Knowledge + Practice

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 226–300

1616 questions total · 22pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 22

226

MCQhard

A company is migrating an SAP system from on-premises to AWS. The migration involves rehosting SAP HANA on EC2. Which of the following is the best practice for sizing the EC2 instance?

A.Use a memory-optimized EC2 instance with the required memory.

B.Use an EC2 instance that is listed in the SAP Certified and Supported SAP HANA Hardware Directory.

C.Use a general-purpose EC2 instance with sufficient vCPUs and memory.

D.Use a compute-optimized EC2 instance to ensure high CPU performance.

AnswerB

Only instances listed in the SAP HANA hardware directory are supported.

Why this answer

SAP HANA instances must be SAP-certified. The AWS instance types that are SAP-certified for HANA (e.g., r5.metal, u-6tb1) should be used. General-purpose instances are not certified.

Memory optimized instances are correct but must be specific certified types. Compute optimized are not suitable.

Full explanation →

227

MCQhard

A company is migrating a critical SAP HANA database from on-premises to AWS. The database is 6 TB, and the migration must be completed within a 4-hour downtime window. The network bandwidth between on-premises and AWS is 1 Gbps. Which approach should the company take to meet the downtime requirement?

A.Use AWS SCT to convert the schema, then export to Amazon S3 and restore into HANA on EC2.

B.Use AWS DMS with change data capture (CDC) and start with a full load over the network.

C.Use AWS Snowball Edge to physically transfer the data, then use AWS DMS for ongoing replication.

D.Perform a direct online migration using AWS DMS over the existing network.

AnswerC

Snowball Edge can transfer large data offline, meeting the time constraint.

Why this answer

AWS Snowball Edge enables physical transfer of the 6 TB data, which is feasible within the 4-hour window despite the 1 Gbps network constraint. After the initial load, AWS DMS can be used for ongoing CDC replication. Option A is wrong because converting schema with SCT and restoring after upload still requires the initial upload over the network, which would exceed the downtime window.

Option B is wrong because AWS DMS with CDC over the existing network for the full load cannot transfer 6 TB in 4 hours at 1 Gbps. Option D is wrong because a direct online migration over the network cannot meet the downtime requirement due to bandwidth limitations.

Full explanation →

228

MCQeasy

A company is migrating its SAP HANA database to AWS. The system requires high network throughput and low latency between the application and database tiers. Which AWS service should be used to achieve this?

A.Amazon Route 53 latency-based routing

B.Amazon EC2 placement group

C.AWS Global Accelerator

D.Amazon EBS io2 Block Express volumes

AnswerB

Placement groups, specifically cluster placement groups, place EC2 instances in a single Availability Zone within a single rack, providing non-blocking, low-latency 10 Gbps or 25 Gbps network throughput between SAP HANA and application tiers. This satisfies the stem’s constraint of high network throughput and low latency by minimising physical distance and eliminating cross-switch hops.

Why this answer

Amazon EC2 placement groups, specifically cluster placement groups, provide low-latency, high-throughput networking by placing instances in a single Availability Zone within a logical group, ensuring they are physically close to each other. This minimizes network latency and maximizes throughput for tightly coupled workloads like SAP HANA, where application and database tiers require consistent, high-speed communication.

Exam trap

The trap here is that candidates often confuse network-level optimizations (like Global Accelerator or Route 53) with compute-level placement strategies, mistakenly believing that global traffic management or storage performance can solve inter-instance latency, when the core requirement is physical proximity between application and database servers.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 latency-based routing directs DNS traffic to the region with the lowest latency for end users, but it does not reduce latency between application and database tiers within AWS; it only optimizes client-to-application routing. Option C is wrong because AWS Global Accelerator improves performance for global users by routing traffic over the AWS global network, but it does not address intra-AZ or inter-instance latency between application and database tiers; it is designed for edge-to-region traffic, not internal tier-to-tier communication. Option D is wrong because Amazon EBS io2 Block Express volumes provide high-performance block storage with low latency, but they do not affect network throughput or latency between compute instances; they are storage-level optimizations, not network-level ones.

Full explanation →

229

MCQhard

Refer to the exhibit. An SAP HANA system is running on an EC2 instance with the attached volumes shown. The HANA system requires high IOPS for its data volume. Which volume should be used for the HANA data directory?

A.Both volumes for striping

B.vol-0a1b2c3d4e5f67890 (gp3)

C.Neither volume; use instance store

D.vol-1a2b3c4d5e6f78901 (io1)

AnswerD

io1 provides higher IOPS, suitable for HANA data.

Why this answer

The io1 volume (vol-1a2b3c4d5e6f78901) provides 10,000 IOPS, which is significantly higher than the gp3 volume's 3,000 IOPS. SAP HANA data directory requires high IOPS for optimal performance, making the io1 volume the best choice. Option A (using both volumes for striping) is unnecessary and adds complexity, while Option B (gp3) has insufficient IOPS.

Option C (instance store) is ephemeral and not suitable for persistent HANA data. Therefore, Option D is correct.

Full explanation →

230

MCQhard

A company is running SAP HANA on AWS and needs to perform an in-place upgrade from HANA 1.0 to 2.0. The database size is 2 TB and the team wants to minimize downtime. Which approach is most appropriate?

A.Stop the HANA database, take a full backup, launch a new EC2 instance with HANA 2.0, and restore the backup.

B.Set up HANA System Replication from the current HANA 1.0 instance to a new EC2 instance running HANA 2.0, then perform a takeover.

C.Use AWS Database Migration Service (DMS) to continuously replicate data to a new HANA 2.0 instance.

D.Create an EBS snapshot of the HANA data volume and attach it to a new EC2 instance with HANA 2.0.

AnswerB

This minimizes downtime as the target is pre-built and the takeover is fast.

Why this answer

The most appropriate approach to minimize downtime for an in-place upgrade from HANA 1.0 to 2.0 is to use HANA System Replication (HSR). HSR allows you to replicate data from the current HANA 1.0 instance to a new EC2 instance running HANA 2.0. Once replication is complete and consistent, a takeover is performed, switching the workload to the HANA 2.0 instance with minimal downtime.

Option A (stop, backup, restore) results in longer downtime because the database must be offline for the entire backup and restore process. Option C (AWS DMS) is not designed for HANA version upgrades and does not support the necessary system replication mechanisms. Option D (EBS snapshot) is a backup method that also incurs significant downtime and does not perform the upgrade; you would still need to upgrade the database on the new instance.

Full explanation →

231

Multi-Selecthard

A company is migrating an SAP ERP system to AWS using the SAP Landscape Virtualization Management (LVM) tool. The migration must comply with SAP's 'bring your own license' (BYOL) model. Which THREE steps should the company take to ensure compliance?

Select 3 answers

A.Use AWS License Manager to track SAP licenses

B.Decommission the source system after successful migration

C.Use the SAP LVM system copy functionality to create the target system

D.Generate new SAP license keys for the AWS instances

E.Configure the target system with the same IP address as the source

AnswersB, C, D

BYOL requires that the source system is no longer used.

Why this answer

Options B, C, and D are correct. During an SAP migration to AWS using SAP LVM, the system copy functionality (Option C) automates the creation of the target system. Because SAP license keys are hardware-dependent, new license keys must be generated for the AWS instances (Option D).

After a successful migration, the source system must be decommissioned to comply with SAP's BYOL model (Option B). Option A is incorrect because AWS License Manager is not designed for SAP license tracking; SAP license management is handled through SAP's own tools. Option E is incorrect because using the same IP address is not required and often impractical in AWS.

Full explanation →

232

Multi-Selecthard

A company runs SAP on AWS and wants to automate the patching of SAP application servers. The servers are in an Auto Scaling group. Which THREE steps should be included in the automation?

Select 3 answers

A.Update the Auto Scaling group's launch configuration or launch template to use the new AMI.

B.Create a new AMI with the patches applied.

C.Use AWS Systems Manager to apply patches to running instances.

D.Perform an instance refresh to gradually replace instances.

E.Terminate all existing instances at once.

AnswersA, B, D

This ensures new instances use the patched AMI.

Why this answer

Options A, B, and D are correct because the recommended approach for patching SAP application servers in an Auto Scaling group is to use immutable updates: create a new AMI with patches (B), update the launch configuration/template to reference the new AMI (A), and then perform an instance refresh to gradually replace instances (D). This minimizes downtime. Option C (using Systems Manager to patch running instances) is not recommended for Auto Scaling groups because it can lead to inconsistent state and doesn't benefit from the rolling update mechanism.

Option E (terminating all instances at once) would cause downtime.

Full explanation →

233

MCQeasy

An SAP administrator needs to rotate the SSL/TLS certificate for the SAP Web Dispatcher running on an EC2 instance. The new certificate is stored in AWS Certificate Manager (ACM). How should the administrator deploy the certificate to the Web Dispatcher?

A.Export the certificate from ACM using the AWS CLI and install it on the EC2 instance.

B.Download the certificate from ACM and manually install it on the EC2 instance.

C.Configure ACM to automatically push the certificate to the EC2 instance.

D.Import the new certificate into ACM and associate it with an Application Load Balancer in front of the Web Dispatcher.

AnswerA

ACM supports exporting certificates for use on EC2 instances.

Why this answer

ACM allows you to export a certificate (including the private key) using the AWS CLI with the `export-certificate` command. This exported certificate can then be installed manually on the EC2 instance running SAP Web Dispatcher. Option B is incorrect because ACM certificates cannot be downloaded directly as files; they must be exported via the CLI or SDK.

Option C is incorrect because ACM does not natively support automatic push of certificates to EC2 instances. Option D is incorrect because associating the certificate with an Application Load Balancer is an alternative approach but not required; the question asks how to deploy the certificate directly to the Web Dispatcher on EC2, not via a load balancer.

Full explanation →

234

MCQhard

A company runs its SAP ERP system on AWS with an Oracle database on an EC2 instance. The system is used by thousands of users globally. Recently, the database has been experiencing slow query performance, especially during end-of-month processing. The administrator notices that the database instance is an r5.8xlarge with 32 vCPUs and 256 GB of memory, running on a single EBS io1 volume with 20,000 IOPS for the data files. The administrator has already optimized the SQL queries and increased the SGA size. However, performance remains poor. The Amazon CloudWatch metrics show that the EBS volume's Average Queue Length is consistently above 10 and the read latency spikes to over 100 ms during peak times. The CPU utilization is around 70%. Which action should the administrator take to resolve the I/O bottleneck?

A.Change the volume type to gp3 and increase the baseline IOPS.

B.Create multiple EBS io1 volumes and stripe them using RAID 0 at the OS level.

C.Increase the IOPS of the existing io1 volume to 40,000.

D.Upgrade the EC2 instance to an r5.12xlarge with more network bandwidth.

AnswerB

Correct. RAID 0 striping increases parallelism, distributing I/O across volumes to reduce queue depth and latency.

Why this answer

Striping multiple EBS io1 volumes using RAID 0 at the OS level increases I/O parallelism, distributing the workload across multiple volumes and reducing the average queue length and latency. Option A is incorrect because gp3 volumes may not provide sufficient IOPS for this demanding workload, and a single volume still creates a bottleneck. Option C is incorrect because increasing IOPS on a single volume may not resolve the queue length issue if the volume is already at its throughput limit.

Option D is incorrect because upgrading the instance does not directly improve EBS performance; the bottleneck is at the storage layer.

Full explanation →

235

Multi-Selectmedium

Which TWO of the following are best practices for securing an SAP HANA database on AWS? (Choose two.)

Select 2 answers

A.Deploy the HANA instance in a private subnet without direct internet access.

B.Disable SSL/TLS for client connections to improve performance.

C.Use a single Availability Zone to simplify network security group management.

D.Enable encryption at rest for the HANA data and log volumes using AWS KMS.

E.Assign a public IP address to the HANA instance for easy access from the internet.

AnswersA, D

Private subnet reduces attack surface.

Why this answer

Deploying the HANA instance in a private subnet without direct internet access ensures that the database is not exposed to the public internet, reducing the attack surface. This follows the AWS security best practice of using private subnets for sensitive workloads, with access only through bastion hosts or VPN/Direct Connect. It also aligns with SAP's own security recommendations for HANA deployments.

Exam trap

The trap here is that candidates may think disabling SSL/TLS improves performance (Option B) without recognizing that the performance gain is negligible compared to the catastrophic security risk, or they may incorrectly assume a public IP is acceptable for administrative access, overlooking the fundamental network isolation requirement for production databases.

Full explanation →

236

MCQeasy

Refer to the exhibit. A CloudFormation template is used to migrate a web server to AWS. The template launches an EC2 instance but does not install the web server. What is the best way to automate the installation?

A.Create a CloudWatch Events rule to trigger a Lambda function after instance launch.

B.Add a UserData property to the EC2 instance resource.

C.Use AWS Systems Manager Run Command to install the web server.

D.Use AWS CodeDeploy to deploy the web server after the instance is created.

AnswerB

UserData runs scripts during instance initialization.

Why this answer

The UserData property in a CloudFormation EC2 resource allows you to specify scripts or commands that run automatically at instance launch. This is the simplest and most direct method to install software like a web server during provisioning. Option A (CloudWatch Events triggering Lambda) is not automatic at launch and requires additional resources.

Option C (Run Command) requires manual invocation or scheduling, not automatic at launch. Option D (CodeDeploy) requires an agent to be pre-installed, which is not the case here.

Full explanation →

237

MCQeasy

An SAP system uses a secondary IP address for the SAP application. After an instance reboot, the secondary IP address is no longer attached. What is the most likely cause?

A.The Elastic IP address was not associated with the instance

B.The secondary IP address is not automatically re-attached after instance stop/start

C.The security group removed the IP address

D.The Elastic Network Interface (ENI) was deleted

AnswerB

Secondary IPs are not persistent across stop/start; they must be re-attached or use an ENI.

Why this answer

When an EC2 instance is stopped and started, any secondary private IP addresses assigned to its primary Elastic Network Interface (ENI) are automatically released and not re-attached. The SAP application relies on this secondary IP address, so after a stop/start cycle the address is lost, requiring manual re-assignment or automation to restore it.

Exam trap

The trap here is that candidates confuse the behavior of Elastic IP addresses (which persist across stop/start if associated with an ENI) with secondary private IP addresses, which do not persist on the primary ENI after a stop/start cycle.

How to eliminate wrong answers

Option A is wrong because an Elastic IP address is a public IPv4 address that can be associated with an instance or ENI, but the question specifies a secondary IP address (private IPv4), not a public Elastic IP. Option C is wrong because security groups are stateful virtual firewalls that control inbound/outbound traffic based on rules; they do not assign or remove IP addresses from an instance. Option D is wrong because the ENI itself is not deleted during a stop/start cycle; only the secondary private IP address is released from the primary ENI when the instance is stopped.

Full explanation →

238

Multi-Selecthard

A company is migrating an SAP HANA database from on-premises to AWS. The database is 5 TB and the network link is 500 Mbps. The company has a tight window of 24 hours for the migration. Which TWO methods can be used to transfer the initial data load within the time constraint?

Select 2 answers

A.Use AWS DMS to perform a full load directly over the network.

B.Use AWS Site-to-Site VPN with jumbo frames enabled.

C.Use AWS Snowball Edge to transfer the database backup files to AWS.

D.Use AWS DataSync with compression enabled over a Direct Connect link.

E.Use Amazon S3 multipart upload to upload backup files directly from on-premises.

AnswersC, D

Physical transfer bypasses network limitations.

Why this answer

The correct answers are Option C (AWS Snowball Edge) and Option D (AWS DataSync over Direct Connect with compression). Snowball Edge allows physical shipment of the 5 TB database, bypassing the 500 Mbps network bottleneck entirely. DataSync with compression over Direct Connect can accelerate the transfer, potentially completing within 24 hours.

Option A (AWS DMS) over 500 Mbps for 5 TB would take approximately 23 hours theoretically, but with overhead and potential retries, it may exceed the 24-hour window. Option B (AWS Site-to-Site VPN) is slower than Direct Connect and also limited by the 500 Mbps link. Option E (Amazon S3 multipart upload) faces the same network speed limitation as DMS and would likely exceed the time constraint.

Full explanation →

239

MCQhard

A company runs SAP on AWS and wants to implement a disaster recovery solution with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes. The primary site is in us-east-1, and the DR site is in us-west-2. Which strategy meets these requirements for SAP HANA database?

A.Use AWS Database Migration Service (DMS) for ongoing replication

B.Take EBS snapshots every 15 minutes and copy them to us-west-2

C.Use Amazon S3 Cross-Region Replication for HANA data files

D.Configure SAP HANA System Replication across regions

AnswerD

HANA System Replication provides low RPO and meets RTO.

Why this answer

HANA System Replication with log shipping can achieve RPO of minutes and RTO within hours. Option A is incorrect because EBS snapshots cannot achieve 15-minute RPO. Option B is incorrect because S3 cross-region replication is for files, not live HANA replication.

Option C is incorrect because DMS is for heterogeneous migrations, not real-time HANA replication.

Full explanation →

240

Drag & Dropmedium

Drag and drop the steps to set up an SAP HANA system replication in AWS using the SAP HANA Cockpit into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

SAP HANA system replication requires two instances, network connectivity, enabling replication on primary, registering secondary, and then starting replication.

Full explanation →

241

MCQmedium

An SAP environment on AWS consists of several EC2 instances running SAP NetWeaver and a separate HANA database instance. The system is using an Application Load Balancer (ALB) to distribute traffic to the web dispatchers. Recently, the ALB health checks are failing for one of the web dispatchers, causing it to be taken out of service. You investigate and find that the web dispatcher is running and can be reached directly via its private IP. The health check is configured to check the /sap/public/health endpoint. What is the most likely reason for the health check failure?

A.The security group for the web dispatcher does not allow traffic from the ALB.

B.The web dispatcher is configured to redirect HTTP requests to HTTPS, and the health check is using HTTP.

C.The web dispatcher instance is running out of memory, causing slow responses.

D.The web dispatcher has multiple IP addresses and the health check targets the wrong one.

AnswerB

A redirect response (3xx) is considered unhealthy by ALB; the health check should use HTTPS or the web dispatcher should not redirect.

Why this answer

The ALB health check expects a 200 OK response. If the web dispatcher is configured to redirect HTTP to HTTPS, the health check (which uses HTTP) receives a redirect (3xx) response instead of 200, causing the ALB to mark it as unhealthy. Option A is incorrect because if the security group blocked traffic from the ALB, direct access via private IP would also be blocked.

Option C is incorrect because slow responses would cause timeout, not a redirect. Option D is incorrect because a single instance typically has one IP address for the web dispatcher service.

Exam trap

A common trap is to think that a redirect (3xx) response is acceptable for health checks. ALB requires a 200 OK from the target. Any other response, including redirects, is considered unhealthy.

Full explanation →

242

MCQmedium

A company runs a critical SAP application on an SAP HANA database in a single Availability Zone on AWS. The database is 2 TB in size. The company needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The DR region must be in a different AWS Region. Which solution meets these requirements with the LEAST operational overhead?

A.Configure SAP HANA System Replication (HSR) in a multitier setup with a primary in the source region and a synchronous secondary in the DR region. Use HANA takeover for failover.

B.Use AWS Database Migration Service (DMS) to continuously replicate data from the HANA database to a HANA database in the DR region.

C.Deploy a second HANA node in a different Availability Zone in the same region and configure HANA System Replication. Use AWS Global Accelerator to route traffic to the standby.

D.Use AWS Backup to schedule daily snapshots of the HANA database and copy them to the DR region. In the event of a disaster, restore the latest snapshot to a new HANA instance.

AnswerB

Correct. AWS DMS can continuously replicate HANA data with change data capture, meeting the RPO of 15 minutes. The target database can be pre-provisioned, and automated failover can be configured using DMS ongoing replication, achieving an RTO of 2 hours. This is a managed service, reducing operational overhead.

Why this answer

AWS Database Migration Service (DMS) with continuous replication (change data capture) can achieve an RPO of 15 minutes for a 2 TB SAP HANA database across AWS Regions. The RTO of 2 hours is achievable by provisioning the target HANA instance in advance and applying changes. This solution uses a fully managed AWS service, reducing operational overhead compared to manual scripting or third-party tools.

While SAP HANA System Replication (HSR) is native, cross-region synchronous replication is not feasible due to latency; asynchronous HSR could meet the RPO but is not listed as an option. DMS provides continuous replication with minimal setup and monitoring, making it the best choice among the given options.

Exam trap

The trap is that candidates assume SAP HANA System Replication is always the best solution for HANA DR, but synchronous replication across AWS Regions is not feasible due to latency. They may overlook AWS DMS as a viable managed alternative that can meet the RPO/RTO with lower operational overhead.

How to eliminate wrong answers

Option B is wrong because AWS Database Migration Service (DMS) is designed for one-time migrations or ongoing replication with change data capture, but it does not support SAP HANA as a target for continuous replication in a DR scenario and introduces significant operational overhead for failover and consistency management. Option C is wrong because it places the secondary in a different Availability Zone within the same region, which does not satisfy the requirement for a different AWS Region for DR. Option D is wrong because daily snapshots cannot achieve an RPO of 15 minutes, and restoring from snapshots would exceed the 2-hour RTO due to the time required to copy and restore 2 TB of data.

Full explanation →

243

MCQmedium

A company is deploying SAP S/4HANA on AWS and needs to ensure that the database and application servers are in the same placement group to minimize latency. However, the instance types required for the HANA database are not available in the same placement group due to insufficient capacity. What should the company do to maintain low latency?

A.Use a spread placement group instead of a cluster placement group.

B.Place all instances in the same Availability Zone without a placement group.

C.Use a different instance type for the database that is available in the placement group.

D.Place the database in a different AWS Region and use AWS Direct Connect.

AnswerA

Spread placement groups distribute instances across distinct hardware, reducing capacity issues while still minimizing latency.

Why this answer

A spread placement group is the correct choice because it spreads instances across distinct underlying hardware, reducing the risk of correlated failures while still keeping them in the same Availability Zone to minimize latency. Unlike a cluster placement group, which requires all instances to be on the same rack and can suffer from capacity constraints, a spread placement group does not enforce a single rack placement, so it can accommodate different instance types even when the cluster placement group lacks capacity. This ensures low latency for SAP S/4HANA communication between database and application servers without violating placement group constraints.

Exam trap

The trap here is that candidates assume only a cluster placement group can provide low latency, overlooking that a spread placement group in the same Availability Zone still offers significantly lower latency than no placement group, while avoiding the capacity limitations of a cluster placement group.

How to eliminate wrong answers

Option B is wrong because placing instances in the same Availability Zone without a placement group does not guarantee that they will be on the same physical hardware or even close together, which can introduce higher latency than a placement group provides. Option C is wrong because changing the database instance type may not meet the performance or memory requirements of SAP HANA, and it does not solve the underlying capacity issue in the cluster placement group. Option D is wrong because placing the database in a different AWS Region introduces significant cross-Region latency, which is unacceptable for SAP S/4HANA’s low-latency requirements, and AWS Direct Connect does not reduce latency between Regions.

Full explanation →

244

MCQmedium

A company uses SAP NetWeaver with an Oracle database on EC2. The operations team wants to automate the patching of the operating system while ensuring minimal downtime. Which AWS Systems Manager capability should be used?

A.AWS Systems Manager Automation

B.AWS Systems Manager Run Command

C.AWS Systems Manager OpsCenter

D.AWS Systems Manager Patch Manager

AnswerD

Patch Manager automates the process of patching managed instances.

Why this answer

(AWS Systems Manager Patch Manager) is correct because it automates OS patching with scheduling and maintenance windows, minimizing downtime for SAP NetWeaver on EC2. Option A (Automation) is for running predefined workflows, not specifically for patching. Option B (Run Command) is for ad-hoc command execution, not automated patching.

Option C (OpsCenter) is for managing operational issues, not patching.

Full explanation →

245

Multi-Selecthard

Which THREE factors should be considered when selecting an EC2 instance type for an SAP HANA production system during migration? (Choose 3.)

Select 3 answers

A.Memory (RAM) size relative to the HANA workload

B.GPU acceleration capabilities

C.EBS-optimized by default

D.Network throughput and latency

E.SAP certification of the instance type

AnswersA, D, E

HANA is memory-bound; sufficient RAM is critical.

Why this answer

Options A, D, and E are correct because SAP HANA is memory-intensive and requires sufficient RAM (A), high network throughput and low latency for data replication and client access (D), and must be run on instance types certified by SAP for HANA workloads (E). Option B is incorrect because GPU acceleration is not a requirement for standard SAP HANA production systems. Option C is incorrect because while EBS-optimized is recommended for consistent performance, it is not a primary selection factor compared to the others.

Full explanation →

246

MCQeasy

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

A.Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

B.AWS Database Migration Service (DMS) with ongoing replication.

C.AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

D.AWS Snowball Edge to ship the data physically, then import to RDS.

AnswerB

DMS supports full load plus change data capture (CDC) for minimal downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Exam trap

The trap here is that candidates often choose Snowball Edge for large datasets without considering the minimal downtime requirement, forgetting that physical shipping introduces hours or days of latency and cannot provide ongoing replication, while DMS with CDC is the only option that keeps the source online during migration.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration only speeds up uploads to S3 over the public internet but does not provide ongoing replication or CDC; restoring a dump from S3 to RDS would require taking the source database offline for the entire dump and restore process, violating the minimal downtime requirement. Option C is wrong because AWS Storage Gateway is designed for hybrid storage (e.g., file shares, volume backups) and cannot replicate live Oracle database changes or perform CDC; it would only copy static database files, requiring a full outage for the initial copy and lacking incremental sync. Option D is wrong because AWS Snowball Edge is a physical data transfer device intended for large datasets over slow or unreliable networks; while it can move 2 TB, the shipping time (days) and the need to stop writes during data extraction make it unsuitable for minimal downtime, and it does not support ongoing replication.

Full explanation →

247

MCQmedium

A company is migrating its SAP landscape to AWS and wants to ensure that all SAP systems can communicate with each other using private IP addresses only. The systems are deployed in multiple VPCs. Which AWS solution should be used to enable private connectivity between these VPCs?

A.VPC Peering.

B.VPC Endpoints.

C.AWS Site-to-Site VPN.

D.AWS Direct Connect.

AnswerA

VPC Peering enables private routing between VPCs.

Why this answer

VPC Peering is the correct solution because it enables direct, private IP connectivity between VPCs using the AWS global network, with no gateways or VPN connections required. Traffic stays within AWS and never traverses the public internet, satisfying the requirement for SAP systems to communicate using only private IP addresses across multiple VPCs.

Exam trap

The trap here is that candidates may confuse VPC Peering with VPC Endpoints, thinking both provide private connectivity, but VPC Endpoints only connect to AWS services, not to other VPCs.

How to eliminate wrong answers

Option B is wrong because VPC Endpoints (Gateway or Interface endpoints) provide private connectivity to AWS services (like S3 or DynamoDB) from within a VPC, not between VPCs. Option C is wrong because AWS Site-to-Site VPN establishes encrypted tunnels over the public internet between on-premises networks and a VPC, not between VPCs. Option D is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, used for hybrid connectivity, not for inter-VPC communication.

Full explanation →

248

MCQeasy

A company runs its SAP landscape on AWS and uses an Application Load Balancer (ALB) to distribute traffic to multiple web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the most likely cause?

A.The security groups for the ALB are blocking incoming traffic.

B.The SSL certificate on the ALB has expired.

C.The CloudFront distribution in front of the ALB is misconfigured.

D.The target group health checks are failing, causing the ALB to mark instances as unhealthy.

AnswerD

503 errors occur when no healthy targets are available.

Why this answer

503 errors from an ALB typically indicate that the target instances are unhealthy or the ALB cannot route traffic to them, often due to failed health checks. Option A is wrong because security groups blocking traffic would cause 504 or timeout errors, not 503. Option B is wrong because an expired SSL certificate on the ALB would cause 502 errors (bad gateway), not 503.

Option C is wrong because CloudFront is not in the path; the question describes an ALB distributing traffic directly to web dispatchers, so CloudFront misconfiguration is irrelevant.

Full explanation →

249

MCQmedium

A company is migrating its SAP ERP system to AWS and needs to minimize network latency between the SAP application servers and the database. Which architecture is recommended?

A.Place the application servers in one AZ and the database in a different AZ

B.Place both the application and database servers in the same Availability Zone

C.Place the application servers in one region and the database in another region

D.Keep the database on-premises and move only the application servers to AWS

AnswerB

Same-AZ placement minimizes latency.

Why this answer

Placing both the SAP application servers and the database in the same Availability Zone (AZ) minimizes network latency by keeping traffic within a single data center. Option A is incorrect because different AZs introduce additional latency due to inter-AZ data transfer. Option C is incorrect because different regions add significant latency and incur higher costs.

Option D is incorrect because keeping the database on-premises introduces network latency over the internet or VPN connection.

Full explanation →

250

MCQhard

A company is migrating a large SAP Business Warehouse (BW) system to AWS. The system uses SAP HANA as the database. The migration plan involves using SAP HANA System Replication (HSR) for near-zero downtime. During the initial synchronization, the network bandwidth is limited to 1 Gbps. The source database is 5 TB. How long will the initial synchronization approximately take, assuming no other bottlenecks?

A.Approximately 2 hours

B.Approximately 6 hours

C.Approximately 12 hours

D.Approximately 24 hours

AnswerC

5 TB at 1 Gbps gives about 11.1 hours; 12 hours is a reasonable estimate including overhead.

Why this answer

5 TB = 5,000 GB = 40,000 Gb (since 1 GB = 8 Gb). At 1 Gbps, time = 40,000 seconds ≈ 11.1 hours. This simple calculation ignores overhead, but among the options, 12 hours is the closest.

The other options are unrealistic.

Full explanation →

251

MCQmedium

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

A.The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.

B.The S3 bucket has versioning enabled, which requires additional permissions.

C.The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.

D.The bucket policy does not grant the s3:PutObject permission to the IAM role.

AnswerA

The bucket policy condition requires this header; without it, the request is denied.

Why this answer

The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Exam trap

The trap here is that candidates assume the bucket policy alone is sufficient for cross-account uploads, overlooking the requirement for the `bucket-owner-full-control` ACL header to transfer object ownership to the bucket owner.

How to eliminate wrong answers

Option B is wrong because enabling versioning does not require additional permissions for PutObject; versioning affects object version IDs but does not block uploads due to ownership issues. Option C is wrong because the resource ARN `arn:aws:s3:::my-bucket` is correct for granting permissions on the bucket itself; the wildcard `/*` is needed only for object-level operations, but the policy already uses `arn:aws:s3:::my-bucket/*` in the Resource element (the question states the bucket policy is shown above, and the correct ARN is used). Option D is wrong because the bucket policy does grant s3:PutObject to the IAM role; the failure is not due to missing permission but due to missing ACL header.

Full explanation →

252

MCQmedium

The above IAM policy is attached to an IAM role used by an AWS DMS replication instance. The DMS task is migrating data from an on-premises Oracle database to Amazon S3. The DMS task fails with an access error. What is missing from the policy?

A.Permissions to describe EC2 instances are missing

B.Permissions to access Amazon RDS are missing

C.Permissions to pass the IAM role to the DMS replication instance are missing

D.Permissions to write to the S3 bucket are missing

AnswerC

DMS needs iam:PassRole to allow the replication instance to assume the role.

Why this answer

The IAM policy attached to the role used by the DMS replication instance must include 'iam:PassRole' to allow DMS to pass the role to the replication instance. Without this permission, DMS cannot assume the role, leading to an access error. Option A is incorrect because EC2 describe permissions are not required for this migration.

Option B is incorrect because the source is on-premises Oracle, not Amazon RDS. Option D is incorrect because the policy already includes S3 write permissions (implied by the context; the policy is not shown but the error is not about S3 access).

Full explanation →

253

MCQeasy

An SAP system running on AWS is experiencing high CPU usage on the application server during peak hours. The system is already using the largest instance type available in the current generation. What is the most cost-effective solution to handle the peak load?

A.Upgrade to a larger instance type from a different instance family

B.Purchase Reserved Instances to reduce cost and allocate more resources

C.Add an additional SAP application server in the same Availability Zone

D.Use Auto Scaling to automatically add instances during peak hours

AnswerC

Horizontal scaling distributes load across multiple servers.

Why this answer

SAP on AWS supports horizontal scaling by adding more application servers to distribute the load, which is the most cost-effective approach when the current instance type is already the largest available. Option C correctly adds an additional SAP application server in the same Availability Zone, leveraging SAP's native architecture to handle peak CPU usage without incurring the cost of a larger, potentially unavailable instance.

Exam trap

The trap here is that candidates often confuse Auto Scaling (Option D) with SAP's native horizontal scaling, but Auto Scaling is not a standard SAP feature and requires significant custom implementation, making Option C the correct and most cost-effective answer.

How to eliminate wrong answers

Option A is wrong because upgrading to a larger instance type from a different instance family is not possible if the current generation's largest instance is already in use; AWS instance families have fixed maximum sizes, and moving to a different family (e.g., from compute-optimized to memory-optimized) may not provide the required CPU performance and could introduce compatibility issues with SAP's certified instance types. Option B is wrong because purchasing Reserved Instances reduces hourly cost but does not allocate more resources or solve the immediate high CPU usage during peak hours; it is a billing optimization, not a scaling solution. Option D is wrong because Auto Scaling is not natively supported for SAP application servers in a traditional SAP architecture; SAP systems require manual or orchestrated addition of application servers, and Auto Scaling would need custom scripts and careful state management to avoid disrupting SAP's distributed processes.

Full explanation →

254

MCQeasy

A company is migrating an on-premises SAP HANA database to AWS. The database is 2 TB in size. The migration window is limited to 3 days. Which AWS service should be used to perform the initial data transfer?

A.AWS Snowball Edge

B.AWS Database Migration Service (DMS)

C.AWS DataSync

D.AWS Direct Connect

AnswerA

Snowball Edge can physically transport 2 TB of data quickly, bypassing network constraints.

Why this answer

AWS Snowball Edge is designed for large data transfers when network bandwidth is limited. The 2 TB database can be physically shipped and loaded onto AWS. AWS Direct Connect is for ongoing connectivity, not bulk transfer.

AWS DataSync is for smaller datasets over the network. AWS DMS is for ongoing replication and requires network bandwidth.

Full explanation →

255

MCQeasy

An SAP administrator needs to migrate an on-premises SAP ERP system to AWS. The current system runs on a single Windows Server with SQL Server and uses 2 TB of storage. The migration must minimize downtime and use native AWS tools. Which service should be used to replicate the on-premises server to AWS?

A.AWS CloudFormation

B.AWS Snowball

C.AWS Database Migration Service (DMS)

D.AWS Server Migration Service (SMS)

AnswerD

SMS replicates entire server volumes to AWS, minimizing downtime.

Why this answer

AWS Server Migration Service (SMS) is the correct choice because it is designed to automate the replication of on-premises live server volumes (including Windows Server with SQL Server) to AWS as Amazon Machine Images (AMIs), enabling incremental replication with minimal downtime. It uses agentless replication via the AWS Replication Agent or hypervisor-level integration, making it ideal for migrating the entire server, including the OS and SQL Server database, without requiring separate database-level tools.

Exam trap

The trap here is that candidates often confuse AWS DMS as the go-to migration tool for any SQL Server workload, but DMS only handles the database layer, not the entire server including the SAP application and Windows OS, which SMS is specifically built for in server-level migrations.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation is an Infrastructure as Code (IaC) service for provisioning and managing AWS resources, not a replication or migration tool for live server volumes. Option B is wrong because AWS Snowball is a physical data transfer device intended for large-scale offline data migration (typically >10 TB or low-bandwidth scenarios), not for minimizing downtime via online replication of a 2 TB server. Option C is wrong because AWS Database Migration Service (DMS) is specialized for migrating databases (e.g., SQL Server to Amazon RDS or EC2-hosted SQL Server) but does not replicate the entire server OS, file system, or application stack; it would leave the Windows Server and SAP application layer unmigrated.

Full explanation →

256

MCQmedium

A company is migrating an SAP ERP system running on an on-premises IBM AIX server to AWS. The server hosts both the SAP application and the DB2 database. The company has a tight deadline and wants to minimize the migration effort. The current system uses a storage area network (SAN) with 2 TB of data. The company wants to use AWS native services and avoid re-architecting. What is the BEST migration strategy?

A.Use AWS Application Migration Service (MGN) to replicate the entire server to AWS.

B.Manually install SAP and DB2 on EC2 and restore from backup.

C.Use AWS Snowball Edge to transfer the data offline and then launch EC2 instances.

D.Use AWS DMS to migrate the DB2 database to Amazon RDS for DB2.

AnswerA

MGN supports AIX and replicates the entire server.

Why this answer

AWS MGN supports migration of IBM AIX servers with block-level replication. Option B (manual install) is wrong because manual installation is more effort and not leveraging AWS services. Option C is wrong because AWS Snowball would require downtime and is not real-time.

Option D is wrong because AWS DMS does not support DB2 on AIX as a source.

Full explanation →

257

MCQmedium

A company is migrating its SAP environment to AWS and needs to ensure that the SAP license compliance is maintained. What should the company do to verify that the EC2 instances used for SAP are properly licensed?

A.Use AWS License Manager to enforce license limits

B.Use only bring-your-own-license (BYOL) instances

C.Use AWS Config rules to check instance types

D.Use EC2 instance types listed in the SAP Certified and Supported SAP HANA Hardware Directory

AnswerD

The SAP Certified and Supported SAP HANA Hardware Directory lists EC2 instance types that are certified for SAP, ensuring proper licensing.

Why this answer

To maintain SAP license compliance, the company must use EC2 instance types that are listed in the SAP Certified and Supported SAP HANA Hardware Directory. This directory provides the list of AWS instance types that are officially certified for SAP and have the appropriate licensing support. Option D is correct.

Option A (AWS License Manager) can enforce license limits but does not verify if the instance types are SAP-certified. Option B (BYOL) is a licensing model, not a verification method. Option C (AWS Config) can track instance configurations but does not verify SAP certification or licensing.

Full explanation →

258

MCQeasy

A company is deploying SAP S/4HANA on AWS and needs to choose the storage for the HANA data volume. Which EBS volume type provides the highest consistent IOPS for this workload?

A.EBS io2 Block Express

B.EBS gp3

C.EBS io1

D.EBS st1

AnswerA

io2 Block Express offers up to 256,000 IOPS.

Why this answer

EBS io2 Block Express is designed for mission-critical applications like SAP HANA, offering the highest consistent IOPS of any EBS volume type, with up to 256,000 IOPS. Option B (gp3) provides baseline performance but lower maximum IOPS than io2 Block Express. Option C (io1) is an older provisioned IOPS type with lower maximum IOPS (up to 64,000) compared to io2 Block Express.

Option D (st1) is throughput-optimized and not suitable for high IOPS workloads.

Full explanation →

259

MCQhard

A company is migrating its SAP landscape to AWS and plans to use SAP S/4HANA. The migration includes a heterogeneous system conversion from an existing SAP ECC system. Which AWS service or tool supports the generation of the migration cockpit and migration object modeler content required for the conversion?

A.AWS Database Migration Service (DMS)

B.AWS Application Migration Service (MGN)

C.AWS Migration Hub

D.SAP S/4HANA Migration Cockpit (not an AWS service)

AnswerD

The Migration Cockpit is the SAP tool that generates migration content; AWS does not provide this.

Why this answer

SAP S/4HANA migration uses the SAP S/4HANA Migration Cockpit, which relies on migration object modeler content. This content is generated by the SAP S/4HANA Migration Cockpit itself, not by an AWS service. AWS does not provide a service that generates SAP migration content.

Option A (AWS Migration Hub) tracks migrations. Option B (AWS Application Migration Service) is for server migration. Option C (AWS Database Migration Service) migrates databases.

Option D (SAP S/4HANA Migration Cockpit) is the correct tool for generating the migration cockpit content.

Full explanation →

260

Multi-Selecthard

A company runs SAP ERP on AWS with an Oracle database. The architect wants to implement a backup strategy that provides point-in-time recovery (PITR) with an RPO of 5 minutes and an RTO of 2 hours. Which TWO solutions should the architect consider? (Choose TWO.)

Select 2 answers

A.AWS Database Migration Service (DMS) with ongoing replication to an Oracle instance in another AZ

B.Oracle Recovery Manager (RMAN) with archivelog mode backing up to Amazon S3

C.Amazon S3 Lifecycle policies to move backups to Glacier

D.Amazon S3 Transfer Acceleration for backup uploads

E.EBS snapshots every 5 minutes

AnswersA, B

DMS ongoing replication can achieve low RPO and provides a standby for failover.

Why this answer

AWS DMS with ongoing replication can continuously replicate changes from the Oracle source database to a target Oracle instance in another Availability Zone, enabling point-in-time recovery with an RPO as low as 5 minutes. This approach supports near-real-time replication and can be combined with automatic failover to meet the RTO of 2 hours, as the target instance is already synchronized and ready.

Exam trap

The trap here is that candidates often assume EBS snapshots can be taken at very high frequencies (like every 5 minutes) to achieve low RPO, but AWS enforces a 60-minute minimum cooldown between snapshots, making this option infeasible for the stated RPO.

Full explanation →

261

MCQeasy

Which AWS service should be used to capture and analyze operating system-level metrics from an EC2 instance running SAP, such as memory utilization and disk I/O, and to set alarms based on thresholds?

A.AWS Config

B.AWS Trusted Advisor

C.Amazon CloudWatch with the CloudWatch Agent

D.Amazon Inspector

AnswerC

CloudWatch Agent collects OS metrics and supports alarms.

Why this answer

Amazon CloudWatch with the CloudWatch Agent is the correct choice because the CloudWatch Agent can collect custom operating system-level metrics (such as memory utilization and disk I/O) from EC2 instances, including those running SAP. The agent sends these metrics to CloudWatch, where you can set alarms based on thresholds. AWS Config, Trusted Advisor, and Inspector do not provide OS-level metric collection or alarm capabilities.

Exam trap

The trap here is that candidates often assume the default EC2 metrics in CloudWatch include memory and disk I/O, but those are only available if you install the CloudWatch Agent, as the hypervisor cannot see inside the guest OS.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and auditing resource configurations against rules (e.g., checking if an EC2 instance has a specific tag), not for capturing OS-level metrics or setting alarms. Option B is wrong because AWS Trusted Advisor provides best-practice recommendations (e.g., cost optimization, security checks) but does not collect or analyze memory utilization or disk I/O metrics from EC2 instances. Option D is wrong because Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure; it does not capture OS-level performance metrics or support alarm thresholds.

Full explanation →

262

MCQhard

A company runs an SAP system on AWS and wants to implement a disaster recovery (DR) strategy that provides a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. The primary site is in us-east-1 and the DR site is in us-west-2. Which approach meets these requirements?

A.Use Amazon EBS cross-Region replication for all volumes

B.Use AWS Backup to copy snapshots to the DR region every 15 minutes

C.Configure SAP HANA system replication to the DR region and use automatic failover

D.Take daily backups of the SAP HANA database and store in S3, then restore in us-west-2

AnswerC

Provides low RTO and RPO.

Why this answer

Configuring SAP HANA system replication to the DR region with automatic failover provides an RTO of less than 2 hours and an RPO of 15 minutes or less. Option A is incorrect because Amazon EBS cross-Region replication does not exist for EBS volumes; snapshots must be copied manually or via AWS Backup, and the RPO would be higher. Option B is incorrect because AWS Backup can copy snapshots, but the minimum backup frequency is hourly (not every 15 minutes), and restoring from snapshots would exceed the RTO.

Option D is incorrect because daily backups to S3 have an RPO of 24 hours, which exceeds the required 15 minutes.

Full explanation →

263

MCQhard

An SAP system administrator notices that nightly SAP HANA backups to Amazon S3 are failing intermittently with 'Access Denied' errors. The backups are initiated by an AWS Lambda function that uses an IAM role. The role has a policy that grants s3:PutObject on the backup bucket. Which additional IAM action is most likely required to resolve the issue?

A.s3:ListBucket

B.s3:PutObjectAcl

C.s3:DeleteObject

D.s3:GetObject

AnswerB

Required to set object ownership, especially when bucket policy enforces bucket owner full control.

Why this answer

s3:PutObjectAcl is required when the bucket owner and the object uploader are different, or when the bucket policy requires the uploader to set ACLs to give the bucket owner full control. In this scenario, the Lambda function's IAM role likely needs this permission to successfully write objects to the S3 bucket, especially if the bucket is owned by a different AWS account or has a bucket policy that enforces specific ACLs. Without s3:PutObjectAcl, the upload may fail with 'Access Denied' when the bucket policy requires the uploader to grant the bucket owner full control.

Option A (s3:ListBucket) is for listing objects, not uploading. Option C (s3:DeleteObject) is for deleting, not uploading. Option D (s3:GetObject) is for reading, not writing.

Full explanation →

264

MCQeasy

A manufacturing company is migrating its SAP ECC system to AWS. The system includes an SAP HANA database (1 TB) and an SAP NetWeaver application server. They plan to use AWS Database Migration Service (DMS) for the database and AWS Application Migration Service (MGN) for the application server. The network connection is AWS Direct Connect with 1 Gbps bandwidth. During a test migration, the DMS task for the database fails with a connection error. The source database is on an on-premises server that is behind a firewall. The administrator has already opened the necessary ports in the firewall. The DMS replication instance is in a VPC with a public subnet. Which step should the administrator take to resolve the connection issue?

A.Modify the DMS source endpoint to use a different port.

B.Create a private subnet for the DMS replication instance and attach a NAT gateway to allow outbound traffic to the on-premises database.

C.Configure the source database to allow connections from the DMS replication instance IP.

D.Open additional ports in the on-premises firewall.

AnswerC

The source database likely has an IP allowlist. Even with open firewall ports, the database must accept connections from the DMS replication instance's IP address. Configuring this allows the connection.

Why this answer

The DMS replication instance needs to establish a connection to the source database. Even if the necessary ports are open in the firewall, the source database itself may have an IP allowlist that must include the DMS instance's IP. Since the DMS instance is in a public subnet, it has a public IP.

The administrator should configure the source database to allow connections from that IP. Option C is correct. Option B is misleading because a NAT gateway provides internet access, not connectivity to on-premises via Direct Connect; proper routing via a virtual private gateway is needed.

Option A is incorrect because changing the port does not resolve network reachability. Option D is incorrect because the firewall ports are already open.

Full explanation →

265

MCQeasy

A company is running SAP BusinessObjects on AWS. The application is deployed on EC2 instances with an Application Load Balancer. Users are reporting that the application is sometimes unreachable. What is the most likely cause?

A.The target group health checks are failing intermittently on the EC2 instances.

B.The security group for the instances is not allowing traffic from the load balancer.

C.The load balancer is not configured with sticky sessions.

D.The Route 53 TTL is too short for DNS resolution.

AnswerA

Unhealthy instances are removed from the load balancer, causing connection failures.

Why this answer

Intermittent unreachability of an application behind an Application Load Balancer (ALB) is most commonly caused by health checks failing on the target EC2 instances. When health checks fail intermittently, the ALB will periodically mark the instances as unhealthy and stop routing traffic to them, causing the application to become unreachable during those windows. This matches the symptom of 'sometimes unreachable' rather than a persistent failure.

Exam trap

The trap here is that candidates often confuse intermittent reachability with misconfigured security groups or DNS, but the key phrase 'sometimes unreachable' points directly to a dynamic health check failure rather than a static configuration error.

How to eliminate wrong answers

Option B is wrong because if the security group for the instances were not allowing traffic from the load balancer, the application would be persistently unreachable, not intermittent. Option C is wrong because sticky sessions (session affinity) affect which instance handles a user's session, not overall reachability of the application. Option D is wrong because a short Route 53 TTL affects how quickly DNS changes propagate, not the real-time reachability of an already-resolved endpoint; DNS resolution is cached by clients and intermediate resolvers, so a short TTL would not cause intermittent unreachability.

Full explanation →

266

MCQhard

A company runs SAP Business Suite on AWS with Oracle Database. The system is experiencing high read latency on the database server. The current storage configuration uses EBS gp2 volumes. Which change would most effectively reduce read latency?

A.Migrate to io2 Block Express volumes with provisioned IOPS.

B.Increase the size of the EBS gp2 volumes to increase baseline IOPS.

C.Configure a RAID 0 stripe across multiple EBS volumes.

D.Use EBS st1 volumes for better throughput.

AnswerA

Migrating to io2 Block Express volumes reduces read latency by providing consistent, high-performance IOPS with sub-millisecond latency, directly addressing the high read latency constraint of the gp2 burst-bucket model. Unlike gp2, which throttles performance when burst credits are exhausted, io2 Block Express delivers provisioned IOPS independently of volume size, ensuring sustained throughput for SAP’s read-heavy Oracle workloads.

Why this answer

Io2 Block Express volumes provide consistent, high-performance IOPS with sub-millisecond latency, which directly addresses the high read latency issue. Unlike gp2, which relies on burst credits and has variable performance, io2 Block Express delivers provisioned IOPS up to 256,000 per volume, making it ideal for latency-sensitive SAP workloads with Oracle Database.

Exam trap

The trap here is that candidates often assume increasing gp2 volume size (Option B) or striping volumes (Option C) will solve latency issues, but the PAS-C01 exam tests the understanding that for consistent low-latency random I/O, provisioned IOPS volumes like io2 Block Express are required, not just higher throughput or IOPS aggregation.

How to eliminate wrong answers

Option B is wrong because increasing gp2 volume size only raises the baseline IOPS (at a rate of 3 IOPS per GB), but does not guarantee low latency under sustained high read loads, as gp2 performance can still degrade when burst credits are exhausted. Option C is wrong because RAID 0 striping across multiple EBS volumes improves throughput and IOPS but does not inherently reduce read latency; it can even introduce additional overhead from the RAID controller and increase the risk of data loss if a single volume fails. Option D is wrong because EBS st1 volumes are throughput-optimized HDDs designed for large, sequential workloads, not for low-latency random reads, and they have higher latency than SSD-based volumes like gp2 or io2.

Full explanation →

267

MCQeasy

A company is running SAP on AWS and needs to monitor the available memory on their SAP application servers. Which AWS service can be used to collect and visualize memory utilization metrics?

A.AWS Config

B.Amazon Inspector

C.Amazon CloudWatch with CloudWatch Agent

D.AWS CloudTrail

AnswerC

CloudWatch Agent collects memory metrics and sends them to CloudWatch.

Why this answer

Amazon CloudWatch with the CloudWatch Agent is the correct choice because the agent can be installed on EC2 instances to collect custom metrics, including memory utilization, which is not available by default from the hypervisor. The agent sends these metrics to CloudWatch, where you can visualize them using dashboards or set alarms. This directly addresses the need to monitor SAP application server memory on AWS.

Exam trap

The trap here is that candidates assume EC2 instance metrics in CloudWatch automatically include memory utilization, but they do not—only the CloudWatch Agent can collect and publish those OS-level metrics.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and auditing resource configurations against desired policies, not for collecting or visualizing runtime performance metrics like memory utilization. Option B is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a monitoring tool for OS-level metrics such as memory usage. Option D is wrong because AWS CloudTrail records API activity and user actions for auditing and governance, not for collecting system-level performance metrics from EC2 instances.

Full explanation →

268

Multi-Selectmedium

Which THREE AWS services are typically used in the migration of an SAP environment to AWS? (Choose 3.)

Select 3 answers

A.AWS Database Migration Service (DMS)

B.AWS CloudTrail

C.AWS Direct Connect

D.AWS Server Migration Service (SMS)

E.AWS Schema Conversion Tool (SCT)

AnswersA, D, E

DMS is used for database migration.

Why this answer

AWS Database Migration Service (DMS) is correct because it enables the migration of SAP HANA, SAP ASE, or other SAP-supported databases to AWS with minimal downtime. DMS supports homogeneous migrations (e.g., SAP HANA to SAP HANA on Amazon RDS or EC2) and heterogeneous migrations (e.g., SAP ASE to SAP HANA) when paired with the Schema Conversion Tool (SCT). It handles ongoing replication via Change Data Capture (CDC), which is critical for SAP systems that cannot tolerate extended outages.

Exam trap

The trap here is that candidates confuse supporting services (like Direct Connect for network or CloudTrail for auditing) with actual migration services, leading them to select options that are not part of the core migration toolset for SAP workloads.

Full explanation →

269

MCQhard

A company runs SAP HANA on AWS with a multi-AZ deployment using HANA System Replication (HSR). The primary site is in us-east-1a and the secondary in us-east-1b. Each site has an ASCS and PAS. The HANA database uses a virtual IP address managed by a Route 53 health check with a failover routing policy. During a recent AZ failure in us-east-1a, the automatic failover to the secondary site took over 15 minutes. The recovery time objective (RTO) is 5 minutes. Analysis shows that the Route 53 health check failed but the failover did not trigger quickly because the DNS TTL was set to 300 seconds. What changes should be made to meet the RTO?

A.Increase the DNS TTL to 600 seconds to ensure stability.

B.Replace Route 53 with an Application Load Balancer for the virtual IP.

C.Reduce the DNS TTL to 60 seconds and use a weighted routing policy with health checks.

D.Remove the health check and use a simple routing policy with a low TTL.

AnswerC

Lower TTL speeds up DNS propagation; weighted routing allows immediate failover.

Why this answer

Reducing the DNS TTL to 60 seconds ensures that DNS resolvers cache the failover record for a shorter duration, allowing the Route 53 failover routing policy to propagate the new IP address more quickly after a health check failure. Combined with a weighted routing policy and health checks, this enables failover within the 5-minute RTO by minimizing DNS propagation delay, which was the bottleneck at 300 seconds.

Exam trap

The trap here is that candidates may think increasing TTL improves stability (Option A) or that an ALB can replace a virtual IP for HANA HSR (Option B), but the core issue is DNS propagation delay, and only reducing TTL with a failover routing policy directly addresses the RTO requirement.

How to eliminate wrong answers

Option A is wrong because increasing the DNS TTL to 600 seconds would worsen the failover time, extending the delay beyond 15 minutes and making it impossible to meet the 5-minute RTO. Option B is wrong because an Application Load Balancer (ALB) does not support virtual IP addresses for SAP HANA HSR; ALBs operate at Layer 7 and cannot handle the static IP requirements of HANA System Replication, which relies on a fixed virtual IP for client connections. Option D is wrong because removing the health check eliminates the automated failure detection mechanism, and using a simple routing policy without health checks would not trigger failover at all, leaving the system unable to recover from an AZ failure.

Full explanation →

270

MCQmedium

A company is running SAP on AWS and needs to ensure that its SAP HANA database is backed up daily with minimal impact on performance. The database is 2 TB in size and runs on an r5.8xlarge instance. Which backup strategy meets these requirements?

A.Perform a full backup to Amazon EBS volumes attached to the instance

B.Use the SAP HANA Backint agent to back up directly to Amazon S3

C.Use AWS Backup to create snapshots of the entire EC2 instance

D.Use AWS Storage Gateway to back up to Amazon S3 Glacier

AnswerB

Backint integrates with SAP HANA for efficient, performant backups.

Why this answer

The SAP HANA Backint agent integrates directly with SAP HANA to stream backup data to Amazon S3, which offloads the backup workload from the database instance's CPU and I/O. This minimizes performance impact compared to local EBS snapshots or volume-based backups, as Backint uses S3's scalable throughput without consuming instance storage bandwidth.

Exam trap

The trap here is that candidates often assume EBS snapshots (via AWS Backup) are the simplest and least impactful method, but they fail to recognize that snapshots still cause I/O pauses and require database consistency, whereas Backint to S3 is the native, low-impact SAP HANA backup strategy on AWS.

How to eliminate wrong answers

Option A is wrong because performing a full backup to EBS volumes attached to the instance consumes significant I/O and CPU resources on the r5.8xlarge instance, impacting SAP HANA performance during the backup window. Option C is wrong because AWS Backup snapshots of the entire EC2 instance capture the full volume state, which requires a database-consistent snapshot (e.g., via pre-script hooks) and still incurs I/O overhead during snapshot creation, plus it is not a native SAP HANA backup method. Option D is wrong because AWS Storage Gateway is designed for hybrid storage scenarios and does not provide a direct, low-impact backup path for SAP HANA; backing up to S3 Glacier adds retrieval latency and is not suitable for daily operational backups.

Full explanation →

271

MCQmedium

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the MOST likely cause?

A.The SSL certificate on the ALB has expired.

B.Security groups allow too much traffic.

C.The target instances are failing health checks.

D.The ALB is out of capacity.

AnswerC

Unhealthy targets cause ALB to return 503 errors.

Why this answer

503 errors from an ALB indicate that the target instances are unhealthy or not responding. Option A is wrong because 503 errors are not caused by SSL certificate issues. Option B is wrong because security groups would cause connection timeouts, not 503.

Option D is wrong because ALB capacity is automatically scaled.

Full explanation →

272

MCQeasy

An operations team needs to automate the patching of EC2 instances running SAP applications. The instances are part of an Auto Scaling group. The team wants to apply patches without causing downtime to the SAP system. Which approach should they use?

A.Use AWS Systems Manager Patch Manager with a maintenance window that patches all instances simultaneously

B.Use AWS CodeDeploy to deploy patches as a new application version

C.Use AWS Systems Manager Patch Manager with a maintenance window and configure the Auto Scaling group to perform a rolling update

D.Use AWS OpsWorks to manage patching, configuring a rolling update

AnswerC

Patches can be applied during a maintenance window, and rolling updates ensure availability.

Why this answer

AWS Systems Manager Patch Manager can be integrated with an Auto Scaling group to perform a rolling update, which updates instances in batches, ensuring that the SAP application remains available throughout the patching process. This approach minimizes downtime by replacing or updating instances incrementally rather than all at once, which is critical for SAP systems that require high availability.

Exam trap

The trap here is that candidates might assume patching all instances simultaneously is acceptable for SAP systems, overlooking the critical requirement for zero downtime, or they might confuse CodeDeploy's application deployment capabilities with OS patching needs.

How to eliminate wrong answers

Option A is wrong because patching all instances simultaneously would cause downtime for the SAP system, as the instances would be unavailable at the same time. Option B is wrong because AWS CodeDeploy is designed for deploying application code, not for OS-level patching of EC2 instances; it does not manage system patches or integrate with Patch Manager for this purpose. Option D is wrong because AWS OpsWorks is a configuration management service that uses Chef or Puppet, but it is not the recommended or native service for automated patching of EC2 instances in an Auto Scaling group; Patch Manager with rolling updates is the standard approach.

Full explanation →

273

MCQeasy

A company wants to ensure that their SAP HANA database backups are stored securely and can be retained for 7 years for compliance. Which AWS service should they use to archive the backups?

A.Amazon EBS Snapshots

B.Amazon S3 Glacier Deep Archive

C.Amazon S3 Intelligent-Tiering

D.Amazon S3 Standard

AnswerB

Glacier Deep Archive provides the lowest cost for 7-year retention, meeting compliance requirements.

Why this answer

Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage class designed for long-term retention of data that is accessed infrequently, with a default retrieval time of 12 hours. This meets the 7-year compliance requirement for SAP HANA backups while minimizing storage costs, as the backups are unlikely to be accessed frequently after the initial retention period.

Exam trap

The trap here is that candidates often choose Amazon S3 Intelligent-Tiering because it automates cost savings, but they overlook that it does not include the deep archive tier and incurs additional monitoring costs, making it less suitable for long-term, infrequently accessed backups compared to Glacier Deep Archive.

How to eliminate wrong answers

Option A is wrong because Amazon EBS Snapshots are stored in Amazon S3 but are not directly accessible as objects, cannot be retained for 7 years without incurring high costs due to incremental snapshot storage, and lack lifecycle management for archival to lower-cost tiers. Option C is wrong because Amazon S3 Intelligent-Tiering is designed for data with unknown or changing access patterns and automatically moves data between frequent, infrequent, and archive tiers, but it does not provide the lowest-cost deep archive tier for 7-year retention and incurs monitoring and automation charges that make it less cost-effective for purely archival data. Option D is wrong because Amazon S3 Standard is optimized for frequently accessed data with low latency and high throughput, making it prohibitively expensive for 7-year retention of backups that are rarely accessed, and it does not offer the cost savings of a dedicated archival storage class.

Full explanation →

274

Multi-Selecteasy

A company is migrating SAP workloads to AWS and needs to choose storage for SAP HANA. Which two storage options are supported for SAP HANA data volumes? (Select TWO.)

Select 2 answers

A.Amazon EBS io2 Block Express volumes.

B.Amazon S3.

C.Amazon EFS.

D.Instance Store (NVMe SSD) volumes.

E.Amazon EBS gp3 volumes.

AnswersA, E

Supports high IOPS and low latency required by HANA.

Why this answer

Amazon EBS io2 Block Express volumes are supported for SAP HANA data volumes because they provide high durability (99.999% durability) and sub-millisecond latency with up to 256,000 IOPS per volume, meeting SAP's performance requirements for production HANA workloads. Amazon EBS gp3 volumes are also supported for SAP HANA data volumes, offering a baseline of 3,000 IOPS and 125 MB/s throughput with the ability to scale independently, making them suitable for non-production or smaller production environments.

Exam trap

The trap here is that candidates often confuse supported storage for SAP HANA data volumes with log volumes, where Instance Store (NVMe SSD) is supported for log volumes but not for data volumes, leading to incorrect selection of Option D.

Full explanation →

275

MCQmedium

A company runs SAP HANA on AWS and needs to ensure that the database can survive a single Availability Zone failure without manual intervention. The SAP HANA system is currently deployed on a single EC2 instance. Which solution meets this requirement?

A.Use an Auto Scaling group to launch a new SAP HANA instance if the current instance fails

B.Configure SAP HANA System Replication with a secondary instance in a different Availability Zone and enable automatic takeover

C.Deploy the SAP HANA instance in a placement group within a single Availability Zone

D.Take daily EBS snapshots and copy them to another AWS Region

AnswerB

System Replication with automatic takeover ensures failover without manual intervention.

Why this answer

SAP HANA System Replication (HSR) with automatic takeover provides synchronous or asynchronous data replication to a secondary instance in a different Availability Zone (AZ). When the primary fails, the secondary automatically becomes the new primary without manual intervention, ensuring database survival during a single AZ failure. This is the only option that meets the requirement for automatic failover across AZs.

Exam trap

The trap here is that candidates confuse instance-level recovery (Auto Scaling) with database-level replication, assuming that launching a new EC2 instance automatically restores the SAP HANA database, when in fact HANA data is ephemeral unless explicitly replicated or backed up.

How to eliminate wrong answers

Option A is wrong because an Auto Scaling group launches a new EC2 instance but does not restore the SAP HANA database state from the failed instance; it would start with an empty or outdated volume, losing all transactions committed after the last snapshot or backup. Option C is wrong because a placement group within a single AZ actually increases the risk of simultaneous failure and does not provide any cross-AZ redundancy or automatic failover. Option D is wrong because daily EBS snapshots copied to another Region provide disaster recovery but not automatic failover; restoring from a snapshot requires manual intervention and can lose up to 24 hours of data, failing the 'without manual intervention' and 'survive a single AZ failure' requirements.

Full explanation →

276

MCQmedium

A company runs SAP on AWS and uses AWS Backup to back up the SAP HANA database. The backup job fails with an error indicating insufficient IAM permissions. What is the most likely missing permission?

A.ec2:DescribeInstances

B.kms:Decrypt

C.rds:CreateDBSnapshot

D.s3:PutObject

AnswerB

If the backup is encrypted, AWS Backup requires kms:Decrypt to access the key.

Why this answer

AWS Backup requires permissions to decrypt the KMS key used to encrypt the SAP HANA database or its backup target. If the IAM role assigned to AWS Backup lacks the `kms:Decrypt` action for the specific KMS key, the backup job fails with an insufficient IAM permissions error. This is because AWS Backup must read the encrypted data before transferring it to the backup vault.

Exam trap

The trap here is that candidates often assume the missing permission is `s3:PutObject` because backups are stored in S3, but the error occurs before the data is written, during the decryption step when the source is encrypted with a KMS key.

How to eliminate wrong answers

Option A is wrong because `ec2:DescribeInstances` is used to list or describe EC2 instances, not to perform backup operations on SAP HANA databases; it is not required for the backup job itself. Option C is wrong because `rds:CreateDBSnapshot` is specific to Amazon RDS instances, not SAP HANA on EC2, which uses AWS Backup with custom resources or the SAP HANA Backint agent. Option D is wrong because `s3:PutObject` is needed for writing backup data to an S3 bucket, but the error specifically indicates insufficient IAM permissions, and the most common missing permission in encrypted environments is `kms:Decrypt`, not the S3 write action.

Full explanation →

277

MCQhard

An SAP system on AWS uses a Multi-AZ deployment for the database layer with synchronous replication. The application servers are in the same region but different Availability Zones. During a recent failure of the primary database instance, the automatic failover to the standby instance took longer than expected, exceeding the RTO of 5 minutes. Upon investigation, the team finds that the standby instance was not fully synchronized at the time of failure. What could be the cause?

A.The EBS volumes on the standby instance have lower IOPS than the primary.

B.The Multi-AZ configuration uses a single network interface.

C.The security groups on the standby instance block replication traffic.

D.The network latency between the Availability Zones is high.

AnswerD

High latency can cause synchronous replication to slow down.

Why this answer

In a Multi-AZ deployment with synchronous replication, high network latency between Availability Zones can cause the primary database to wait for acknowledgment from the standby. This increases transaction commit time and can lead to the standby falling behind, especially if the primary continues processing transactions while waiting. During failover, the standby may not be fully synchronized, causing longer failover time and exceeding RTO.

Option A is unlikely because EBS IOPS affect storage performance but not replication lag directly; Option B is incorrect because Multi-AZ uses multiple network interfaces; Option C is incorrect because blocked replication traffic would cause complete failure, not just lag.

Exam trap

Candidates often assume that replication lag is caused by storage performance or network configuration errors, but in a synchronous replication setup, network latency is a primary factor affecting synchronization.

Full explanation →

278

Multi-Selectmedium

An architect is designing a highly available SAP NetWeaver architecture on AWS. The system uses an SAP Central Services (ASCS) instance. Which THREE components are required to achieve high availability for the SAP environment? (Choose THREE.)

Select 3 answers

A.Shared file storage (e.g., Amazon EFS or EBS Multi-Attach)

B.A cluster manager such as Pacemaker

C.A NAT Gateway for outbound traffic

D.An Internet Gateway for inbound traffic

E.A Network Load Balancer to distribute traffic to ASCS

AnswersA, B, E

Shared storage ensures data consistency after failover.

Why this answer

A cluster manager like Pacemaker is required to orchestrate failover between the two ASCS nodes. Shared file storage (e.g., Amazon EFS or EBS Multi-Attach) provides a shared file system for /sapmnt and /usr/sap, which must be accessible from both nodes. A Network Load Balancer (NLB) distributes traffic to the active ASCS instance and performs health checks to detect failures.

Options C and D are incorrect because a NAT Gateway and Internet Gateway are not required for SAP HA; they are used for outbound/inbound internet connectivity.

Full explanation →

279

MCQhard

A company is migrating a critical SAP system to AWS using the SAP Landscape Virtualization Management (LVM) and AWS Launch Wizard. What is the primary benefit of using AWS Launch Wizard for SAP deployment?

A.It automates the deployment of SAP systems based on AWS best practices

B.It provides a fully automated migration from on-premises to AWS

C.It manages the backup and disaster recovery of the SAP system

D.It automatically optimizes the deployment for cost

AnswerA

Launch Wizard automates deployment using best practices.

Why this answer

AWS Launch Wizard automates the deployment of SAP systems by providing guided best-practice recommendations, reducing manual effort and errors. Option B is wrong because Launch Wizard is for deployment, not migration; migration requires other tools like AWS Migration Service or SAP LVM. Option C is wrong because Launch Wizard focuses on initial deployment, not ongoing backup and disaster recovery management, though it can integrate with AWS Backup.

Option D is wrong because Launch Wizard provides cost estimates but does not automatically optimize deployment for cost; cost optimization requires separate analysis.

Full explanation →

280

MCQhard

An SAP administrator notices that the SAP HANA database performance has degraded significantly during peak hours. The HANA instance is running on an r5.8xlarge EC2 instance with EBS gp2 volumes. Monitoring shows high I/O wait times on the data volume. Which change is MOST likely to improve performance?

A.Enable Multi-AZ deployment for SAP HANA.

B.Upgrade the EC2 instance to a larger size like r5.16xlarge.

C.Change the EBS volume type from gp2 to gp3 with 3000 IOPS.

D.Use Amazon EBS io2 Block Express volumes with high IOPS.

AnswerD

io2 volumes provide consistent low-latency performance suitable for HANA workloads.

Why this answer

The performance degradation is due to high I/O wait times on the data volume, indicating that the EBS volume's IOPS limit is being saturated. Amazon EBS io2 Block Express volumes provide up to 256,000 IOPS per volume with consistent sub-millisecond latency, which directly addresses the I/O bottleneck for SAP HANA workloads. In contrast, gp3 volumes are capped at 16,000 IOPS, which is insufficient for peak-hour demands on an r5.8xlarge instance.

Exam trap

The trap here is that candidates often assume upgrading the instance size (Option B) will fix I/O bottlenecks, overlooking that EBS volume performance is a separate constraint, or they choose gp3 (Option C) thinking it is always an improvement, without considering that the specified 3000 IOPS is too low for the workload.

How to eliminate wrong answers

Option A is wrong because Multi-AZ deployment for SAP HANA is a high-availability feature that does not improve I/O performance; it adds replication overhead and may increase latency. Option B is wrong because upgrading to a larger EC2 instance (r5.16xlarge) increases CPU and memory but does not resolve the underlying EBS volume IOPS bottleneck; the instance's EBS bandwidth may increase, but the gp2 volume's IOPS limit remains the constraint. Option C is wrong because gp3 with 3000 IOPS provides only 3000 baseline IOPS, which is lower than the gp2 volume's baseline (which scales with size) and is insufficient for high I/O wait times; gp3's maximum IOPS is 16,000, which may still be inadequate for peak SAP HANA workloads.

Full explanation →

281

MCQeasy

An SAP system needs to store audit logs for 7 years to meet compliance requirements. The logs are accessed rarely. Which storage class is MOST cost-effective?

A.Amazon S3 Standard

B.Amazon S3 Glacier Deep Archive

C.Amazon S3 One Zone-Infrequent Access

D.Amazon S3 Intelligent-Tiering

AnswerB

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for long-term archival of rarely accessed data, making it the best choice for 7-year compliance logs.

Why this answer

S3 Glacier Deep Archive is the lowest cost for long-term archival. Option A is incorrect because S3 Standard is for frequently accessed data. Option C is incorrect because S3 One Zone-IA is for infrequent access but not archival.

Option D is incorrect because S3 Intelligent-Tiering incurs monitoring costs and is not as cost-effective for rarely accessed logs over 7 years.

Full explanation →

282

MCQmedium

A company is designing a disaster recovery (DR) strategy for SAP S/4HANA on AWS. The primary region is us-east-1 and the DR region is us-west-2. The RPO is 15 minutes and RTO is 1 hour. Which approach should be used to replicate SAP HANA data?

A.Configure HANA System Replication across regions

B.Use AWS Database Migration Service (DMS) with ongoing replication

C.Use Amazon S3 Cross-Region Replication for backup files

D.Use AWS Backup cross-region copy of EBS snapshots

AnswerA

HANA System Replication (HSR) for cross-region DR uses asynchronous replication (typically with log shipping) to meet the 15-minute RPO and 1-hour RTO. Synchronous replication is not feasible across regions due to latency.

Why this answer

HANA System Replication (HSR) is the only option that meets the 15-minute RPO and 1-hour RTO for SAP HANA data replication across regions. HSR uses log-based asynchronous replication to continuously ship redo logs to the DR region, enabling near-real-time data synchronization with minimal data loss. This is the native SAP-recommended method for cross-region DR of SAP HANA databases.

Exam trap

The trap here is that candidates often confuse AWS-native services (DMS, S3 CRR, AWS Backup) as viable for SAP HANA DR, but they fail to recognize that only HANA System Replication provides the sub-15-minute RPO and sub-1-hour RTO required for SAP-certified DR on AWS.

How to eliminate wrong answers

Option B is wrong because AWS DMS with ongoing replication does not support SAP HANA as a source for continuous change data capture (CDC) in a production-grade DR scenario; DMS is designed for heterogeneous migrations, not for low-latency, log-based replication of SAP HANA. Option C is wrong because S3 Cross-Region Replication of backup files can only achieve RPOs measured in hours (due to backup frequency and replication delays), not the required 15 minutes, and it does not provide a mechanism for rapid database recovery within 1 hour. Option D is wrong because AWS Backup cross-region copy of EBS snapshots typically has an RPO of at least 1 hour (snapshot intervals) and an RTO of several hours (restore time), failing both the 15-minute RPO and 1-hour RTO requirements.

Full explanation →

283

MCQmedium

Refer to the exhibit. An IAM policy is attached to an IAM user. Which EC2 instance can the user terminate?

A.Only instance i-1234567890abcdef0

B.Any instance with tag 'Environment:Production'

C.None, because the Deny statement overrides the Allow for that instance

D.Any instance in the account

AnswerC

Explicit Deny always wins over Allow.

Why this answer

The explicit Deny for all instances (*) overrides the Allow for the specific instance i-1234567890abcdef0, as Deny always wins. Option A is incorrect because the Deny applies to all instances, including i-1234567890abcdef0. Option B is incorrect because the Deny covers all instances, regardless of tags.

Option D is incorrect because the Deny explicitly denies access to all instances.

Full explanation →

284

Multi-Selecthard

An SAP system on AWS is experiencing performance issues during peak hours. The system includes SAP application servers and a HANA database. The CloudWatch metrics show high CPU utilization on the application servers and high disk read latency on the database EBS volumes. Which THREE actions should be taken to improve performance?

Select 3 answers

A.Increase the provisioned IOPS on the EBS volumes attached to the HANA database.

B.Upgrade the HANA database to a larger instance type with more CPU and memory.

C.Add more SAP application servers to the Auto Scaling group.

D.Add a NAT Gateway to the VPC to improve network performance.

E.Deploy a read replica for the HANA database.

AnswersA, B, C

Higher IOPS reduces read latency.

Why this answer

Increasing provisioned IOPS on the EBS volumes reduces disk read latency, addressing the high disk read latency issue. Option B is correct because upgrading the HANA database to a larger instance type provides more CPU and memory, which helps with high CPU utilization and overall performance. Option C is correct because adding more SAP application servers distributes the load, reducing high CPU utilization on existing servers.

Option D is incorrect because a NAT Gateway is for outbound internet traffic and does not improve internal network performance or address CPU/disk latency. Option E is incorrect because a read replica for HANA would not help with disk read latency or CPU utilization; it is typically used for disaster recovery or offloading reporting, not for improving performance of the primary database under high write or read load.

Full explanation →

285

Multi-Selecthard

A company runs a production web application on EC2 instances behind an ALB. The operations team receives an alert that the application is returning HTTP 503 errors. Which THREE steps should be taken to diagnose the issue?

Select 3 answers

A.Review VPC Flow Logs to identify if traffic is reaching the ALB.

B.Check the ALB's HealthyHostCount metric in CloudWatch.

C.Check the CPU utilization of the EC2 instances in the Auto Scaling group.

D.Verify the health check settings on the target group.

AnswersB, C, D

Indicates if targets are passing health checks.

Why this answer

The ALB's HealthyHostCount metric in CloudWatch shows the number of healthy targets registered to the target group. A value of zero or a persistent drop indicates that all EC2 instances are failing health checks, which directly causes HTTP 503 errors because the ALB has no healthy targets to forward traffic to. This metric is the first place to check when diagnosing 503 errors, as it pinpoints whether the issue is with target health rather than network connectivity or load.

Exam trap

The PAS-C01 exam often tests the misconception that CPU utilization or instance-level metrics are the primary cause of 503 errors, when in reality the ALB's health check mechanism and target group configuration are the direct cause, and CPU issues are only one possible underlying reason for health check failures.

Full explanation →

286

MCQhard

An SAP administrator creates this IAM policy for an EC2 instance role used by SAP HANA Backint to back up to S3. The backups are failing with access denied errors for S3 operations. What is the most likely cause?

A.The policy does not allow s3:ListBucket action.

B.The policy does not include kms:Encrypt action.

C.The policy uses a wildcard in the resource ARN for the bucket.

D.The policy does not include kms:ReEncrypt action.

AnswerB

Backint needs kms:Encrypt to write encrypted objects.

Why this answer

SAP HANA Backint for S3 typically uses Server-Side Encryption with AWS KMS (SSE-KMS) to encrypt backups at rest. The IAM policy must include the `kms:Encrypt` action on the KMS key to allow the EC2 instance role to encrypt objects during upload. Without this permission, the S3 PutObject call fails with an access denied error, even if the S3 actions are correctly allowed.

Exam trap

The trap here is that candidates often focus only on S3 permissions (like ListBucket or wildcard ARNs) and overlook that KMS permissions are required when the S3 bucket uses SSE-KMS, which is a common default for SAP HANA backups in AWS.

How to eliminate wrong answers

Option A is wrong because `s3:ListBucket` is not required for Backint backup operations; Backint only needs `s3:PutObject` and `s3:GetObject` for writing and reading backup files, and `s3:ListBucket` is used for listing objects, which is not part of the backup workflow. Option C is wrong because using a wildcard in the resource ARN for the bucket (e.g., `arn:aws:s3:::bucket-name/*`) is standard and correct for granting access to objects within the bucket; the issue is not the wildcard but the missing KMS permissions. Option D is wrong because `kms:ReEncrypt` is used for re-encrypting data under a different KMS key, which is not relevant to the initial encryption of backups being uploaded; Backint requires `kms:Encrypt` and `kms:Decrypt` for the backup and restore operations.

Full explanation →

287

MCQhard

A company runs SAP S/4HANA on AWS. The system is critical and requires high availability. The database is SAP HANA running on two EC2 instances in a cluster. The company wants to ensure that the secondary instance can take over quickly in case of primary failure. Which AWS service should be used to implement a floating IP address that can be moved between the instances?

A.AWS Global Accelerator

B.Amazon Route 53

C.Elastic IP addresses

D.VPC Peering

AnswerC

Elastic IP addresses are the appropriate AWS service for a floating IP that can be moved between EC2 instances. They can be reassigned quickly via the AWS console, CLI, or scripts, allowing the secondary instance to take over the same IP address upon primary failure.

Why this answer

Elastic IP addresses are static public IPv4 addresses that can be allocated to an AWS account and reassigned between EC2 instances. When a primary SAP HANA instance fails, the Elastic IP can be disassociated from the failed instance and associated with the secondary instance. This provides a floating IP that can be moved quickly, supporting high availability.

Route 53 DNS failover changes DNS resolution, but does not provide a floating IP address that is directly moved between instances.

Exam trap

The trap here is that candidates often assume Route 53 is the only way to implement failover with a fixed endpoint. However, the requirement is for a floating IP address that moves between instances, which is exactly what Elastic IP addresses provide. Route 53 changes DNS records, not the IP address itself.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator provides static anycast IP addresses and traffic management at the edge, but it does not support moving a floating IP between EC2 instances within a VPC; it is designed for global traffic distribution, not intra-VPC failover. Option C is wrong because Elastic IP addresses are static public IPv4 addresses that can be remapped between instances, but they are not recommended for SAP HANA cluster failover due to the time required for API calls to reassociate the EIP and the lack of automatic health-based failover without additional scripting. Option D is wrong because VPC Peering connects two VPCs for routing traffic, but it does not provide any IP address mobility or failover capability between instances within the same VPC.

Full explanation →

288

Multi-Selecteasy

Which TWO of the following are recommended best practices for deploying SAP HANA on AWS? (Choose two.)

Select 2 answers

A.Deploy HANA in a single Availability Zone to reduce costs.

B.Disable hyper-threading on the HANA instance.

C.Store HANA data on instance store volumes for better performance.

D.Use EBS-optimized instances for HANA workloads.

E.Use EBS snapshots for backup of HANA data volumes.

AnswersD, E

EBS-optimized instances dedicate network bandwidth exclusively to Amazon EBS I/O, preventing contention between storage traffic and other network flows. This satisfies the SAP HANA requirement for consistent, low-latency access to persistent storage, as HANA’s savepoint and log writes demand predictable disk performance without throttling from shared network resources.

Why this answer

EBS-optimized instances provide dedicated network bandwidth for Amazon EBS I/O, which is critical for SAP HANA's high-throughput, low-latency storage requirements. Without EBS optimization, network traffic can contend with EBS traffic, causing performance degradation and potential SLA violations for HANA workloads.

Exam trap

The trap here is that candidates often confuse 'disabling hyper-threading' (a requirement for on-premises HANA deployments) with AWS best practices, where hyper-threading must remain enabled to leverage the full CPU capacity of the instance.

Full explanation →

289

MCQmedium

A company is implementing SAP S/4HANA on AWS and wants to ensure that the system is backed up properly. They need to back up the HANA database and the application layer. Which approach is recommended for backing up the HANA database?

A.Use EBS snapshots for the HANA data volumes

B.Configure an S3 lifecycle policy to archive the HANA log files

C.Use AWS Backup with a backup plan that includes the HANA instance

D.Use the AWS Backint agent to back up HANA to Amazon S3

AnswerD

AWS Backint agent provides application-consistent backups of HANA to S3 via SAP Backint interface.

Why this answer

The AWS Backint agent is the recommended and supported method for backing up SAP HANA databases on AWS. It integrates directly with SAP HANA's native backup interface (backint for SAP HANA) to stream backup data to Amazon S3, ensuring consistent, incremental, and catalog-aware backups without relying on file-system-level snapshots.

Exam trap

The trap here is that candidates confuse crash-consistent EBS snapshots (Option A) or generic AWS Backup plans (Option C) with the application-consistent, HANA-integrated backup method required for SAP workloads, assuming any snapshot-based approach is sufficient for database consistency.

How to eliminate wrong answers

Option A is wrong because EBS snapshots are crash-consistent, not application-consistent, and cannot guarantee HANA database integrity without additional pre-freeze/post-thaw scripts; they also do not integrate with HANA's backup catalog. Option B is wrong because an S3 lifecycle policy archives log files but does not perform a database backup; HANA requires a proper backup of data and log volumes, not just archival of logs. Option C is wrong because AWS Backup does not natively support SAP HANA's backint interface; it can back up EC2 instances via EBS snapshots, but those lack HANA-consistent backup capabilities and catalog integration.

Full explanation →

290

Multi-Selectmedium

Which THREE are valid strategies for backing up an SAP HANA database on AWS? (Choose three.)

Select 3 answers

A.Use Amazon EBS snapshots of the HANA data volumes.

B.Use AWS Backup to schedule and manage HANA backups.

C.Use SAP HANA Backint agent to back up to Amazon S3.

D.Set up an Amazon RDS for SAP HANA read replica.

E.Configure a lifecycle policy to move backups to Amazon S3 Glacier immediately.

AnswersA, B, C

EBS snapshots are crash-consistent and can be used for HANA backups with application consistency steps.

Why this answer

Amazon EBS snapshots provide crash-consistent, point-in-time backups of the HANA data volumes. When used with SAP HANA's snapshot mode (e.g., via hdbsql or Python scripts), they ensure transactional consistency by quiescing the database before the snapshot. This is a valid and commonly used backup strategy for SAP HANA on AWS.

Exam trap

The trap here is that candidates may confuse Amazon RDS with EC2-based deployments, incorrectly assuming RDS supports SAP HANA, or they may think immediate Glacier transitions are acceptable without considering SAP HANA's need for rapid restore access.

Full explanation →

291

Multi-Selecteasy

An operations team needs to monitor the performance of an SAP HANA database running on an EC2 instance. Which THREE CloudWatch metrics should the team monitor to ensure the database is not resource-constrained? (Choose THREE.)

Select 3 answers

A.DatabaseConnections

B.DiskReadOps

C.Memory (using CloudWatch agent)

D.CPUUtilization

E.NetworkIn

AnswersB, C, D

High disk I/O can indicate database workload.

Why this answer

CPUUtilization, Memory (via custom metrics or CloudWatch agent), and DiskReadOps/DiskWriteOps are key performance indicators. NetworkIn/NetworkOut are important for network throughput but not directly for database resource constraints. DatabaseConnections is for RDS, not EC2-hosted HANA.

Full explanation →

292

MCQmedium

An SAP administrator notices that the SAP application server is unable to establish an RFC connection to the SAP HANA database. The database is running on an EC2 instance in the same VPC. Security groups and NACLs allow all traffic. What is the most likely cause?

A.The VPC has overlapping CIDR blocks with the on-premises network.

B.The application server uses TCP instead of the required UDP protocol.

C.The application server is configured to connect to the wrong port number.

D.The HANA database instance was rebooted for maintenance.

AnswerC

HANA uses port 3<instance number>13. Misconfiguration is a common issue.

Why this answer

The SAP HANA database listens on a specific TCP port, typically 3<instance_number>13 (e.g., 30013 for instance 00). If the application server is configured with a different port number, it cannot establish an RFC connection. Option C is correct because a port mismatch is a common misconfiguration.

Option A (overlapping CIDR) would cause routing issues at the network layer, but since security groups and NACLs allow all traffic, this is less likely. Option B (UDP protocol) is incorrect because RFC connections use TCP, not UDP. Option D (reboot) would be temporary and the connection would resume after the database restarts.

Full explanation →

293

MCQhard

An SAP system uses an Amazon RDS for SAP ASE database. The database is experiencing high connection timeouts. The SAP team notices that the RDS instance's maximum connections parameter is set to 500. What should be done to resolve the issue?

A.Upgrade the RDS instance to a larger size with more vCPUs.

B.Modify the RDS parameter group to increase max_connections.

C.Create a read replica to offload connections.

D.Increase the allocated storage for the RDS instance.

AnswerB

Directly addresses the connection limit.

Why this answer

The high connection timeouts are caused by the max_connections parameter being set to 500, which is the default for many RDS for SAP ASE instances. Increasing this value in the RDS parameter group allows more concurrent connections to the database, directly resolving the timeout issue without changing the instance size or storage. This is the simplest and most effective fix because the database engine itself is capable of handling more connections if the parameter is adjusted.

Exam trap

The trap here is that candidates often assume connection timeouts are caused by insufficient compute or storage resources, leading them to choose instance upgrades or storage increases, when the actual root cause is a misconfigured database parameter that directly controls the connection limit.

How to eliminate wrong answers

Option A is wrong because upgrading to a larger instance with more vCPUs does not automatically increase the max_connections limit; it only provides more compute resources, but the connection limit is a separate parameter that must be explicitly modified. Option C is wrong because creating a read replica does not offload connections from the primary database; read replicas handle read-only traffic, but connection timeouts are typically caused by the primary database reaching its connection limit, and read replicas do not reduce the number of connections to the primary instance. Option D is wrong because increasing allocated storage does not affect the max_connections parameter; storage size is unrelated to the number of concurrent database connections.

Full explanation →

294

MCQhard

A company runs SAP S/4HANA on AWS with a production database on an r5.24xlarge instance and 15 application servers on r5.4xlarge instances. The system has been stable for months. Recently, the database instance started experiencing high CPU utilization during peak hours, causing performance degradation. The company has reserved capacity for the database instance. The SAP team has already optimized the SQL queries and reduced the CPU usage by 20%, but the CPU still spikes to 95% during peak hours. The team is considering upgrading the database instance to a larger type. However, the next larger instance type (r5.32xlarge) is not available in the current Availability Zone. The company needs a solution that minimizes downtime and cost. What should be done?

A.Stop the database instance, change to a larger instance type in a different Availability Zone, and use a placement group with the application servers.

B.Migrate the database to a different instance family, such as x1e.32xlarge.

C.Use an Auto Scaling group to automatically scale the database instance.

D.Add more application servers to distribute the load.

AnswerA

Provides more CPU and maintains low latency.

Why this answer

Stopping the database instance allows changing to a larger instance type. Since r5.32xlarge is not available in the current AZ, the instance must be moved to a different AZ where it is available. Note that cluster placement groups cannot span Availability Zones, so to use a placement group, the application servers would also need to be moved to the same AZ, increasing downtime.

Therefore, the most cost-effective and minimally disruptive approach is to simply move the database instance to the new AZ and accept the minimal cross-AZ latency, which is acceptable for SAP workloads. This avoids the need to recertify a different instance family as in option B, and options C and D do not address the database bottleneck.

Full explanation →

295

Multi-Selectmedium

A company is migrating an SAP NetWeaver system to AWS. The system uses an on-premises shared file system (NFS). Which TWO AWS services can provide a scalable, highly available NFS share for SAP transport directories?

Select 2 answers

A.AWS Storage Gateway File Gateway

B.Amazon Elastic Block Store (EBS) with a shared volume

C.Amazon Elastic File System (EFS)

D.Amazon S3 with S3 File Gateway

E.Amazon FSx for NetApp ONTAP

AnswersC, E

EFS is a scalable NFS file system.

Why this answer

Amazon EFS provides a scalable, fully managed NFS file system that is highly available across multiple Availability Zones, making it suitable for SAP transport directories. It supports the NFSv4 protocol required by SAP and automatically scales storage capacity as files are added or removed, eliminating the need for manual provisioning.

Exam trap

The trap here is that candidates may confuse AWS Storage Gateway File Gateway or S3 File Gateway with native NFS services, not realizing that these gateway solutions introduce additional latency and are not recommended for SAP transport directories due to performance and consistency requirements.

Full explanation →

296

MCQeasy

An SAP Basis administrator needs to automate the start and stop of SAP application servers on AWS to reduce costs during non-business hours. The instance must be stopped (not terminated) to preserve the data. Which AWS service can be used to schedule the start and stop?

A.AWS Auto Scaling

B.Amazon CloudWatch Alarms

C.AWS Instance Scheduler

D.AWS Systems Manager Maintenance Windows

AnswerC

Specifically designed to schedule start/stop of instances.

Why this answer

AWS Instance Scheduler is a solution that uses AWS Lambda and Amazon CloudWatch Events (Amazon EventBridge) to automatically start and stop EC2 instances based on a defined schedule. For SAP Basis administrators, this allows stopping (not terminating) SAP application server instances during non-business hours, preserving all data on the attached EBS volumes. The solution supports tagging instances with schedule tags, making it ideal for cost optimization without data loss.

Exam trap

The trap here is that candidates confuse 'scheduling start/stop' with 'automating scaling' (Auto Scaling) or 'scheduling maintenance tasks' (Maintenance Windows), but only AWS Instance Scheduler is purpose-built for time-based instance state transitions without termination.

How to eliminate wrong answers

Option A is wrong because AWS Auto Scaling is designed to automatically adjust capacity based on demand or health checks, not to schedule start/stop actions on a fixed time-based schedule; it would terminate instances during scale-in, which would destroy data. Option B is wrong because Amazon CloudWatch Alarms monitor metrics and trigger actions based on thresholds (e.g., CPU utilization), not on a recurring time schedule; they cannot reliably stop and start instances at specific times like 6 PM and 6 AM. Option D is wrong because AWS Systems Manager Maintenance Windows are used to schedule administrative tasks (e.g., patching, running commands) on instances that are already running, not to start or stop instances; they require the instance to be running to execute actions.

Full explanation →

297

Multi-Selecthard

An SAP system on AWS is experiencing performance degradation. The operations team suspects a network bottleneck. Which THREE metrics should they analyze in CloudWatch to diagnose the issue? (Choose THREE.)

Select 3 answers

A.NetworkOut

B.NetworkPacketsIn

C.CPUUtilization

D.NetworkIn

E.DiskReadOps

AnswersA, B, D

Shows outgoing network traffic.

Why this answer

(NetworkOut), Option B (NetworkPacketsIn), and Option D (NetworkIn) are standard EC2 network metrics that help diagnose network bottlenecks by showing traffic volume. Option C (CPUUtilization) is compute-related, not network-related. Option E (DiskReadOps) is storage-related, not network-related.

Full explanation →

298

MCQmedium

A company runs its SAP HANA database on an EC2 instance (r5.8xlarge) with 8 EBS gp2 volumes (1 TB each) in a RAID 0 stripe. The database is critical and requires high availability. The current architecture uses a single EC2 instance in one Availability Zone. The company wants to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. The DR site must be in a different AWS Region. The SAP HANA database size is 4 TB. The company has a 1 Gbps Direct Connect connection between the primary and DR Regions. The database workload is write-intensive with an average write throughput of 200 MB/s. Which solution meets the RPO and RTO requirements?

A.Set up HANA System Replication (HSR) in asynchronous mode from the primary to a secondary EC2 instance in the DR Region. Use the same instance type and EBS configuration. In case of failure, perform a HSR takeover.

B.Take EBS snapshots of the RAID array every 15 minutes and replicate them to the DR Region using EBS snapshot copy. In the DR Region, restore the snapshots to new volumes and attach them to a new EC2 instance.

C.Back up the HANA database to Amazon S3 every 15 minutes using the HANA backup tool, and set up cross-Region replication for the S3 bucket. In the DR Region, restore the latest backup to a new EC2 instance.

D.Use AWS Database Migration Service (DMS) to continuously replicate changes to a target HANA database in the DR Region.

AnswerA

HANA System Replication (HSR) in asynchronous mode can achieve an RPO of seconds, well within the 15-minute requirement. The 1 Gbps Direct Connect connection, with HANA's built-in compression, can handle the 200 MB/s write throughput (approximately 1.6 Gbps uncompressed, compressed to ~800 Mbps or less). Using the same instance type and EBS RAID 0 configuration ensures performance parity after takeover. HSR takeover can be completed in minutes, meeting the 4-hour RTO. Option A is correct.

Why this answer

HANA System Replication (HSR) in asynchronous mode can achieve an RPO of seconds, well within the 15-minute requirement. The 1 Gbps Direct Connect connection, with HANA's built-in compression, can handle the 200 MB/s write throughput (approximately 1.6 Gbps uncompressed, compressed to ~800 Mbps or less). Using the same instance type and EBS RAID 0 configuration ensures performance parity after takeover.

HSR takeover can be completed in minutes, meeting the 4-hour RTO. Option B is incorrect because EBS snapshots of a RAID array require stopping I/O for consistency, and taking snapshots every 15 minutes is impractical; restoring 4 TB from snapshots would significantly exceed the 4-hour RTO. Option C is incorrect because backing up to S3 every 15 minutes can impact database performance, and restoring from S3 takes longer than 4 hours due to data transfer and re-import time.

Option D is incorrect because AWS DMS does not natively support SAP HANA as a target for continuous replication; it is designed for heterogeneous migrations, not HANA-specific replication.

Full explanation →

299

MCQmedium

A company is running SAP ERP on AWS. They want to implement automated backups for the SAP HANA database using AWS Backup. Which AWS service should they use to orchestrate the HANA backup?

A.AWS Backup

B.AWS Lambda

C.Amazon Data Lifecycle Manager

D.AWS Systems Manager

AnswerA

AWS Backup supports SAP HANA via Backint.

Why this answer

AWS Backup natively supports SAP HANA databases by integrating with the SAP HANA Backint agent, which allows you to define backup policies, retention rules, and cross-region copy directly from the AWS Backup console. This eliminates the need for custom scripting or manual orchestration, making it the correct service for automating HANA backups on AWS.

Exam trap

The trap here is that candidates may confuse AWS Backup's general snapshot capabilities with services like DLM or Systems Manager, not realizing that AWS Backup has specific SAP HANA Backint integration that makes it the only correct choice for orchestrating HANA database backups.

How to eliminate wrong answers

Option B is wrong because AWS Lambda is a serverless compute service used for running code in response to events, not for orchestrating database backups; it would require custom code to invoke HANA backup commands and manage lifecycle, adding complexity without native backup integration. Option C is wrong because Amazon Data Lifecycle Manager (DLM) is designed for automating the creation, retention, and deletion of Amazon EBS snapshots and EBS-backed AMIs, not for orchestrating SAP HANA database backups which require Backint integration. Option D is wrong because AWS Systems Manager is a management service for operational tasks like patching and automation runbooks, but it does not provide native backup orchestration for SAP HANA; while it can trigger scripts, it lacks the built-in backup policy and retention management that AWS Backup offers for HANA.

Full explanation →

300

MCQmedium

An SAP administrator notices that the /usr/sap directory on an EC2 instance is filling up. The instance is part of an SAP application server cluster. Which AWS service can be used to add additional storage without downtime?

A.Amazon EFS

B.Amazon S3

C.Amazon EBS

D.EC2 Instance Store

AnswerC

EBS allows online resizing of volumes without downtime.

Why this answer

Amazon EBS volumes can be attached to EC2 instances and expanded without downtime using Elastic Volumes, making it the correct choice for adding storage to the /usr/sap directory. Option A (EFS) is a file system but may not provide the required low-latency block storage for SAP application servers. Option B (S3) is object storage, not suitable for an OS directory.

Option D (Instance Store) is ephemeral and not persistent, so it cannot be used for permanent storage. Therefore, Amazon EBS is the appropriate service.

Full explanation →

Page 4 of 22

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWS Technology Migration Operations and Maintenance

See all domains with question counts →