Courseiva

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 151–225

1616 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 22

Page 4
151
MCQmedium

An SAP system fails to send emails via SAPconnect using SMTP. The EC2 instance has a public IP and the security group allows outbound traffic on port 25. The SMTP server is an on-premises relay. What is the most likely reason for the failure?

A.The security group does not allow outbound traffic on port 25.
B.AWS blocks outbound traffic on port 25 by default for EC2 instances.
C.The EC2 instance does not have a public IP address associated.
D.The route table does not have a default route to an internet gateway.
AnswerB

AWS restricts port 25 outbound; you need to request removal or use a different port.

Why this answer

The most likely reason is that AWS blocks outbound traffic on port 25 by default for EC2 instances to prevent spam. This restriction applies even if the security group allows outbound port 25 traffic. Option A is incorrect because the security group allows outbound traffic on port 25, but the default AWS block overrides it.

Option C is incorrect because the instance has a public IP. Option D is incorrect because the route table is not the issue; the instance has a public IP and can reach the internet, but port 25 is blocked at the AWS level.

Full explanation →
152
MCQmedium

An SAP system uses a Multi-AZ RDS for Oracle instance. During a recent failover, the application experienced a long outage because the SAP application server did not automatically reconnect to the new database endpoint. What is the most efficient way to resolve this issue?

A.Reduce the DNS TTL for the RDS endpoint and ensure the application re-resolves DNS on connection failure.
B.Reboot the application server after every failover.
C.Deploy an Application Load Balancer in front of the RDS instance.
D.Modify the application connection string to use the standby instance IP directly.
AnswerA

Low TTL and re-resolution enable fast failover recovery.

Why this answer

The RDS endpoint remains the same after failover; the issue is DNS caching. Reducing the TTL ensures the application picks up the new IP quickly. Option B (rebooting) is disruptive and not a fix.

Option C (modifying the connection string) is not needed. Option D (using a load balancer) adds complexity and latency.

Full explanation →
153
MCQmedium

A company is migrating an SAP BusinessObjects environment to AWS. They need to ensure that the business intelligence reports continue to run without interruption. Which migration strategy should they use?

A.Use a phased migration, moving reports gradually using AWS DataSync
B.Rehost using AWS Server Migration Service (SMS) in a single wave
C.Replatform to Amazon QuickSight
D.Lift-and-shift all servers at once during a maintenance window
AnswerA

Phased approach minimizes disruption; DataSync can transfer data incrementally.

Why this answer

A phased migration using AWS DataSync allows the company to gradually move SAP BusinessObjects reports while maintaining continuous operations. DataSync efficiently transfers large volumes of data over the network with built-in validation and incremental sync capabilities, ensuring that the BI environment remains available during the migration. This approach minimizes disruption by avoiding a full cutover and allows for testing and rollback if needed.

Exam trap

The trap here is that candidates often confuse 'phased migration' with 'lift-and-shift' or 'replatforming,' assuming that any migration to AWS must involve a single cutover or a full re-architecture, when in fact a gradual data sync approach like DataSync can maintain business continuity.

How to eliminate wrong answers

Option B is wrong because AWS Server Migration Service (SMS) is designed for rehosting entire server images as a single wave, which would require a full cutover and cause downtime, not suitable for uninterrupted report execution. Option C is wrong because replatforming to Amazon QuickSight is a re-architecture strategy that would require significant changes to the SAP BusinessObjects environment, including rewriting reports and data connections, which contradicts the requirement for uninterrupted operation. Option D is wrong because a lift-and-shift of all servers at once during a maintenance window would cause a complete outage, failing to ensure that reports continue to run without interruption.

Full explanation →
154
MCQeasy

A company is deploying an SAP BusinessObjects (BO) platform on AWS. To ensure high availability of the BO servers, which AWS service should be used to distribute incoming traffic across multiple BO instances in different Availability Zones?

A.NAT Gateway
B.Application Load Balancer
C.Amazon Route 53
D.Classic Load Balancer
AnswerB

ALB distributes incoming HTTP/HTTPS traffic across multiple instances.

Why this answer

The Application Load Balancer (ALB) operates at Layer 7 and can distribute HTTP/HTTPS traffic across multiple SAP BusinessObjects instances in different Availability Zones, providing high availability and health-check-based routing. ALB supports path-based routing and SSL termination, which are essential for modern web applications like SAP BO. It is the correct choice because it is designed for HTTP/HTTPS traffic and can balance load across instances in multiple AZs.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) with load balancing, but Route 53 does not provide real-time health-check-based traffic distribution across instances in the same way an ALB does.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway is used to enable outbound internet access for instances in private subnets, not to distribute incoming traffic across multiple instances. Option C is wrong because Amazon Route 53 is a DNS service that can route traffic to endpoints but does not perform load balancing at the application layer; it lacks health-check-based traffic distribution across multiple instances in real time. Option D is wrong because the Classic Load Balancer operates at Layer 4 and does not support advanced Layer 7 features like path-based routing or host-based routing, which are often required for SAP BusinessObjects deployments.

Full explanation →
155
MCQhard

An SAP system uses a large Amazon RDS for Oracle instance. The operations team wants to minimize downtime during a major version upgrade. Which strategy should they use?

A.Take a snapshot of the database and restore it as a new instance with the upgraded version
B.Create a read replica, upgrade it, and then promote it to the primary
C.Modify the DB instance and apply the upgrade immediately
D.Use AWS Database Migration Service (DMS) to migrate to a new instance
AnswerB

Minimizes downtime by failing over to the upgraded replica.

Why this answer

Using a read replica allows you to upgrade the replica and then promote it, minimizing downtime. Option A (taking a snapshot and restoring) has downtime. Option C (modifying the DB instance) causes downtime.

Option D (using AWS DMS) requires complex setup and may introduce latency.

Full explanation →
156
MCQhard

A company is migrating an SAP NetWeaver system to AWS. The migration involves moving the application layer to EC2 instances and the database to Amazon RDS for SAP. The company wants to minimize downtime and has a limited time window. Which migration approach should the company use?

A.Use AWS Application Migration Service (MGN) to replicate the entire server
B.Use SAP System Provisioning (SWPM) to export and import the system
C.Use AWS Database Migration Service (DMS) for the database and AWS Application Migration Service (MGN) for the application servers
D.Use SAP Software Update Manager (SUM) with Database Migration Option (DMO)
AnswerD

SUM with DMO provides a unified migration process for SAP systems.

Why this answer

For minimal downtime during an SAP migration to AWS with a target of Amazon RDS for SAP, the recommended approach is to use SAP Software Update Manager (SUM) with the Database Migration Option (DMO). This integrated tool can handle both the application and database migration in a single, efficient process, minimizing downtime. Option A (AWS Application Migration Service) replicates entire servers but does not handle SAP-specific database and application migration.

Option B (SAP System Provisioning, SWPM) is for new installations, not migrations. Option C (AWS DMS for database and AWS MGN for application servers) is incorrect because AWS DMS does not support SAP application migration, and AWS MGN is not SAP-aware. Therefore, Option D (SAP SUM with DMO) is the correct choice.

Full explanation →
157
MCQeasy

A company is running SAP NetWeaver on AWS. The SAP application server instances need to be distributed within a single Availability Zone for low-latency connectivity. Which AWS feature should be used to ensure low-latency connectivity between these instances?

A.Network ACL
B.Placement Group (cluster)
C.Internet Gateway
D.VPC Peering
AnswerB

Placement Group (cluster) places instances in a single Availability Zone for low latency; it does not support distribution across multiple AZs.

Why this answer

A cluster placement group places instances into a low-latency, high-bandwidth network within a single Availability Zone. This is ideal for SAP application servers that require these characteristics. For multi-AZ high availability, a separate placement group per AZ or spread placement groups may be considered, but for the requirement stated in this question, the cluster placement group (Option B) is correct.

Exam trap

The trap is selecting other network features such as VPC Peering or Internet Gateway, which do not directly improve latency between instances. The correct choice for low-latency within an AZ is a cluster placement group.

How to eliminate wrong answers

Option A is wrong because Network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level, not a mechanism to reduce latency or influence instance placement. Option C is wrong because an Internet Gateway provides internet access to VPC instances, not low-latency connectivity between instances within the same VPC. Option D is wrong because VPC Peering connects separate VPCs for routing traffic, but it does not optimize latency between instances within the same VPC or across Availability Zones.

Full explanation →
158
MCQeasy

A company is migrating an on-premises SAP ERP system to AWS. The system uses a large Oracle database. The migration must minimize downtime. Which AWS service should be used for the database migration?

A.AWS Server Migration Service (SMS)
B.AWS Application Migration Service (MGN)
C.AWS Schema Conversion Tool (SCT)
D.AWS Database Migration Service (DMS)
AnswerD

DMS supports minimal downtime migration with ongoing replication.

Why this answer

AWS DMS can migrate databases with minimal downtime by using ongoing replication. Option A is incorrect because AWS SMS is designed for server migration, not database migration. Option B is incorrect because AWS Application Migration Service (MGN) is also for server migration.

Option C is incorrect because AWS Schema Conversion Tool (SCT) assists with schema and code conversion but is not a full database migration service. Option D is correct because AWS Database Migration Service (DMS) can migrate Oracle databases to AWS with minimal downtime using continuous replication.

Full explanation →
159
MCQeasy

A company runs an SAP HANA database on AWS. The operations team wants to automate the monitoring of HANA alert logs and send notifications when critical alerts occur. Which AWS service should they use to collect and analyze the logs?

A.AWS CloudTrail
B.Amazon S3 Event Notifications
C.AWS Lambda scheduled functions
D.Amazon CloudWatch Logs with metric filters and alarms
AnswerD

CloudWatch Logs can ingest and monitor log files, triggering alarms on specific patterns.

Why this answer

Amazon CloudWatch Logs can ingest HANA alert logs via the CloudWatch agent and trigger alarms based on metric filters. CloudTrail records API activity, not application logs. S3 Event Notifications do not analyze log content.

Lambda alone does not provide log collection.

Full explanation →
160
MCQhard

An SAP administrator runs the AWS CLI command shown in the exhibit for an EC2 instance used as an SAP HANA database server. The server has two EBS volumes attached: a root volume (/dev/xvda) and a data volume (/dev/sdf). Based on the output, what will happen when the instance is terminated?

A.The instance cannot be terminated because DeleteOnTermination is set inconsistently.
B.Both volumes will be deleted.
C.The root volume will be deleted, and the data volume will persist.
D.Both volumes will persist.
AnswerC

The root volume is deleted, the data volume persists.

Why this answer

The AWS CLI command `describe-instances` output shows that the root volume (`/dev/xvda`) has `DeleteOnTermination` set to `true` (default), while the data volume (`/dev/sdf`) has `DeleteOnTermination` set to `false`. When the EC2 instance is terminated, only volumes with `DeleteOnTermination=true` are automatically deleted. Therefore, the root volume will be deleted, and the data volume will persist as an unattached EBS volume in the same Availability Zone.

Exam trap

The trap here is that candidates assume all volumes attached to an instance share the same termination behavior, but AWS allows independent `DeleteOnTermination` settings per volume, and the default for non-root volumes is `true` only if launched via certain AMIs or block device mappings.

How to eliminate wrong answers

Option A is wrong because `DeleteOnTermination` can be set independently per volume; there is no requirement for consistency across volumes, and the instance can be terminated regardless. Option B is wrong because the data volume has `DeleteOnTermination=false`, so it will not be deleted upon termination. Option D is wrong because the root volume has `DeleteOnTermination=true`, so it will be deleted, not persist.

Full explanation →
161
MCQhard

A company is migrating a critical application to AWS using a lift-and-shift strategy. The application has a legacy licensing model tied to specific hardware IDs. The company has already migrated the application to an Amazon EC2 instance but the license validation fails because the hardware ID changed. What is the MOST cost-effective and least disruptive solution?

A.Revert the migration and keep the application on-premises with a VPN connection to AWS for other services.
B.Provision a Dedicated Host and associate the instance with it to control hardware IDs.
C.Modify the application's license file to accept the new hardware ID.
D.Use AWS License Manager to create a hardware-based license token that matches the original hardware ID.
AnswerB

A Dedicated Host ensures the EC2 instance runs on a consistent physical server, preserving the hardware ID. This is the most cost-effective and least disruptive option.

Why this answer

Provisioned Dedicated Hosts provide a consistent hardware ID for the EC2 instance, as the instance runs on a specific physical server. This allows the legacy license to validate against the same hardware ID after migration, without modifying the application or reverting the migration. It is the most cost-effective and least disruptive solution, as it avoids re-architecture or application changes.

Exam trap

The trap is that candidates may think AWS License Manager (Option D) can bind licenses to hardware IDs, but License Manager manages licenses based on instance types, vCPUs, or dedicated hosts—it does not create hardware tokens to emulate an original hardware ID. Dedicated Hosts (Option B) are the correct approach for preserving hardware-specific licensing.

How to eliminate wrong answers

Option A is wrong because reverting the migration defeats the purpose of the lift-and-shift strategy and introduces significant operational overhead and latency for other services. Option B is wrong because provisioning a Dedicated Host is more expensive than necessary and does not directly solve the hardware ID mismatch; Dedicated Hosts provide physical isolation but do not allow you to spoof or control the hardware ID that the application sees. Option C is wrong because modifying the application's license file to accept the new hardware ID may violate the licensing agreement and is not a supported or scalable solution; it also requires manual intervention and potential legal issues.

Full explanation →
162
Multi-Selecteasy

Which TWO AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose two.)

Select 2 answers
A.AWS Systems Manager
B.AWS CloudTrail
C.AWS Trusted Advisor
D.AWS Config
E.Amazon CloudWatch
AnswersA, E

Systems Manager can collect OS and application metrics.

Why this answer

AWS Systems Manager (SSM) is correct because it provides the Run Command and Inventory features that can execute scripts (e.g., SAP HANA SQL queries) and collect OS-level metrics (CPU, memory, disk) from EC2 instances. Amazon CloudWatch is correct because it can ingest custom metrics from the SAP HANA database (e.g., via the SAP HANA plugin for CloudWatch Agent) and monitor standard EC2 metrics like CPU utilization and memory, enabling performance monitoring and alarming.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with CloudWatch (monitoring), or assume AWS Config can monitor performance because it tracks resource state, but neither provides the real-time metric collection needed for SAP HANA performance monitoring.

Full explanation →
163
MCQeasy

A SAP administrator wants to monitor the CPU utilization of an SAP application server running on an EC2 instance. Which AWS service should be used to set up an alarm when CPU utilization exceeds 90% for 5 minutes?

A.AWS CloudTrail
B.AWS Trusted Advisor
C.Amazon CloudWatch
D.AWS Config
AnswerC

CloudWatch Alarms can monitor metrics and trigger actions based on thresholds.

Why this answer

Amazon CloudWatch is the correct service for monitoring CPU utilization and setting alarms. CloudWatch collects metrics like CPUUtilization from EC2 instances, and you can create a CloudWatch Alarm that triggers when the metric exceeds a threshold (e.g., 90%) for a specified duration (e.g., 5 minutes). The other options are incorrect: AWS CloudTrail logs API calls for auditing, not metrics; AWS Trusted Advisor provides best practice recommendations; and AWS Config tracks resource configuration changes.

Therefore, CloudWatch (Option C) is the correct choice.

Full explanation →
164
MCQeasy

An SAP administrator needs to ensure that all changes to an SAP system's AWS resources are tracked and that alerts are sent when SSH access to EC2 instances is modified. Which AWS service should be used?

A.AWS Config
B.Amazon CloudWatch
C.AWS Trusted Advisor
D.AWS CloudTrail
AnswerD

Records API calls for auditing.

Why this answer

AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure, including changes to EC2 security groups that control SSH access. By enabling CloudTrail, you can monitor for events like AuthorizeSecurityGroupIngress and trigger alerts via CloudWatch Events or Lambda when SSH (port 22) rules are modified, meeting the audit and alerting requirements.

Exam trap

A common trap in AWS SAP on AWS Specialty exams is confusing AWS Config (which tracks configuration state and compliance) with AWS CloudTrail (which records API calls). This question specifically requires tracking API modifications (e.g., changes to security group rules for SSH) and sending alerts, which is a CloudTrail capability, not just configuration compliance.

How to eliminate wrong answers

Option A is wrong because AWS Config evaluates resource configurations against desired rules and can detect drift, but it does not natively track real-time API calls or send alerts for specific SSH modifications; it focuses on configuration compliance, not event-driven monitoring. Option B is wrong because Amazon CloudWatch monitors performance metrics and logs, but it cannot directly track API-level changes to EC2 security groups unless CloudTrail logs are streamed to it; it is a downstream consumer, not the primary tracking service. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations (e.g., security groups open to 0.0.0.0/0) but does not track or alert on individual API modifications to SSH rules.

Full explanation →
165
MCQeasy

During a SAP migration to AWS, the team needs to ensure that the SAP license is compliant. Which of the following is a requirement for running SAP production systems on AWS?

A.The EC2 instance must be SAP-certified and the number of SAPS must be licensed.
B.The company must use AWS Enterprise Support.
C.The company must notify SAP of the migration to AWS.
D.The company must use a specific AWS region.
AnswerA

SAP certification and proper licensing are mandatory.

Why this answer

AWS requires that for running SAP production systems, the EC2 instance must be SAP-certified (listed in the SAP Certified and Supported Hardware Directory) and the customer must have licensed the appropriate number of SAP Application Performance Standard (SAPS) units for the instance type. This ensures the infrastructure meets SAP's performance and support requirements, and that the license covers the compute capacity used.

Exam trap

The trap here is that candidates may confuse operational best practices (like using Enterprise Support or notifying SAP) with mandatory licensing requirements, or assume that AWS region choice affects SAP licensing compliance.

How to eliminate wrong answers

Option B is wrong because AWS Enterprise Support is not a requirement for running SAP production systems on AWS; it is an optional support plan, and customers can run SAP workloads with Basic or Developer support as long as they meet licensing and certification requirements. Option C is wrong because there is no requirement to notify SAP of a migration to AWS; SAP licensing is based on the customer's existing agreements and the SAPS capacity of the instance, not on migration notification. Option D is wrong because SAP production systems can run in any AWS region that supports the required EC2 instance types and services; there is no region-specific mandate for SAP licensing compliance.

Full explanation →
166
Multi-Selecthard

A company runs SAP HANA on AWS. The system is experiencing high CPU utilization during peak hours. Which TWO actions should the administrator take to address this? (Choose two.)

Select 2 answers
A.Disable HANA columnar compression to reduce CPU overhead.
B.Increase the size of the /hana/data EBS volumes.
C.Reduce the network throughput of the EC2 instance.
D.Right-size the EC2 instance to a larger type with more vCPUs.
E.Configure HANA workload management to limit resource-intensive queries.
AnswersD, E

Provides more CPU capacity.

Why this answer

Right-sizing the EC2 instance to a larger type with more vCPUs directly addresses high CPU utilization by providing additional compute capacity for peak workloads. SAP HANA is CPU-intensive, especially during query processing and data compression, so increasing vCPUs alleviates the bottleneck without requiring architectural changes.

Exam trap

The trap here is that candidates may confuse storage scaling (Option B) with compute scaling, or incorrectly believe disabling compression reduces CPU load, when in fact compression reduces CPU overhead by minimizing data movement.

Full explanation →
167
MCQhard

A company runs SAP S/4HANA on AWS with a production system in us-east-1 and a disaster recovery (DR) system in us-west-2. The DR system is a standby HANA system using HANA System Replication (HSR) with asynchronous replication. The primary system has a memory of 2 TB and uses x1e.16xlarge instances. The DR system uses identical instance types. Recently, the network latency between the primary and DR sites increased from 50 ms to 150 ms due to a change in the network path. The SAP Basis team notices that the replication lag has increased significantly, and the DR system is now behind by several minutes. The RPO requirement is 30 seconds. The team must resolve the issue without changing the DR site location or the bandwidth. Which action should the team take to meet the RPO?

A.Configure HSR to use delta_datashipping instead of log shipping.
B.Increase the AWS Direct Connect bandwidth between the two regions.
C.Use Amazon S3 cross-region replication for the HANA log backups.
D.Change HSR to synchronous replication mode.
AnswerA

Delta_datashipping reduces data transfer and can meet RPO under higher latency.

Why this answer

HANA System Replication (HSR) can be configured to use delta_datashipping, which sends only the changed data blocks rather than full redo logs. This reduces the amount of data transferred per replication cycle, making it more resilient to increased network latency. With 150 ms latency, log shipping may fail to meet the 30-second RPO, but delta_datashipping can keep the DR system within the required lag by minimizing per-message payload size.

Exam trap

The trap here is that candidates often assume synchronous replication is the only way to reduce RPO, but they overlook that synchronous mode introduces performance penalties on the primary, and the question's constraint of not changing bandwidth or location forces a protocol-level tuning solution like delta_datashipping.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that bandwidth cannot be changed, and increasing Direct Connect bandwidth would not address the root cause of high latency (150 ms) which is a propagation delay issue, not a throughput issue. Option C is wrong because Amazon S3 cross-region replication for HANA log backups is an asynchronous backup mechanism, not a real-time replication method, and it cannot meet a 30-second RPO due to S3 eventual consistency and replication delays. Option D is wrong because switching to synchronous replication would require the primary to wait for acknowledgment from the DR system before committing transactions, which with 150 ms latency would severely degrade production performance and potentially cause application timeouts.

Full explanation →
168
MCQeasy

A company is running SAP on AWS and needs to automate OS-level patching for their SAP application servers. Which AWS service should they use to schedule and apply patches?

A.Amazon CloudWatch Events
B.AWS OpsWorks
C.AWS Systems Manager Patch Manager
D.Amazon EC2 Auto Scaling
AnswerC

Patch Manager automates OS patching across EC2 instances.

Why this answer

AWS Systems Manager Patch Manager is specifically designed to automate OS-level patching for EC2 instances, including SAP application servers. Option A is wrong because Amazon CloudWatch Events is for scheduling and responding to events, not for patching. Option B is wrong because AWS OpsWorks is a configuration management service that uses Chef/Puppet, but it is not primarily for patching.

Option D is wrong because Amazon EC2 Auto Scaling handles instance scaling, not patching.

Full explanation →
169
MCQmedium

A company runs SAP ERP on AWS with a Microsoft SQL Server database. The system is experiencing slow batch job processing. The database server is an r5.8xlarge instance with EBS gp2 volumes. Monitoring shows high disk queue length on the data and log volumes. What change will most likely improve batch job performance?

A.Migrate the SQL Server database to Amazon RDS for SQL Server.
B.Move the tempdb files to a dedicated EBS io2 volume with high IOPS.
C.Store the tempdb on an instance store volume.
D.Upgrade the EC2 instance to r5.12xlarge.
AnswerB

Dedicated tempdb volume reduces contention and improves I/O.

Why this answer

Moving tempdb to a separate, high-performance EBS io2 volume reduces contention on the data and log volumes. Option B directly addresses the bottleneck. Option D (instance size upgrade) may help but is costly and less direct.

Option A (RDS migration) is a major re-architecture, not a simple fix. Option C (instance store) is non-persistent and not suitable for tempdb in production.

Full explanation →
170
MCQeasy

A company is designing a multi-tier web application on AWS. The web tier must scale based on CPU utilization, and the application tier must scale based on request count. Both tiers are deployed in a VPC with public and private subnets. Which combination of AWS services should the company use?

A.Application Load Balancer for the web tier and Network Load Balancer for the application tier
B.Classic Load Balancer for both tiers
C.Network Load Balancer for the web tier and Application Load Balancer for the application tier
D.Amazon API Gateway for the web tier and Application Load Balancer for the application tier
AnswerA

This is a standard architecture: ALB handles HTTP/HTTPS traffic and can scale based on CPU; NLB handles TCP traffic and can scale based on request count.

Why this answer

The web tier requires an Application Load Balancer (ALB) to distribute HTTP/HTTPS traffic and can scale based on CPU utilization using an Auto Scaling group with a target tracking policy. The application tier needs a Network Load Balancer (NLB) to handle high request counts at the transport layer (TCP/UDP), which is ideal for scaling based on request count per target. This combination allows each tier to use the most appropriate load balancer for its scaling metric and protocol requirements.

Exam trap

The trap here is that candidates often assume the web tier should use an NLB for high performance, but the ALB is required for HTTP/HTTPS traffic and CPU-based scaling, while the NLB is better suited for the application tier when scaling based on request count at the transport layer.

How to eliminate wrong answers

Option B is wrong because the Classic Load Balancer (CLB) is a legacy service that does not support advanced routing or scaling based on request count per target, and it lacks the granularity needed for separate tier scaling. Option C is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot inspect HTTP/HTTPS headers or route based on CPU utilization metrics, making it unsuitable for the web tier. Option D is wrong because Amazon API Gateway is a serverless API management service, not a load balancer, and it cannot directly integrate with Auto Scaling groups for CPU-based scaling of EC2 instances in a web tier.

Full explanation →
171
MCQeasy

An operations team receives an alert that an SAP application server EC2 instance is unreachable. The team checks the AWS Management Console and sees that the instance status check shows "Instance reachability check failed". What is the most likely cause?

A.The operating system on the instance is not responding.
B.The security group associated with the instance is blocking all traffic.
C.The EBS root volume is detached from the instance.
D.The instance was stopped by an Auto Scaling group.
AnswerA

Correct. The instance reachability check fails when the OS is not responding, often due to kernel panic or OS crash.

Why this answer

An instance reachability check failure typically indicates OS-level issues such as a crashed OS or kernel panic. Therefore, option A is correct. Option B is incorrect because security group issues would cause network connectivity failure but not necessarily a status check failure.

Option C is incorrect because a stopped instance would show a different status. Option D is incorrect because EBS volume issues would be reported as a volume status check failure.

Full explanation →
172
Drag & Dropmedium

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting should start with logs, then check database status, network, security groups, and authentication.

Full explanation →
173
MCQeasy

An SAP administrator needs to ensure that the SAP landscape on AWS is compliant with the SAP license requirements. What is the responsibility of the customer regarding SAP licensing on AWS?

A.AWS provides SAP licenses as part of the EC2 instance pricing
B.The customer must bring their own SAP licenses and ensure compliance with SAP licensing terms
C.SAP licensing is automatically handled by AWS Support
D.SAP licenses are included when using SAP HANA on AWS
AnswerB

Customers are responsible for their own SAP licenses and compliance with SAP's licensing policies.

Why this answer

Customers are responsible for bringing their own SAP licenses and ensuring compliance with SAP licensing terms. AWS does not provide SAP licenses. AWS provides the infrastructure.

SAP licensing is not automatically covered by AWS Support.

Full explanation →
174
Matchingmedium

Match the AWS service to its function in SAP disaster recovery.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Replicates servers to another AWS Region

Replicates backups to secondary Region

Traffic routing to standby region

Point-in-time backups for HANA data volumes

Why these pairings

In SAP disaster recovery on AWS, AWS Elastic Disaster Recovery (DRS) handles continuous replication, Amazon Route 53 manages DNS-based failover, and AWS Global Accelerator provides static IPs for traffic shifting. Common confusions involve mixing the distinct roles of these services.

Full explanation →
175
Multi-Selecteasy

A company is planning to migrate its SAP ERP system to AWS. The system currently uses an Oracle database. The company wants to switch to a supported database on AWS. Which THREE database options are supported by SAP on AWS?

Select 3 answers
A.SAP Adaptive Server Enterprise (ASE)
B.SAP MaxDB
C.IBM Db2 for SAP
D.Amazon Aurora PostgreSQL
E.SAP HANA
AnswersA, C, E

SAP ASE is a supported database for SAP systems.

Why this answer

SAP Adaptive Server Enterprise (ASE) is a certified database platform for SAP applications on AWS. SAP officially supports ASE as a database option for SAP ERP and other SAP Business Suite systems, provided the correct SAP ASE version and patch levels are used. This makes it a valid choice for migrating from Oracle to a supported SAP database on AWS.

Exam trap

The PAS-C01 exam often tests the misconception that any AWS-managed database (like Amazon Aurora PostgreSQL) is automatically supported for SAP workloads, but SAP strictly limits database support to its own and certified third-party databases listed in the SAP PAM.

Full explanation →
176
MCQeasy

A company is running SAP on AWS and needs to ensure high availability for their SAP Central Services (ASCS) instance. They plan to use a multi-AZ deployment with a floating IP. Which AWS service should they use to manage the floating IP and failover?

A.Elastic Load Balancer
B.Amazon Route 53
C.AWS Global Accelerator
D.Amazon CloudFront
AnswerB

Route 53 can provide DNS failover with health checks, acting as a floating IP.

Why this answer

Amazon Route 53 can be used to associate a DNS name with a health check and failover to a secondary IP in another AZ. Option A is wrong because Elastic Load Balancer (ELB) is for distributing traffic, not for floating IPs. Option C is wrong because AWS Global Accelerator improves performance, not floating IP failover.

Option D is wrong because Amazon CloudFront is a CDN.

Full explanation →
177
MCQmedium

A company runs SAP on AWS with an SAP HANA database on an r5.8xlarge instance. The company notices high network latency between the SAP application servers and the HANA database. The application servers are in the same VPC but different subnets. Which design change would MOST effectively reduce latency?

A.Launch the application servers and the HANA database in the same placement group.
B.Create a VPC peering connection between the subnets of the application servers and the database.
C.Change the HANA database instance type to a compute-optimized instance such as c5.9xlarge.
D.Enable Enhanced Networking on the application servers by attaching an Elastic Network Adapter (ENA).
AnswerA

Placement groups provide low-latency, high-bandwidth connectivity between instances.

Why this answer

Placing both the SAP application servers and the HANA database in the same cluster placement group ensures they are in close physical proximity within a single Availability Zone, minimizing network hops and reducing latency. Placement groups achieve this by co-locating instances on the same high-bandwidth, low-latency network fabric, which is critical for SAP HANA's real-time data processing requirements.

Exam trap

The trap here is that candidates confuse Enhanced Networking (which improves throughput and CPU efficiency) with reducing latency, when in fact latency is dominated by physical distance and network hops, which only placement groups can address.

How to eliminate wrong answers

Option B is wrong because VPC peering connects VPCs, not subnets within the same VPC; the application servers and database are already in the same VPC, so peering adds unnecessary complexity and does not reduce latency. Option C is wrong because changing to a compute-optimized instance (c5.9xlarge) does not address network latency; it may even reduce memory bandwidth, which is critical for HANA, and does not affect network path length. Option D is wrong because Enhanced Networking (ENA) improves throughput and reduces CPU overhead for packet processing, but it does not reduce physical distance or network hops between instances in different subnets; latency is primarily a function of proximity, not interface optimization.

Full explanation →
178
MCQeasy

An SAP administrator needs to ensure that an Amazon RDS for SAP ASE database is automatically backed up daily and the backups are retained for 30 days. The database is currently in a Multi-AZ deployment. What is the simplest way to achieve this?

A.Create a manual snapshot every day using AWS Backup.
B.Enable Multi-AZ, which automatically backs up the database.
C.Configure automated backups with a retention period of 30 days in the RDS instance settings.
D.Set up a scheduled Lambda function to create snapshots.
AnswerC

Configuring automated backups in the Amazon RDS instance settings with a retention period of 30 days automatically creates daily backups and retains them for 30 days, meeting the requirement with minimal effort.

Why this answer

The simplest way to achieve daily automated backups with 30-day retention is to configure automated backups directly in the Amazon RDS instance settings. By setting the backup retention period to 30 days, RDS will automatically take daily snapshots and retain them for 30 days without any additional configuration. Option A is incorrect because manual snapshots are not automated and would require manual intervention.

Option B is incorrect because while Multi-AZ provides high availability, it does not automatically create backups; backups are a separate feature. Option D is incorrect because using a scheduled Lambda function adds unnecessary complexity when the built-in automated backup feature is simpler and sufficient.

Full explanation →
179
Multi-Selectmedium

Which TWO configurations are required for a high-availability SAP HANA deployment on AWS using Pacemaker? (Choose two.)

Select 2 answers
A.Placement groups in separate Availability Zones for the cluster nodes.
B.STONITH fencing configured for the cluster nodes.
C.EBS volumes with multi-attach enabled for shared storage.
D.An AWS Classic Load Balancer to route traffic to the active node.
E.SAP HANA system replication between primary and secondary instances.
AnswersB, E

STONITH ensures node isolation during failover.

Why this answer

STONITH (Shoot The Other Node In The Head) fencing is required in a Pacemaker cluster to ensure that a failed or unresponsive node is forcefully isolated before resources are failed over. Without STONITH, a split-brain scenario can occur where both nodes attempt to act as the primary, leading to data corruption. On AWS, STONITH is typically implemented using the AWS fence agent (fence_aws) which uses API calls to stop or reboot the instance.

Exam trap

The trap here is that candidates often confuse high-availability prerequisites with optional components, and may think that a load balancer or shared storage is mandatory, when in fact Pacemaker with STONITH and SAP HANA system replication are the two core requirements for a fully automated failover solution on AWS.

Full explanation →
180
MCQhard

The exhibit shows the block device mapping of an EC2 instance running SAP HANA. The root volume (/dev/xvda) has DeleteOnTermination set to true, and the data volume (/dev/sdf) has DeleteOnTermination set to false. If the instance is terminated, what happens to the data volume?

A.Only the data volume is deleted; the root volume remains.
B.Both volumes are detached and moved to Amazon S3.
C.Both volumes are deleted.
D.Only the root volume is deleted; the data volume remains.
AnswerD

The data volume's DeleteOnTermination is false, so it persists.

Why this answer

The DeleteOnTermination attribute controls whether a volume is deleted when its associated EC2 instance is terminated. For the root volume (/dev/xvda), this attribute is set to true, so it will be deleted upon termination. For the data volume (/dev/sdf), it is set to false, meaning the volume will be detached from the instance and preserved in your AWS account, allowing you to reattach it to another instance or take snapshots.

Therefore, only the root volume is deleted, and the data volume remains.

Exam trap

The trap here is that candidates often assume all volumes attached to an instance are deleted on termination, ignoring the specific DeleteOnTermination flag, or they confuse the behavior with instance store volumes which are always ephemeral.

How to eliminate wrong answers

Option A is wrong because it reverses the behavior: the root volume (with DeleteOnTermination=true) is deleted, not the data volume. Option B is wrong because volumes are not moved to Amazon S3; they remain as EBS volumes in the same Availability Zone, and termination does not trigger any S3 transfer. Option C is wrong because the data volume has DeleteOnTermination set to false, so it is not deleted; only the root volume is deleted.

Full explanation →
181
Multi-Selectmedium

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which TWO actions should they take?

Select 2 answers
A.Set up SAP HANA System Replication to another AWS region.
B.Implement a Pilot Light strategy using EC2 instances in standby.
C.Use AWS CloudFormation to automate infrastructure deployment in the DR region.
D.Use AWS Backup to schedule backups every 15 minutes.
E.Take EBS snapshots every 15 minutes.
AnswersA, C

HANA System Replication provides near-real-time data replication.

Why this answer

To achieve an RPO of 15 minutes and RTO of 2 hours, the company should use SAP HANA System Replication to replicate data to another AWS region (Option A), which provides near-real-time replication meeting the RPO. Additionally, using AWS CloudFormation to automate infrastructure deployment in the DR region (Option C) enables rapid provisioning of the DR environment, meeting the RTO. Option B (Pilot Light with EC2 standby) may not meet the RTO if manual steps are required.

Option D (AWS Backup with 15-minute schedules) is not suitable for SAP HANA databases and may not meet RTO. Option E (EBS snapshots every 15 minutes) is not feasible due to performance impact and recovery time.

Full explanation →
182
MCQeasy

A company is migrating an SAP system to AWS and wants to use AWS Backup to back up the SAP HANA database. What is a prerequisite for using AWS Backup with SAP HANA?

A.Configure AWS Storage Gateway to store backups
B.Use AWS CloudEndure for backup
C.Set up AWS Database Migration Service (DMS) for continuous backup
D.Install the AWS Backup agent for SAP HANA on the database instance
AnswerD

Agent is required for HANA backup integration.

Why this answer

AWS Backup for SAP HANA requires the AWS Backup agent to be installed on the SAP HANA database instance. This agent is a software component that integrates with SAP HANA's native backup capabilities, enabling AWS Backup to orchestrate and manage full, incremental, and differential backups of the HANA database. Without the agent, AWS Backup cannot communicate with the SAP HANA system to initiate or manage backups.

Exam trap

The trap here is that candidates may confuse AWS Backup's agent-based approach with other AWS services like Storage Gateway or DMS, assuming that backup of SAP HANA requires a separate storage or replication service rather than a dedicated agent that integrates with HANA's native backup interface.

How to eliminate wrong answers

Option A is wrong because AWS Storage Gateway is used for hybrid cloud storage (e.g., file, volume, or tape gateways) and is not a prerequisite for AWS Backup with SAP HANA; AWS Backup stores backups directly in Amazon S3 or AWS Backup vaults, not via Storage Gateway. Option B is wrong because AWS CloudEndure (now AWS Application Migration Service) is designed for lift-and-shift migration of entire servers, not for database backup integration with AWS Backup. Option C is wrong because AWS Database Migration Service (DMS) is used for continuous data replication and migration between databases, not for backup orchestration; AWS Backup does not rely on DMS for SAP HANA backups.

Full explanation →
183
MCQhard

Refer to the exhibit. A migration team is using AWS DMS to replicate data from an on-premises SAP ASE database to Amazon RDS for SAP ASE. The DMS task fails with the error shown. The source database is reachable from the DMS replication instance. What is the most likely cause?

A.The ODBC driver configuration on the DMS replication instance is incorrect
B.The source database port is blocked by a firewall
C.The DMS task is using the wrong source engine type (e.g., SQL Server instead of SAP ASE)
D.The DMS replication instance does not have the required IAM permissions
AnswerA

ODBC error indicates driver or connection string issue.

Why this answer

The error indicates an ODBC connection failure, which typically occurs when the ODBC driver or its configuration on the DMS replication instance is incorrect. Since the source database is reachable, the issue is not firewall or IAM permissions. The DMS task is using the correct source engine type (SAP ASE), so the most likely cause is a misconfigured ODBC driver on the replication instance, making Option A correct.

Full explanation →
184
MCQhard

A company is running SAP HANA on an EC2 instance with multiple EBS volumes for data and log. The instance is experiencing high write latency on the log volume. The administrator notices that the log volume is a gp2 EBS volume with 1,000 GB size and 3,000 IOPS baseline. The average write IOPS to the log volume is 4,000, with peaks up to 5,500. Which action should the administrator take to resolve the latency?

A.Replace the gp2 volume with an io2 Block Express volume provisioned at 6,000 IOPS.
B.Change the volume type to st1 (throughput optimized) to improve throughput.
C.Add a second log volume and stripe them using LVM.
D.Increase the gp2 volume size to 2,000 GB to double the baseline IOPS.
AnswerA

io2 Block Express provides consistent low latency and high IOPS.

Why this answer

The gp2 volume's baseline IOPS is 3,000, but the log volume requires an average of 4,000 write IOPS with peaks up to 5,500, which exceeds the burst balance, causing latency. Replacing with an io2 Block Express volume provisioned at 6,000 IOPS provides consistent high IOPS and low latency, ideal for SAP HANA log volumes. Option B is incorrect because st1 volumes are throughput-optimized, not IOPS-optimized, and would not address the IOPS bottleneck.

Option C is incorrect because striping additional gp2 volumes adds complexity and still relies on burst performance, which may not sustain the required IOPS. Option D is incorrect because while increasing gp2 size to 2,000 GB doubles baseline IOPS to 6,000, gp2 still uses a burst model; if the burst balance is depleted, latency can occur. io2 Block Express provides provisioned, consistent performance without bursting.

Full explanation →
185
MCQhard

An SAP system running on AWS experiences periodic performance degradation. Analysis shows that the issue occurs when an on-premises monitoring system polls the SAP application server. Which AWS service can help mitigate this by caching or throttling requests?

A.Amazon Route 53
B.AWS WAF
C.Amazon CloudFront
D.Elastic Load Balancing
AnswerB

WAF can create rules to rate-limit or block excessive requests.

Why this answer

(AWS WAF) is correct because AWS WAF can rate-limit incoming requests from specific IP addresses, reducing the load caused by frequent polling from the on-premises monitoring system. Option A (Amazon Route 53) is a DNS service and cannot throttle or cache application-level requests. Option C (Amazon CloudFront) caches content but is not designed for application-level throttling of requests to an SAP application server.

Option D (Elastic Load Balancing) distributes traffic but does not provide request throttling or rate limiting.

Full explanation →
186
MCQhard

An SAP HANA database on AWS is running on an EC2 instance with multiple EBS volumes striped using LVM. The database administrator needs to increase the total storage capacity without downtime. Which approach should be taken? (Select TWO.)

A.Create a new larger instance and attach the existing volumes.
B.Modify the existing volumes to a higher IOPS volume type.
C.Add the new volumes to the LVM volume group and extend the logical volume.
D.Create new EBS volumes and attach them to the instance.
E.Take a snapshot of the existing volumes and restore to larger volumes.
AnswerC, D

Online LVM extension adds capacity without downtime.

Why this answer

LVM (Logical Volume Manager) allows you to add new EBS volumes to an existing volume group and extend the logical volume without unmounting the filesystem or stopping the database. This enables online storage expansion for SAP HANA, which requires zero downtime for production workloads.

Exam trap

The trap here is that candidates may confuse increasing storage capacity with changing volume type or instance size, or assume snapshot-based migration is the only way to expand, overlooking LVM's online extension capability.

How to eliminate wrong answers

Option A is wrong because creating a new larger instance and attaching existing volumes would require stopping the original instance and migrating, causing downtime; it also does not increase storage capacity. Option B is wrong because modifying existing volumes to a higher IOPS volume type changes performance characteristics, not storage capacity, and does not address the need for more total storage. Option E is wrong because taking snapshots and restoring to larger volumes is an offline process that requires downtime for the database, and it is not a live expansion method.

Full explanation →
187
Multi-Selectmedium

Which THREE of the following are best practices for securing SAP systems on AWS?

Select 3 answers
A.Enable AWS CloudTrail to log all API calls
B.Enable encryption at rest using AWS KMS for SAP HANA data volumes
C.Use security groups to restrict network access to SAP application servers
D.Use IAM users to authenticate SAP system users
E.Store SAP system credentials in application source code
AnswersA, B, C

CloudTrail provides audit trail for AWS API calls.

Why this answer

AWS CloudTrail logs all API calls made to the AWS environment, including those that modify SAP infrastructure resources such as EC2 instances, security groups, and KMS keys. Enabling CloudTrail is a security best practice because it provides an immutable audit trail for governance, compliance, and operational troubleshooting of SAP workloads on AWS.

Exam trap

The trap here is that candidates may confuse IAM users with SAP system users, thinking that IAM can directly authenticate SAP logins, when in fact IAM is only for AWS API access and cannot authenticate SAP application-level users.

Full explanation →
188
Multi-Selectmedium

Which THREE factors should be considered when sizing an EC2 instance for SAP HANA? (Choose THREE.)

Select 3 answers
A.Total memory available on the instance
B.GPU acceleration for HANA calculations
C.SAP HANA certification of the instance type
D.vCPU and network throughput requirements
E.Instance store availability for HANA data
AnswersA, C, D

SAP HANA requires enough memory to hold data.

Why this answer

SAP HANA is an in-memory database, meaning all data must reside in RAM for processing. The total memory available on the EC2 instance directly determines the maximum size of the HANA database that can be supported, as the database must fit entirely within the instance's memory. AWS provides specific EC2 instance types (e.g., x1e.32xlarge, u-6tb1.112xlarge) with large memory capacities to meet HANA's requirements.

Exam trap

The trap here is that candidates may confuse instance store volumes with persistent storage for HANA data, but HANA requires durable, non-ephemeral storage (EBS or dedicated) and does not use instance stores for database persistence.

Full explanation →
189
MCQhard

An organization is migrating a multi-tier application to AWS. The web tier runs on EC2 instances behind an Application Load Balancer. The database tier uses a self-managed MySQL instance on EC2. To achieve high availability, they plan to use Multi-AZ deployment. Which migration step should they prioritize to ensure minimal downtime?

A.Set up continuous replication using DMS and perform a cutover
B.Configure Amazon EBS snapshots for the database volume
C.Use AWS DMS for one-time full load only
D.Launch the database in a single Availability Zone first
AnswerA

Continuous replication enables minimal downtime cutover.

Why this answer

Setting up continuous replication using AWS DMS (Database Migration Service) ensures data is synchronized between the source and target databases with minimal lag. This allows a quick cutover, significantly reducing downtime during migration. Option A is correct.

Option B is not prioritized for minimal downtime as snapshots require downtime to restore. Option C is wrong because a one-time full load alone would miss ongoing changes, causing data loss. Option D defeats the high-availability goal by not using Multi-AZ from the start.

Full explanation →
190
Multi-Selectmedium

An SAP Basis administrator is planning to migrate an SAP NetWeaver system from on-premises to AWS. The system uses a proprietary storage backend for the transport directory. Which AWS storage options are suitable for the SAP transport directory to provide shared access across multiple EC2 instances? (Choose TWO.)

Select 2 answers
A.Amazon FSx for Lustre
B.EC2 instance store
C.Amazon EBS with multi-attach
D.Amazon EFS
E.Amazon S3
AnswersA, D

FSx for Lustre provides high-performance shared storage suitable for SAP transport directories.

Why this answer

Amazon EFS provides a shared file system accessible from multiple Linux instances. Amazon FSx for Lustre is a high-performance file system for HPC and can be used for SAP transport directories if performance is critical. S3 is object storage, not a file system.

EBS can only be attached to one instance at a time (except multi-attach which is limited). Instance store is ephemeral.

Full explanation →
191
MCQeasy

An SAP administrator needs to automate the daily backup of an SAP HANA database running on EC2. Which AWS service should be used to schedule and manage the backup process?

A.Amazon S3 Lifecycle policies
B.AWS Backup
C.AWS Data Pipeline
D.Amazon CloudWatch Events
AnswerB

AWS Backup automates backup scheduling and retention.

Why this answer

AWS Backup is the correct service because it provides a centralized backup service that can schedule and manage backups for EC2 instances, including SAP HANA databases running on EC2. It supports automated backups, retention policies, and integration with SAP HANA. Option A is incorrect because Amazon S3 Lifecycle policies manage the lifecycle of objects in S3, not database backups.

Option C is incorrect because AWS Data Pipeline is used for data movement and transformation, not backup scheduling. Option D is incorrect because Amazon CloudWatch Events can trigger actions based on events but does not manage backup processes itself.

Full explanation →
192
MCQhard

A company has a large SAP HANA database running on an r5.8xlarge instance. They are planning to migrate to a new instance type that supports more memory for future growth. Which migration approach minimizes downtime and requires no data reload?

A.Use AWS Database Migration Service (DMS) to replicate data to the new instance.
B.Perform a full HANA database backup and restore to the new instance.
C.Stop the instance, change the instance type, and start the instance.
D.Create an Amazon EBS snapshot of the root volume, launch a new instance with the desired type, and attach the snapshot.
AnswerC

Correct. Stopping the instance, changing the instance type, and starting the instance keeps all attached EBS volumes intact, preserving HANA data without any reload. This is the quickest approach.

Why this answer

Stopping the instance, changing the instance type, and starting the instance preserves all attached EBS volumes, including the HANA data and log volumes. This approach requires no data backup or restore, minimizing downtime to just the stop/start cycle. Option D is incorrect because SAP HANA data is typically stored on separate EBS volumes (not the root volume), so an EBS snapshot of only the root volume would not capture the HANA data, necessitating a full data reload.

Options A and B both involve time-consuming data replication or backup/restore, resulting in more downtime.

Exam trap

The trap is that candidates may think taking an EBS snapshot of the root volume (Option D) is sufficient, but in standard SAP HANA deployments on AWS, HANA data and log volumes are separate. Stopping the instance and changing the instance type (Option C) is the simplest and fastest method that preserves all data.

How to eliminate wrong answers

Option A is wrong because AWS DMS is designed for heterogeneous or homogeneous database migrations and would require a full data load and ongoing replication, which introduces significant downtime and complexity for a large SAP HANA database; it does not simply change the instance type. Option B is wrong because performing a full HANA backup and restore to a new instance requires a lengthy backup process, data transfer, and restore operation, resulting in substantial downtime and a full data reload. Option C is wrong because stopping the instance and changing the instance type is the correct approach, but the option as stated does not specify that the instance type change is performed via the AWS console/CLI after stopping; however, the key issue is that Option C is actually a valid method (stop, change type, start) and is not incorrect—this is a trap because the question asks for the approach that minimizes downtime and requires no data reload, and Option C achieves that, but the exam expects the candidate to recognize that Option D is the same concept but with an unnecessary EBS snapshot step; in reality, Option C is the simplest and correct method, but the question's phrasing and answer choices are designed to mislead candidates into thinking a snapshot is required.

Option D is the officially correct answer in the exam context, even though Option C is functionally equivalent and simpler.

Full explanation →
193
Multi-Selecthard

An organization is migrating a critical SAP workload to AWS. They need to ensure compliance with SAP's 'Bring Your Own License' (BYOL) model. Which THREE steps should they take?

Select 3 answers
A.Migrate existing SAP licenses to AWS without any restrictions
B.Use AWS License Manager to track and manage licenses
C.Verify that the SAP licenses are eligible for migration to AWS
D.Use Dedicated Hosts or Dedicated Instances to meet licensing requirements
E.Deploy SAP software on instances that support 'software license mobility'
AnswersC, D, E

License eligibility must be confirmed before migration.

Why this answer

The correct answers are C, D, and E. Option C is correct because you must verify that your SAP licenses are eligible for migration to AWS under the BYOL model. Option D is correct because using Dedicated Hosts or Dedicated Instances is required to meet SAP licensing requirements for BYOL.

Option E is correct because SAP software must be deployed on instances that support 'software license mobility' to comply with the BYOL model. Option A is incorrect because SAP BYOL does not allow unrestricted migration of licenses; you must adhere to specific licensing terms. Option B is incorrect because AWS License Manager is an optional tool for license tracking, not a mandatory step for BYOL compliance.

Full explanation →
194
MCQmedium

An SAP administrator needs to set up a fault-tolerant architecture for SAP NetWeaver on AWS. The architecture must survive an entire Availability Zone failure. Which configuration is the most appropriate?

A.Deploy all SAP application servers in one Availability Zone and use Amazon EBS snapshots for backup.
B.Deploy SAP application servers across multiple AZs but without a load balancer.
C.Use a single large EC2 instance for all SAP components.
D.Use an Auto Scaling group to launch SAP application servers across multiple AZs behind an Application Load Balancer.
AnswerD

Provides fault tolerance and load distribution.

Why this answer

Deploying SAP application servers across multiple Availability Zones (AZs) behind an Application Load Balancer (ALB) provides fault tolerance at the AZ level. The ALB distributes traffic to healthy instances in different AZs, ensuring that if one AZ fails, the remaining AZs continue to serve requests without interruption. This architecture aligns with SAP's recommended high-availability pattern for the ABAP stateless application tier.

Exam trap

The trap here is that candidates may think deploying across multiple AZs alone (Option B) is sufficient for fault tolerance, but without a load balancer to automate traffic distribution and health checks, the architecture cannot survive an AZ failure without manual intervention.

How to eliminate wrong answers

Option A is wrong because deploying all SAP application servers in a single AZ creates a single point of failure; an AZ outage would take down the entire application tier, and Amazon EBS snapshots only provide data backup, not real-time failover. Option B is wrong because deploying across multiple AZs without a load balancer means there is no mechanism to distribute traffic or automatically route requests away from failed AZs, so clients would need manual intervention to reach healthy servers. Option C is wrong because a single large EC2 instance for all SAP components (including the database) is a monolithic design that cannot survive an AZ failure; if the instance or its AZ fails, the entire SAP landscape is lost.

Full explanation →
195
MCQhard

A company has an SAP HANA database running on an EC2 instance with 1.9 TB of memory. The database requires persistent storage. The solutions architect must choose a storage configuration that provides the highest IOPS and throughput while maintaining data durability. Which storage option should the architect choose?

A.Use multiple io2 EBS volumes with Block Express striped together using LVM.
B.Use a single io2 Block Express EBS volume of the required size.
C.Use multiple gp3 EBS volumes striped together with LVM.
D.Use NVMe instance store volumes for the HANA data and log areas.
AnswerA

Striping multiple io2 Block Express volumes provides high IOPS and throughput with durability.

Why this answer

It combines multiple io2 Block Express EBS volumes striped via LVM, which delivers the highest possible IOPS and throughput for SAP HANA on AWS. io2 Block Express volumes support up to 256,000 IOPS and 4,000 MB/s throughput per volume, and striping multiple volumes linearly scales these limits to meet the demands of a 1.9 TB memory HANA database. This configuration also ensures data durability through EBS replication within an Availability Zone, unlike instance store volumes.

Exam trap

The trap here is that candidates often assume a single high-performance EBS volume (io2 Block Express) is sufficient, but they overlook that SAP HANA's performance requirements for a 1.9 TB memory database exceed the per-volume IOPS and throughput limits, necessitating striping of multiple volumes.

How to eliminate wrong answers

Option B is wrong because a single io2 Block Express EBS volume, while high-performance, cannot achieve the aggregate IOPS and throughput required for a 1.9 TB memory HANA workload; the maximum per-volume limits (256,000 IOPS, 4,000 MB/s) are insufficient for such a large in-memory database that demands parallel I/O. Option C is wrong because gp3 volumes have lower maximum IOPS (16,000 per volume) and throughput (1,000 MB/s per volume) compared to io2 Block Express, and striping them still cannot match the performance needed for SAP HANA's high-throughput log and data writes. Option D is wrong because NVMe instance store volumes are ephemeral and do not provide persistent storage; data is lost if the instance stops, terminates, or fails, violating the durability requirement for SAP HANA.

Full explanation →
196
MCQeasy

A company wants to migrate its on-premises VMware virtual machines to AWS. They need to retain the current operating system and applications. Which AWS service should they use?

A.AWS Server Migration Service (SMS)
B.AWS Application Migration Service (MGN)
C.AWS Database Migration Service (DMS)
D.AWS DataSync
AnswerA

SMS replicates VMware VMs to AWS.

Why this answer

AWS Server Migration Service (SMS) is the correct choice because it is specifically designed to migrate on-premises VMware virtual machines to AWS while preserving the operating system, applications, and system configurations. It uses agentless replication via the VMware vCenter connector to create Amazon Machine Images (AMIs) from the source VMs, enabling a lift-and-shift migration without reinstallation or reconfiguration.

Exam trap

The trap here is that candidates often confuse AWS Application Migration Service (MGN) with SMS, but MGN requires an agent and is not VMware-specific, whereas SMS is the agentless, VMware-native service that directly integrates with vCenter for VM discovery and replication.

How to eliminate wrong answers

Option B is wrong because AWS Application Migration Service (MGN) is a newer service that also performs lift-and-shift migrations, but it requires an agent to be installed on each source server and is not VMware-specific; SMS is the legacy service explicitly built for VMware environments, and the question's context (VMware VMs) points to SMS as the intended answer. Option C is wrong because AWS Database Migration Service (DMS) is designed for migrating databases (e.g., Oracle, SQL Server, MySQL) to AWS database services, not for migrating entire virtual machines with their operating systems and applications. Option D is wrong because AWS DataSync is a data transfer service for moving large volumes of file data (e.g., NFS, SMB shares) to Amazon S3, EFS, or FSx, and it does not migrate virtual machines or preserve OS and application state.

Full explanation →
197
MCQmedium

An SAP Basis administrator needs to monitor the performance of their SAP HANA database running on an EC2 instance. The administrator wants to visualize key metrics such as CPU utilization, memory usage, and disk I/O in a single dashboard. Which AWS service should be used to create this dashboard?

A.Amazon CloudWatch Dashboards
B.AWS Config
C.AWS Trusted Advisor
D.AWS CloudTrail
AnswerA

CloudWatch Dashboards visualize metrics from multiple sources.

Why this answer

Amazon CloudWatch Dashboards is the correct service because it allows you to create custom, single-pane-of-glass views that aggregate metrics from multiple sources, including EC2 instances. For SAP HANA on EC2, you can pull CPU utilization, memory usage, and disk I/O metrics from CloudWatch (enabled via the CloudWatch Agent or EC2 detailed monitoring) and display them together on one dashboard for real-time performance monitoring.

Exam trap

The trap here is that candidates may confuse AWS Config or CloudTrail with monitoring services, but neither provides real-time metric visualization; CloudWatch Dashboards is the only service designed for aggregating and displaying live performance data in a customizable view.

How to eliminate wrong answers

Option B (AWS Config) is wrong because it is a service for evaluating, auditing, and recording configuration changes of AWS resources, not for visualizing real-time performance metrics like CPU, memory, or disk I/O. Option C (AWS Trusted Advisor) is wrong because it provides best-practice recommendations for cost optimization, security, fault tolerance, and performance limits, but it does not offer customizable dashboards for live metric visualization. Option D (AWS CloudTrail) is wrong because it records API activity and user actions for auditing and governance, not for monitoring system-level performance metrics such as CPU utilization or disk I/O.

Full explanation →
198
MCQmedium

An SAP Basis administrator is troubleshooting a performance issue on an SAP NetWeaver application server running on Amazon EC2. The administrator notices that the CPU utilization is low but the application response times are high. The system is using an Amazon EBS gp2 volume. Which configuration change is most likely to improve performance?

A.Increase the IOPS of the EBS gp2 volume or switch to io1.
B.Change the EBS volume to instance store.
C.Move the EC2 instance to a larger instance family.
D.Increase the number of vCPUs on the EC2 instance.
AnswerA

Higher IOPS improves disk throughput, reducing I/O wait.

Why this answer

Low CPU utilization with high application response times on an SAP NetWeaver server indicates that the bottleneck is I/O latency, not compute capacity. Amazon EBS gp2 volumes have a baseline IOPS performance that scales with volume size, and if the volume is small or the workload exceeds the burst balance, throughput can be throttled. Increasing the IOPS (by resizing the gp2 volume or switching to io1/io2 with provisioned IOPS) directly addresses the I/O bottleneck, reducing latency and improving application response times.

Exam trap

The trap here is that candidates assume low CPU utilization means the instance is underpowered, leading them to choose a larger instance or more vCPUs, when in fact the symptom points to an I/O bottleneck that requires increasing EBS IOPS or switching to a provisioned IOPS volume.

How to eliminate wrong answers

Option B is wrong because instance store volumes are ephemeral and provide only temporary, block-level storage that is not persistent; they are unsuitable for SAP databases or critical application data that require durability and snapshot capabilities. Option C is wrong because moving to a larger instance family increases CPU and memory resources, but the problem is low CPU utilization, indicating the bottleneck is I/O, not compute. Option D is wrong because increasing the number of vCPUs does not resolve I/O latency; the issue is storage throughput, not processing power.

Full explanation →
199
Multi-Selectmedium

A company is deploying SAP NetWeaver on AWS and needs to configure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The solution must use AWS native services. Which TWO actions should be taken?

Select 2 answers
A.Associate an Elastic IP address with the active ASCS instance using a script.
B.Place an Application Load Balancer in front of the ASCS instances.
C.Set up AWS Direct Connect for redundant connectivity.
D.Deploy AWS Global Accelerator for failover.
E.Use Amazon Route 53 with health checks and failover routing policy.
AnswersA, E

Elastic IP can be moved during failover to provide a stable endpoint.

Why this answer

An Elastic IP address can be programmatically reassigned to the standby ASCS instance using a script (e.g., AWS CLI or custom automation) during a failover event. This provides a stable virtual IP address that clients use to connect to the active ASCS, meeting the high availability requirement without relying on a load balancer, which is not suitable for SAP Central Services due to its stateful nature and the need for a fixed IP address.

Exam trap

The trap here is that candidates often assume a load balancer (like ALB) is the standard AWS high availability solution, but for stateful SAP services requiring a fixed IP address, Elastic IP reassignment is the correct AWS-native approach, not a load balancer.

Full explanation →
200
MCQmedium

A company is running an SAP application on an SAP HANA database in a multi-AZ deployment on AWS. The operations team notices that the system is experiencing high latency during peak hours. Upon investigation, they find that the EBS volumes attached to the HANA instances are frequently exceeding the provisioned IOPS limit. Which of the following is the MOST effective action to resolve this issue?

A.Increase the volume size of the EBS volumes to increase the baseline IOPS.
B.Switch from Provisioned IOPS SSD (io2) to General Purpose SSD (gp3) volumes.
C.Enable EBS optimization on the EC2 instances.
D.Reduce the number of concurrent connections to the SAP HANA database.
AnswerA

Increasing volume size directly increases the baseline IOPS for gp3 volumes or allows higher provisioned IOPS for io2 volumes, resolving the IOPS limit issue.

Why this answer

Increasing the volume size of EBS volumes increases the baseline IOPS (for gp3) or allows higher provisioned IOPS (for io2), directly addressing the IOPS limit. Option B is wrong because switching to General Purpose SSD (gp3) may not guarantee the needed IOPS if burst credits are exhausted. Option C is wrong because enabling EBS optimization is already enabled for current generation instances and does not increase IOPS limits.

Option D is wrong because reducing concurrent connections does not address the IOPS limit of the EBS volumes.

Full explanation →
201
MCQmedium

A company is preparing to migrate its SAP ECC 6.0 system to SAP S/4HANA on AWS. The current on-premises system includes a single application server and a database server running Oracle. The total database size is 1.5 TB. The company plans to use a homogeneous migration approach by exporting the existing Oracle database and importing it into a new SAP HANA database running on AWS. The migration must be completed within a tight weekend window. The company has established a 1 Gbps AWS Direct Connect connection to AWS. Which migration strategy should the company use to minimize downtime?

A.Use the SAP Software Update Manager (SUM) with Database Migration Option (DMO). Perform the migration in a weekend window using the delta replication feature.
B.Use AWS Database Migration Service (DMS) to continuously replicate the Oracle database to HANA, and then switch over.
C.Use an Application Load Balancer to redirect traffic to the new HANA system after exporting the data to S3.
D.Use the SAP HANA Studio migration wizard to export the Oracle database and import it into HANA. This is the simplest method.
AnswerA

DMO provides efficient migration with minimal downtime.

Why this answer

SAP Software Update Manager (SUM) with Database Migration Option (DMO) supports a homogeneous migration from Oracle to SAP HANA while performing both the system update and database migration in a single step. The delta replication feature allows initial full load followed by continuous replication of changes, enabling a short downtime window by switching over only after the delta catch-up is complete. This approach is specifically designed for tight migration windows and leverages the 1 Gbps Direct Connect for efficient data transfer.

Exam trap

The trap here is that candidates often confuse general-purpose migration tools like AWS DMS with SAP-specific tools, assuming DMS can handle SAP HANA migrations, but DMS lacks support for SAP HANA as a target and cannot maintain SAP application consistency.

How to eliminate wrong answers

Option B is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a target for homogeneous migrations from Oracle in the context of SAP systems; DMS is designed for general-purpose database migrations and lacks the SAP-specific schema, data type, and application-level consistency required for SAP S/4HANA. Option C is wrong because an Application Load Balancer operates at Layer 7 and cannot redirect traffic from an Oracle database to a HANA database; it is used for HTTP/HTTPS traffic distribution, not for database-level migration or switchover. Option D is wrong because the SAP HANA Studio migration wizard is intended for heterogeneous migrations (e.g., from other databases to HANA) but does not include delta replication capabilities, making it unsuitable for a tight weekend window as it requires a full export/import with extended downtime.

Full explanation →
202
Multi-Selectmedium

A company runs its SAP HANA database on a single EC2 instance with EBS storage. The database is critical and the company needs to ensure data durability and recoverability in case of a disaster. Which TWO actions should the company take?

Select 2 answers
A.Enable Multi-AZ deployment for the HANA database on RDS.
B.Take periodic EBS snapshots and copy them to another region.
C.Configure automated backups of the HANA database to Amazon S3.
D.Use Cross-Region Replication for the EBS volumes.
E.Set up HANA System Replication to a secondary instance in a different Availability Zone.
AnswersB, C

Correct. Periodic EBS snapshots copied to another region provide cross-region backup for disaster recovery and ensure data durability.

Why this answer

Taking periodic EBS snapshots and copying them to another region provides cross-region disaster recovery and data durability. Option C is correct: backing up the HANA database to Amazon S3 provides durable, off-site storage. Option A is incorrect because the database runs on EC2, not RDS, so Multi-AZ for RDS is not applicable.

Option D is incorrect because Cross-Region Replication is for S3 buckets, not EBS volumes. Option E is incorrect because HANA System Replication to a different AZ provides high availability within a region, but does not protect against regional disasters; it is not sufficient for disaster recovery.

Full explanation →
203
MCQmedium

The operations team uses the IAM policy above for a group of administrators. An administrator tries to terminate an EC2 instance that is tagged with Environment=Production. What will happen?

A.The termination will be denied because the Deny condition applies to all instances
B.The termination will be allowed because the Deny condition is not met
C.The termination will be allowed because the Deny does not apply to Production instances
D.The termination will be denied because there is no explicit Allow for TerminateInstances
AnswerD

Without an explicit Allow, the action is implicitly denied.

Why this answer

The Deny statement has a condition that denies termination only when the tag is NOT Production. Since the instance is tagged Production, the condition is not met, so the Deny does not apply. The Allow statement does not include TerminateInstances, so there is no explicit Allow for termination.

The default is implicit Deny, so the action is denied.

Full explanation →
204
MCQhard

A company is performing a large-scale migration of multiple SAP systems to AWS. They need to automate the replication of servers from on-premises to AWS while minimizing downtime. Which AWS service should they use to replicate entire servers (OS, applications, and data) in real-time?

A.AWS CloudFormation
B.AWS Application Migration Service (AWS MGN)
C.AWS DataSync
D.AWS Database Migration Service (DMS)
AnswerB

AWS MGN replicates entire servers continuously.

Why this answer

AWS Application Migration Service (AWS MGN) replicates entire servers in real-time, enabling automated migration with minimal downtime. Option B is correct. Option A (AWS CloudFormation) is for infrastructure as code, not replication.

Option C (AWS DataSync) is for file storage, not full server replication. Option D (AWS Database Migration Service) is for databases only.

Full explanation →
205
MCQhard

A company runs SAP S/4HANA on AWS with a multi-Node HA cluster using Pacemaker and SUSE Linux Enterprise Server. The SAP application and database are on separate EC2 instances. After a planned failover test, the secondary node fails to take over the database role. What is the most likely cause?

A.The SAP HANA system replication is using asynchronous mode.
B.STONITH fencing is not configured for the cluster.
C.The EBS volumes are not configured with multi-attach enabled.
D.The SAP HANA system replication is not configured with ENSA2.
AnswerB

Without STONITH, the secondary node cannot safely take over.

Why this answer

In a Pacemaker HA cluster, STONITH (Shoot The Other Node In The Head) fencing is mandatory to ensure that a failed node is forcibly isolated before the cluster can safely promote the secondary node. Without STONITH, the cluster cannot guarantee that the primary node is truly dead, so it refuses to promote the secondary to avoid a split-brain scenario. This is why the secondary node fails to take over the database role after a planned failover test.

Exam trap

The trap here is that candidates often assume the failover failure is due to replication mode or storage configuration, but the root cause is the mandatory fencing requirement in Pacemaker clusters, which is a fundamental design principle for HA in SAP on AWS.

How to eliminate wrong answers

Option A is wrong because asynchronous SAP HANA system replication is a valid replication mode and does not prevent the secondary from taking over; it only affects data freshness and potential data loss, not the ability to promote. Option C is wrong because EBS multi-attach is not used for SAP HANA on EC2; HANA requires dedicated EBS volumes per instance, and the cluster manages volume attachment via scripts, not multi-attach. Option D is wrong because ENSA2 (Enqueue Server 2) is an SAP NetWeaver feature for enqueue replication, not related to SAP HANA database failover or Pacemaker cluster behavior.

Full explanation →
206
Multi-Selecthard

An SAP environment on AWS includes multiple EC2 instances running SAP application servers. The operations team needs to capture and analyze all API calls made to AWS services by these instances. Which THREE services should be used together?

Select 3 answers
A.Amazon Athena
B.AWS CloudTrail
C.Amazon S3
D.AWS Config
E.Amazon GuardDuty
AnswersA, B, C

Athena can query CloudTrail logs directly in S3 using SQL.

Why this answer

AWS CloudTrail captures API calls, Amazon S3 stores the logs, and Amazon Athena allows querying the logs. Alternatively, CloudWatch Logs can be used, but Athena is more cost-effective for ad-hoc analysis. The three correct services are CloudTrail, S3, and Athena.

Full explanation →
207
MCQhard

A company is migrating a 50 TB Oracle database to Amazon RDS for Oracle using AWS DMS. The source database is running on-premises and the network link has a bandwidth of 100 Mbps. The migration must complete within 5 days. What is the MOST effective approach to meet the deadline?

A.Provision a Direct Connect connection to increase bandwidth
B.Use AWS Snowball to transfer the data offline, then use DMS for CDC
C.Use AWS DMS with full load and change data capture (CDC) online
D.Use AWS Schema Conversion Tool (SCT) to convert schema, then DMS for data
AnswerB

Snowball transfers data physically, meeting the 5-day window; DMS handles ongoing changes.

Why this answer

The 50 TB database over a 100 Mbps link would take approximately 48 days for a full load (50 TB * 8 / 100 Mbps / 86400 seconds/day), far exceeding the 5-day deadline. AWS Snowball allows offline transfer of the full database snapshot, bypassing network bandwidth constraints, after which AWS DMS can be used for ongoing change data capture (CDC) to replicate incremental changes. This hybrid approach meets the deadline while ensuring minimal data loss.

Exam trap

The trap here is that candidates assume Direct Connect or DMS online can handle large migrations over slow links, but they fail to calculate the raw transfer time; the question explicitly tests the ability to recognize when offline transfer (Snowball) is the only viable option for multi-terabyte datasets under tight deadlines.

How to eliminate wrong answers

Option A is wrong because provisioning a Direct Connect connection does not inherently increase bandwidth beyond the 100 Mbps link; it only provides a dedicated connection, and even at 10 Gbps, the full load would still take ~11 hours for 50 TB, but the question states the network link is 100 Mbps, implying the bottleneck is the on-premises network capacity, not the connection type. Option C is wrong because using AWS DMS with full load and CDC online over a 100 Mbps link would take ~48 days for the full load alone, far exceeding the 5-day deadline, and CDC cannot start until the full load completes. Option D is wrong because the AWS Schema Conversion Tool (SCT) is used for heterogeneous migrations (e.g., Oracle to PostgreSQL) and does not address the bandwidth limitation; the source and target are both Oracle, so schema conversion is unnecessary, and the data transfer bottleneck remains.

Full explanation →
208
MCQhard

An SAP ERP system on AWS is experiencing intermittent connectivity issues between the SAP application servers and the database server. Both are in the same VPC, but in different subnets. The security group for the database allows traffic from the application security group. Network ACLs are default (allow all). Despite this, some application servers cannot connect during peak loads. What is the most likely cause?

A.The security group inbound rule for the database has reached its rule evaluation limit.
B.The connection tracking table for the database security group is full, dropping new connections.
C.The application servers are using a single NAT Gateway for outbound traffic, causing a bottleneck.
D.The database is accessed through a VPC Endpoint, which is rate-limiting connections.
AnswerB

Security groups maintain connection tracking; when the table fills, new connections are dropped until old ones expire.

Why this answer

AWS security groups are stateful and track connections. Under peak loads, the connection tracking table can become full, causing new connections to be dropped. Option A is wrong because security groups do not have a rule evaluation limit; they evaluate all rules.

Option C is wrong because a NAT Gateway is used for outbound internet traffic, not for internal VPC communication. Option D is wrong because VPC Endpoints are used for accessing AWS services privately, not for database connectivity.

Full explanation →
209
MCQeasy

A company is running SAP on AWS and wants to send alerts when the CPU utilization of an EC2 instance exceeds 90% for 5 minutes. Which AWS service should be used to create this alarm?

A.AWS Lambda
B.AWS Config
C.Amazon Simple Notification Service (SNS)
D.Amazon CloudWatch Alarms
AnswerD

CloudWatch Alarms monitor metrics and send notifications when thresholds are breached.

Why this answer

Amazon CloudWatch Alarms (Option D) are the correct AWS service for creating alarms based on metrics such as CPU utilization. They monitor CloudWatch metrics and perform actions (e.g., send notifications via SNS) when thresholds are breached. Option A (AWS Lambda) can be a target action for an alarm but is not the alarm service itself.

Option B (AWS Config) evaluates resource configurations against rules, not metric thresholds. Option C (Amazon SNS) is a notification service that can be triggered by CloudWatch Alarms but does not create the alarm.

Full explanation →
210
MCQmedium

A company is migrating an SAP BusinessObjects environment to AWS. They need to ensure high availability for the web tier and have a requirement to use a single DNS name for end users. Which AWS service should they use to distribute traffic across multiple web servers?

A.Amazon CloudFront
B.Network Load Balancer
C.Amazon Route 53 weighted routing policy
D.Application Load Balancer
AnswerD

Layer 7 load balancer suitable for HTTP/HTTPS.

Why this answer

Application Load Balancer (ALB) operates at Layer 7 and can distribute HTTP/HTTPS traffic across multiple web servers, providing health checks and a single DNS name. Option A (Amazon CloudFront) is a content delivery network, not a load balancer. Option B (Network Load Balancer) operates at Layer 4 and is ideal for TCP/UDP traffic, not web application traffic.

Option C (Amazon Route 53 weighted routing policy) distributes traffic based on weights but does not provide built-in health checks or load balancing features like connection draining and path-based routing.

Full explanation →
211
MCQeasy

An SAP administrator is configuring backups for an SAP HANA database running on Amazon EC2. The backup must be stored in Amazon S3 for long-term retention. Which AWS service should be used to automate the backup process?

A.AWS Backup
B.Amazon S3 Lifecycle policies
C.AWS Lambda
D.Amazon EBS Snapshots
AnswerA

AWS Backup can orchestrate HANA backups with pre/post scripts.

Why this answer

AWS Backup is the correct choice because it provides a fully managed, policy-driven backup service that can automate and centralize backups for SAP HANA databases running on Amazon EC2. It integrates natively with SAP HANA using Backint agents, enabling automated, consistent, and application-aware backups directly to Amazon S3 for long-term retention without custom scripting.

Exam trap

The trap here is that candidates often confuse AWS Backup with Amazon S3 Lifecycle policies, thinking that lifecycle rules alone can automate database backups, but lifecycle policies only manage existing S3 objects and cannot initiate the backup process from SAP HANA.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Lifecycle policies manage object transitions and expiration within S3 itself, but they do not automate the backup process from an SAP HANA database; they only act on objects already in S3. Option C is wrong because AWS Lambda can be used to trigger backup scripts, but it is not a managed backup service and requires custom code, error handling, and orchestration, making it less reliable and more complex than AWS Backup. Option D is wrong because Amazon EBS Snapshots capture block-level data of EC2 instance volumes, but they are not application-consistent for SAP HANA without additional quiescing steps, and they do not natively support SAP HANA's Backint interface for database-aware backups.

Full explanation →
212
MCQhard

A company is running SAP on AWS and wants to implement encryption at rest for all data. The company uses AWS KMS with Customer Managed Keys (CMKs) for the EBS volumes. The SAP application servers need to access an S3 bucket that contains sensitive data. How should the company ensure that the S3 bucket is encrypted with the same CMK?

A.Use client-side encryption before uploading to S3
B.Configure the S3 bucket to use SSE-KMS with the same CMK
C.Add a bucket policy that denies if encryption is not present
D.Enable default encryption on the S3 bucket with SSE-S3
AnswerB

SSE-KMS allows specifying a particular CMK.

Why this answer

SSE-KMS (Server-Side Encryption with AWS KMS) allows you to specify a Customer Managed Key (CMK) to encrypt objects in S3. By configuring the S3 bucket to use the same CMK that is already used for EBS volumes, the company ensures a unified encryption key strategy for all data at rest, meeting the requirement for consistent encryption across services.

Exam trap

The trap here is that candidates often confuse SSE-S3 (which uses an AWS-managed key) with SSE-KMS (which allows a customer-managed key), and assume that enabling default encryption with SSE-S3 satisfies the requirement to use the same CMK.

How to eliminate wrong answers

Option A is wrong because client-side encryption encrypts data before it is uploaded to S3, which does not use the same AWS KMS CMK for server-side encryption and introduces key management complexity outside of AWS KMS. Option C is wrong because a bucket policy that denies if encryption is not present only enforces that some form of encryption is applied, but does not specify or enforce the use of the same CMK; it could allow SSE-S3 or other keys. Option D is wrong because SSE-S3 uses an AWS-managed key, not a customer-managed CMK, so it cannot be the same key used for EBS volumes.

Full explanation →
213
MCQmedium

A company is running an SAP HANA database on an EC2 instance. The operations team notices that the SAP application is responding slowly during peak hours. CloudWatch metrics show high CPU utilization and increased swap usage. Which combination of actions should the team take to resolve the performance issue?

A.Enable Auto Scaling for the EC2 instance to automatically add more instances.
B.Resize the EC2 instance to a larger instance type with more vCPUs and memory.
C.Change the instance type to a compute-optimized instance to improve CPU performance.
D.Add more EBS volumes and increase the number of read replicas.
AnswerB

Vertical scaling addresses both high CPU and memory pressure, reducing swap usage.

Why this answer

Increasing both vCPUs and memory addresses the high CPU utilization and high swap usage (indicating memory pressure). Option A is wrong because Auto Scaling horizontally adds instances, which is not appropriate for a single SAP HANA database that typically runs vertically. Option C is wrong because compute-optimized instances prioritize CPU over memory, but the issue also involves memory shortage (swap usage).

Option D is wrong because adding EBS volumes and read replicas targets storage and read scaling, not CPU or memory bottlenecks.

Full explanation →
214
MCQmedium

An SAP system on AWS experiences intermittent performance degradation during peak hours. CloudWatch metrics show high CPU utilization on the application server but normal on the database server. The application server is an m5.2xlarge instance. Which action should the operations team take FIRST to diagnose the issue?

A.Change the application server instance type to a compute-optimized instance like c5.4xlarge.
B.Increase the provisioned IOPS on the database server's EBS volumes.
C.Increase the network bandwidth of the application server.
D.Scale out the application tier by adding more application servers behind a load balancer.
AnswerA

Compute-optimized instances provide higher CPU performance.

Why this answer

The application server is experiencing high CPU utilization; switching to a compute-optimized instance (like c5.4xlarge) helps determine if the performance issue is due to insufficient CPU resources. Option B is incorrect because the database server shows normal CPU, so increasing IOPS on its EBS volumes would not address the application server's CPU bottleneck. Option C is incorrect because the problem is not network-related; increasing network bandwidth would not alleviate CPU contention.

Option D is incorrect because scaling out by adding more servers may help but is not the first diagnostic step; the first step should be to test a compute-optimized instance to isolate the CPU issue.

Full explanation →
215
MCQmedium

An SAP Basis team is planning to migrate an SAP ERP system from on-premises to AWS. The system currently uses Oracle Database and runs on a physical server with 256 GB RAM. The team wants to minimize downtime and ensure the migration is supported by SAP. Which AWS service or feature should they use to perform the migration?

A.Use AWS VM Import/Export to migrate the physical server as an AMI.
B.Use AWS CloudEndure Migration to replicate the entire server to AWS.
C.Use AWS Database Migration Service (DMS) to replicate the Oracle database to Amazon RDS for Oracle.
D.Use SAP's Software Provisioning Manager (SWPM) to perform a homogeneous system copy to AWS.
AnswerD

SWPM is the SAP-recommended tool for system copy and migration.

Why this answer

SAP explicitly supports homogeneous system copies using Software Provisioning Manager (SWPM) for migrating SAP systems to AWS. This method allows the team to perform a database-level export/import while keeping the same operating system and database platform (Oracle), minimizing downtime by using SAP's validated tools and processes. AWS provides no native service that is SAP-certified for this specific migration scenario, making SWPM the only supported approach.

Exam trap

The trap here is that candidates often assume AWS-native migration services like DMS or CloudEndure are universally applicable, but SAP has strict certification requirements that exclude these tools for homogeneous system copies, making SWPM the only correct choice despite its manual nature.

How to eliminate wrong answers

Option A is wrong because AWS VM Import/Export converts physical servers into AMIs, but this process is not supported by SAP for production SAP systems and does not handle SAP-specific licensing, kernel parameters, or database consistency requirements. Option B is wrong because AWS CloudEndure Migration replicates entire servers at the block level, but it is not certified by SAP for migrating SAP systems and can cause database inconsistencies or unsupported configurations. Option C is wrong because AWS Database Migration Service (DMS) is designed for heterogeneous migrations (e.g., Oracle to Amazon RDS for Oracle) but does not support homogeneous system copies where the target database remains Oracle on EC2; additionally, DMS is not SAP-certified for migrating SAP ERP databases.

Full explanation →
216
MCQeasy

An SAP administrator needs to back up the SAP HANA database daily. The backups must be stored securely and retained for 30 days. Which storage option is the most cost-effective?

A.Amazon S3 Standard
B.Amazon S3 Glacier
C.Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
D.Amazon EBS Snapshots
AnswerC

S3 Standard-IA is cost-effective for infrequent access with immediate retrieval.

Why this answer

S3 Standard-IA is for infrequently accessed data with lower cost. Option A is incorrect because S3 Standard is more expensive. Option B is incorrect because Glacier is for long-term archival, not 30-day retention.

Option D is incorrect because EBS snapshots are for volumes, not database backups directly.

Full explanation →
217
MCQeasy

A company has an SAP system running on AWS that uses an Application Load Balancer (ALB) to distribute traffic to multiple EC2 instances. The operations team notices that the ALB is returning 503 errors intermittently. Which of the following is the MOST likely cause?

A.The security group attached to the ALB is blocking inbound traffic from the targets.
B.The target instances are failing health checks.
C.The ALB does not have enough capacity to handle the traffic.
D.The SSL certificate on the ALB has expired.
AnswerB

Correct. 503 errors are typically returned when the target instances fail health checks and become unhealthy.

Why this answer

503 errors are typically returned when the target instances fail health checks and become unhealthy. Option A is wrong because if the security group blocked inbound traffic from the targets, it would cause timeout or 502 errors, not 503. Option C is wrong because insufficient ALB capacity can lead to latency or 502 errors, but 503 specifically indicates unhealthy targets.

Option D is wrong because an expired SSL certificate would result in 502 errors (bad gateway), not 503.

Full explanation →
218
Multi-Selectmedium

Which TWO metrics should be monitored to ensure the health of an SAP HANA database running on AWS? (Select two.)

Select 2 answers
A.Elastic Load Balancer Latency
B.S3 Bucket Size
C.Disk I/O (read/write throughput)
D.HANA System Replication Lag
E.CPU Credit Balance
AnswersC, D

HANA is I/O intensive, so I/O performance is key.

Why this answer

Disk I/O (read/write throughput) is critical for SAP HANA because HANA is an in-memory database that relies on persistent storage for savepoints, log writes, and data recovery. Insufficient disk throughput can cause performance degradation or system hangs, making it a key health metric.

Exam trap

The trap here is that candidates may confuse general AWS infrastructure metrics (like ELB latency or CPU credits) with database-specific health indicators, overlooking that HANA's in-memory architecture makes disk I/O and replication lag the direct measures of database stability.

Full explanation →
219
MCQmedium

An SAP workload on AWS uses a Multi-AZ RDS for Oracle instance for its database. The application team reports that a recent batch job caused a spike in database connections and CPU utilization, leading to performance degradation. The database administrator wants to be notified when CPU utilization exceeds 80% for 5 minutes. Which combination of AWS services should be used to set up this monitoring and notification?

A.Amazon EventBridge with AWS Lambda
B.AWS Trusted Advisor with Amazon Simple Email Service (SES)
C.Amazon CloudWatch with an Amazon CloudWatch Alarm and Amazon SNS
D.Amazon Inspector with Amazon Simple Notification Service (SNS)
AnswerC

Amazon CloudWatch can monitor the CPU utilization metric of the RDS instance. A CloudWatch alarm can be configured to trigger when CPU utilization exceeds 80% for 5 consecutive periods (each period is 1 minute by default), and the alarm can publish to an Amazon SNS topic to send notifications.

Why this answer

Amazon CloudWatch can monitor the CPU utilization metric of the RDS instance. A CloudWatch alarm can be configured to trigger when CPU utilization exceeds 80% for 5 consecutive periods (each period is 1 minute by default), and the alarm can publish to an Amazon SNS topic to send notifications. Option A is incorrect because Amazon EventBridge with AWS Lambda would require custom code and is not the simplest monitoring solution for this use case.

Option B is incorrect because AWS Trusted Advisor provides best practice checks and recommendations, not real-time metric monitoring and alerting. Option D is incorrect because Amazon Inspector is a security assessment service that scans for vulnerabilities, not a monitoring and notification service for metrics.

Full explanation →
220
MCQmedium

A company runs a production web application on AWS using an Application Load Balancer (ALB) with a target group of EC2 instances in an Auto Scaling group. The application uses a custom Amazon Machine Image (AMI) that includes the web server and application code. The Auto Scaling group has a launch template that references the AMI. The company updates the application code weekly and creates a new AMI version. The operations team manually updates the launch template to reference the new AMI and then initiates an instance refresh. Recently, a misconfiguration caused the launch template to point to an old AMI after an instance refresh, resulting in a rollback of the application code. The company wants to automate the deployment process to ensure that new AMIs are deployed consistently and safely. Which solution meets these requirements?

A.Use EC2 Image Builder to create and test the new AMI, then use AWS CodePipeline to automatically update the launch template and perform a rolling instance refresh.
B.Use AWS CodePipeline to run a script that updates the launch template with the new AMI ID and triggers an instance refresh.
C.Use AWS CloudFormation with a custom resource that validates the AMI and updates the Auto Scaling group.
D.Use AWS CodeDeploy to deploy the application code directly to the existing instances, bypassing the AMI update.
AnswerA

EC2 Image Builder automates AMI creation and testing; CodePipeline orchestrates the deployment pipeline.

Why this answer

EC2 Image Builder automates the creation, testing, and validation of AMIs, ensuring only compliant images are produced. AWS CodePipeline can then automatically update the launch template with the new AMI ID and trigger a rolling instance refresh, eliminating manual steps and preventing misconfigurations like pointing to an old AMI.

Exam trap

The trap here is that candidates often choose a simpler automation option (like Option B) that updates the launch template but lacks the integrated AMI creation and testing pipeline, failing to address the root cause of deploying an untested or incorrect AMI.

How to eliminate wrong answers

Option B is wrong because it only runs a script to update the launch template and trigger an instance refresh, but lacks the automated AMI creation and testing pipeline, so it does not prevent deployment of untested or incorrect AMIs. Option C is wrong because AWS CloudFormation custom resources can validate AMIs but do not natively automate the full AMI build, test, and deployment lifecycle; they also add complexity and potential for custom resource failures. Option D is wrong because it bypasses the AMI update entirely, which contradicts the requirement to deploy new AMIs consistently; CodeDeploy is designed for in-place or blue/green deployments of application code, not for managing AMI-based infrastructure updates.

Full explanation →
221
MCQhard

An SAP architect is designing a new SAP S/4HANA system on AWS. The system must be PCI DSS compliant. The architect plans to use AWS KMS for encryption at rest and AWS CloudTrail for audit logging. The database will be SAP HANA on an r5.24xlarge instance with EBS gp3 volumes. What additional step is required to meet PCI DSS encryption requirements?

A.Store all SAP audit logs in Amazon S3 with server-side encryption.
B.Enable SAP HANA data volume encryption using the HANA database engine.
C.Use Amazon RDS for Oracle instead of SAP HANA to leverage native encryption.
D.Set up a VPN connection between the SAP system and the corporate network.
AnswerB

HANA data volume encryption encrypts data within the database, meeting PCI DSS requirements.

Why this answer

PCI DSS requires encryption of cardholder data at rest. While AWS KMS encrypts EBS volumes at the block level, SAP HANA's data volume resides in its own persistence layer and is not automatically encrypted by EBS encryption. Enabling SAP HANA data volume encryption ensures that data is encrypted within the database.

Option A (S3 with SSE) is for audit logs, not the database. Option C (Amazon RDS for Oracle) is not applicable because the system uses SAP HANA. Option D (VPN) is for network encryption, not at rest.

Full explanation →
222
Multi-Selectmedium

Which TWO AWS services can be used to monitor SAP system performance and send alerts? (Choose two.)

Select 2 answers
A.AWS Config
B.Amazon CloudWatch
C.Amazon Inspector
D.AWS Lambda
E.AWS Trusted Advisor
AnswersB, D

CloudWatch monitors metrics and sends alarms.

Why this answer

Amazon CloudWatch is correct because it can monitor SAP system performance by collecting and tracking metrics such as CPU utilization, memory usage, and disk I/O from EC2 instances running SAP. It can also send alerts via CloudWatch Alarms when thresholds are breached, using actions like Amazon SNS notifications or Auto Scaling.

Exam trap

The trap here is that candidates may confuse AWS Config's configuration tracking with performance monitoring, or assume AWS Trusted Advisor's recommendations include real-time alerting, when in fact neither service provides the metric-based alerting required for SAP performance monitoring.

Full explanation →
223
MCQeasy

An SAP administrator created the IAM policy shown in the exhibit to allow an EC2 instance to back up to an S3 bucket. However, the backup fails with an access denied error. What is the most likely issue?

A.The policy does not grant permissions on the bucket itself.
B.The actions specified are insufficient for backup operations.
C.The resource ARN is incorrectly formatted.
D.The bucket is in a different region than the EC2 instance.
AnswerA

Missing s3:ListBucket permission on the bucket resource.

Why this answer

The IAM policy shown in the exhibit grants permissions on individual objects within the S3 bucket (using the `arn:aws:s3:::bucket-name/*` resource ARN) but does not grant any permissions on the bucket itself (using `arn:aws:s3:::bucket-name`). For backup operations, the EC2 instance typically needs to list the bucket or check its existence before writing objects, which requires `s3:ListBucket` or similar actions on the bucket resource. Without these bucket-level permissions, the backup fails with an access denied error.

Exam trap

The trap here is that candidates often focus on the object-level actions being correct and overlook the need for separate bucket-level permissions, assuming that granting `s3:PutObject` on `bucket-name/*` implicitly allows listing the bucket.

How to eliminate wrong answers

Option B is wrong because the actions specified (e.g., `s3:PutObject`, `s3:GetObject`) are sufficient for the actual object upload and retrieval steps of a backup; the failure is due to missing bucket-level permissions, not insufficient actions. Option C is wrong because the resource ARN for objects (`arn:aws:s3:::bucket-name/*`) is correctly formatted; the issue is the omission of the bucket-level ARN, not a formatting error. Option D is wrong because S3 is a global service and cross-region access between an EC2 instance and an S3 bucket works without additional permissions; the access denied error is purely an IAM policy issue, not a regional mismatch.

Full explanation →
224
MCQhard

An SAP administrator configures Route 53 failover routing as shown. The health check associated with the primary record is failing. What will happen to client requests for sap.example.com?

A.Route 53 will return the ALIAS record for the primary load balancer
B.Route 53 will return the secondary CNAME record
C.Route 53 will return an error
D.Route 53 will return both records
AnswerB

Failover routing directs to the secondary record when primary health check fails.

Why this answer

When the health check associated with the primary record fails, Route 53 automatically fails over to the secondary record. In this configuration, the primary record is an ALIAS record pointing to a load balancer, and the secondary record is a CNAME record. Since the primary is unhealthy, Route 53 returns the secondary CNAME record, directing clients to the failover endpoint.

Exam trap

The trap here is that candidates may assume Route 53 returns an error or both records when a health check fails, but failover routing is designed to seamlessly switch to the secondary record without returning errors or multiple answers.

How to eliminate wrong answers

Option A is wrong because Route 53 will not return the ALIAS record for the primary load balancer when its health check is failing; failover routing only returns the primary record if it is healthy. Option C is wrong because Route 53 does not return an error; it gracefully fails over to the secondary record as configured. Option D is wrong because Route 53 does not return both records; failover routing returns only one record at a time based on health check status.

Full explanation →
225
Multi-Selectmedium

Which TWO considerations are critical when migrating an SAP HANA database to AWS using backup and restore? (Choose two.)

Select 2 answers
A.Compatibility of SAP HANA version between source and target
B.Network bandwidth available for data transfer
C.Amazon RDS for SAP HANA instance class
D.Encryption settings for Amazon EBS volumes
E.Network latency between on-premises and AWS
AnswersA, B

The target HANA version must support restoring backups from the source version.

Why this answer

The correct answers are A and B. Compatibility of SAP HANA versions (A) is critical because the backup can only be restored to a target system running a compatible HANA version. Network bandwidth (B) directly affects the time required to transfer the backup files, which is especially important for large databases.

Option C is incorrect because SAP HANA on AWS is typically deployed on EC2 instances, not Amazon RDS; there is no Amazon RDS for SAP HANA. Option D is incorrect because encryption settings for EBS volumes are not a critical consideration during backup and restore; encryption can be applied at rest but does not prevent the restore process. Option E is incorrect because network latency is not a major factor for offline backup transfer; it is more relevant for real-time replication.

Full explanation →
Page 2

Page 3 of 22

Page 4

All pages

12345678910111213141516171819202122

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWSTechnologyMigrationOperations and Maintenance
See all domains with question counts →