (HANA System Replication across Regions) typically requires a low-latency connection and may not meet the 4-hour RTO due to potential delays in failover and data synchronization.

Full explanation →

1489

Multi-Selecteasy

Which TWO AWS services can be used to monitor SAP system performance and send alerts? (Choose two.)

Select 2 answers

A.Amazon Simple Notification Service (SNS)

B.Amazon Inspector

C.Amazon CloudWatch

D.AWS Config

E.AWS Trusted Advisor

AnswersA, C

SNS can send notifications from CloudWatch alarms.

Why this answer

Amazon CloudWatch is the primary AWS monitoring service that can collect metrics from SAP systems (e.g., via SAP Cloud Connector or custom scripts) and trigger alarms based on thresholds. Amazon SNS is the notification service that CloudWatch alarms use to send alerts via email, SMS, or HTTP endpoints. Together, they form the standard monitoring and alerting pipeline for SAP workloads on AWS.

Exam trap

The trap here is that candidates often confuse AWS Config or Trusted Advisor as monitoring services, but they are configuration auditing and advisory tools, not real-time performance monitoring and alerting services like CloudWatch and SNS.

Full explanation →

1490

MCQeasy

An SAP administrator needs to monitor the CPU utilization of an SAP application server EC2 instance and send an alert if it exceeds 80% for 5 consecutive minutes. Which AWS service should be used?

A.AWS CloudTrail

B.VPC Flow Logs

C.Amazon CloudWatch Alarm

D.AWS Config

AnswerC

CloudWatch Alarms monitor metrics and can send notifications.

Why this answer

Amazon CloudWatch Alarm is the correct service for monitoring CPU utilization and sending alerts when the CPU utilization exceeds 80% for 5 consecutive minutes. CloudWatch Alarms can be configured to monitor any CloudWatch metric (such as CPUUtilization) and trigger actions like sending a notification via Amazon SNS. Option A (AWS CloudTrail) is incorrect because it records API calls for auditing, not metric monitoring.

Option B (VPC Flow Logs) is incorrect as it captures network traffic information, not CPU metrics. Option D (AWS Config) is incorrect because it evaluates resource compliance against rules, not performance metrics.

Full explanation →

1491

MCQmedium

An SAP administrator is configuring the /hana/data volume for SAP HANA on an EC2 instance. The exhibit shows the /etc/fstab entry. What is the purpose of the 'noatime' mount option?

A.To enable swap space on the volume.

B.To enable disk quotas.

C.To mount the volume as read-only.

D.To disable updating the access time on files, improving performance.

AnswerD

noatime reduces write operations.

Why this answer

The 'noatime' mount option disables the update of inode access timestamps (atime) on every file read. For SAP HANA, which performs high-frequency I/O operations on the /hana/data volume, this eliminates unnecessary metadata writes, reducing disk I/O overhead and improving overall filesystem performance.

Exam trap

The trap here is that candidates may confuse 'noatime' with other mount options like 'ro' (read-only) or 'sw' (swap), or assume it is related to performance tuning for swap or quotas, when in fact it specifically targets access time updates to reduce I/O overhead.

How to eliminate wrong answers

Option A is wrong because swap space is configured via a swap partition or a swap file, not by the 'noatime' mount option; 'noatime' does not enable swap. Option B is wrong because disk quotas are enabled using the 'usrquota' or 'grpquota' mount options, not 'noatime'. Option C is wrong because mounting a volume as read-only is achieved with the 'ro' mount option, while 'noatime' only affects access time updates and does not restrict write operations.

Full explanation →

1492

MCQmedium

A company is migrating an SAP system to AWS and needs to ensure that the SAP license is compliant. The current license is based on the number of users. Which AWS pricing model is most appropriate for this scenario?

A.Spot Instances

B.Reserved Instances

C.Dedicated Hosts

D.On-Demand instances

AnswerD

On-Demand allows scaling based on demand without affecting user-based licensing.

Why this answer

On-Demand instances are the most appropriate pricing model for this SAP migration because the SAP license is based on the number of users, not on the underlying hardware or instance type. With On-Demand instances, the company pays only for compute capacity by the hour or second, avoiding any long-term commitment that could inadvertently trigger SAP license compliance issues related to dedicated hardware or specific instance sizing. This flexibility allows the company to align AWS costs directly with the user-based SAP licensing model without additional constraints.

Exam trap

The trap here is that candidates often confuse SAP licensing models (user-based vs. core-based) and assume that Dedicated Hosts or Reserved Instances are always required for SAP on AWS, when in fact the licensing model dictates the appropriate AWS pricing option.

How to eliminate wrong answers

Option A is wrong because Spot Instances are not suitable for production SAP workloads due to their potential for interruption with a two-minute warning, which would violate SAP's high-availability and stability requirements. Option B is wrong because Reserved Instances require a 1- or 3-year commitment, which could lock the company into specific instance sizes or families that may not align with future SAP license adjustments based on user counts, and they do not provide the hardware-level isolation needed for some SAP licensing models. Option C is wrong because Dedicated Hosts provide physical server isolation that is typically required for SAP licenses based on physical cores or sockets, not for user-based licensing; using Dedicated Hosts would unnecessarily increase costs without any licensing benefit for a user-based model.

Full explanation →

1493

MCQeasy

A company runs its SAP ERP system on AWS using an SAP HANA database on a single EC2 instance. The system experiences intermittent performance degradation during peak hours. The operations team suspects CPU contention, as the instance type is an r5.4xlarge (16 vCPUs). When they check Amazon CloudWatch metrics, they notice that the CPU utilization averages 60%, but occasionally spikes to 100% for a few seconds. The team wants to improve performance without changing the instance type. They are considering using AWS Compute Optimizer or enabling T2/T3 unlimited. What is the MOST effective action to address the CPU spikes?

A.Use AWS Global Accelerator to improve network performance and reduce CPU overhead.

B.Attach an Elastic Fabric Adapter to offload network processing from the CPU.

C.Upgrade the instance to a larger size in the r5 family, such as r5.8xlarge, to provide more CPU capacity.

D.Enable T3 unlimited on the instance to allow sustained high CPU performance.

AnswerA

AWS Global Accelerator improves network performance and reduces CPU overhead, helping to mitigate CPU spikes.

Why this answer

AWS Global Accelerator improves network performance by routing traffic over the AWS global network, reducing latency and jitter. This reduces the CPU overhead incurred by the EC2 instance for handling network processing, which can help alleviate CPU spikes during peak hours. The other options are either ineffective or require changing the instance type, which the team wants to avoid.

Full explanation →

1494

Drag & Dropmedium

Drag and drop the steps to perform a backup and restore of an SAP HANA database using AWS Backup into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

AWS Backup requires a plan, resource assignment, backup execution, selection of backup, and restore.

Full explanation →

1495

Multi-Selecthard

An SAP administrator is troubleshooting a performance issue on an SAP NetWeaver system running on AWS. The system uses an Oracle database. The CPU utilization of the database server is consistently below 30%, but application response times are slow. Which THREE checks should the administrator perform to identify the bottleneck?

Select 3 answers

A.Use Amazon CloudWatch metrics to check network throughput and latency between the application and database servers.

B.Check the EBS volume queue length and I/O wait times on the database server.

C.Examine Oracle database wait events for enqueue and latch contention.

D.Increase the number of CPU cores on the database server.

E.Enable Amazon EBS Elastic Volumes to increase volume size dynamically.

AnswersA, B, C

Network latency can cause slow responses.

Why this answer

High network latency or insufficient throughput between the application and database servers can cause slow response times even when CPU utilization is low. Amazon CloudWatch metrics such as NetworkIn, NetworkOut, and NetworkPacketsIn/Out can reveal congestion or bandwidth saturation, which is a common bottleneck in SAP NetWeaver deployments on AWS.

Exam trap

The trap here is that candidates often assume low CPU utilization means the system is not busy, overlooking that I/O wait, network latency, or database contention can cause slow responses without consuming CPU cycles.

Full explanation →

1496

MCQmedium

A company is migrating its SAP ERP system to AWS and needs to minimize network latency between the SAP application servers and the database. Which AWS service or feature should be used to meet this requirement?

A.Use AWS Global Accelerator for the application servers.

B.Place the application and database servers in the same placement group.

C.Set up VPC peering between the application and database VPCs.

D.Use an Elastic Load Balancer in front of the application servers.

AnswerB

Placement groups provide low-latency, high-throughput networking between EC2 instances.

Why this answer

Placement groups in AWS, specifically cluster placement groups, provide low-latency network performance by ensuring that EC2 instances are placed in close physical proximity within a single Availability Zone. This minimizes network latency between SAP application servers and the database, meeting the requirement for high-throughput, low-latency communication critical for SAP ERP workloads.

Exam trap

The trap here is that candidates often confuse network-level services like Global Accelerator or load balancers with physical proximity optimizations, mistakenly thinking they reduce inter-instance latency when they actually add network hops or are designed for external traffic optimization.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves global traffic routing and reduces internet latency via the AWS edge network, but it does not reduce network latency between instances within the same AWS region or Availability Zone; it is designed for external user traffic, not inter-instance communication. Option C is wrong because VPC peering connects separate VPCs for IP routing but does not influence the physical placement or network distance between instances; it does not inherently reduce latency compared to instances in the same VPC or placement group. Option D is wrong because an Elastic Load Balancer distributes incoming traffic across multiple application servers for high availability and scaling, but it adds network hop latency and does not reduce the latency between application servers and the database; it is not a solution for inter-instance latency optimization.

Full explanation →

1497

Multi-Selectmedium

A company is running SAP HANA on AWS and needs to backup the database. Which TWO services can be used together to create a backup strategy that meets the requirement of point-in-time recovery? (Choose two.)

Select 2 answers

A.AWS Database Migration Service

B.Amazon EBS snapshots

C.AWS Backup

D.Amazon S3 Lifecycle policies

E.AWS Storage Gateway

AnswersB, C

EBS snapshots are used for point-in-time backups of volumes.

Why this answer

Amazon EBS snapshots (B) provide point-in-time backups of SAP HANA data volumes, and AWS Backup (C) can orchestrate and manage these snapshots, enabling a comprehensive backup strategy with point-in-time recovery. AWS Database Migration Service (A) is for database migration, not backup. Amazon S3 Lifecycle policies (D) manage object transitions, not database backups.

AWS Storage Gateway (E) is for hybrid cloud storage, not SAP HANA backup.

Full explanation →

1498

MCQmedium

An SAP HANA administrator sees the error log entry shown in the exhibit. The error occurs when a scheduled job tries to insert data into the BKPF table. What is the MOST likely cause?

A.The credentials used by the scheduled job are incorrect.

B.The user does not have INSERT privilege on the BKPF table.

C.The SQL statement has a syntax error.

D.The table BKPF is full and cannot accept new rows.

AnswerA

The error message explicitly says invalid user or password.

Why this answer

The error log entry indicates that the scheduled job is failing during an INSERT operation on the BKPF table. In SAP HANA, when a scheduled job fails with an authentication or authorization error, the most common cause is incorrect credentials being used by the job's connection to the database. This is because the job's runtime context does not have the correct user or password to establish a valid session, leading to a failure before any SQL operation is attempted.

Exam trap

The trap here is that candidates often confuse authentication (credential validation) with authorization (privilege checks), assuming that a failure during an INSERT operation must be a privilege issue, when in fact the error log points to a connection-level failure due to incorrect credentials.

How to eliminate wrong answers

Option B is wrong because an INSERT privilege error would produce a specific 'insufficient privilege' or 'no privilege' error message, not a generic authentication failure. Option C is wrong because a syntax error would generate a SQL syntax error message (e.g., 'syntax error' or 'incorrect syntax') and would occur at parse time, not during execution. Option D is wrong because a full table would result in a 'table is full' or 'no more space' error, not an authentication-related error.

Full explanation →

1499

Multi-Selecthard

A company is migrating an SAP environment to AWS and needs to ensure that the SAP HANA database can be backed up efficiently. Which THREE AWS services can be used together to implement a backup strategy for SAP HANA?

Select 3 answers

A.Amazon RDS

B.Amazon EBS snapshots

C.Amazon DynamoDB

D.AWS Backup

E.Amazon S3

AnswersB, D, E

EBS snapshots provide quick backups of HANA volumes.

Why this answer

The correct answers are B, D, and E. Amazon EBS snapshots provide point-in-time backups of SAP HANA data volumes. AWS Backup can automate and manage backup schedules for EBS snapshots and other resources.

Amazon S3 can be used for long-term storage of backup files. Option A (Amazon RDS) is incorrect because SAP HANA is not an RDS database; it runs on EC2 with EBS volumes. Option C (Amazon DynamoDB) is a NoSQL database not used for SAP HANA backups.

Full explanation →

1500

MCQmedium

A company is migrating an SAP ERP system to AWS and wants to use SAP HANA as the database. The current on-premises database is 4 TB. Which EC2 instance type is optimized for SAP HANA workloads and provides sufficient memory?

A.x1e.32xlarge

B.r5.24xlarge

C.m5.24xlarge

D.c5.18xlarge

AnswerA

x1e.32xlarge offers 4 TB of memory, SAP HANA certified.

Why this answer

The x1e.32xlarge instance is specifically optimized for SAP HANA workloads, offering 3,904 GiB of memory, which is sufficient for a 4 TB SAP HANA database when considering the 1:5 memory-to-data ratio required by SAP (4 TB data requires approximately 800 GB memory, but the x1e.32xlarge provides ample headroom for growth and workload peaks). It also supports SAP HANA certified instance types and provides high network and EBS throughput essential for HANA's performance demands.

Exam trap

The trap here is that candidates often choose the r5.24xlarge because it is memory-optimized and has a high memory-to-vCPU ratio, but they overlook that it is not SAP HANA certified for production workloads and its 768 GiB memory is insufficient for a 4 TB database, as SAP requires a minimum memory-to-data ratio of 1:5 (and often 1:2 for production).

How to eliminate wrong answers

Option B (r5.24xlarge) is wrong because while it is memory-optimized, it only provides 768 GiB of memory, which is insufficient for a 4 TB SAP HANA database that typically requires at least 800 GB to 1 TB of memory for the data and working memory, and it is not listed as a certified SAP HANA instance type for production workloads. Option C (m5.24xlarge) is wrong because it is a general-purpose instance with only 384 GiB of memory, far below the memory requirements for a 4 TB HANA database, and it lacks the dedicated HANA certification. Option D (c5.18xlarge) is wrong because it is compute-optimized with only 144 GiB of memory, completely inadequate for SAP HANA's memory-intensive in-memory database operations, and it is not certified for SAP HANA.

Full explanation →

Page 20 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →