Courseiva

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 376–450

1616 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 22

Page 7
376
MCQhard

A company runs a critical SAP ERP system on AWS. The architecture includes an SAP HANA database on an r5.24xlarge instance (with 768 GB RAM) in us-east-1a, and multiple SAP application servers in an Auto Scaling group across two Availability Zones (us-east-1a and us-east-1b). The database uses EBS volumes: two 1 TB gp3 volumes for data, one 500 GB gp3 for log, and one 100 GB gp3 for backup. The system has been running without issues for months. At 3:00 PM, the operations team receives alerts from Amazon CloudWatch that the HANA database instance's CPU utilization is at 100%, memory usage is at 95%, and the disk queue length for the log volume is consistently above 10. The SAP application is experiencing intermittent timeouts. The team checks the HANA studio and sees that there are many long-running queries and that the log volume is almost full (95% used). The database backups are scheduled to run at 2:00 AM and completed successfully. There have been no changes to the system or workload recently. The team suspects a performance degradation. What is the MOST likely cause of the issue?

A.The HANA database has reached its memory limit due to the global.ini allocation.
B.The gp3 volume's baseline IOPS are insufficient for the current workload.
C.A backup job is running and consuming CPU and I/O resources.
D.The log volume is almost full, causing HANA to stall transaction processing.
AnswerD

Correct. A nearly full log volume forces HANA to pause transaction processing, leading to increased CPU/memory utilization and application timeouts.

Why this answer

The most likely cause is that the HANA log volume is almost full (95% used). When the log area reaches capacity, SAP HANA suspends transaction processing to prevent log overflow, leading to timeouts and increased CPU/memory usage as transactions queue. Option D correctly identifies this.

Option A is incorrect because HANA's memory management is dynamic and not constrained by global.ini limits. Option B is incorrect because the gp3 volumes have baseline IOPS of 3000, which is sufficient, and the symptom is log volume full, not I/O performance. Option C is incorrect because backups completed at 2:00 AM, hours before the issue.

Full explanation →
377
MCQeasy

A company is migrating a SAP BusinessObjects environment to AWS. Which AWS service can be used to automate the deployment of the SAP BusinessObjects components?

A.AWS OpsWorks
B.AWS Elastic Beanstalk
C.AWS CodePipeline
D.AWS CloudFormation
AnswerD

CloudFormation can automate SAP BusinessObjects deployment with templates.

Why this answer

AWS CloudFormation allows infrastructure as code to automate the deployment of SAP BusinessObjects. Option A is wrong because AWS OpsWorks is for Chef/Puppet, not directly for SAP. Option B is wrong because AWS Elastic Beanstalk is for web applications, not SAP.

Option C is wrong because AWS CodePipeline is for CI/CD, not infrastructure deployment.

Full explanation →
378
Multi-Selecteasy

A company is designing a disaster recovery (DR) strategy for its SAP HANA database on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO actions are required to enable HANA System Replication (HSR) across AWS Regions? (Choose 2)

Select 2 answers
A.Enable cross-Region replication of EBS snapshots.
B.Set up a VPN or Direct Connect connection between the Regions for secure, low-latency communication.
C.Configure HSR with asynchronous replication mode.
D.Use S3 Cross-Region Replication to copy HANA data files.
E.Deploy an Application Load Balancer in front of the HANA instances in both Regions.
AnswersB, C

Correct. Low-latency network connectivity is needed for HSR.

Why this answer

Options B and C are correct. Option B is correct because HSR requires low-latency network connectivity between the primary and DR sites, which can be provided by VPN or Direct Connect. Option C is correct because for cross-region HSR, asynchronous replication mode is required since synchronous replication would introduce unacceptable latency over long distances.

Option A is incorrect because EBS snapshots are not used for HSR; HSR uses log replication. Option D is incorrect because S3 Cross-Region Replication is not used for HANA data files; HSR replicates log volumes. Option E is incorrect because HSR is a database-level replication, not an application-level load balancer.

Full explanation →
379
MCQmedium

A company runs an SAP HANA database on an r5.8xlarge EC2 instance. The operations team notices that the instance's CPU utilization spikes to 100% every night at 2 AM, causing SAP application timeouts. CloudWatch metrics show the spike corresponds to a backup process. Which action should be taken to resolve the issue?

A.Move the backup window to an earlier time when the system is less active.
B.Increase the instance size to handle the backup load.
C.Disable the nightly backup.
D.Implement CloudWatch alarm to restart the instance when CPU is high.
AnswerA

Rescheduling the backup to a less active time reduces CPU contention directly.

Why this answer

Rescheduling the backup to a less active time reduces CPU contention directly. Option B is wrong because increasing instance size is costly and does not address the underlying scheduling issue. Option C is wrong because disabling backups compromises data protection.

Option D is wrong because restarting the instance via CloudWatch alarm is a reactive measure that may cause data loss or downtime and does not fix the root cause.

Full explanation →
380
MCQeasy

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP application are logged for auditing purposes. The administrator wants to store these logs in Amazon S3 for long-term retention. Which AWS service should be used to capture the API calls?

A.VPC Flow Logs
B.AWS CloudTrail
C.AWS Config
D.Amazon CloudWatch Logs
AnswerB

CloudTrail records API calls for auditing.

Why this answer

AWS CloudTrail records API calls and can deliver logs to S3. Option A is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Option D is wrong because Config records configuration changes.

Full explanation →
381
Multi-Selecthard

An SAP administrator needs to ensure high availability for SAP NetWeaver ABAP stack on AWS. Which three components should be configured in a multi-AZ active/passive cluster? (Select THREE.)

Select 3 answers
A.Enqueue Replication Server (ERS).
B.ABAP SAP Central Services (ASCS).
C.Database instance.
D.SAP Gateway.
E.Dialog instances.
AnswersA, B, C

ERS works with ASCS for failover.

Why this answer

The Enqueue Replication Server (ERS) is a critical component in an SAP NetWeaver ABAP stack active/passive cluster because it replicates the lock table from the primary ASCS instance to the standby node. In a multi-AZ setup, this ensures that if the primary ASCS fails, the standby can take over with minimal disruption, as the lock state is preserved. Without ERS, a failover would require all locked resources to be released, causing data inconsistencies or application errors.

Exam trap

AWS often tests the misconception that all SAP components must be in an active/passive cluster for high availability, but only stateful components like ASCS, ERS, and the database require this; stateless components like SAP Gateway and Dialog instances can be distributed across AZs in an active/active manner.

Full explanation →
382
MCQeasy

A company is setting up a disaster recovery (DR) site for SAP on AWS. They need to replicate the SAP HANA database to another region. Which AWS service is BEST suited for this?

A.SAP HANA System Replication
B.AWS Backup cross-region copy
C.AWS Database Migration Service (DMS)
D.Amazon S3 Cross-Region Replication
AnswerA

HANA System Replication is designed for cross-region DR.

Why this answer

SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for replicating HANA databases asynchronously or synchronously across regions. It replicates at the database level using log shipping and is the only option that maintains full SAP HANA consistency, transaction integrity, and support for takeover in a DR scenario.

Exam trap

The trap here is that candidates confuse general-purpose AWS backup or replication services (like AWS Backup or S3 CRR) with SAP-specific replication, assuming any cross-region copy can serve as DR, but only HSR provides the required database-level consistency and SAP certification for HANA DR.

How to eliminate wrong answers

Option B (AWS Backup cross-region copy) is wrong because it creates point-in-time snapshots of the entire HANA instance, not continuous log replication, leading to potential data loss and longer recovery time objectives (RTO/RPO) unsuitable for SAP HANA DR. Option C (AWS Database Migration Service) is wrong because DMS is designed for one-time or ongoing migration between heterogeneous databases, not for continuous replication of a live SAP HANA system with full transaction consistency and failover support. Option D (Amazon S3 Cross-Region Replication) is wrong because S3 CRR replicates objects in S3 buckets, not database files or logs, and cannot maintain the transactional state of a running HANA database.

Full explanation →
383
MCQhard

A company runs its SAP ERP system on AWS. The SAP application servers are in an Auto Scaling group across two Availability Zones. The SAP HANA database runs on a single EC2 instance in us-east-1a. The database instance has an Elastic IP and uses EBS io1 volumes with 5000 provisioned IOPS. During a recent deployment, the company experienced a complete outage when the Availability Zone us-east-1a became unavailable due to a power failure. The database was unavailable for 6 hours until the zone recovered. The company wants to implement a highly available architecture that can automatically recover from an AZ failure with minimal data loss. The Recovery Point Objective (RPO) is 15 minutes and Recovery Time Objective (RTO) is 30 minutes. What should the company do?

A.Set up HANA System Replication with synchronous replication to a secondary instance in us-east-1b and configure automatic takeover.
B.Take EBS snapshots every 15 minutes and copy them to another region.
C.Move the HANA database to a larger instance in the same Availability Zone and increase IOPS to 10000.
D.Migrate the HANA database to Amazon RDS for SAP HANA with Multi-AZ enabled.
AnswerA

Correct. HANA System Replication with synchronous mode across AZs provides automatic failover, meeting both RPO and RTO.

Why this answer

HANA System Replication with synchronous replication to a secondary instance in a different Availability Zone (us-east-1b) provides automatic takeover, meeting the RPO of 15 minutes (synchronous replication ensures no data loss) and RTO of 30 minutes (automatic failover). Option B is wrong because EBS snapshots every 15 minutes cannot guarantee RPO and RTO; restore time from snapshots often exceeds 30 minutes, and cross-region copying adds latency. Option C is wrong because scaling within the same AZ does not address AZ failure; the single point of failure remains.

Option D is wrong because Amazon RDS for SAP HANA does not exist; HANA is not supported on RDS. The correct architecture requires HANA System Replication across AZs.

Exam trap

Candidates may mistakenly think that RDS Multi-AZ is available for SAP HANA, but HANA is not a supported engine on Amazon RDS. HANA must be managed on EC2 with HANA System Replication.

Full explanation →
384
MCQhard

An SAP Basis team is migrating an SAP Business Suite system to AWS. The system has a large number of background jobs and requires consistent performance for batch processing. Which Amazon EC2 instance type is most suitable for this workload?

A.i3.2xlarge
B.g4dn.xlarge
C.z1d.xlarge
D.t3.large
AnswerC

z1d instances offer high CPU frequency and large memory, suitable for SAP batch workloads.

Why this answer

The z1d.xlarge instance is most suitable because it offers a high baseline clock speed of up to 4.0 GHz with Intel Turbo Boost, which is critical for SAP Business Suite batch processing workloads that are CPU-bound and sensitive to single-threaded performance. SAP background jobs often require consistent, high-frequency CPU performance to meet batch window SLAs, and the z1d family is specifically designed for such high-performance, memory-intensive SAP workloads on AWS.

Exam trap

The trap here is that candidates often confuse storage-optimized instances (i3) with compute-optimized needs, or mistakenly think burstable instances (t3) can handle sustained batch loads due to their low cost, ignoring CPU credit exhaustion and performance throttling.

How to eliminate wrong answers

Option A (i3.2xlarge) is wrong because it is an instance optimized for high-speed NVMe SSD storage and low-latency I/O, not for high CPU clock speed; it is intended for database workloads like SAP HANA, not for CPU-bound batch processing. Option B (g4dn.xlarge) is wrong because it is a GPU-accelerated instance designed for machine learning and graphics workloads, not for SAP batch jobs that do not leverage GPU compute. Option D (t3.large) is wrong because it is a burstable performance instance that uses CPU credits; sustained batch processing would deplete credits and throttle performance, making it unsuitable for consistent batch processing requirements.

Full explanation →
385
Multi-Selecteasy

A company is running SAP HANA on AWS with a single Availability Zone (AZ). They want to improve high availability (HA) by deploying across multiple AZs. Which THREE components must be configured to support a multi-AZ SAP HANA HA setup? (Select THREE.)

Select 3 answers
A.Amazon Route 53 health checks for automatic failover
B.Elastic Load Balancer (ALB or NLB) for the SAP application tier
C.Amazon CloudFront distribution in front of the application servers
D.SAP HANA System Replication across AZs
E.Shared file system such as Amazon FSx for NetApp ONTAP for /sapmnt and /usr/sap/trans
AnswersB, D, E

Correct. An Elastic Load Balancer (ALB or NLB) is essential to distribute traffic to SAP application servers across multiple AZs, ensuring that if one AZ fails, traffic is routed to healthy servers in another AZ.

Why this answer

To achieve multi-AZ high availability for SAP HANA on AWS, three core components are required. First, SAP HANA System Replication must be configured to replicate data synchronously or asynchronously across AZs, ensuring database failover capability. Second, a shared file system (e.g., Amazon FSx for NetApp ONTAP or Amazon EFS) is needed for directories like /sapmnt and /usr/sap/trans so that all application servers can access consistent files after failover.

Third, an Elastic Load Balancer (ALB or NLB) distributes traffic to SAP application servers across AZs, enabling automatic failover at the application tier. Option A (Route 53 health checks) is a DNS-level component that can support failover but is not a direct requirement for the multi-AZ HA architecture itself; it is often used in conjunction but not considered a core component. Option C (CloudFront) is a CDN service and has no role in SAP HA.

Exam trap

Candidates often confuse the need for a load balancer with DNS failover, thinking Route 53 health checks alone are sufficient. However, for the application tier, a load balancer is essential to distribute traffic across AZs and handle failures automatically.

Full explanation →
386
Multi-Selecthard

Which THREE considerations are important when planning the migration of an SAP HANA database to AWS using HANA System Replication (HSR)?

Select 3 answers
A.The target EC2 instance must have at least the same amount of RAM as the source.
B.The source and target must be in the same AWS Region.
C.The target storage must be able to accommodate the data volume.
D.The network latency between source and target must be less than 10 ms for synchronous replication.
E.The source database must be encrypted before replication can start.
AnswersA, C, D

HANA needs sufficient memory.

Why this answer

HSR requires network latency below 10 ms for synchronous replication, and the target instance must have sufficient memory and storage. Network bandwidth is important but not the only factor. The source and target can be in different Regions, but latency must be acceptable.

Encryption is not a prerequisite for HSR.

Full explanation →
387
MCQhard

An SAP administrator notices that the SAP application server is experiencing high memory utilization. The system uses a cluster of EC2 instances. What is the most cost-effective solution to automatically add an additional application server when memory exceeds 80%?

A.Configure an Auto Scaling group with a scaling policy based on a custom CloudWatch metric for memory utilization.
B.Create a CloudWatch alarm that sends an email to the administrator to manually launch a new instance.
C.Use an Auto Scaling group with a scaling policy based on CPU utilization.
D.Use AWS Elastic Beanstalk to deploy the application server.
AnswerA

Correct. An Auto Scaling group with a scaling policy based on a custom CloudWatch metric for memory utilization will automatically launch a new instance when memory exceeds 80%.

Why this answer

Auto Scaling groups can use custom CloudWatch metrics (e.g., memory utilization) via the CloudWatch Agent to trigger scaling actions. This automates adding instances when memory exceeds 80% without manual intervention. Option B is incorrect because it only sends an email for manual action, which is not automatic nor cost-effective.

Option C is incorrect because it scales based on CPU, not memory, so it does not address the memory issue. Option D is incorrect because Elastic Beanstalk is a PaaS service that abstracts infrastructure, but it does not provide a simple way to scale based on memory utilization, and it is not specifically designed for SAP application server clusters.

Exam trap

A common pitfall is assuming that CPU utilization is the only metric available for Auto Scaling. Memory utilization requires a custom CloudWatch metric, which must be published from the instances using the CloudWatch agent.

Full explanation →
388
MCQeasy

A company is running SAP on AWS and uses CloudWatch to monitor the SAP HANA database. The database administrator wants to create a dashboard that shows the current memory utilization of all HANA instances. Which CloudWatch feature should they use?

A.CloudWatch Logs
B.CloudWatch Alarms
C.CloudWatch Events
D.CloudWatch Dashboards
AnswerD

Dashboards can aggregate metrics from multiple instances.

Why this answer

CloudWatch Dashboards (Option D) allow you to create custom views that display metrics from multiple sources, including memory utilization from all HANA instances, in a single pane. Option A (CloudWatch Logs) is for collecting and storing log data, not for visualizing metrics. Option B (CloudWatch Alarms) is used to trigger actions based on metric thresholds, not for creating dashboards.

Option C (CloudWatch Events) is for event-driven automation, not for metric visualization.

Full explanation →
389
MCQeasy

A company runs SAP Business Suite on AWS. The SAP application servers are behind an Application Load Balancer (ALB). The operations team notices that occasionally, some requests fail with HTTP 503 errors. The team checks the ALB and finds that the target group has healthy instances. The SAP application logs show no errors. What is the most likely cause of the 503 errors?

A.The security groups for the application servers do not allow traffic from the ALB.
B.The SSL certificate on the ALB has expired.
C.The target group health checks are misconfigured, marking instances as healthy when they are not.
D.The ALB connection draining timeout is set too low, causing requests to be routed to instances that are being de-registered.
AnswerD

Connection draining ensures in-flight requests complete, but if timeout is too short, requests may fail.

Why this answer

Connection draining (also known as deregistration delay) allows the ALB to complete in-flight requests to instances that are being de-registered. If the timeout is set too low, the ALB may terminate connections prematurely, causing the client to receive a 503 error even though the target group shows healthy instances. Option A is incorrect because security group misconfigurations would typically result in connection timeouts or 504 errors, not 503.

Option B is incorrect because an expired SSL certificate on the ALB would cause SSL handshake failures, not 503 errors. Option C is incorrect because if health checks were misconfigured, the ALB would route traffic to unhealthy instances, likely causing application errors rather than ALB-level 503 errors.

Exam trap

The trap is that the target group shows healthy instances and the application logs show no errors, leading teams to overlook connection draining settings. The 503 error is likely due to the ALB routing requests to instances that are being de-registered before the connection draining timeout expires.

Full explanation →
390
MCQhard

A company runs SAP S/4HANA in a multi-AZ deployment with a primary and standby database. During a planned failover test, the database fails over but the SAP system becomes unresponsive. Investigation reveals that the SAP application servers cannot connect to the new primary database because the database VIP is not updated. What is the most likely cause?

A.The HANA instance number changed after failover.
B.The DNS record for the HANA host still points to the old primary IP address.
C.The HANA hostname in the SAP profile is set to the physical instance hostname instead of the VIP.
D.The HANA database VIP is not configured to move to the new primary instance during failover.
AnswerD

The VIP must be reassigned to the new primary for seamless connectivity.

Why this answer

In a multi-AZ SAP HANA setup, the application servers connect to the database via a virtual IP address (VIP). During failover, the VIP must be moved to the new primary instance for connectivity. If the VIP is not migrated, the application servers will still try to reach the old primary (which is now standby), causing unresponsiveness.

Option A is incorrect because the HANA instance number remains constant. Option B is incorrect because DNS records are not typically used for HANA failover; the VIP is used. Option C could cause issues if set to the physical hostname, but in this case the core problem is that the VIP did not move.

Full explanation →
391
MCQhard

An SAP system administrator is troubleshooting a performance issue on an SAP application server running on an EC2 instance. The /usr/sap directory is on an EBS volume. The administrator notices high I/O wait times. Which action should be taken to improve I/O performance?

A.Migrate the /usr/sap directory to Amazon EFS
B.Move the /usr/sap directory to an instance store volume
C.Change the EBS volume type to io2 Block Express with provisioned IOPS
D.Increase the instance size to a larger instance type
AnswerC

io2 volumes with provisioned IOPS can significantly improve I/O performance for high-throughput workloads like SAP.

Why this answer

The io2 Block Express volume type provides up to 256,000 provisioned IOPS and sub-millisecond latency, which directly addresses high I/O wait times caused by insufficient IOPS on the EBS volume hosting /usr/sap. SAP application servers are sensitive to storage latency, and increasing provisioned IOPS reduces queue depth and wait times for database and log writes.

Exam trap

The trap here is that candidates confuse compute scaling (Option D) with storage performance tuning, overlooking that I/O wait is a storage-layer metric that requires adjusting EBS volume type or IOPS, not instance size.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a network file system with higher latency than EBS, which would likely worsen I/O wait times for SAP's transactional workloads. Option B is wrong because instance store volumes are ephemeral and data is lost on instance stop/termination, making them unsuitable for persistent SAP directories like /usr/sap. Option D is wrong because increasing instance size improves CPU and memory but does not directly address EBS volume I/O performance; the bottleneck is at the storage layer, not the compute layer.

Full explanation →
392
MCQmedium

An SAP system is deployed across multiple Availability Zones using an Application Load Balancer (ALB). The Operations team notices that during a failover test, the ALB is sending traffic to unhealthy instances. Which configuration change would ensure the ALB stops sending traffic to unhealthy targets?

A.Enable sticky sessions (session affinity).
B.Configure a health check with appropriate thresholds and interval.
C.Increase the deregistration delay value.
D.Enable cross-zone load balancing.
AnswerB

Health checks determine if a target is healthy; if thresholds are too lenient, unhealthy instances may still receive traffic.

Why this answer

Configuring a health check with appropriate thresholds and interval ensures the ALB can accurately determine the health of targets and stop routing traffic to unhealthy instances. Option A is incorrect because sticky sessions (session affinity) do not affect health checking; they only maintain session persistence. Option C is incorrect because increasing the deregistration delay only extends the time for connection draining, not health detection.

Option D is incorrect because cross-zone load balancing distributes traffic across Availability Zones but does not influence health checks or unhealthy target routing.

Full explanation →
393
MCQmedium

A company runs its SAP application on EC2 instances in a private subnet. The SAP application needs to access an on-premises database through a VPN connection. The company wants to improve network performance and reduce latency between the SAP application and the on-premises database. Which action should the company take?

A.Set up AWS Direct Connect between the VPC and on-premises data center.
B.Increase the VPN tunnel bandwidth to 10 Gbps.
C.Create a VPC Peering connection to the on-premises network.
D.Add a NAT Gateway to the private subnet.
AnswerA

Direct Connect provides dedicated, low-latency connection.

Why this answer

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering lower and consistent latency compared to VPN connections that traverse the internet. Option B is incorrect because increasing VPN bandwidth does not reduce latency; latency is primarily affected by distance and internet routing. Option C is incorrect because VPC Peering is used to connect two VPCs, not to connect a VPC to an on-premises network.

Option D is incorrect because a NAT Gateway enables outbound internet access from private subnets and does not provide connectivity to on-premises databases.

Full explanation →
394
MCQeasy

A company is designing a new SAP environment on AWS. The SAP application servers communicate with the database over the network. The architect wants to minimize latency and maximize throughput. Which placement strategy should the architect use?

A.Place all servers in a single Availability Zone and use a cluster placement group.
B.Place the application servers in one Availability Zone and the database in a different Availability Zone.
C.Place the application servers in one VPC and the database in a different VPC connected via VPC peering.
D.Place the application servers in one AWS Region and the database in another Region.
AnswerA

Cluster placement group provides low latency and high throughput.

Why this answer

A cluster placement group is the correct choice because it provides the lowest possible latency and highest throughput by ensuring that all SAP application and database servers are placed in close physical proximity within a single Availability Zone. This placement minimizes network hops and leverages non-blocking, high-bandwidth networking, which is critical for SAP's latency-sensitive communication between application and database layers.

Exam trap

The trap here is that candidates may assume spreading resources across multiple Availability Zones improves availability, but for SAP workloads requiring minimal latency, a single-AZ cluster placement group is the correct performance optimization, even though it sacrifices AZ-level fault tolerance.

How to eliminate wrong answers

Option B is wrong because placing the application servers and database in different Availability Zones introduces cross-AZ network latency (typically 1-2 ms) and additional data transfer costs, which degrades SAP performance. Option C is wrong because using separate VPCs connected via VPC peering adds extra network hops and does not guarantee the same physical proximity or bandwidth as a single VPC, increasing latency. Option D is wrong because inter-Region latency (often 10-100 ms) is far too high for SAP's real-time database communication, making it impractical for production workloads.

Full explanation →
395
MCQmedium

A company runs SAP ERP on AWS with a Sybase ASE database. The database is on an EC2 instance with a single 500 GB gp2 EBS volume. The volume shows 100% credit balance consumption frequently, causing I/O throttling. What should the company do to resolve the throttling?

A.Increase the gp2 volume size to 1,000 GB to gain more I/O credits.
B.Migrate the volume to gp3 with appropriate IOPS and throughput settings.
C.Enable EBS optimization on the EC2 instance.
D.Move the database to Amazon RDS for Sybase ASE.
AnswerB

gp3 volumes provide consistent baseline IOPS and throughput without burst credits, solving the throttling issue.

Why this answer

The gp2 volume's credit balance is fully consumed because the workload's sustained I/O demand exceeds the baseline performance of 500 GB gp2 (1,500 IOPS). Migrating to gp3 (option B) eliminates the credit-bucket model entirely, providing a baseline of 3,000 IOPS and 125 MiB/s throughput regardless of volume size, with the ability to provision higher IOPS and throughput independently without relying on burst credits.

Exam trap

The trap here is that candidates assume increasing gp2 volume size (Option A) is the only way to gain more I/O credits, overlooking that gp3 eliminates the credit model entirely and provides a cost-effective, predictable performance baseline without throttling.

How to eliminate wrong answers

Option A is wrong because increasing gp2 volume size to 1,000 GB would raise the baseline IOPS to 3,000 and increase the credit-earning rate, but it does not eliminate the burst-bucket model; if the workload consistently exceeds baseline, credits will still be depleted and throttling will recur, plus it incurs unnecessary storage cost. Option C is wrong because EBS optimization is a feature that dedicates network bandwidth for EBS traffic between the EC2 instance and EBS volumes; it does not affect the I/O credit balance or burst behavior of a gp2 volume, and the instance likely already has it enabled if it supports the volume size. Option D is wrong because Amazon RDS for Sybase ASE does not exist as a managed service; Sybase ASE is not supported by Amazon RDS, so this option is technically infeasible and would require a different database migration strategy.

Full explanation →
396
MCQeasy

A company is migrating its SAP ERP system to AWS and needs to ensure that the SAP application can communicate with the corporate LDAP server for authentication. The LDAP server is on-premises. Which AWS service should be used to establish a secure connection?

A.AWS Direct Connect
B.VPC Peering
C.AWS Site-to-Site VPN
D.AWS Transit Gateway
AnswerC

Site-to-Site VPN provides a secure IPsec tunnel over the internet.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel over the public internet using IPsec, enabling secure communication between the SAP application in the VPC and the on-premises LDAP server. This is the most straightforward and cost-effective option for establishing a secure connection when a dedicated physical link is not required.

Exam trap

The trap here is that candidates often confuse VPC Peering with on-premises connectivity, not realizing that VPC Peering only works between VPCs within AWS and cannot extend to an on-premises network.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated private physical connection, which is overkill and more expensive for simply securing LDAP traffic; it is typically used for high-bandwidth or low-latency needs. Option B is wrong because VPC Peering connects two VPCs within AWS, not an on-premises network, and does not support VPN or encryption for on-premises connectivity. Option D is wrong because AWS Transit Gateway is a network transit hub that can connect VPCs and on-premises networks, but it requires a VPN or Direct Connect attachment to reach on-premises; it is not a direct replacement for the secure tunnel itself.

Full explanation →
397
MCQhard

An SAP system is running on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers be encrypted in transit. Which solution meets this requirement with minimal latency?

A.Use an AWS Site-to-Site VPN connection between the tiers
B.Use security groups to allow traffic only between the instances, with IPsec configured
C.Use an Application Load Balancer with TLS termination in front of the database tier
D.Install TLS certificates on each EC2 instance and enable HTTPS
AnswerB

Correct. Configuring IPsec directly on the EC2 instances and using security groups to control traffic provides encryption in transit with minimal latency, as it works at the network layer without additional components.

Why this answer

Security groups act as a virtual firewall, and when combined with IPsec configuration on the EC2 instances, they provide end-to-end encryption between the application and database tiers. This method introduces minimal latency because the encryption is handled by the instances themselves without additional network appliances or load balancers. Option A is incorrect because an AWS Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for internal traffic between tiers.

Option C is incorrect because an Application Load Balancer with TLS termination adds unnecessary latency and does not encrypt traffic beyond the load balancer. Option D is incorrect because enabling HTTPS alone does not encrypt database traffic, as database protocols typically use different ports and are not HTTP-based.

Full explanation →
398
MCQmedium

A company runs SAP S/4HANA on AWS and needs to set up a disaster recovery (DR) site in another AWS Region. The RPO is 15 minutes and RTO is 4 hours. The database is SAP HANA. Which approach meets these requirements?

A.Take nightly backups to S3 and restore in the DR region.
B.Use AWS Database Migration Service (DMS) for continuous replication.
C.Enable SAP HANA System Replication across regions.
D.Use AWS Backup for cross-region EBS snapshots.
AnswerC

Supports low RPO and moderate RTO.

Why this answer

SAP HANA System Replication (HSR) is the native SAP mechanism for replicating HANA databases to a secondary site with low RPO (typically seconds to minutes) and supports cross-region asynchronous replication. With an RPO of 15 minutes and RTO of 4 hours, HSR can meet these requirements by continuously shipping log entries to the DR region, enabling a controlled takeover within the RTO window.

Exam trap

The trap here is that candidates often confuse AWS-native replication services (DMS, AWS Backup) with SAP-specific replication mechanisms, assuming any continuous replication tool can handle SAP HANA, when in fact only HSR provides the required log-level consistency and takeover capabilities for a 15-minute RPO.

How to eliminate wrong answers

Option A is wrong because nightly backups to S3 cannot achieve a 15-minute RPO; they only provide point-in-time recovery from the previous night, and restoring a multi-terabyte HANA database from S3 would far exceed the 4-hour RTO. Option B is wrong because AWS DMS does not support SAP HANA as a source for continuous replication; it is designed for heterogeneous database migrations, not native HANA log replication, and cannot maintain HANA-specific transactional consistency. Option D is wrong because AWS Backup cross-region EBS snapshots capture entire volumes at a block level, but they are not application-consistent for SAP HANA (they would require crash recovery) and the snapshot frequency (typically every 1–24 hours) cannot meet a 15-minute RPO.

Full explanation →
399
MCQeasy

A company wants to migrate its SAP HANA database to AWS using SAP HANA Database Backup and Recovery. The backup files are stored on an NFS share on-premises. The company wants to restore these backups directly to an Amazon EC2 instance running SAP HANA. Which AWS storage service should they use to make the NFS backup files accessible to the EC2 instance?

A.Amazon S3
B.Amazon FSx for Windows File Server
C.Amazon EFS
D.Amazon EBS
AnswerC

EFS provides NFS file system.

Why this answer

Amazon EFS provides a scalable NFS file system that can be mounted on EC2 instances. The backup files can be copied from on-premises NFS to EFS using AWS DataSync or other methods, and then used for restore. Options A, B, D are incorrect because S3 is object storage (not NFS), FSx for Windows File Server is SMB, and EBS is block storage not NFS.

Full explanation →
400
MCQeasy

An SAP administrator needs to grant an external auditor read-only access to view SAP system logs stored in CloudWatch Logs. Which AWS identity-based policy should be used?

A.AWSSupportAccess
B.CloudWatchLogsReadOnlyAccess
C.AmazonS3ReadOnlyAccess
D.CloudWatchReadOnlyAccess
AnswerB

This policy grants read-only access to CloudWatch Logs.

Why this answer

The AWS managed policy CloudWatchLogsReadOnlyAccess grants read-only access specifically to CloudWatch Logs, which is required for viewing SAP system logs. Option A (AWSSupportAccess) is intended for AWS Support cases, not log access. Option C (AmazonS3ReadOnlyAccess) is for S3 buckets.

Option D (CloudWatchReadOnlyAccess) includes CloudWatch metrics and alarms but not logs; for logs, CloudWatchLogsReadOnlyAccess is needed.

Full explanation →
401
MCQhard

A company runs SAP on AWS and uses a custom AMI for their EC2 instances. They want to ensure that all instances launched from this AMI automatically have the SAP host agent installed and configured. What is the most efficient way to achieve this?

A.Use AWS Systems Manager Run Command to install the agent after launch.
B.Create a new AMI that includes the SAP host agent pre-installed and configured.
C.Use a user data script that installs and configures the SAP host agent at instance launch.
D.Use AWS CodeDeploy to automatically deploy the agent to new instances.
AnswerB

A custom AMI ensures consistency and eliminates post-launch steps.

Why this answer

Baking the SAP host agent into the AMI ensures that every instance launched from that AMI automatically has the agent installed and configured with no additional steps. This is the most efficient approach as it avoids post-launch configuration, reduces potential failure points, and ensures consistency.

Full explanation →
402
MCQmedium

A company is planning to migrate its SAP ERP system to AWS. The system uses Oracle Database as its backend. The company wants to minimize licensing costs and administrative overhead. Which AWS database service is most suitable for this migration?

A.Amazon Redshift
B.Amazon DynamoDB
C.Amazon RDS for Oracle
D.Amazon Aurora
AnswerC

RDS for Oracle provides managed Oracle database service.

Why this answer

Amazon RDS for Oracle is the most suitable choice because it directly supports Oracle Database, allowing the company to migrate its existing SAP ERP system with minimal re-architecture. It reduces administrative overhead through automated backups, patching, and replication, while still using the company's existing Oracle licenses (if they choose to bring their own license) to minimize licensing costs.

Exam trap

The trap here is that candidates often assume Amazon Aurora is a drop-in replacement for Oracle due to its high performance and compatibility claims, but Aurora does not support Oracle's proprietary SQL dialect, PL/SQL, or Oracle-specific database features required by SAP ERP.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse optimized for analytical queries, not a transactional database for SAP ERP workloads, and it does not support Oracle compatibility or SAP-certified database features. Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database that lacks the relational database capabilities, stored procedures, and ACID transaction support required by SAP ERP with Oracle Database. Option D is wrong because Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database, not Oracle-compatible, and SAP ERP requires Oracle-specific features such as Oracle PL/SQL, Oracle RAC, and Oracle-specific data types that Aurora does not support.

Full explanation →
403
MCQhard

A company is running a large SAP S/4HANA production system on AWS. The system consists of a single HANA database instance running on an r5.24xlarge EC2 instance (with 768 GB of RAM), and multiple application server instances behind an Application Load Balancer. The database uses six EBS io1 volumes for data and log files, each with 20,000 provisioned IOPS. The application servers are in an Auto Scaling group. Recently, the company experienced a prolonged database outage when the primary EC2 instance failed. The recovery took over 4 hours because a new instance had to be launched and snapshots restored. The company wants to improve the Recovery Time Objective (RTO) to less than 30 minutes for the HANA database. They also want to minimize data loss with an RPO of less than 5 minutes. The company has a second AWS region (us-west-2) available for disaster recovery but prefers to keep costs low for the DR site. Which solution should the company implement?

A.Configure SAP HANA System Replication to a standby instance in the same region but use a larger instance to ensure capacity.
B.Configure automated Amazon EBS snapshots every 5 minutes and create an AMI for the HANA instance. In the event of a failure, launch a new instance from the AMI in the same Availability Zone.
C.Set up SAP HANA System Replication to a standby HANA instance in a different Availability Zone. Use a smaller instance type for the standby to reduce costs. Automate failover using a cluster manager like Pacemaker.
D.Use Amazon RDS for SAP HANA with Multi-AZ deployment to automatically failover to a standby in another Availability Zone.
AnswerC

HSR with failover can achieve RTO < 30 minutes and RPO < 5 minutes.

Why this answer

SAP HANA System Replication (HSR) with a standby instance in a different Availability Zone provides synchronous replication, achieving an RPO of less than 5 minutes, and automated failover via a cluster manager like Pacemaker can bring the database online in under 30 minutes. Using a smaller instance for the standby reduces DR costs while still allowing the system to run in degraded mode during failover. This meets the RTO and RPO requirements without the high cost of a full-sized DR site in another region.

Exam trap

The trap here is that candidates may assume a second region is required for DR, but the question explicitly allows using a different Availability Zone within the same region to meet the RTO and RPO goals while keeping costs low, and they may also mistakenly think Amazon RDS supports SAP HANA.

How to eliminate wrong answers

Option A is wrong because configuring HSR to a standby in the same region does not address the requirement to use the second region for DR, and using a larger instance increases costs unnecessarily without improving RTO beyond what a properly configured standby in another AZ can achieve. Option B is wrong because automated EBS snapshots every 5 minutes cannot guarantee an RPO of less than 5 minutes due to snapshot consistency delays and the time required to restore from snapshots (launching a new instance and restoring volumes typically takes well over 30 minutes). Option D is wrong because Amazon RDS for SAP HANA does not exist; RDS supports other databases but not SAP HANA, so this option is technically invalid.

Full explanation →
404
Multi-Selectmedium

A company is migrating an SAP ERP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS). The company plans to use a shared file system for the SAP transport directory. Which TWO AWS services can be used to provide a highly available shared file system for this purpose?

Select 2 answers
A.Amazon EBS Multi-Attach
B.Amazon S3
C.Amazon FSx for Windows File Server
D.Amazon FSx for NetApp ONTAP
E.Amazon EFS
AnswersD, E

FSx for NetApp ONTAP provides NFS, supports HA.

Why this answer

Options D (Amazon FSx for NetApp ONTAP) and E (Amazon EFS) are correct because they provide NFS-based shared file systems that support the required protocols for SAP transport directory and can be configured for high availability. Option A (Amazon EBS Multi-Attach) is block storage, not a shared file system, and does not support concurrent read/write operations required for SAP. Option B (Amazon S3) is object storage, not POSIX-compliant.

Option C (Amazon FSx for Windows File Server) uses SMB protocol, not NFS, which is required by SAP.

Full explanation →
405
MCQhard

An SAP HANA database on AWS is using EBS gp3 volumes with 3000 IOPS. The database team observes that the write latency is high during peak hours. The EBS volume is not exceeding its bandwidth limit. What is the most likely cause?

A.The EBS volume is not attached as a dedicated EBS bandwidth volume.
B.The EBS volume's IOPS limit is being reached, causing queuing.
C.The EC2 instance's EBS bandwidth is saturated.
D.The EC2 instance does not have EBS optimization enabled.
AnswerB

3000 IOPS may be insufficient, leading to high queue depth and latency.

Why this answer

The observed high write latency during peak hours, despite the EBS volume not exceeding its bandwidth limit, indicates that the volume's IOPS limit of 3000 is being reached. When the IOPS limit is hit, the EBS volume queues I/O requests, which increases latency. This is a classic symptom of IOPS saturation rather than bandwidth saturation.

Exam trap

The trap here is that candidates confuse IOPS limits with bandwidth limits, assuming high latency must be due to bandwidth saturation, but the question explicitly rules out bandwidth as the cause, pointing directly to IOPS queuing.

How to eliminate wrong answers

Option A is wrong because there is no such concept as a 'dedicated EBS bandwidth volume' in AWS; EBS bandwidth is determined by the EC2 instance type and volume type, not by a dedicated attachment setting. Option C is wrong because the question explicitly states the EBS volume is not exceeding its bandwidth limit, so the EC2 instance's EBS bandwidth is not saturated. Option D is wrong because EBS optimization is enabled by default on all current-generation EC2 instances, and if it were disabled, the instance would be throttled at the network level, not specifically cause write latency only during peak hours without bandwidth saturation.

Full explanation →
406
MCQmedium

A company is running SAP S/4HANA on AWS with a high-availability setup using SAP HANA System Replication and a Pacemaker cluster. The cluster consists of two EC2 instances in different Availability Zones, each with an EBS volume for HANA data. The cluster uses a virtual IP address (VIP) managed by the AWS Route 53 health check and failover mechanism. During a recent failover test, the secondary node took over as primary, but the application was unable to connect to the database for several minutes. The investigation reveals that the VIP did not update correctly. The company wants to ensure fast and reliable VIP failover. What should the team do to improve the failover time?

A.Increase the DNS TTL to 300 seconds to reduce lookups and rely on the Pacemaker VIP update.
B.Assign an Elastic IP address to the active node and use a script to reassign it during failover.
C.Reduce the Route 53 health check interval to 10 seconds and lower the DNS TTL to 60 seconds.
D.Place the SAP HANA database behind an internal Network Load Balancer (NLB) and use the NLB's TCP health checks to route traffic to the active instance.
AnswerD

NLB provides fast health checks (every 10 seconds) and immediate traffic rerouting without DNS delays, enabling sub-second failover.

Why this answer

Using an internal Network Load Balancer (NLB) as a database endpoint provides a static IP that can be redirected to the active HANA node. The NLB performs TCP health checks at layer 4 and can detect failure within seconds, rerouting traffic to the healthy secondary instance almost immediately. Option A is incorrect because increasing DNS TTL makes failover slower, not faster.

Option B is incorrect because reassigning an Elastic IP requires API calls that can take tens of seconds. Option C is incorrect because even with a reduced health check interval and low TTL, DNS propagation still introduces delays, and Route 53 health checks are not as fast as NLB health checks.

Full explanation →
407
MCQhard

An SAP system on AWS is using a shared /usr/sap/trans directory mounted on an NFS file server. The file server is an EC2 instance with a standard gp2 EBS volume. During SAP transports, users experience slow response times and occasional timeouts. The system administrator suspects the file server is the bottleneck. Which solution would provide a fully managed, highly available, and performant file share for SAP transport files?

A.Configure multiple EC2 file servers with a load balancer.
B.Replace the EC2 file server with Amazon EFS.
C.Migrate /usr/sap/trans to Amazon FSx for NetApp ONTAP with Multi-AZ deployment.
D.Increase the EBS volume size of the file server to improve throughput.
AnswerC

FSx for NetApp ONTAP provides a fully managed, scalable, and highly available NFS file system ideal for SAP transport files.

Why this answer

Amazon FSx for NetApp ONTAP is a fully managed, high-performance NFS file system that supports Multi-AZ deployment and is SAP-certified for /usr/sap/trans. Option A (multiple EC2 file servers with a load balancer) adds complexity and is not fully managed. Option B (Amazon EFS) can be used but may not provide the same level of performance and features as FSx ONTAP for this use case.

Option D (increasing the EBS volume size) does not address the single point of failure and may not significantly improve throughput.

Full explanation →
408
Multi-Selectmedium

An SAP administrator is troubleshooting a performance issue on an SAP HANA database running on AWS. The HANA data volume is an EBS io1 volume with 10,000 provisioned IOPS. The administrator notices that the average queue length is consistently above 10, and the average latency is 20 ms. Which TWO actions will most likely improve performance?

Select 2 answers
A.Migrate the volume to an instance with NVMe instance store.
B.Increase the provisioned IOPS on the io1 volume to 20,000.
C.Move the database to a larger EC2 instance type that supports higher EBS bandwidth.
D.Configure multiple EBS volumes in a RAID 0 stripe to increase IOPS.
E.Change the volume type to gp3 with 10,000 IOPS.
AnswersB, C

More IOPS reduces queue depth and latency.

Why this answer

Options B and C are correct. Increasing provisioned IOPS on the io1 volume (Option B) directly addresses the high queue length and latency by providing more I/O capacity. Moving the database to a larger EC2 instance type (Option C) increases the dedicated EBS bandwidth, removing a potential throughput bottleneck at the instance level.

Option A (NVMe instance store) is not suitable for persistent SAP HANA data. Option D (RAID 0) can increase IOPS but adds complexity and does not fix insufficient provisioned IOPS or instance bandwidth. Option E (gp3 with 10,000 IOPS) does not increase IOPS compared to the current io1 volume.

Full explanation →
409
Multi-Selecteasy

A company is planning to migrate its SAP workloads to AWS. Which THREE AWS services are commonly used to set up a secure network connectivity between on-premises and AWS? (Choose THREE.)

Select 3 answers
A.AWS Transit Gateway
B.AWS Site-to-Site VPN
C.AWS Direct Connect
D.VPC Peering
E.AWS Client VPN
AnswersA, B, C

Acts as a hub to connect VPCs and on-premises networks.

Why this answer

Options A, B, and C are correct. AWS VPN, Direct Connect, and Transit Gateway are used for hybrid connectivity. Option D is not correct because VPC Peering is for VPC-to-VPC, not on-premises.

Option E is not correct because Client VPN is for individual clients.

Full explanation →
410
MCQhard

A company is migrating a large SAP HANA system to AWS. The SAP system has strict latency requirements for storage and requires high IOPS. Which storage solution should be used for the SAP HANA data volume?

A.Amazon S3
B.Amazon EBS io2 Block Express volumes
C.Amazon EFS
D.Amazon EBS gp3 volumes
AnswerB

io2 Block Express delivers up to 256K IOPS and low latency, meeting HANA requirements.

Why this answer

SAP HANA on AWS requires high-performance storage with high IOPS and sub-millisecond latency. Amazon EBS io2 Block Express volumes provide up to 256K IOPS and sub-millisecond latency, making them the appropriate choice for the SAP HANA data volume. Option A (Amazon S3) is object storage, not block storage, and is unsuitable for database volumes.

Option C (Amazon EFS) is file storage, also not block storage. Option D (Amazon EBS gp3 volumes) is general purpose SSD but does not match the performance of io2 Block Express for HANA workloads.

Full explanation →
411
Multi-Selectmedium

Which TWO of the following are best practices for running SAP HANA on AWS?

Select 2 answers
A.Use RAID 0 across multiple EBS volumes to increase IOPS.
B.Deploy the HANA database in multiple Availability Zones for high availability.
C.Store HANA data and log files on Amazon S3.
D.Use EBS-optimized instances for dedicated storage throughput.
E.Use burstable instance types for cost savings.
AnswersB, D

Multi-AZ is key for HA.

Why this answer

Deploying the HANA database in multiple Availability Zones is a best practice for high availability because it protects against an entire AZ failure. SAP HANA supports system replication (HSR) in synchronous or synchronous-memory mode across AZs, enabling automatic failover with minimal data loss. This aligns with the AWS Well-Architected Framework's reliability pillar for critical SAP workloads.

Exam trap

The trap here is that candidates often confuse high availability (multi-AZ) with disaster recovery (multi-Region), or they assume RAID 0 is a performance best practice without considering the data integrity risks for a mission-critical database like SAP HANA.

Full explanation →
412
MCQhard

A company runs SAP ECC on AWS with a multi-ASCS architecture for high availability. During a failover test, the secondary ASCS instance does not take over. The cluster logs indicate that the 'aws-cluster' resource agent failed to release the Elastic IP. What is the MOST likely cause?

A.The Elastic IP is associated with the primary private IP address of the ENI.
B.The Elastic IP is in a different Availability Zone than the secondary ASCS instance.
C.The cluster is using a NAT Gateway for outbound traffic, conflicting with the Elastic IP.
D.The IAM role assigned to the instances does not have permission to release the Elastic IP.
AnswerA

EIPs are associated with private IPs; if it's on the primary IP, the ENI cannot be moved without detaching. A secondary IP allows reassignment.

Why this answer

In a multi-ASCS SAP cluster on AWS, the 'aws-cluster' resource agent manages Elastic IP (EIP) failover by disassociating the EIP from the primary instance and associating it with the secondary instance. If the EIP is associated with the primary private IP address of the Elastic Network Interface (ENI) rather than the ENI itself, the resource agent cannot release it because the association is at the IP level, not the ENI level. This prevents the secondary ASCS instance from acquiring the EIP, causing the failover to fail.

Exam trap

The trap here is that candidates often assume IAM permissions (Option D) are the root cause of any AWS resource management failure, but the specific log message about 'failed to release' points to a technical limitation of the resource agent with IP-level EIP associations, not an authorization issue.

How to eliminate wrong answers

Option B is wrong because Elastic IPs are regional resources that can be associated with instances in any Availability Zone within the same region; a different AZ does not prevent release or association. Option C is wrong because a NAT Gateway is used for outbound internet traffic and does not conflict with Elastic IP operations; the cluster resource agent interacts directly with the EC2 API to manage EIPs, independent of NAT Gateway routing. Option D is wrong because the IAM role permissions issue would typically cause an authorization error in the logs, but the question states the logs indicate the resource agent 'failed to release the Elastic IP' — this points to a technical limitation of the agent, not a permissions failure.

Full explanation →
413
MCQeasy

A small business runs its SAP Business One on a single EC2 instance in AWS. The database is SAP HANA, and the application is also on the same instance. The company wants to ensure that in the event of an instance failure, they can quickly restore the system from backups. They take daily EBS snapshots of the root volume and the data volume. One day, the instance fails and becomes unreachable. The IT administrator attempts to launch a new instance from the most recent AMI, but the new instance does not have the same private IP address, causing connectivity issues for the company's on-premises systems that use VPN to connect to the SAP server. The company uses a Site-to-Site VPN connection to the VPC. What should the administrator do to ensure that the private IP address is preserved after recovery?

A.Modify the VPC subnet to use a smaller CIDR range to ensure the IP is available.
B.Create a new AMI from the failed instance and use that AMI to launch a new instance, specifying the same private IP in the subnet.
C.Assign an Elastic IP to the instance and update the VPN configuration to use the Elastic IP.
D.Create an Elastic Network Interface (ENI) with the desired private IP, attach it to the instance, and after failure, detach it from the old instance and attach to the new instance.
AnswerD

ENI retains the private IP and can be moved to another instance.

Why this answer

An Elastic Network Interface (ENI) can retain a fixed private IP address. By creating an ENI with the desired private IP and attaching it to the original instance, after a failure you can detach the ENI from the failed instance (or simply launch a new instance and attach the ENI) to preserve the same private IP. This ensures that the on-premises VPN connection, which relies on that IP, continues to work.

Option A is incorrect because modifying the subnet's CIDR does not guarantee that the specific IP address remains available; it might still be used by another resource or cause routing issues. Option B is incorrect because creating a new AMI from the failed instance does not preserve the private IP; the new instance launched from that AMI will receive a dynamically assigned IP from the subnet unless you specify a static IP, but that is not part of the AMI process. Option C is incorrect because Elastic IP addresses are public IPs; the VPN connection between on-premises and the VPC uses private IP addresses, so using an Elastic IP would not resolve the private IP connectivity issue.

Full explanation →
414
MCQmedium

A company is planning to run SAP NetWeaver on AWS and wants to use Auto Scaling for the application server tier. Which consideration is critical when implementing Auto Scaling for SAP application servers?

A.Ensure the database can scale automatically with the application tier.
B.Enable termination protection on all Auto Scaling instances.
C.Use encrypted EBS volumes for all instances.
D.Automatically register new instances with the SAP Central Services instance.
AnswerD

New app servers must be registered with ASCS to join the SAP system.

Why this answer

SAP application servers must be registered with the SAP Central Services instance (ASCS/SCS) to be recognized as part of the SAP system. Auto Scaling can launch new instances, but without automatic registration via sapstartsrv or the SAP Host Agent, the new instances will not be able to communicate with the Central Services instance, and the SAP system will not utilize them for workload.

Exam trap

The trap here is that candidates often focus on infrastructure-level concerns like encryption or termination protection, overlooking the application-level dependency that SAP application servers must be explicitly registered with Central Services to function as part of the SAP system.

How to eliminate wrong answers

Option A is wrong because the database tier in an SAP NetWeaver landscape is typically a single, stateful component that cannot be scaled automatically with the application tier; Auto Scaling is designed for stateless application servers, and the database must be scaled independently, often requiring manual intervention or separate database clustering solutions. Option B is wrong because termination protection is a safety feature to prevent accidental deletion of instances, but it is not a critical consideration for implementing Auto Scaling for SAP application servers; in fact, Auto Scaling requires the ability to terminate instances during scale-in events, and enabling termination protection would break the scaling process. Option C is wrong while encrypted EBS volumes are a security best practice, they are not a critical consideration specific to Auto Scaling for SAP application servers; encryption does not affect the ability to scale or register instances with Central Services.

Full explanation →
415
MCQeasy

An administrator receives this error when trying to register an SAP system in AWS Systems Manager. What is the likely cause?

A.The SAP Host Agent is not installed on the EC2 instance.
B.The IAM role assigned to the instance does not have the required permissions.
C.The AWS Systems Manager Agent (SSM Agent) is not running.
D.The SAP system is not installed correctly.
AnswerA

The error message explicitly states that the SAP Host Agent is not installed.

Why this answer

The error occurs because AWS Systems Manager requires the SAP Host Agent to be installed and running on the EC2 instance to register an SAP system. Without the SAP Host Agent, Systems Manager cannot discover or manage the SAP instance, even if the SSM Agent and IAM permissions are correctly configured.

Exam trap

The trap here is that candidates confuse the AWS SSM Agent (required for instance management) with the SAP Host Agent (required for SAP system registration), leading them to incorrectly select the SSM Agent not running as the cause.

How to eliminate wrong answers

Option B is wrong because an IAM role with insufficient permissions would cause a different error, such as 'AccessDenied' or 'UnauthorizedOperation', not a registration failure specific to SAP system discovery. Option C is wrong because if the SSM Agent were not running, the instance itself would not appear in Systems Manager at all, and the error would be about instance connectivity, not SAP registration. Option D is wrong because an incorrectly installed SAP system would produce SAP-specific startup or runtime errors, not a registration failure in Systems Manager, which relies on the SAP Host Agent for discovery.

Full explanation →
416
MCQeasy

Your SAP system on AWS uses a shared file system with Amazon EFS. The operations team notices that the SAP application is experiencing latency when reading files from EFS. Which action can improve read performance?

A.Use Amazon FSx for Windows File Server instead.
B.Move the file system to Amazon EBS with provisioned IOPS.
C.Use Amazon S3 with Transfer Acceleration.
D.Enable EFS performance mode 'max I/O'.
AnswerD

Improves throughput.

Why this answer

Enabling EFS 'max I/O' performance mode increases the file system's ability to handle a high number of concurrent read operations by distributing data across multiple servers within the AWS region. This mode is specifically designed for workloads like SAP that require high throughput and low-latency access to shared files, as it scales I/O operations horizontally without the bottleneck of a single file server.

Exam trap

The trap here is that candidates often confuse EFS performance modes with throughput settings, assuming 'max I/O' only helps with write-heavy workloads, when in fact it is critical for read-heavy, high-concurrency scenarios like SAP shared file systems.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server uses the SMB protocol, which is not optimized for SAP's typical NFS-based shared file system requirements and can introduce additional latency due to protocol translation overhead. Option B is wrong because moving to Amazon EBS with provisioned IOPS would require attaching the volume to a single EC2 instance, breaking the shared file system requirement for SAP's distributed architecture and failing to provide concurrent access across multiple application servers. Option C is wrong because Amazon S3 with Transfer Acceleration is an object storage service that does not support file-level locking or POSIX semantics required by SAP for shared file systems, and Transfer Acceleration only improves upload speeds over long distances, not read latency for existing files.

Full explanation →
417
MCQmedium

Refer to the exhibit. An administrator runs the AWS CLI command shown and receives the output. The instance is running, but the SAP application on the instance is not accessible. Which additional AWS CLI command should the administrator run to troubleshoot the network connectivity?

A.aws ec2 describe-subnets
B.aws ec2 describe-network-interfaces
C.aws ec2 describe-security-groups
D.aws ec2 describe-instances --instance-ids i-0abcd1234efgh5678 --query 'Reservations[0].Instances[0].NetworkInterfaces'
AnswerD

This query returns network interface details including public IP, security groups, etc.

Why this answer

The correct command, `describe-instances` with a filter on `NetworkInterfaces`, retrieves the detailed network interface configuration attached to the specific instance, including the subnet ID, security group IDs, and public/private IP addresses. This allows the administrator to verify whether the instance is attached to the correct subnet and security groups, which are the most common causes of network connectivity issues for an SAP application. The other commands either do not filter to the specific instance or do not provide the necessary network interface details to diagnose the problem.

Exam trap

The trap here is that candidates often choose `describe-security-groups` (Option C) thinking it directly shows the rules, but they forget that without linking the security group to the specific instance's network interface, they cannot confirm which rules are actually applied to that instance, especially when multiple security groups are involved.

How to eliminate wrong answers

Option A is wrong because `describe-subnets` lists all subnets in the VPC but does not show which subnet the specific instance is attached to, so it cannot directly troubleshoot connectivity for that instance. Option B is wrong because `describe-network-interfaces` lists all network interfaces in the account without filtering to the specific instance, making it impractical to isolate the interface associated with the problematic instance. Option C is wrong because `describe-security-groups` lists all security groups but does not show which security groups are attached to the instance's network interface, so it cannot verify the instance-level firewall rules affecting the SAP application.

Full explanation →
418
MCQmedium

A company is migrating its SAP HANA database to AWS and needs to choose the most appropriate EC2 instance type. The workload requires high memory bandwidth and is CPU-intensive. Which instance family would best meet these requirements?

A.M5 instance family
B.I3 instance family
C.C5 instance family
D.X1e instance family
AnswerD

X1e instances are memory-optimized with high memory bandwidth, ideal for SAP HANA workloads.

Why this answer

The X1e instance family is purpose-built for high-memory, CPU-intensive SAP HANA workloads, offering up to 3.9 TB of memory and high memory bandwidth per vCPU. This aligns with SAP HANA's requirement for large in-memory databases and compute-intensive processing, making D the correct choice.

Exam trap

The trap here is that candidates often confuse compute-optimized (C5) or storage-optimized (I3) families with SAP HANA requirements, overlooking that SAP HANA's in-memory nature demands memory-optimized instances like X1e with high memory bandwidth and capacity, not just raw CPU or I/O performance.

How to eliminate wrong answers

Option A is wrong because the M5 instance family is a general-purpose option that balances compute, memory, and networking, but lacks the high memory bandwidth and large memory capacity required for SAP HANA. Option B is wrong because the I3 instance family is storage-optimized with high local NVMe SSD performance, designed for I/O-intensive workloads like databases with high throughput, not for CPU-intensive, high-memory-bandwidth SAP HANA. Option C is wrong because the C5 instance family is compute-optimized, focusing on high CPU performance for workloads like batch processing or web servers, but it does not provide the large memory footprint or memory bandwidth needed for SAP HANA in-memory operations.

Full explanation →
419
MCQeasy

A company is using SAP HANA on AWS and needs to restore a backup to a new HANA instance. Which AWS service should be used to automate the backup and restore process?

A.AWS Backup
B.Amazon Data Lifecycle Manager (DLM)
C.AWS CloudFormation
D.Amazon S3
AnswerA

AWS Backup supports SAP HANA with Backint integration for automated backups.

Why this answer

(AWS Backup) is correct because AWS Backup can automate backups of SAP HANA databases using the Backint agent integration, enabling automated backup and restore operations. Option B (Amazon Data Lifecycle Manager) is incorrect because DLM is used to automate creation and deletion of EBS snapshots, not HANA database backups. Option C (AWS CloudFormation) is incorrect because CloudFormation is an infrastructure-as-code service for provisioning resources, not for managing database backups.

Option D (Amazon S3) is incorrect because S3 is object storage; while it can store backup files, it does not provide backup automation itself.

Full explanation →
420
Multi-Selecteasy

A company is deploying SAP on AWS and needs to ensure high availability for the SAP application servers. Which TWO strategies can be used to achieve this? (Choose TWO.)

Select 2 answers
A.Use Amazon RDS Multi-AZ for the application tier
B.Use a single large EC2 instance with an Elastic IP
C.Use an Auto Scaling group with an Application Load Balancer
D.Attach the same EBS volume to multiple instances
E.Deploy application servers in multiple Availability Zones
AnswersC, E

An Auto Scaling group combined with an Application Load Balancer (ALB) automatically distributes incoming traffic across multiple SAP application server instances and replaces failed instances. The ALB performs health checks and routes traffic only to healthy instances, while Auto Scaling maintains the desired instance count across Availability Zones.

Why this answer

Options C and E are correct. Option C uses an Auto Scaling group with an Application Load Balancer to automatically distribute traffic across multiple SAP application server instances and replace failed ones, ensuring high availability. Option E deploys application servers in multiple Availability Zones to eliminate a single point of failure, as AZs are independent failure domains.

Both strategies are recommended for SAP on AWS.

Exam trap

The trap here is that candidates confuse the database tier (where Multi-AZ is appropriate) with the application tier, or mistakenly think that a single large instance with an Elastic IP provides high availability, when in fact it creates a single point of failure.

Full explanation →
421
MCQmedium

A company is migrating a legacy application to AWS that requires a static IP address for client whitelisting. The application will run on EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure the IP address does not change over time. What should the company do?

A.Assign an Elastic IP to each EC2 instance
B.Use Route 53 latency-based routing to point to the ALB
C.Use AWS Global Accelerator to get two static IP addresses
D.Use a Network Load Balancer (NLB) with an Elastic IP address
AnswerD

NLB supports static IP via Elastic IP, which can be whitelisted.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses by allowing you to assign Elastic IPs directly to each of its Availability Zone subnets. This provides fixed IP endpoints for client whitelisting, while the NLB can forward traffic to the EC2 instances behind an ALB, preserving the application's architecture.

Exam trap

The trap here is that candidates often choose Global Accelerator because it offers static IPs, but they overlook that an NLB with Elastic IPs is the simpler, cost-effective solution for a single-region static IP requirement, and Global Accelerator is intended for global traffic acceleration, not just static IP assignment.

How to eliminate wrong answers

Option A is wrong because assigning Elastic IPs to EC2 instances would expose individual instance IPs, not a stable front-end IP for the ALB, and the instances are behind the ALB, so client whitelisting should target the load balancer's IP, not the instances. Option B is wrong because Route 53 latency-based routing resolves to the ALB's DNS name, which can change IP addresses over time, and does not provide static IP addresses. Option C is wrong because AWS Global Accelerator provides two static IP addresses, but it is designed for global traffic optimization and adds unnecessary complexity and cost; the question requires a simple static IP for whitelisting, which the NLB with Elastic IPs directly achieves.

Full explanation →
422
MCQmedium

A company is designing a highly available SAP HANA system on AWS. They need to replicate data synchronously to a secondary site in a different Availability Zone. Which AWS service should they use?

A.Amazon S3 cross-region replication
B.AWS Database Migration Service (DMS)
C.Amazon RDS Multi-AZ
D.SAP HANA System Replication (HSR)
AnswerD

HSR is SAP's native replication for HANA.

Why this answer

SAP HANA System Replication (HSR) is the native SAP mechanism for synchronously replicating HANA data to a secondary system. It supports synchronous replication mode, which ensures zero data loss (RPO=0) by committing transactions only after they are confirmed on the secondary site, making it the correct choice for a highly available SAP HANA system across Availability Zones.

Exam trap

The trap here is that candidates confuse AWS-managed HA services (like RDS Multi-AZ) with SAP-specific replication, forgetting that SAP HANA on AWS is an EC2-based workload requiring native HANA tools, not AWS database services.

How to eliminate wrong answers

Option A is wrong because Amazon S3 cross-region replication is an object-level, asynchronous replication feature for S3 buckets; it cannot replicate SAP HANA database transactions or provide the synchronous, low-latency replication required for HANA HA. Option B is wrong because AWS Database Migration Service (DMS) is designed for one-time or ongoing migration of databases to AWS, not for real-time synchronous replication between two active HANA instances; it introduces latency and does not support HANA's native replication protocols. Option C is wrong because Amazon RDS Multi-AZ is a managed database HA feature for RDS engines (e.g., MySQL, PostgreSQL, Oracle, SQL Server), not for SAP HANA; SAP HANA on AWS is deployed on EC2, not RDS, and RDS Multi-AZ uses storage-level or engine-level replication incompatible with HANA's requirements.

Full explanation →
423
MCQhard

Refer to the exhibit. An IAM policy is attached to a user who manages SAP EC2 instances. Which of the following actions can the user perform?

A.Describe all EC2 instances, but start and stop only those with the tag Environment=production.
B.Describe, start, and stop all EC2 instances regardless of tags.
C.Start and stop any EC2 instance in the account.
D.Terminate any EC2 instance with the tag Environment=production.
AnswerA

The describe action is wildcard; start/stop have condition.

Why this answer

The IAM policy grants ec2:Describe* on all resources, allowing the user to describe any EC2 instance. However, ec2:StartInstances and ec2:StopInstances are only allowed on instances with the tag Environment=production, so the user can start and stop only those instances. Option B is incorrect because the user cannot start/stop all instances—only those with the production tag.

Option C is incorrect because the user cannot start/stop any instance; the tag condition restricts these actions. Option D is incorrect because the policy does not allow the ec2:TerminateInstances action at all.

Full explanation →
424
MCQmedium

An SAP administrator created the IAM policy shown in the exhibit to allow a monitoring tool to start and stop SAP application servers tagged with Environment=Production. When testing the policy, the tool fails to start an instance. What is the most likely cause?

A.The policy requires the instance to be stopped before starting.
B.The policy is missing the ec2:DescribeInstances action.
C.The policy does not allow starting instances that are already running.
D.The resource ARN does not match the instance ID.
AnswerC

ec2:StartInstances only works on stopped instances; attempting to start a running instance fails.

Why this answer

The policy uses a condition that checks if the instance is already running (`ec2:InstanceState/Name` equals `running`). The `ec2:StartInstances` action is only allowed when the instance is in the `running` state, but starting an instance requires it to be in the `stopped` state. This mismatch causes the start action to fail for production-tagged instances.

Exam trap

The trap here is that candidates assume the condition `ec2:InstanceState/Name` equals `running` is correct for starting instances, confusing the required state for start (stopped) with the state for stop (running).

How to eliminate wrong answers

Option A is wrong because the policy does not require the instance to be stopped before starting; the condition incorrectly requires the instance to be running, which is the opposite of what is needed for a start operation. Option B is wrong because the `ec2:DescribeInstances` action is not required for starting instances; the `ec2:StartInstances` action alone is sufficient, and the failure is due to the condition, not a missing action. Option D is wrong because the resource ARN uses a wildcard (`*`) for the instance ID, which matches any instance ID, so the ARN format is not the issue.

Full explanation →
425
MCQhard

Refer to the exhibit. An IAM policy is created for an automated script that starts and stops EC2 instances. The script is failing to stop an instance with the tag 'Environment: non-production'. What is the most likely cause?

A.The EC2 instance does not have the tag 'Environment' with value 'non-production'.
B.The policy does not include ec2:StopInstances action.
C.The policy does not allow ec2:Describe* actions for instances.
D.The condition is applied to the ec2:StartInstances action but not ec2:StopInstances.
AnswerA

The condition requires the instance to have that exact tag; otherwise, the action is denied.

Why this answer

The IAM policy is configured with a condition that requires the EC2 instance to have the tag 'Environment' with value 'non-production' for both StartInstances and StopInstances actions. If the instance does not have this exact tag, the action is denied. Option B is incorrect because the policy likely includes the ec2:StopInstances action, but the condition is not met.

Option C is incorrect because the policy does not require ec2:Describe* actions for the stop operation to work. Option D is incorrect because the condition is applied equally to both StartInstances and StopInstances.

Exam trap

The trap is that candidates may assume a lack of ec2:StopInstances action is the cause, but the policy actually includes it; the issue is the tag condition not being satisfied.

Full explanation →
426
MCQmedium

An SAP administrator attaches the above IAM policy to a user. What actions can the user perform?

A.Describe, start, and stop EC2 instances, but not terminate them.
B.Perform all EC2 actions including terminate.
C.Only describe EC2 instances.
D.Only start and stop instances.
AnswerA

Allow actions include describe, start, stop; deny overrides for terminate.

Why this answer

The IAM policy explicitly allows ec2:Describe*, ec2:StartInstances, and ec2:StopInstances actions, but does not include ec2:TerminateInstances. Therefore, the user can describe, start, and stop EC2 instances, but cannot terminate them. The Deny effect on ec2:TerminateInstances is not present, but the absence of an Allow means the action is implicitly denied.

Exam trap

The trap here is that candidates may assume the wildcard ec2:Describe* also covers start/stop/terminate actions, but it only grants read-only Describe permissions, not lifecycle management actions.

How to eliminate wrong answers

Option B is wrong because the policy does not grant ec2:TerminateInstances, so the user cannot perform all EC2 actions including terminate. Option C is wrong because the policy also allows StartInstances and StopInstances, not just Describe actions. Option D is wrong because the policy includes Describe actions in addition to Start and Stop, so the user can also describe instances.

Full explanation →
427
MCQeasy

A company is running SAP HANA on an r5.8xlarge instance. They want to scale up to meet increased memory requirements. Which instance family would be the MOST suitable for a scale-up scenario?

A.x1e.32xlarge
B.r5.24xlarge
C.i3.16xlarge
D.c5.18xlarge
AnswerA

x1e is designed for large SAP HANA scale-up.

Why this answer

The x1e.32xlarge instance is part of the X1e family, which is specifically designed for high-memory workloads like SAP HANA. With 3,904 GiB of memory, it provides the largest memory capacity among AWS instances, making it the most suitable for scaling up SAP HANA to meet increased memory requirements. SAP HANA is an in-memory database, so scaling up requires instances with high memory-to-vCPU ratios, which the X1e family delivers.

Exam trap

The trap here is that candidates may choose the r5.24xlarge because it is memory-optimized, but they overlook that the X1e family offers much higher memory capacity specifically required for SAP HANA scale-up scenarios.

How to eliminate wrong answers

Option B (r5.24xlarge) is wrong because while the R5 family is memory-optimized, it offers only 768 GiB of memory, which is significantly less than the x1e.32xlarge and may not meet the increased memory requirements for a scale-up scenario. Option C (i3.16xlarge) is wrong because the I3 family is storage-optimized with high local NVMe SSD performance, not designed for large memory capacity; it provides only 488 GiB of memory, which is insufficient for SAP HANA scale-up. Option D (c5.18xlarge) is wrong because the C5 family is compute-optimized, focusing on high CPU performance with only 144 GiB of memory, making it completely unsuitable for memory-intensive SAP HANA workloads.

Full explanation →
428
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 4-hour maintenance window. Which AWS service should be used to minimize downtime during the migration?

A.AWS Server Migration Service
B.AWS Database Migration Service (DMS)
C.AWS Data Pipeline
D.AWS Snowball
AnswerB

DMS supports ongoing replication to minimize downtime during database migration.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication to minimize downtime. Option A (AWS Server Migration Service) is for server-level migrations. Option C (AWS Data Pipeline) is for data processing.

Option D (AWS Snowball) is for large data transfers but not minimal downtime.

Full explanation →
429
MCQeasy

An SAP workload on AWS uses a single Availability Zone deployment. The company wants to improve high availability without changing the existing architecture significantly. Which action should be taken?

A.Use an Amazon EBS volume attached to multiple instances across AZs.
B.Add a second SAP application server in a different Availability Zone and configure load balancing.
C.Increase the size of the EC2 instances to handle failover.
D.Enable EBS Multi-Attach on the database volume.
AnswerB

This provides application tier HA across AZs.

Why this answer

Adding a second SAP application server in a different Availability Zone and configuring load balancing provides high availability by distributing traffic across multiple AZs, ensuring that if one AZ fails, the application remains accessible. This approach aligns with SAP's recommended architecture for multi-AZ deployments without requiring significant changes to the existing single-AZ setup, as it only adds an additional application tier instance and a load balancer.

Exam trap

The trap here is that candidates often confuse scaling (increasing instance size) with high availability, or assume EBS Multi-Attach works across Availability Zones, when in fact it is restricted to a single AZ and specific volume types.

How to eliminate wrong answers

Option A is wrong because an Amazon EBS volume cannot be attached to multiple EC2 instances across different Availability Zones; EBS volumes are AZ-specific and can only be attached to instances within the same AZ, and multi-attach is limited to specific volume types and instances within the same AZ. Option C is wrong because increasing the size of EC2 instances does not provide high availability; it only improves performance or capacity for a single instance, which remains a single point of failure in the event of an AZ outage. Option D is wrong because EBS Multi-Attach is only supported for io1 or io2 volumes within a single Availability Zone and cannot be used across AZs; it also does not address application-level high availability and is not suitable for SAP database volumes that require consistent read/write access from multiple instances.

Full explanation →
430
Multi-Selectmedium

Which THREE factors should be considered when choosing a migration strategy for a legacy application to AWS? (Choose three.)

Select 3 answers
A.Physical location of the source server
B.Programming language used
C.Total cost of ownership (TCO)
D.Business continuity requirements (RTO/RPO)
E.Data sensitivity and compliance requirements
AnswersC, D, E

TCO influences re-architecture vs. lift-and-shift.

Why this answer

Correct options: C, D, E. Total cost of ownership (TCO) is a key factor in migration decision-making. Business continuity requirements (RTO/RPO) ensure the application meets recovery objectives.

Data sensitivity and compliance requirements dictate how data is handled during and after migration. Option A (Physical location) is less relevant because cloud migrations are not bound by physical location; servers can be migrated regardless of location. Option B (Programming language) alone does not determine the migration strategy; the application's architecture and dependencies are more important.

Full explanation →
431
Multi-Selecthard

Which THREE actions should be taken to ensure a secure and compliant SAP environment on AWS? (Choose 3)

Select 3 answers
A.Place all SAP servers in a public subnet for easy access
B.Restrict IAM permissions to only necessary actions
C.Use security groups to restrict inbound and outbound traffic
D.Enable encryption on EBS volumes and RDS instances
E.Store all application logs in Amazon S3 with public read access
AnswersB, C, D

Least privilege reduces security risks.

Why this answer

Options B, C, and D are correct. B: Restricting IAM permissions to only necessary actions follows the principle of least privilege, minimizing security risks. C: Security groups act as a virtual firewall to control inbound and outbound traffic, enhancing network security.

D: Enabling encryption on EBS volumes and RDS instances protects data at rest, ensuring compliance with security standards. Option A is incorrect because placing SAP servers in a public subnet exposes them to the internet, increasing attack surface. Option E is incorrect because storing logs with public read access violates security best practices; logs should be private or accessed via controlled mechanisms.

Full explanation →
432
MCQeasy

A company is deploying SAP NetWeaver on AWS and needs to configure the SAP application server instances for high availability. Which AWS feature is used to distribute traffic across multiple application server instances in different Availability Zones?

A.Auto Scaling group
B.Amazon Route 53 weighted routing
C.Application Load Balancer
D.NAT Gateway
AnswerC

ALB distributes traffic across instances in multiple AZs.

Why this answer

The Application Load Balancer (ALB) is the correct AWS service for distributing traffic across multiple SAP application server instances in different Availability Zones. ALB operates at Layer 7, supports health checks, and can route HTTP/HTTPS traffic to target groups spanning multiple AZs, which is essential for SAP NetWeaver's stateless application layer high availability.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) with application-layer load balancing, not realizing that Route 53 weighted routing lacks health-check-aware traffic distribution and session persistence, which are required for SAP high availability.

How to eliminate wrong answers

Option A is wrong because Auto Scaling groups manage instance scaling and replacement, not traffic distribution; they can be used with a load balancer but do not route traffic themselves. Option B is wrong because Amazon Route 53 weighted routing distributes DNS traffic across endpoints but does not perform health-check-aware load balancing at the application layer; it can cause uneven traffic distribution due to DNS caching and does not handle session persistence required for SAP. Option D is wrong because a NAT Gateway provides outbound internet access for instances in private subnets and has no role in distributing inbound application traffic.

Full explanation →
433
Multi-Selectmedium

Which TWO of the following are valid strategies for reducing the total cost of ownership (TCO) for SAP workloads on AWS?

Select 2 answers
A.Schedule start/stop of non-production instances using Instance Scheduler
B.Use Reserved Instances for production systems
C.Use GP2 EBS volumes instead of GP3
D.Use Graviton-based instances for SAP application servers
E.Deploy SAP HANA in Multi-AZ configuration
AnswersA, B

Stops instances when not needed.

Why this answer

AWS Instance Scheduler allows you to define start and stop schedules for non-production SAP instances, significantly reducing compute costs during off-hours. This is a direct TCO reduction strategy for SAP workloads, as non-production environments often run 24/7 unnecessarily.

Exam trap

The trap here is that candidates may confuse cost-reduction strategies with performance or availability strategies, such as choosing GP2 over GP3 (which actually increases cost) or assuming Graviton is supported for SAP when it is not.

Full explanation →
434
MCQmedium

A company is running SAP on AWS and needs to reduce the cost of their development and test systems. The systems are only needed during business hours on weekdays. Which AWS service can be used to automatically stop and start the EC2 instances on a schedule?

A.AWS Instance Scheduler
B.Amazon EC2 Auto Scaling
C.Amazon CloudWatch Alarms
D.AWS Systems Manager Maintenance Windows
AnswerA

AWS Instance Scheduler is a solution that automatically stops and starts instances based on a schedule, making it correct for reducing cost during off-hours.

Why this answer

AWS Instance Scheduler is a solution that automatically stops and starts instances based on a schedule. Option B is wrong because Auto Scaling is for scaling, not scheduling. Option C is wrong because CloudWatch Alarms trigger based on metrics, not time-based schedules.

Option D is wrong because Systems Manager Maintenance Windows are for patching and maintenance tasks, not scheduling stop/start.

Full explanation →
435
MCQhard

A company has an SAP S/4HANA system running on AWS with a custom backup solution that uses AWS Backup. The backup policy includes daily backups with a retention of 30 days. The operations team notices that backup jobs for the SAP application server are failing intermittently. What should the team do to troubleshoot the issue?

A.Verify that the IAM role used by AWS Backup has sufficient permissions.
B.Review the CloudWatch Logs for the backup job to identify error messages.
C.Switch to using SAP HANA Studio for backups.
D.Increase the backup frequency to capture more recovery points.
AnswerB

CloudWatch Logs contain detailed error information for troubleshooting.

Why this answer

Amazon CloudWatch Logs capture detailed error messages from AWS Backup jobs, allowing the team to identify the root cause of intermittent failures. Option A is incorrect because while IAM permissions are necessary, intermittent failures are more likely due to transient issues detectable in logs. Option C is incorrect because switching to SAP HANA Studio does not leverage AWS Backup's integration and may not resolve underlying issues.

Option D is incorrect because increasing backup frequency does not address the cause of failures and may increase load.

Full explanation →
436
MCQeasy

An SAP system administrator needs to restart a critical SAP application server EC2 instance that is part of a cluster. Which approach minimizes downtime?

A.Modify the instance type in the AWS Management Console.
B.Reboot the instance from the AWS Management Console.
C.Stop and start the instance from the AWS Management Console.
D.Terminate the instance and launch a new one with the same AMI.
AnswerB

Reboot is the fastest recovery without changing the host.

Why this answer

Rebooting the instance restarts the operating system without changing the underlying host. The instance retains its public and private IP addresses, elastic network interfaces, and instance store data, minimizing downtime for the SAP application. Modifying the instance type (Option A) requires a stop/start, which moves the instance to a new host and increases downtime.

Stopping and starting the instance (Option C) also changes the host and takes longer than a reboot. Terminating the instance and launching a new one (Option D) loses any data on instance store volumes and requires full reconfiguration, causing prolonged downtime.

Full explanation →
437
MCQmedium

An SAP system running on AWS is experiencing high latency to its S3-backed backup destination. Which architectural change would most effectively reduce backup latency?

A.Configure an S3 Gateway Endpoint in the VPC to route traffic to S3 privately.
B.Increase the size of the EC2 instance running SAP to improve I/O throughput.
C.Move the SAP instance to a different Availability Zone closer to the S3 bucket.
D.Enable S3 Transfer Acceleration on the backup bucket.
AnswerA

An S3 Gateway Endpoint keeps traffic within the AWS network, reducing latency and improving performance.

Why this answer

An S3 Gateway Endpoint provides a private, low-latency path from the SAP EC2 instance to S3 without traversing the public internet or NAT gateways. This eliminates network hops and reduces latency by keeping traffic within the AWS network, directly addressing the high-latency issue for S3-backed backups.

Exam trap

The trap here is that candidates often confuse S3 Transfer Acceleration (which is for long-distance, cross-region speed) with a solution for within-region latency, or assume that moving to a different Availability Zone reduces latency to a regional service like S3.

How to eliminate wrong answers

Option B is wrong because increasing EC2 instance size improves compute and I/O throughput for local storage, but does not reduce network latency to S3, which is the root cause. Option C is wrong because moving the SAP instance to a different Availability Zone does not change the physical distance to the S3 bucket (S3 is a regional service), and may even increase latency if the new AZ is farther from the S3 endpoints. Option D is wrong because S3 Transfer Acceleration optimizes upload speed over long distances via edge locations, but adds overhead and cost; it does not reduce latency for backups within the same region and may actually increase latency for short-distance transfers.

Full explanation →
438
Multi-Selecthard

A company is migrating its SAP ECC system to SAP S/4HANA on AWS. The current database is running on Oracle. They want to minimize downtime during the migration. Which TWO services or features should they consider to achieve a near-zero downtime migration? (Select TWO.)

Select 2 answers
A.Use AWS Snowball to transfer the initial Oracle data dump to AWS.
B.Use SAP HANA System Replication (HSR) for the final synchronization.
C.Use EC2 Hibernate to pause the source instance during cutover.
D.Use AWS Database Migration Service (DMS) for ongoing replication from Oracle to HANA.
E.Use Amazon EBS Snapshots for point-in-time recovery and replication.
AnswersA, D

Snowball is for offline data transfer, not for near-zero downtime.

Why this answer

To achieve near-zero downtime migration from Oracle to SAP HANA on AWS, two key services are recommended: AWS Snowball for the initial bulk data transfer to AWS, and AWS Database Migration Service (DMS) for ongoing replication of changes from Oracle to HANA. SAP HANA System Replication (HSR) is used for replication between two HANA systems, not for heterogeneous migration from Oracle. EC2 Hibernate and EBS Snapshots are not designed for live database migration across different engines.

Exam trap

A common mistake is thinking that SAP HANA System Replication can be used for migrating from Oracle to HANA. HSR only works between HANA databases, not for cross-platform replication. Also, EC2 Hibernate cannot facilitate database migration.

Full explanation →
439
MCQeasy

A company is running SAP on AWS and needs to encrypt all data at rest for the SAP HANA database. Which AWS service should be used to manage the encryption keys?

A.AWS CloudHSM
B.AWS Key Management Service (KMS)
C.AWS Secrets Manager
D.AWS Certificate Manager (ACM)
AnswerB

KMS is used to manage encryption keys for data at rest.

Why this answer

AWS Key Management Service (KMS) is the correct service for managing encryption keys for SAP HANA on AWS because it provides a centralized, highly available key management system that integrates directly with AWS services and supports envelope encryption. For SAP HANA, KMS can be used to encrypt the EBS volumes, S3 buckets, or other storage where HANA data resides, and it allows you to control key rotation, access policies, and auditing via AWS CloudTrail, meeting the requirement to encrypt data at rest.

Exam trap

The trap here is that candidates confuse AWS CloudHSM with KMS, thinking that because CloudHSM provides dedicated HSMs it must be the correct choice for key management, but the question specifically asks for a service to 'manage' encryption keys, which is KMS's core function, while CloudHSM is a raw HSM service that requires manual key management and lacks native integration with AWS storage services for transparent encryption.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for generating and storing keys, but it is not a key management service; it requires you to manage the HSM cluster and client software yourself, and it does not natively integrate with SAP HANA or AWS services for automatic encryption of data at rest without custom development. Option C is wrong because AWS Secrets Manager is designed to manage and rotate secrets such as database credentials, API keys, and passwords, not to manage encryption keys for data-at-rest encryption; it stores secrets but does not perform encryption operations or integrate with storage services for transparent encryption. Option D is wrong because AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates for securing network communications, not for managing encryption keys for data at rest; it does not provide key management for storage encryption.

Full explanation →
440
MCQhard

An SAP system on AWS uses a shared file system with Amazon EFS. The operations team notices that file operations have high latency during peak hours. The EFS file system is configured with Bursting Throughput mode. The team monitors the CloudWatch metric PercentIOLimit and sees it consistently at 100%. What should the team do to improve performance?

A.Enable encryption at rest for the file system
B.Change the performance mode to General Purpose
C.Increase the size of the file system by adding more files
D.Change the file system to Provisioned Throughput mode
AnswerD

Provisioned Throughput ensures consistent throughput regardless of burst credits.

Why this answer

PercentIOLimit at 100% indicates the file system is using all its burst credits. To avoid throttling, the team should change to Provisioned Throughput mode or increase the amount of data stored to earn more credits. Changing to General Purpose performance mode affects latency, not throughput.

Enabling encryption adds overhead. Increasing file system size indirectly helps earn more credits but is not a direct solution.

Full explanation →
441
MCQmedium

An SAP administrator runs the above CLI command to find the public IP of an m5.2xlarge instance. The output is null. Which of the following is the most likely reason?

A.The security group blocks the public IP
B.The CLI command has a syntax error
C.The instance type m5.2xlarge does not support public IP addresses
D.The instance does not have a public IP address assigned
AnswerD

The instance may be in a private subnet or launched without a public IP.

Why this answer

The CLI command `aws ec2 describe-instances --instance-ids <id> --query 'Reservations[0].Instances[0].PublicIpAddress'` returns null because the instance does not have a public IP address assigned. In AWS, a public IP is only assigned to an instance if it is launched in a subnet that auto-assigns public IPv4 addresses, or if an Elastic IP is attached. The command itself is syntactically correct and will output null (or an empty string) when no public IP exists, not an error.

Exam trap

The trap here is that candidates may incorrectly attribute the null output to a security group blocking the IP or a syntax error, rather than understanding that the instance simply lacks a public IP address due to subnet configuration or missing Elastic IP.

How to eliminate wrong answers

Option A is wrong because security groups do not block or hide the public IP address; they control inbound/outbound traffic at the instance level, but the public IP metadata is still available via the EC2 API regardless of security group rules. Option B is wrong because the CLI command shown is syntactically valid; if there were a syntax error, the AWS CLI would return an error message (e.g., 'Bad value for --query'), not a null output. Option C is wrong because the m5.2xlarge instance type fully supports public IP addresses; public IP assignment depends on subnet settings or Elastic IP association, not on the instance type.

Full explanation →
442
MCQeasy

An SAP administrator is troubleshooting connectivity between an SAP application server (security group sg-12345) and an SAP HANA database server. The inbound rule on the database security group is shown in the exhibit. Which additional configuration is required for the application server to communicate with the database?

A.Add an inbound rule allowing traffic from the application server's IP address.
B.Add an inbound rule to the application server's security group.
C.Modify the network ACL to allow inbound traffic on port 3300.
D.No additional rule is needed; the rule allows traffic from sg-12345.
AnswerC

NACLs are stateless and must allow both inbound and outbound traffic.

Why this answer

The security group inbound rule already references the application server's security group (sg-12345), which allows traffic from any instance with that security group. However, network ACLs (NACLs) are stateless and must allow both inbound and outbound traffic separately. If the NACL does not have an inbound rule allowing traffic on port 3300 (the default HANA database port), the traffic will be blocked at the subnet level despite the security group rule.

Modifying the NACL to allow inbound traffic on port 3300 is required. Option A is incorrect because the security group rule already allows traffic from the application server's IP via the security group reference. Option B is incorrect because the application server's security group only controls outbound traffic to the database; the inbound rule on the database SG is already sufficient.

Option D is incorrect because the NACL must be configured properly; the security group rule alone does not guarantee connectivity if the NACL blocks the traffic.

Full explanation →
443
MCQhard

An SAP Basis administrator is troubleshooting a performance issue on a SAP HANA database running on an r5.4xlarge instance with dedicated tenancy. The instance is part of a placement group named 'sap-cluster'. The administrator suspects network throughput is suboptimal. Based on the exhibit, what is the MOST likely reason?

A.Dedicated tenancy prevents the use of Enhanced Networking.
B.The instance type r5.4xlarge does not support Enhanced Networking.
C.The placement group 'sap-cluster' restricts network throughput.
D.The instance is using the Xen paravirtual network driver (xen-net) instead of Enhanced Networking with ENA, resulting in suboptimal throughput.
AnswerD

Xen hypervisor indicates no Enhanced Networking.

Why this answer

The exhibit shows the network driver is 'xen-net', indicating the instance is using the Xen PV (paravirtual) driver instead of the Elastic Network Adapter (ENA). While the r5.4xlarge instance uses the Nitro hypervisor, launching with an older AMI that lacks ENA support results in the Xen PV driver being used. This driver does not provide the advanced networking features of ENA, leading to suboptimal network throughput.

Therefore, the most likely reason is option D, as the instance is effectively using a Xen-based driver configuration that does not support ENA.

Exam trap

The trap here is that candidates may assume all modern instance types automatically have Enhanced Networking enabled, but the actual driver and AMI support determine whether ENA is used, and the exhibit's network driver information reveals the root cause.

How to eliminate wrong answers

Option A is wrong because dedicated tenancy does not prevent the use of Enhanced Networking; Enhanced Networking with ENA is supported on dedicated instances. Option B is wrong because the r5.4xlarge instance type fully supports Enhanced Networking with ENA. Option C is wrong because placement groups do not restrict network throughput; they can actually improve network performance by placing instances in close proximity within a single Availability Zone.

Full explanation →
444
Multi-Selectmedium

Which THREE factors should be considered when selecting an EC2 instance type for an SAP HANA production system? (Choose three.)

Select 3 answers
A.The instance type must have sufficient memory capacity for the HANA database.
B.The instance type must provide adequate network bandwidth for replication and backups.
C.The instance type must have GPU acceleration for HANA analytics.
D.The instance type must be certified by SAP for SAP HANA.
E.The instance type must have a high number of vCPUs regardless of memory.
AnswersA, B, D

HANA is memory-intensive.

Why this answer

SAP HANA is an in-memory database that loads all data into RAM for processing, so the EC2 instance must have sufficient memory capacity to accommodate the HANA database size, including overhead for operations and growth. AWS provides specific EC2 instance types (e.g., x1e, x1, r5, u-6tb1) with large memory configurations tailored for SAP HANA workloads.

Exam trap

The trap here is that candidates may assume GPU acceleration (option C) is needed for HANA analytics due to the term 'analytics,' but SAP HANA does not leverage GPUs; instead, it uses CPU SIMD instructions and memory bandwidth for high-performance query processing.

Full explanation →
445
MCQhard

An SAP administrator notices that the sapstartsrv process on an EC2 instance is failing to start after a system reboot. The instance is running SUSE Linux Enterprise Server (SLES) for SAP Applications. Which of the following log files should be examined FIRST to diagnose the issue?

A./var/log/messages
B./usr/sap/<SID>/SYS/global/sapstartsrv.log
C.SAP HANA studio trace files
D.Amazon CloudWatch logs for the instance
AnswerB

The sapstartsrv log file contains detailed information about the startup process of the SAP start service.

Why this answer

The sapstartsrv process log is stored in /usr/sap/<SID>/SYS/global/sapstartsrv.log (Option B). This log contains startup and error messages specific to the sapstartsrv process, making it the first place to check for failures after a reboot. Option A (/var/log/messages) is a general system log that may contain kernel or hardware messages but not SAP-specific process details.

Option C (SAP HANA studio trace files) is used for database issues, not the sapstartsrv process. Option D (Amazon CloudWatch logs) requires prior configuration to capture local boot logs and would not be the first choice for a local SAP process failure.

Full explanation →
446
MCQhard

A company is designing a high-availability architecture for SAP NetWeaver on AWS. The architecture includes two application server instances in different Availability Zones, a shared file system using Amazon EFS, and a database using SAP HANA with HANA System Replication (HSR). During a failover test, the application servers cannot connect to the database after the HANA secondary becomes the primary. What is the most likely cause?

A.HANA System Replication is not configured correctly for automatic failover.
B.The SAP application servers are configured with the hostname of the primary HANA instance, which did not update after failover.
C.The Amazon EFS file system is not available in the secondary Availability Zone.
D.The security group of the application servers does not allow outbound traffic to the secondary HANA instance.
AnswerB

Application servers need to have a virtual hostname or use a DNS name that updates to the new primary.

Why this answer

In SAP NetWeaver, application servers connect to the database using a fixed hostname or virtual IP address. After HANA System Replication (HSR) failover, the secondary becomes the primary but retains its own hostname unless a virtual hostname (e.g., using Amazon Route 53 or Elastic IP) is configured to automatically update. If the application servers are hardcoded with the original primary's hostname, they cannot resolve or reach the new primary, causing connection failure.

Exam trap

The trap here is that candidates often assume HSR automatic failover (Option A) is the root cause, but the real issue is the lack of a virtual hostname or DNS update mechanism, which is a common misconfiguration in SAP on AWS architectures.

How to eliminate wrong answers

Option A is wrong because HSR automatic failover is not required for the application servers to reconnect; even with manual failover, the connection would fail if the hostname is not updated. Option C is wrong because Amazon EFS is a regional, multi-AZ service that is available in all Availability Zones simultaneously, so its availability does not affect database connectivity. Option D is wrong because outbound traffic from application servers to the secondary HANA instance is typically allowed by default in security groups; the issue is name resolution, not network access.

Full explanation →
447
MCQhard

An SAP system on AWS is experiencing high latency between the application server and the database server. Both servers are in the same VPC but in different Availability Zones. Which action should the administrator take to reduce latency?

A.Create a placement group and launch both instances in it
B.Move the application and database servers to the same Availability Zone
C.Upgrade the instance types to compute-optimized instances
D.Use AWS Direct Connect to connect the servers
AnswerB

Reduces network latency.

Why this answer

Moving both servers to the same Availability Zone (Option B) reduces network latency because data does not have to traverse the AZ boundary, which adds extra network hops and latency. Creating a placement group (Option A) can help co-locate instances but does not guarantee they are in the same AZ unless specified, and even then, moving to the same AZ is simpler. Upgrading instance types (Option C) does not affect network latency.

AWS Direct Connect (Option D) is for connecting on-premises networks to AWS, not for inter-instance communication within a VPC.

Full explanation →
448
MCQhard

An SAP administrator uses an IAM role attached to an EC2 instance to perform backups. The backup script fails when trying to write to an S3 bucket and create EBS snapshots. What is the most likely cause?

A.The S3 bucket policy denies all writes from this role.
B.The trust policy does not include the EC2 service principal.
C.The role does not have permission to create snapshots due to an explicit deny.
D.The policy lacks 's3:ListBucket' and 'ec2:CreateSnapshot' requires volume ARN.
AnswerB

Correct. Without the EC2 service principal in the trust policy, the instance cannot assume the role, causing all API calls to fail.

Why this answer

The most likely cause is that the trust policy of the IAM role does not include the EC2 service principal (ec2.amazonaws.com). Without this, the EC2 instance cannot assume the role, causing all AWS API calls from the backup script to fail, including writing to S3 and creating EBS snapshots. Options A and C only affect specific actions, and D incorrectly includes s3:ListBucket as a requirement.

Exam trap

Candidates often focus on missing S3 or EC2 permissions but overlook the prerequisite trust policy. If the instance cannot assume the role, no permissions are applied.

How to eliminate wrong answers

Option A is wrong because a bucket policy that denies all writes from this role would explicitly block writes, but the question states the script fails when trying to write and create snapshots, implying a broader permission issue rather than a targeted deny. Option B is wrong because the trust policy already allows the EC2 service principal to assume the role (the role is attached to the EC2 instance), so the trust policy is not the cause. Option C is wrong because an explicit deny for snapshot creation would cause a failure, but the question's scenario points to missing permissions (not an explicit deny) as the root cause, and the error is more likely due to missing resource ARN requirements.

Full explanation →
449
MCQmedium

A company wants to centralize monitoring of EC2 instance metrics across multiple AWS accounts. Which solution is MOST scalable and cost-effective?

A.Log in to each account and view CloudWatch metrics individually.
B.Use CloudWatch cross-region metrics to aggregate metrics in a single account.
C.Configure each account to publish metrics to an S3 bucket and use Athena to query.
D.Set up CloudWatch cross-account observability with a monitoring account.
AnswerD

CloudWatch cross-account observability natively centralizes monitoring from multiple accounts into a single monitoring account, making it both scalable and cost-effective.

Why this answer

CloudWatch cross-account observability (option D) is the most scalable and cost-effective solution for centralizing monitoring across multiple AWS accounts, as it allows a single monitoring account to aggregate metrics, logs, and traces from source accounts without manual logins or complex data pipelines. Option A, while not scalable for large environments, can be used for simple, ad-hoc checks in small setups; however, the question specifically asks for the MOST scalable and cost-effective approach, which is solely option D. The previous marking of option B as correct was in error; option B refers to cross-region metrics, which do not aggregate across accounts.

Option C is inefficient and costly due to storage and query overhead.

Exam trap

Candidates may confuse cross-region metrics (option B) with cross-account observability, or overcomplicate the solution with S3 and Athena (option C). The key is to recognize that cross-account observability is purpose-built for this scenario.

How to eliminate wrong answers

Option A is wrong because manually logging into each account to view metrics individually is not scalable and introduces operational overhead, especially as the number of accounts grows. Option B is wrong because CloudWatch cross-region metrics aggregate metrics across regions, not across accounts; they do not solve the multi-account centralization requirement. Option C is wrong because publishing metrics to an S3 bucket and querying with Athena incurs additional costs for S3 storage, Athena query execution, and data transfer, and it adds latency and complexity compared to native CloudWatch cross-account observability.

Full explanation →
450
MCQhard

An SAP system is experiencing high CPU utilization on the application server. CloudWatch metrics show that the CPU credit balance for the T3 instance is frequently depleted. What is the most cost-effective solution to resolve this issue while maintaining performance?

A.Add more vCPUs by changing to a C5 instance.
B.Enable T3 unlimited on the instance.
C.Change the instance type to M5.large.
D.Increase the size of the EBS volumes.
AnswerB

T3 unlimited allows the instance to burst beyond the baseline, paying extra only when credits are exhausted, which is cost-effective for intermittent spikes.

Why this answer

Enabling T3 unlimited allows the instance to burst beyond its baseline CPU utilization by spending credits, and when credits are exhausted, it can still burst by incurring a small additional charge per vCPU-hour. This is the most cost-effective solution as it avoids the need to migrate to a larger or different instance type, while maintaining performance for the SAP system's variable workloads.

Exam trap

The trap here is that candidates often assume the only way to fix CPU credit exhaustion is to move to a larger or non-burstable instance, overlooking the cost-effective T3 unlimited feature that allows continued bursting with minimal additional cost.

How to eliminate wrong answers

Option A is wrong because changing to a C5 instance adds more vCPUs and increases cost unnecessarily; the issue is not a lack of vCPUs but the T3 instance's credit exhaustion, which is a burstable performance limitation. Option C is wrong because changing to an M5.large instance is a larger, non-burstable instance type that would increase cost without addressing the root cause of credit depletion; it may also provide more baseline CPU than needed, leading to wasted resources. Option D is wrong because increasing EBS volume size does not affect CPU credit balance or CPU utilization; it addresses storage performance, not compute performance.

Full explanation →
Page 5

Page 6 of 22

Page 7

All pages

12345678910111213141516171819202122

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWSTechnologyMigrationOperations and Maintenance
See all domains with question counts →