Courseiva

AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 451–525

1616 questions total · 22pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 22

Page 8
451
MCQeasy

A company is deploying a new SAP BusinessObjects system on AWS. The system will consist of multiple servers: a CMS database server, an audit database server, and several processing servers. The administrator needs to ensure that all servers can communicate with each other and with corporate on-premises systems via a VPN connection. The AWS environment is in a single VPC with public and private subnets. Which network architecture should be used to meet these requirements?

A.Place servers in private subnets and use a NAT Gateway for outbound internet and a VPN gateway for on-premises connectivity.
B.Place all servers in public subnets with Elastic IPs and use security groups to restrict access.
C.Use a single public subnet for all servers and rely on network ACLs for isolation.
D.Place servers in private subnets and use a bastion host for all inter-server communication.
AnswerA

Private subnets with NAT and VPN provide secure connectivity.

Why this answer

Placing the SAP BusinessObjects servers in private subnets ensures they are not directly exposed to the internet, which is a security best practice. A NAT Gateway provides outbound internet access for tasks like software updates, while a VPN Gateway (or Virtual Private Gateway) establishes encrypted connectivity to the corporate on-premises systems, meeting the requirement for inter-server and hybrid communication.

Exam trap

The trap here is that candidates often confuse the purpose of a NAT Gateway (outbound internet only) with a bastion host (administrative access) or mistakenly think public subnets are acceptable for SAP servers, ignoring the security and compliance requirements for private, isolated workloads.

How to eliminate wrong answers

Option B is wrong because placing all servers in public subnets with Elastic IPs exposes them directly to the internet, violating security best practices and increasing the attack surface unnecessarily. Option C is wrong because using a single public subnet for all servers and relying solely on network ACLs for isolation does not provide the private, secure environment required for SAP workloads and does not address the need for VPN-based on-premises connectivity. Option D is wrong because a bastion host is used for administrative access to private instances, not for inter-server communication; inter-server traffic should flow directly within the VPC using private IPs, not be routed through a bastion host.

Full explanation →
452
Multi-Selectmedium

Which AWS service can be used to monitor the performance of SAP HANA databases running on EC2 instances?

Select 1 answer
A.Amazon CloudWatch
B.Amazon Inspector
C.Amazon RDS Performance Insights
D.AWS X-Ray
E.AWS Config
AnswersA

Correct – Amazon CloudWatch can monitor EC2-hosted SAP HANA via custom metrics.

Why this answer

Amazon CloudWatch is the primary AWS service for monitoring the performance of SAP HANA databases on EC2. It can collect custom metrics such as CPU utilization, memory usage, disk I/O, and SAP HANA-specific metrics (e.g., row store memory, column store memory) via the CloudWatch agent or monitoring scripts. The other listed services (Inspector, RDS Performance Insights, X-Ray, Config) are not designed for or capable of directly monitoring self-managed SAP HANA database performance on EC2.

Exam trap

The original question implied two services, but only one AWS service in the list (CloudWatch) is suitable for SAP HANA performance monitoring. Avoid forcing a second answer where none exists; RDS Performance Insights, for example, is exclusive to Amazon RDS and cannot monitor self-managed databases on EC2.

Full explanation →
453
MCQmedium

A company is migrating its SAP landscape to AWS and wants to use SAP HSR (System Replication) for high availability. Which AWS feature is required to support SAP HSR?

A.Elastic IP addresses for each instance
B.Internet Gateway attached to the VPC
C.Both instances in the same VPC with private IP connectivity
D.NAT Gateway for outbound traffic
AnswerC

Low-latency private IP connectivity is required for SAP HSR.

Why this answer

SAP HSR (System Replication) requires low-latency, reliable connectivity between the primary and secondary instances to synchronize data in real-time. Placing both instances in the same VPC enables them to communicate using private IP addresses, which are internal to the VPC and typically have lower latency and higher throughput compared to public IPs. This setup is essential for meeting the RPO and RTO requirements of SAP HSR.

Options A (Elastic IP), B (Internet Gateway), and D (NAT Gateway) are not necessary for HSR and may introduce additional complexity or security risks.

Full explanation →
454
MCQmedium

A company is running an SAP HANA database on an AWS EC2 instance. The system administrator needs to ensure that the database logs are automatically backed up to Amazon S3 and retained for 30 days. Which combination of AWS services can achieve this with minimal operational overhead?

A.Use Amazon CloudWatch Logs with a retention policy of 30 days.
B.Use an S3 Lifecycle Policy to transition logs to S3 Glacier after 30 days.
C.Use an S3 Lifecycle Policy to transition logs to S3 Standard-IA after 30 days.
D.Use AWS Backup to schedule backups of the EC2 instance.
AnswerB

This option uses an S3 Lifecycle Policy to transition logs to S3 Glacier after 30 days. Assuming logs are already in an S3 bucket, the lifecycle policy automates the transition, meeting the retention requirement with minimal operational overhead. This is the correct answer.

Why this answer

An S3 Lifecycle Policy can automatically transition logs to S3 Glacier after 30 days, providing a cost-effective long-term storage option with minimal operational overhead. Option A is incorrect because CloudWatch Logs stores logs in CloudWatch, not S3, and does not automatically back up database logs to S3. Option C is incorrect because S3 Standard-IA is optimized for infrequently accessed data that requires rapid access, not for archival retention; transitioning logs to Standard-IA after 30 days does not provide the cost benefits of Glacier for data that may need to be retained beyond the initial 30-day period.

Option D is incorrect because AWS Backup is designed for backing up entire EC2 instances, not individual log files.

Full explanation →
455
MCQmedium

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances running SAP Web Dispatcher. The ALB has a target group with health checks configured on port 8080. Recently, the operations team noticed that some instances are being deregistered due to health check failures. The instances are healthy and the Web Dispatcher is running. The health check response time is consistently below 2 seconds. What is the most likely cause?

A.The health check interval is too short, causing the threshold to be exceeded.
B.The security group for the instances blocks inbound traffic from the internet.
C.The instances are running out of memory.
D.The health check path is incorrect.
AnswerA

The health check interval is too short, causing the threshold to be exceeded. When the interval is too short, the ALB sends health checks more frequently, and if the threshold is low, a temporary slow response can trigger a failure.

Why this answer

A health check interval that is too short can cause the threshold to be exceeded even though the instances are healthy. If the interval is set very low, the ALB may send health checks more frequently than the instance can respond, leading to occasional timeouts or failures that accumulate and cross the unhealthy threshold. Option B is incorrect because the ALB health checks originate from the ALB's own subnet IPs, not from the internet, so a security group blocking internet traffic would not affect health checks.

Option C is incorrect because memory exhaustion would typically cause application-level failures, not health check failures on port 8080 if Web Dispatcher is still running. Option D is incorrect because an incorrect health check path would cause all health checks to fail consistently, not just some instances intermittently.

Full explanation →
456
MCQmedium

A company is migrating an SAP ERP system to AWS. The SAP system uses a central instance (CI) and dialog instances. The migration must minimize downtime. Which AWS service should be used to replicate the application servers in near real-time?

A.Amazon S3 Replication
B.AWS DataSync
C.AWS Elastic Disaster Recovery (AWS DRS)
D.AWS Backup
AnswerC

AWS DRS provides continuous block-level replication for low RPO.

Why this answer

AWS Elastic Disaster Recovery (DRS) provides continuous replication of block-level data, enabling near real-time replication of application servers. Option A (AWS Backup) is for scheduled backups, not real-time replication. Option B (AWS DataSync) is for one-time data transfers.

Option D (Amazon S3 replication) is for S3 objects.

Full explanation →
457
MCQeasy

A company is planning to run SAP HANA on AWS and needs to ensure that the instance is optimally placed for low latency between the application and database tiers. Which AWS feature should be used?

A.Application Load Balancer
B.VPC endpoint
C.Cluster placement group
D.Auto Scaling group
AnswerC

Cluster placement groups provide low-latency network performance within an AZ.

Why this answer

A cluster placement group is the correct choice because it provides low-latency, high-throughput network connectivity by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth. For SAP HANA, where the application and database tiers require sub-millisecond latency for optimal performance, a cluster placement group ensures that all instances are physically close together, minimizing network hops and jitter.

Exam trap

The trap here is that candidates often confuse a cluster placement group with a spread placement group or partition placement group, assuming any placement group reduces latency, but only the cluster type is designed for low-latency, tightly coupled workloads like SAP HANA.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer operates at Layer 7 and distributes traffic across multiple targets, but it does not influence the physical proximity or network latency between instances; it adds network hops rather than reducing them. Option B is wrong because a VPC endpoint enables private connectivity to AWS services (e.g., S3, DynamoDB) without traversing the internet, but it does not affect the placement or latency between EC2 instances within the same VPC. Option D is wrong because an Auto Scaling group manages instance count and health based on scaling policies, but it does not control the physical placement of instances to achieve low latency; instances in an Auto Scaling group can be spread across multiple Availability Zones, increasing latency.

Full explanation →
458
Multi-Selecthard

A company runs SAP ERP on AWS. The system includes a primary application server and a secondary application server for high availability. The secondary server is not receiving updates from the primary. Which THREE steps should the administrator take to investigate?

Select 3 answers
A.Restart the secondary application server to force a resync.
B.Verify network connectivity between the primary and secondary servers using ping or telnet on SAP ports.
C.Review the SAP message server trace logs for errors.
D.Check the status of SAP enqueue replication using transaction SM51.
E.Check the SAP Gateway service status on the primary server.
AnswersB, C, D

Network issues are a common cause of replication failure.

Why this answer

Options B, C, and D are correct. Verifying network connectivity between the primary and secondary servers (B) ensures that the servers can communicate. Reviewing the SAP message server trace logs (C) can reveal communication errors or replication issues.

Checking the status of SAP enqueue replication using transaction SM51 (D) confirms whether locks are being replicated. Option A is incorrect because restarting the secondary server without investigation may disrupt operations and does not address the root cause. Option E is incorrect because checking the SAP Gateway service is not directly relevant to replication issues between application servers.

Full explanation →
459
MCQhard

An SAP administrator created the above IAM policy for an EC2 instance that performs automated SAP HANA backups. The backup script runs successfully but fails to upload the backup files to the S3 bucket. What is the most likely cause?

A.The S3 bucket policy denies the upload
B.The IAM policy does not include permissions for multipart upload operations
C.The IAM policy does not allow s3:PutObject
D.The EC2 instance does not have permission to create snapshots
AnswerB

Multipart uploads require additional actions like s3:AbortMultipartUpload.

Why this answer

The IAM policy shown in the question (not fully displayed here) likely includes s3:PutObject but omits the required s3:PutObjectPart and s3:AbortMultipartUpload permissions. SAP HANA backups often produce large files that exceed the 5 GB single-upload limit, forcing the AWS CLI or SDK to use multipart upload. Without these permissions, the upload fails after the script runs successfully.

Exam trap

The key trap is that s3:PutObject alone is insufficient for large uploads; candidates mistakenly assume that granting s3:PutObject covers all upload scenarios when multipart upload permissions are also required.

How to eliminate wrong answers

Option A is wrong because the question states the backup script runs successfully and only fails during the upload to S3, implying the S3 bucket policy is not the issue; if it denied the upload, the script would fail earlier or receive an Access Denied error. Option B is wrong because it is actually the correct answer. Option C is wrong because the IAM policy does include s3:PutObject (as the script runs and attempts the upload), but the failure occurs due to missing multipart upload permissions.

Option D is wrong because the question is about uploading to S3, not creating snapshots; EC2 snapshot permissions are irrelevant to S3 uploads.

Full explanation →
460
MCQeasy

A company is migrating an SAP system to AWS. They need to ensure that the migration complies with regulatory requirements for data residency. Which of the following is the most important consideration?

A.Use AWS Artifact to get compliance reports.
B.Select an AWS Region that meets data residency requirements.
C.Encrypt the data at rest using AWS KMS.
D.Store backups in an S3 bucket in a different Region.
AnswerB

Region selection is the primary control for data residency.

Why this answer

Selecting an AWS Region that meets data residency requirements is crucial. AWS Artifact provides compliance reports but does not enforce data residency. Encryption and backup locations are secondary to region selection.

Full explanation →
461
MCQmedium

A company is running SAP on AWS and needs to ensure high availability for their SAP HANA database. They have set up a multi-AZ deployment with replication. During a planned failover test, the secondary node fails to take over. Which AWS service should be used to monitor and automatically remediate the replication status?

A.AWS Elastic Beanstalk
B.AWS Direct Connect
C.Amazon CloudWatch
D.AWS Lambda
AnswerC

Amazon CloudWatch can monitor SAP HANA replication status via custom metrics and automatically trigger remediation actions using CloudWatch Alarms, making it the appropriate choice.

Why this answer

Amazon CloudWatch is the correct service to monitor SAP HANA replication status. It can track metrics such as replication lag or state and, through CloudWatch Alarms, automatically trigger remediation actions like invoking an AWS Lambda function or an AWS Systems Manager Automation runbook to restart replication or adjust configurations. AWS Direct Connect is a network connectivity service and does not monitor or remediate database replication.

AWS Elastic Beanstalk is a PaaS service for web applications, not HANA replication. AWS Lambda can perform remediation but does not natively monitor; it requires CloudWatch for triggering.

Full explanation →
462
MCQhard

An SAP administrator is troubleshooting a failed backup of an SAP HANA database running on an EC2 instance. The backup is configured to use AWS Backup with a backup vault. The error log shows: 'AccessDenied: User: arn:aws:sts::123456789012:assumed-role/AWSBackupRole/backup-job is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/abcd1234-...' Which IAM policy modification is required to resolve this issue?

A.Add cloudhsm:Decrypt permission to the backup role.
B.Add kms:Decrypt permission to the backup role on the KMS key.
C.Add kms:CreateGrant permission to the backup role.
D.Add kms:Encrypt permission to the backup role.
AnswerB

The error shows that the backup role is not authorized to perform kms:Decrypt on the KMS key; adding this permission will resolve the issue.

Why this answer

The error indicates that the backup role is missing the kms:Decrypt permission on the KMS key used to encrypt the backup vault. This permission is necessary to decrypt the data during the backup process. Option A is incorrect because cloudhsm:Decrypt is unrelated to KMS keys.

Option C is incorrect because kms:CreateGrant is used to create grants for cross-account access, not for decryption. Option D is incorrect because kms:Encrypt is used for encryption, not decryption.

Full explanation →
463
MCQhard

An SAP landscape on AWS includes several instances in a VPC. The administrator needs to ensure that SAProuter can connect to the SAP system from the internet securely. Which networking component should be used?

A.AWS Direct Connect with a public VIF
B.Internet Gateway with a public IP on the SAProuter instance
C.AWS CloudFront with a security group
D.AWS VPN connection to the customer's network
AnswerD

VPN provides encrypted tunnel for secure SAProuter communication.

Why this answer

An AWS VPN connection establishes an encrypted tunnel over the internet between the customer's on-premises network and the VPC, allowing SAProuter to connect securely to the SAP system without exposing any instance to the public internet. This aligns with the requirement for secure, authenticated connectivity from the internet while maintaining network isolation.

Exam trap

The trap here is that candidates often confuse 'secure connectivity from the internet' with simply providing internet access via an Internet Gateway, overlooking the need for encrypted tunneling and network isolation that a VPN provides.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect with a public VIF provides a dedicated network connection to AWS public services, but it does not inherently secure SAProuter traffic from the internet; it bypasses the internet but still requires additional security measures and does not address the 'from the internet' requirement directly. Option B is wrong because attaching an Internet Gateway with a public IP on the SAProuter instance exposes the instance directly to the internet, violating security best practices for SAP systems and increasing the attack surface. Option C is wrong because AWS CloudFront is a content delivery network (CDN) for distributing static and dynamic web content, not a networking component for routing SAProuter traffic; it cannot establish a secure tunnel for SAProuter's proprietary protocol.

Full explanation →
464
MCQeasy

A company is migrating its SAP ERP system (with Oracle database) to AWS using the SAP-certified approach. The current on-premises environment uses Oracle RAC for high availability. The company wants to reduce licensing costs and simplify the architecture on AWS. Which of the following is the MOST efficient migration strategy?

A.Use AWS DMS to migrate the database to Amazon RDS for Oracle, but then configure RDS for Oracle RAC.
B.Use AWS DataSync to copy the Oracle database files to EBS volumes, then restore on an EC2 instance.
C.Use AWS DMS to migrate the Oracle database to Amazon RDS for Oracle with a single instance. Use AWS MGN for the application servers.
D.Lift-and-shift the Oracle RAC cluster to EC2 using AWS Application Migration Service.
AnswerC

This reduces licensing costs and simplifies the architecture. DMS supports Oracle as source and target RDS Oracle.

Why this answer

AWS does not support Oracle RAC in a fully supported manner for SAP. The best practice is to migrate to Amazon RDS for Oracle (single instance) or use a single Oracle instance on EC2. Using AWS DMS with ongoing replication minimizes downtime.

Option C is correct because it uses DMS to migrate the Oracle database to Amazon RDS for Oracle single instance, which reduces licensing costs, and AWS MGN for the application servers, simplifying the architecture. Option A is incorrect because RDS for Oracle does not support Oracle RAC. Option B uses AWS DataSync, which is for file transfer, not database replication.

Option D keeps Oracle RAC, which is costly and not simplified.

Full explanation →
465
MCQeasy

An SAP system on AWS needs to be highly available across two Availability Zones. The application tier runs on EC2 instances behind an Application Load Balancer. The database tier uses an RDS Multi-AZ deployment. What additional step is REQUIRED to ensure complete high availability for the application tier?

A.Use a larger EC2 instance type.
B.Launch EC2 instances in at least two different Availability Zones.
C.Enable EBS Multi-Attach for the root volumes.
D.Configure an Auto Scaling group with a dynamic scaling policy.
AnswerB

Ensures application survives AZ failure.

Why this answer

For the application tier to be highly available across two Availability Zones, EC2 instances must be distributed across at least two AZs so that if one AZ fails, the Application Load Balancer can route traffic to instances in the other AZ. Option B directly addresses this requirement. Without instances in multiple AZs, the application tier remains a single point of failure, even if the ALB and RDS Multi-AZ are configured correctly.

Exam trap

The trap here is that candidates often assume an Auto Scaling group (Option D) automatically provides high availability across AZs, but without explicitly configuring subnets in multiple AZs and a multi-AZ distribution strategy, the Auto Scaling group could launch all instances in a single AZ, leaving the application tier vulnerable.

How to eliminate wrong answers

Option A is wrong because using a larger EC2 instance type improves performance and capacity but does not provide fault tolerance across AZs; a single large instance in one AZ still fails if that AZ goes down. Option C is wrong because EBS Multi-Attach is not supported for root volumes of EC2 instances (it is only available for specific EBS volume types like io1/io2 and is intended for clustered workloads, not for boot volumes), and it does not address cross-AZ high availability. Option D is wrong because an Auto Scaling group with a dynamic scaling policy helps with elasticity and capacity management but does not inherently ensure instances are launched in multiple AZs unless the Auto Scaling group is explicitly configured with subnets in at least two AZs; the question asks for a required step to ensure complete high availability, and simply configuring an Auto Scaling group without specifying multi-AZ subnets would not guarantee cross-AZ distribution.

Full explanation →
466
MCQmedium

An SAP HANA system is deployed on AWS with a cluster of EC2 instances. The system requires high network throughput between the nodes for HANA scale-out. Which EC2 networking feature should be used?

A.Use multiple Elastic Network Interfaces (ENIs) per instance.
B.Enable Elastic Network Adapter (ENA) support on the instances.
C.Use the Intel 82599 VF (ixgbevf) driver for enhanced networking.
D.Place all nodes in a cluster placement group.
AnswerB

ENA provides high throughput and low latency, essential for HANA scale-out.

Why this answer

For SAP HANA scale-out clusters requiring high network throughput between EC2 instances, the correct feature is Elastic Network Adapter (ENA) support. ENA is a custom network interface optimized for high-throughput and low-latency packet processing, providing up to 100 Gbps of network bandwidth on supported instance types. This directly meets the performance demands of HANA's inter-node communication.

Exam trap

The trap here is that candidates often confuse 'enhanced networking' with the older ixgbevf driver or think that multiple ENIs or placement groups alone can solve throughput bottlenecks, but only ENA provides the high-bandwidth, low-latency performance required for modern HANA scale-out workloads.

How to eliminate wrong answers

Option A is wrong because using multiple Elastic Network Interfaces (ENIs) per instance does not inherently increase network throughput; it only provides additional IP addresses and separate network paths, but the aggregate bandwidth is still limited by the instance's underlying hardware and ENA support. Option C is wrong because the Intel 82599 VF (ixgbevf) driver is an older enhanced networking driver for instances using the Intel 82599 Virtual Function, which supports only up to 10 Gbps and is not available on modern instance types; it lacks the performance and features of ENA. Option D is wrong because placing all nodes in a cluster placement group reduces network latency and provides up to 10 Gbps of single-flow bandwidth, but it does not increase the maximum network throughput beyond the instance's capabilities; ENA is required to achieve the higher throughput needed for HANA scale-out.

Full explanation →
467
MCQmedium

A company is migrating a monolithic application to AWS. The application has a relational database with complex queries and requires low-latency read replicas. Which database migration strategy minimizes downtime and supports heterogeneous migrations?

A.Use AWS Backup to take a full backup and restore to Amazon RDS.
B.Use AWS Schema Conversion Tool (SCT) to convert the schema and perform a homogeneous migration.
C.Use Amazon Redshift Spectrum to query the data in place.
D.Use AWS Database Migration Service (DMS) with ongoing replication.
AnswerD

DMS supports heterogeneous migrations and minimizes downtime.

Why this answer

AWS Database Migration Service (DMS) supports heterogeneous migrations (e.g., from Oracle to Amazon Aurora) and can minimize downtime by using ongoing replication to keep the source and target synchronized during the migration. Option A is incorrect because AWS Backup is a backup/restore service, not a live migration tool, and typically requires downtime. Option B is incorrect because AWS Schema Conversion Tool (SCT) is used for schema conversion, not for the actual data migration; it is often used alongside DMS.

Option C is incorrect because Amazon Redshift Spectrum is for querying data in Amazon S3, not for database migration.

Full explanation →
468
Multi-Selectmedium

A company runs SAP HANA on AWS and needs to implement a disaster recovery (DR) strategy. The DR site must have a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 15 minutes. Which two AWS services should be used together to achieve these objectives? (Choose TWO.)

Select 2 answers
A.AWS Database Migration Service
B.SAP HANA System Replication
C.AWS CloudEndure Disaster Recovery
D.Amazon S3
E.Amazon EBS snapshots
AnswersB, C

SAP HANA System Replication provides near-synchronous replication with RPO of seconds and fast failover, making it ideal for meeting the RTO of 30 minutes and RPO of 15 minutes.

Why this answer

To achieve an RTO of 30 minutes and RPO of 15 minutes for SAP HANA on AWS, the best combination is SAP HANA System Replication (HSR) and AWS CloudEndure Disaster Recovery. HSR provides near-synchronous replication, enabling an RPO of seconds and rapid failover, meeting the RTO. CloudEndure offers continuous replication at the server level, with sub-second RPO and fast recovery, complementing HSR for additional disaster recovery scenarios.

Option A (AWS DMS) is for database migration, not DR. Option D (Amazon S3) is for object storage, not suitable for real-time replication. Option E (Amazon EBS snapshots) cannot achieve a 15-minute RPO because automated snapshot schedules have a minimum interval of 1 hour, and restoring from snapshots takes time exceeding the 30-minute RTO.

Exam trap

Candidates may incorrectly assume that EBS snapshots can achieve a 15-minute RPO, but automated snapshot schedules have a 1-hour minimum, and restore times are too long for a 30-minute RTO.

Full explanation →
469
MCQmedium

Refer to the exhibit. An IAM policy is attached to a role used by AWS DMS to write data to an S3 bucket. The migration fails with an access denied error. What is the most likely cause?

A.The policy does not allow s3:PutObject.
B.The policy does not include s3:AbortMultipartUpload.
C.The bucket has default encryption enabled.
D.The bucket name is incorrect.
AnswerB

DMS uses multipart uploads and requires the abort action.

Why this answer

DMS needs s3:PutObject and s3:AbortMultipartUpload actions. Option A is incorrect because the bucket exists. Option C is incorrect because encryption settings are not shown.

Option D is incorrect because the policy allows PutObject.

Full explanation →
470
MCQeasy

A company is deploying an SAP BusinessObjects (BOBJ) platform on AWS. The platform consists of multiple web application servers, a CMS database, and an audit database. The company wants to ensure high availability for the CMS database using native SAP tools. Which AWS service should be used to host the CMS database to facilitate the use of SAP's native replication?

A.Amazon RDS
B.Amazon DynamoDB
C.Amazon ElastiCache
D.Amazon S3
AnswerA

RDS supports the databases used by BOBJ CMS and provides Multi-AZ for high availability.

Why this answer

Amazon RDS is the correct choice because it provides managed relational database instances that support database engines like SQL Server and Oracle, which are compatible with SAP BusinessObjects CMS. RDS offers Multi-AZ deployments for high availability and can be used with SAP's native database replication methods such as log shipping or Always On availability groups, meeting the high availability requirement without managing the underlying infrastructure. DynamoDB, ElastiCache, and S3 are not relational databases and do not support the native replication tools needed for the CMS database.

Exam trap

The AWS SAP on AWS Specialty exam often tests the misconception that any AWS database service can host SAP workloads, but the trap here is that candidates might choose DynamoDB or ElastiCache because they are 'highly available' by default, ignoring that SAP BusinessObjects CMS requires a relational database with native replication support.

How to eliminate wrong answers

Option B (Amazon DynamoDB) is wrong because it is a NoSQL key-value and document database that does not support the relational database features required by SAP BusinessObjects CMS, such as stored procedures, triggers, or native SAP replication tools. Option C (Amazon ElastiCache) is wrong because it is an in-memory caching service (Redis or Memcached) that cannot persist the CMS database schema or support SAP's native replication for high availability. Option D (Amazon S3) is wrong because it is an object storage service, not a relational database, and cannot host a CMS database or provide the transactional consistency and replication capabilities needed for SAP BusinessObjects.

Full explanation →
471
MCQeasy

An SAP system is running on EC2 with a single Availability Zone. The company needs to increase availability for the SAP application layer. Which is the most cost-effective and reliable approach?

A.Deploy a second EC2 instance in the same AZ and configure a Route 53 weighted routing policy.
B.Use an Auto Scaling group with EC2 instances in two Availability Zones behind an Application Load Balancer.
C.Use a multi-AZ RDS database and keep the application on a single EC2 instance.
D.Use an EC2 instance in a different region and use Route 53 latency-based routing.
AnswerB

Auto Scaling with multiple AZs provides cost-effective high availability and load distribution.

Why this answer

It distributes the SAP application layer across multiple EC2 instances in two Availability Zones behind an Application Load Balancer, providing both high availability and fault tolerance. The Auto Scaling group ensures that the desired number of instances are maintained even if an instance or an entire AZ fails, while the ALB performs health checks and routes traffic only to healthy instances. This approach is cost-effective as it avoids over-provisioning and only scales based on demand, and it is reliable because it eliminates a single point of failure at the application tier.

Exam trap

The trap here is that candidates may assume that simply adding a second instance in the same AZ (Option A) or using a multi-AZ database (Option C) is sufficient for application-layer high availability, but they overlook that the application tier itself must be distributed across multiple AZs to survive an AZ outage.

How to eliminate wrong answers

Option A is wrong because deploying a second EC2 instance in the same Availability Zone does not protect against an AZ failure; if the AZ goes down, both instances become unavailable, and Route 53 weighted routing alone cannot provide automatic failover or health-based routing. Option C is wrong because it only addresses database high availability via multi-AZ RDS, but the application layer remains on a single EC2 instance, which is a single point of failure; the question specifically asks about increasing availability for the SAP application layer, not the database. Option D is wrong because using a different region introduces significant latency for an SAP system, which is latency-sensitive, and Route 53 latency-based routing does not provide automatic failover or health checks; additionally, cross-region replication for SAP is complex and not cost-effective for the application layer alone.

Full explanation →
472
MCQeasy

An SAP Basis administrator needs to monitor the memory usage of an SAP HANA database running on an EC2 instance. Which AWS service should be used to collect and visualize custom memory metrics from the OS?

A.AWS CloudTrail
B.Amazon CloudWatch with the CloudWatch Agent
C.AWS Systems Manager Inventory
D.AWS Config
AnswerB

CloudWatch Agent collects custom OS metrics like memory and sends them to CloudWatch.

Why this answer

Amazon CloudWatch with the CloudWatch Agent can collect custom memory metrics from the OS of an EC2 instance and visualize them in CloudWatch. AWS CloudTrail logs API activity, not OS metrics. AWS Systems Manager Inventory collects software inventory, not real-time memory metrics.

AWS Config tracks resource configuration changes, not real-time memory usage.

Full explanation →
473
Multi-Selecthard

A company is running an SAP S/4HANA system on AWS. The system uses an SAP HANA database with a current size of 1.5 TB. The company wants to implement a backup strategy that allows point-in-time recovery (PITR) with an RPO of 5 minutes and an RTO of 4 hours. The backup must be stored in Amazon S3. Which combination of steps should the company take? (Choose TWO.)

Select 2 answers
A.Schedule full backups every 12 hours and log backups every 2 hours.
B.Configure log backup to run every 5 minutes using Backint.
C.Install and configure the SAP HANA Backint agent to stream full and log backups to Amazon S3.
D.Use Amazon EBS snapshots of the HANA data volume as the primary backup mechanism.
E.Set up SAP HANA System Replication to a second instance in another Availability Zone.
AnswersB, C

5-minute log backups meet the RPO.

Why this answer

The correct options are B and C. Option B configures log backups every 5 minutes using Backint, achieving the required RPO of 5 minutes. Option C installs the Backint agent to stream both full and log backups to Amazon S3, meeting the storage requirement.

Option A is incorrect because a 2-hour log backup interval exceeds the 5-minute RPO. Option D is incorrect because EBS snapshots provide volume-level recovery, not point-in-time database recovery. Option E is incorrect because SAP HANA System Replication is for high availability, not backup.

Full explanation →
474
MCQhard

A company is planning to run SAP S/4HANA on AWS and needs to ensure that the system can automatically recover from an Availability Zone failure. They want to use SAP HANA System Replication with automatic failover. Which AWS configuration is required?

A.AWS Auto Scaling groups with lifecycle hooks
B.Pacemaker cluster with STONITH across two Availability Zones
C.Amazon RDS Multi-AZ deployment
D.Amazon EFS as shared storage for HANA data
AnswerB

Pacemaker with STONITH provides automatic failover and fencing.

Why this answer

SAP HANA System Replication with automatic failover requires a Pacemaker cluster with STONITH (Shoot The Other Node In The Head) configured across two Availability Zones. This setup provides the fencing mechanism necessary to prevent split-brain scenarios and ensures that the failed primary node is forcibly isolated before the secondary node takes over, enabling reliable automatic failover for SAP S/4HANA on AWS.

Exam trap

The trap here is that candidates confuse managed database services like Amazon RDS Multi-AZ with the specific requirements of SAP HANA System Replication, assuming that AWS's built-in high availability features can replace the need for a Pacemaker cluster with STONITH, but SAP HANA on AWS requires explicit cluster configuration and fencing to achieve automatic failover across Availability Zones.

How to eliminate wrong answers

Option A is wrong because AWS Auto Scaling groups with lifecycle hooks are designed for scaling EC2 instances based on demand, not for orchestrating SAP HANA System Replication failover or providing the fencing and cluster coordination required for automatic recovery from an Availability Zone failure. Option C is wrong because Amazon RDS Multi-AZ deployment is a managed database service for relational databases like MySQL or PostgreSQL, not for SAP HANA, and it does not support SAP S/4HANA's native HANA System Replication or Pacemaker clustering. Option D is wrong because Amazon EFS is a shared file system for NFS workloads, but SAP HANA requires high-performance, low-latency block storage (e.g., Amazon EBS gp3 or io2) for its data and log volumes, and shared storage is not used in HANA System Replication; instead, each node has its own dedicated storage.

Full explanation →
475
MCQeasy

An SAP administrator is designing a new SAP NetWeaver system on AWS. They need to choose an EC2 instance type that is certified for SAP. Which source should they consult?

A.Amazon EC2 console
B.AWS Pricing Calculator
C.SAP Note 2235581 (SAP HANA Hardware Directory)
D.AWS documentation on EC2 instance types
AnswerC

SAP Note 2235581 provides the official SAP HANA hardware directory.

Why this answer

SAP Note 2235581 is the authoritative source for the SAP HANA Hardware Directory, which lists all EC2 instance types certified for SAP HANA and SAP NetWeaver. AWS relies on SAP's own certification process, so only SAP's official directory provides the definitive list of supported instance types.

Exam trap

The trap here is that candidates assume AWS documentation or the EC2 console would list SAP-certified instances, but SAP maintains its own hardware directory independently, and only SAP Note 2235581 is the definitive source.

How to eliminate wrong answers

Option A is wrong because the Amazon EC2 console does not display SAP certification status; it only shows general instance type information and features. Option B is wrong because the AWS Pricing Calculator is a cost estimation tool and does not include SAP certification data. Option D is wrong because AWS documentation on EC2 instance types describes general capabilities but does not maintain the official SAP certification list, which is exclusively managed by SAP.

Full explanation →
476
MCQhard

An administrator needs to back up SAP HANA database to S3 with encryption. The backup must be encrypted at rest in S3. Which combination of actions should be taken?

A.Use AWS CloudHSM to generate keys and store them in S3
B.Enable S3 Versioning and use S3-managed keys
C.Configure S3 bucket with default encryption using SSE-S3 or SSE-KMS
D.Use AWS Backup to back up to S3 with default settings
AnswerC

Default encryption ensures all objects are encrypted at rest.

Why this answer

Configuring an S3 bucket with default encryption using SSE-S3 or SSE-KMS ensures that backups written to S3 are automatically encrypted at rest. SSE-S3 uses Amazon-managed keys with AES-256, while SSE-KMS allows you to use AWS KMS customer managed keys (CMKs) for additional control. This meets the requirement for encryption at rest in S3 without requiring additional infrastructure or manual key management.

Exam trap

The trap here is that candidates confuse S3 Versioning (which protects against accidental deletion) with encryption, or assume that AWS Backup automatically enforces encryption without explicitly configuring bucket default encryption.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM generates keys that are stored in the HSM itself, not in S3; storing keys in S3 would defeat the purpose of a hardware security module and is not a supported pattern for S3 encryption. Option B is wrong because enabling S3 Versioning provides object versioning, not encryption; S3-managed keys (SSE-S3) are a valid encryption method, but Versioning alone does not encrypt data. Option D is wrong because AWS Backup with default settings does not guarantee encryption at rest in S3; default settings may use SSE-S3, but the question requires a specific action to ensure encryption, and AWS Backup does not inherently configure S3 bucket encryption.

Full explanation →
477
MCQhard

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

A.Use AWS Config rules to detect noncompliant buckets and send notifications.
B.Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.
C.Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.
D.Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.
AnswerC

SCPs apply to all accounts in the OU and can prevent noncompliant bucket creation, including by the root user.

Why this answer

Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Exam trap

The trap here is that candidates often choose detective controls like AWS Config (Option A) or account-level IAM policies (Option B) because they are familiar with them, failing to recognize that only SCPs provide preventive, organization-wide enforcement that cannot be bypassed by account administrators.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can only detect noncompliant buckets after they are created and send notifications, but they do not prevent the violation from occurring. Option B is wrong because IAM policies are account-specific and can be overridden by account administrators with full administrative privileges, making them unreliable for organization-wide enforcement. Option D is wrong because CloudFormation StackSets can deploy templates that create buckets with encryption, but they do not prevent users from creating buckets outside of CloudFormation or modifying existing buckets to remove encryption.

Full explanation →
478
MCQeasy

An SAP administrator needs to back up SAP HANA database to Amazon S3. Which AWS service or feature should be used to automate this backup?

A.Amazon EBS snapshots
B.SAP HANA Backup and Recovery with Backint
C.AWS Backup
D.S3 Lifecycle policies
AnswerB

Backint enables HANA to backup directly to S3.

Why this answer

The SAP HANA Backup and Recovery feature can back up directly to S3 via the Backint agent. Option A is incorrect because EBS snapshots capture the entire volume, not just the HANA database, and are not SAP HANA-aware. Option C is incorrect because AWS Backup supports some databases but not SAP HANA directly.

Option D is incorrect because S3 Lifecycle policies manage object retention, not backup initiation.

Full explanation →
479
MCQhard

An SAP system on AWS uses a custom AMI for its application servers. The operations team needs to update the AMI to include a new security patch. What is the MOST efficient way to update all existing instances without downtime?

A.Create a new AMI version, update the Auto Scaling group's launch template, and perform a rolling update.
B.Stop all instances, apply the patch, create a new AMI, and start instances.
C.Use AWS Systems Manager Patch Manager to apply the patch to all running instances.
D.Create a new AMI, launch new instances manually, and terminate old ones.
AnswerA

This approach updates the AMI and replaces instances with minimal downtime.

Why this answer

Creating a new AMI version, updating the Auto Scaling group's launch template, and performing a rolling update ensures zero downtime by gradually replacing instances with the patched AMI. This is the most efficient method for updating all existing instances without downtime. Option B is wrong because stopping all instances causes downtime.

Option C is wrong because Patch Manager patches live instances, but the requirement is to update the AMI for future instances, not just patch running ones. Option D is wrong because manually launching instances is inefficient and not automated.

Full explanation →
480
Multi-Selecthard

Which TWO considerations are critical when planning a migration of an SAP system to AWS? (Choose 2.)

Select 2 answers
A.Storage performance and IOPS requirements
B.AWS Region availability for SAP services
C.Database compatibility with target
D.Network connectivity and latency between components
E.Number of security groups allowed
AnswersA, D

Sufficient IOPS is critical for database performance.

Why this answer

The two critical considerations when planning an SAP migration to AWS are storage performance (IOPS) and network connectivity/latency. Storage performance is critical because SAP databases require high IOPS for optimal performance, and insufficient IOPS can lead to significant degradation. Network connectivity and latency between SAP components (e.g., application servers and database) are also critical to ensure low-latency communication and avoid performance bottlenecks.

Option B (AWS Region availability) is not as critical because SAP can run in any region that supports required services, though it may affect latency. Option C (database compatibility) is important but a separate migration decision, not a top-level planning consideration. Option E (number of security groups) is a security configuration detail, not a critical factor for migration planning.

Full explanation →
481
MCQmedium

An SAP HANA database is experiencing high memory utilization. The operations team needs to determine if the database is using more memory than allocated. Which CloudWatch metric should they monitor?

A.MemoryUtilization
B.SwapUsage
C.CPUUtilization
D.HANA_Memory_Usage
AnswerA

This metric (published by the SAP HANA agent) shows memory utilization percentage.

Why this answer

(MemoryUtilization) is correct because the SAP HANA agent in CloudWatch publishes the 'MemoryUtilization' metric, which directly shows the percentage of memory used by the HANA database. Option D (HANA_Memory_Usage) is not a standard CloudWatch metric name. Option B (SwapUsage) is for swap, not memory.

Option C (CPUUtilization) is for CPU usage.

Full explanation →
482
MCQmedium

An SAP Basis administrator is troubleshooting a performance issue on an SAP application server running on an Amazon EC2 instance. The administrator notices high CPU utilization. Which AWS tool can provide detailed insights into the CPU usage at the process level without installing additional agents?

A.AWS Systems Manager Inventory
B.Amazon CloudWatch CPU Utilization metric
C.Amazon EC2 Instance Connect
D.AWS Systems Manager Run Command
AnswerD

Run Command can execute scripts like 'top' to get process-level CPU usage without additional agents.

Why this answer

AWS Systems Manager Inventory collects metadata about instances but not process-level CPU. EC2 Instance Connect is for shell access. CloudWatch metrics provide aggregate CPU, not per-process.

Systems Manager Run Command can execute scripts to gather process data, but the question asks for a tool that provides the information directly without agents; however, Systems Manager with default agent can run commands to get process-level data, which is more direct than the others. CloudWatch does not provide process-level CPU without custom metrics.

Full explanation →
483
MCQmedium

A company is running SAP ERP on AWS with an Oracle database. The application servers are deployed in an Auto Scaling group across three Availability Zones. The database is hosted on a single EC2 instance in us-east-1a. The company wants to improve availability with minimal changes to the application. The database must be highly available with automatic failover and no data loss. The database size is 1 TB. The current RTO is 2 hours and RPO is 1 hour. The company is considering using Oracle Data Guard for replication. Which solution should the company implement to meet the HA requirements?

A.Use AWS Database Migration Service (DMS) to replicate the Oracle database to a second EC2 instance in another AZ, and use an Amazon Route 53 health check to redirect traffic.
B.Migrate the Oracle database to Amazon RDS for Oracle with Multi-AZ deployment and automatic failover.
C.Configure Oracle Data Guard with synchronous replication and Fast-Start Failover (FSFO) to automatically fail over to a standby instance in another AZ.
D.Configure Oracle Data Guard with asynchronous replication to a standby instance in us-east-1b, and use a custom script to detect failure and promote the standby.
AnswerC

Synchronous replication ensures zero data loss; FSFO provides automatic failover.

Why this answer

Oracle Data Guard with synchronous replication ensures zero data loss by committing transactions only after they are written to both primary and standby redo logs. Fast-Start Failover (FSFO) automates the failover process without manual intervention, meeting the RTO of 2 hours and RPO of 1 hour while requiring minimal application changes since the database remains Oracle-native.

Exam trap

The trap here is that candidates often assume AWS-managed services like RDS Multi-AZ are always the best choice for high availability, but the question explicitly requires minimal application changes and zero data loss, making Oracle-native Data Guard with synchronous replication the correct fit despite the operational overhead.

How to eliminate wrong answers

Option A is wrong because AWS DMS is a migration tool, not a high-availability replication solution; it does not support automatic failover or synchronous replication, and using Route 53 health checks for traffic redirection introduces DNS propagation delays that violate the RTO. Option B is wrong because migrating to Amazon RDS for Oracle with Multi-AZ is not a minimal change—it requires application connection string changes and may not support all SAP ERP-specific Oracle features or customizations, and Multi-AZ uses asynchronous replication by default, risking data loss. Option D is wrong because asynchronous replication does not guarantee zero data loss (RPO=0), and relying on a custom script for failover detection and promotion introduces complexity and potential delays that could exceed the RTO.

Full explanation →
484
MCQeasy

An SAP administrator needs to apply a security patch to the operating system of an EC2 instance running SAP. The instance is part of an Auto Scaling group. What is the best practice to apply the patch while minimizing downtime?

A.Create a new AMI with the patch applied, update the launch configuration, and perform a rolling update using an Auto Scaling lifecycle hook.
B.Update the launch configuration with the patched AMI and manually terminate running instances.
C.Stop the Auto Scaling group, patch the instance, and restart the group.
D.SSH into each instance and apply the patch manually.
AnswerA

Rolling updates replace instances one at a time, minimizing downtime.

Why this answer

The best practice because it leverages a lifecycle hook to perform a rolling update, replacing old instances with new ones based on a patched AMI without downtime. This approach ensures that each instance is gracefully terminated after a new instance is ready. Option B is incorrect because simply updating the launch configuration and manually terminating instances can cause downtime and is not automated.

Option C is incorrect because stopping the Auto Scaling group and patching in place leads to downtime and is not scalable. Option D is incorrect because applying patches manually via SSH is error-prone and requires sequential instance patching, causing downtime.

Full explanation →
485
MCQmedium

A company is migrating a large-scale SAP HANA workload to AWS. The system requires high memory and low latency. Which EC2 instance type is most suitable for this migration?

A.x1e.32xlarge
B.m5.24xlarge
C.c5.18xlarge
D.r5.24xlarge
AnswerA

x1e instances are memory-optimized and SAP HANA certified.

Why this answer

The x1e.32xlarge is purpose-built for high-memory, SAP HANA workloads, offering up to 3,904 GiB of memory and high-speed NVMe SSD storage with low-latency networking. It is certified by SAP for running production HANA environments, making it the most suitable choice for this migration.

Exam trap

The trap here is that candidates often choose the r5 family (memory-optimized) thinking it is sufficient for SAP HANA, but they overlook the specific memory capacity requirements and SAP certification needed for large-scale workloads, which only the x1e instance meets.

How to eliminate wrong answers

Option B (m5.24xlarge) is wrong because it is a general-purpose instance with only 384 GiB of memory, insufficient for large-scale SAP HANA workloads that require terabytes of RAM. Option C (c5.18xlarge) is wrong because it is compute-optimized, designed for CPU-intensive tasks, not memory-intensive databases like SAP HANA. Option D (r5.24xlarge) is wrong because while it is memory-optimized, it provides only 768 GiB of memory, which is far below the x1e's capacity and not SAP HANA-certified for large-scale production deployments.

Full explanation →
486
MCQhard

A company is migrating an SAP BusinessObjects system to AWS. The system includes a Central Management Server (CMS) and several processing servers. The CMS uses a SQL Server database. The company wants to use a managed database service on AWS to reduce operational overhead. The database size is 100 GB and is expected to grow 10% annually. The company requires automatic failover to a secondary Availability Zone with minimal downtime. Which AWS database service should the company use for the CMS database?

A.Amazon RDS for SQL Server with Multi-AZ deployment
B.Amazon EC2 with SQL Server installed
C.Amazon Aurora SQL Server
D.Amazon DynamoDB
AnswerA

Amazon RDS for SQL Server with Multi-AZ deployment provides a managed SQL Server database with automatic failover to a secondary Availability Zone, ensuring minimal downtime and reducing operational overhead.

Why this answer

Amazon RDS for SQL Server with Multi-AZ deployment is the correct choice because it provides a managed database service with automatic failover to a standby instance in a different Availability Zone, meeting the requirement for minimal downtime. Amazon Aurora does not support SQL Server compatibility; Aurora is MySQL/PostgreSQL-compatible. Amazon EC2 with SQL Server installed is not a managed service, increasing operational overhead.

Amazon DynamoDB is a NoSQL database and not compatible with SQL Server, which requires a relational database.

Full explanation →
487
Multi-Selecteasy

A company is planning to run SAP NetWeaver on AWS and needs to ensure that the system is highly available. Which TWO AWS services should be combined to achieve HA for the SAP central services (ASCS/SCS) and the database? (Choose TWO.)

Select 2 answers
A.Elastic Load Balancing (ELB) to distribute traffic across multiple application server instances.
B.Amazon CloudFront to cache static content.
C.Amazon EC2 Auto Recovery to automatically recover the instance hosting ASCS/SCS if it becomes impaired.
D.Amazon S3 to store the SAP system configuration files.
E.Amazon Route 53 health checks with failover routing.
AnswersA, C

ELB provides load balancing and failover for application servers.

Why this answer

Elastic Load Balancing (ELB) is correct because it distributes incoming traffic across multiple SAP application server (AS) instances, ensuring that if one AS fails, the ELB redirects traffic to healthy instances. This provides high availability for the SAP application tier, which is essential for the overall system's resilience.

Exam trap

The trap here is that candidates often confuse DNS-level failover (Route 53) with instance-level recovery (Auto Recovery), or they think CloudFront or S3 can provide HA for SAP services, when in fact only Auto Recovery directly addresses the recovery of a single impaired instance hosting ASCS/SCS.

Full explanation →
488
MCQmedium

A company is running SAP ERP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS service should be used to achieve this?

A.EC2 Auto Scaling
B.Elastic Load Balancer (NLB)
C.Amazon Route 53
D.AWS Global Accelerator
AnswerB

Network Load Balancer can distribute traffic to multiple ASCS instances for HA.

Why this answer

For SAP ASCS high availability, AWS recommends using a Network Load Balancer (NLB) to manage the virtual IP address (VIP) required by SAP. The NLB handles the failover of the ASCS instance between two EC2 nodes by directing traffic to the active node, ensuring seamless client connectivity without relying on a floating IP or custom scripts.

Exam trap

The trap here is that candidates often confuse DNS-based services like Route 53 or Global Accelerator with the Layer 4 load balancing required for SAP ASCS VIP management, overlooking the NLB’s ability to provide a static IP and sub-second failover.

How to eliminate wrong answers

Option A is wrong because EC2 Auto Scaling is designed for horizontal scaling of stateless applications, not for managing the failover of a stateful SAP ASCS instance that requires a stable VIP and controlled cluster failover. Option C is wrong because Amazon Route 53 is a DNS service that provides global traffic routing and health checks, but it cannot provide the sub-second failover and VIP management required for SAP ASCS; DNS caching and propagation delays make it unsuitable for high-availability failover. Option D is wrong because AWS Global Accelerator improves performance and availability by directing traffic over the AWS global network, but it does not manage the virtual IP or cluster failover for SAP ASCS within a single region.

Full explanation →
489
MCQhard

An SAP administrator runs the command `aws ec2 describe-volumes --volume-id vol-0abc1234` and sees the following output: ``` { "Volumes": [ { "VolumeId": "vol-0abc1234", "Size": 100, "VolumeType": "io2", "Iops": 10000, "State": "available", "MultiAttachEnabled": false, "Attachments": [] } ] } ``` The EC2 instance i-0a1b2c3d4e5f6g7h8 is stopped. What will happen if the administrator attempts to start the instance?

A.The instance will fail to start because the volume type is not supported.
B.The instance will start successfully and the volume will be attached.
C.The instance will start but the volume will not attach because multi-attach is disabled.
D.The instance will start but the volume will be read-only.
AnswerC

Correct. The instance will start, but the volume will not be attached because it is currently detached and must be attached explicitly.

Why this answer

The volume is in 'available' state, meaning it is not attached to any instance. Starting a stopped instance does not automatically attach a detached volume; the volume must be manually attached. Therefore, the instance will start successfully but the volume will not be attached, making option C correct.

Exam trap

The trap here is that candidates may assume a stopped instance with a detached volume will fail to start or that the volume type (io2 with 10,000 IOPS) imposes restrictions, when in fact io2 volumes with up to 32,000 IOPS are universally supported and the instance will start normally regardless of the volume's attachment state.

How to eliminate wrong answers

Option A is wrong because gp3 is a fully supported EBS volume type for all EC2 instance families, and there is no restriction that would cause a start failure due to volume type. Option C is wrong because multi-attach is only relevant for io1/io2 volumes and is not required for a single attachment; a gp3 volume can be attached to one instance without multi-attach enabled. Option D is wrong because EBS volumes attached to an EC2 instance are not read-only by default; they are read-write unless explicitly mounted as read-only in the OS, which is not determined by the volume type or attachment method.

Full explanation →
490
MCQmedium

An SAP system on AWS uses an Auto Scaling group for the application tier. The scaling policy is based on the average CPU utilization of the EC2 instances. During peak hours, the system scales out, but the new instances take a long time to become available because they need to install SAP software and configure them. This delay causes performance degradation. The operations team wants to reduce the time to scale out. Which solution should they implement?

A.Increase the instance size to reduce boot time.
B.Create a custom AMI with SAP software pre-installed and use it in the launch configuration.
C.Switch to AWS Elastic Beanstalk for automatic scaling.
D.Use an instance store-backed AMI instead of EBS-backed.
AnswerB

Custom AMI reduces provisioning time.

Why this answer

The correct solution is to create a custom AMI with SAP software pre-installed and use it in the launch configuration. This approach eliminates the need for software installation and configuration at instance launch, significantly reducing the time for new instances to become available. Option A is incorrect because increasing instance size does not reduce boot time; it only provides more resources.

Option C is incorrect because AWS Elastic Beanstalk is a platform-as-a-service offering that is not optimized for SAP workloads and would require significant reconfiguration. Option D is incorrect because instance store-backed AMIs are ephemeral and data is lost on instance stop/termination, which is not suitable for persistent SAP installations.

Full explanation →
491
MCQeasy

An SAP administrator is troubleshooting connectivity between SAP application servers and the SAP HANA database. The database security group has an inbound rule as shown in the exhibit. The application servers are in security group sg-12345. However, the application servers cannot connect to the database. What is the most likely reason?

A.The source should be the IP address range of the application servers.
B.The rule uses the wrong protocol; it should be UDP.
C.The outbound rule on the application server security group is missing.
D.The port number is incorrect for SAP HANA.
AnswerD

SAP HANA uses port 3<instance_number>15, not 3300.

Why this answer

SAP HANA uses TCP port 30015 by default for client connections (3<instance>15). If the security group inbound rule specifies a different port, such as 30013 or 31015, the application servers will be unable to establish a TCP connection to the database. The exhibit likely shows an incorrect port number, making option D the most likely cause.

Exam trap

The trap here is that candidates often assume a security group rule referencing another security group is invalid or that the source must be an IP range, but AWS security groups can reference each other, and the real issue is typically a port mismatch or incorrect protocol.

How to eliminate wrong answers

Option A is wrong because security group rules can reference other security groups as sources, which is a valid and recommended AWS practice for allowing traffic between instances in different security groups without needing to specify IP ranges. Option B is wrong because SAP HANA uses TCP, not UDP, for client-to-database communication; UDP is used only for certain internal replication or name resolution tasks. Option C is wrong because the outbound rule on the application server security group is not the issue—by default, security groups allow all outbound traffic, and the problem is inbound connectivity to the database, not outbound from the app servers.

Full explanation →
492
MCQmedium

An SAP Basis administrator needs to migrate an on-premises SAP ERP system running on Oracle to AWS. The system has a 2 TB database and requires minimal downtime (less than 1 hour). The current on-premises network bandwidth to AWS is 1 Gbps. Which migration strategy is MOST appropriate?

A.Export the database using SAP HANA System Replication (HSR) to an Amazon EC2 instance with HANA.
B.Perform a manual export/import using Oracle Data Pump and transfer the dump file via AWS Direct Connect.
C.Use AWS Application Migration Service (MGN) to replicate the entire server to AWS, then cut over.
D.Use AWS Database Migration Service (DMS) with ongoing replication from Oracle to Amazon RDS for Oracle, then perform a final cutover.
AnswerD

DMS supports ongoing replication, enabling minimal downtime cutover.

Why this answer

AWS DMS with ongoing replication from Oracle to Amazon RDS for Oracle is the most appropriate strategy because it supports minimal downtime (less than 1 hour) by continuously replicating changes from the source Oracle database to the target RDS instance, allowing a short final cutover window. The 1 Gbps bandwidth is sufficient for the initial full load of a 2 TB database when using DMS's optimized data transfer, and the target RDS for Oracle provides a fully managed Oracle-compatible environment suitable for SAP ERP workloads.

Exam trap

The trap here is that candidates often assume a manual export/import (Option B) is the simplest approach, but they overlook the time constraint of a 2 TB database over 1 Gbps, which makes it impossible to achieve less than 1 hour downtime, while DMS's CDC capability is the key to meeting that requirement.

How to eliminate wrong answers

Option A is wrong because SAP HANA System Replication (HSR) is designed for SAP HANA databases, not for Oracle databases, and the source system runs on Oracle, making this option technically incompatible. Option B is wrong because a manual export/import using Oracle Data Pump with a 2 TB dump file over 1 Gbps bandwidth would take significantly longer than 1 hour (approximately 4.5 hours at theoretical max), failing the minimal downtime requirement. Option C is wrong because AWS Application Migration Service (MGN) replicates the entire server at the block level, which would require a full server conversion and does not natively handle Oracle-to-Oracle database replication with minimal downtime for an SAP ERP system; it also lacks the fine-grained database-level change capture needed for a sub-hour cutover.

Full explanation →
493
Multi-Selectmedium

A company is running an SAP NetWeaver system on AWS. The system includes a primary application server (PAS) and a dialog instance. The administrator wants to monitor the SAP system health using Amazon CloudWatch. Which THREE metrics should be monitored to proactively detect performance issues? (Choose THREE.)

Select 3 answers
A.EBS Volume Queue Length
B.EC2 SwapUsage (as custom metric)
C.EC2 CPU Utilization
D.EC2 NetworkIn
E.SAP work process usage (via SAP monitoring)
AnswersA, C, E

High queue length indicates I/O requests waiting, often a sign of storage bottleneck.

Why this answer

EBS Volume Queue Length is a critical metric for SAP workloads because it directly indicates I/O latency. A high queue length means the storage subsystem cannot keep up with the SAP database or application server I/O requests, which can cause transaction delays and system hangs. Monitoring this metric allows proactive detection of storage bottlenecks before they impact SAP performance.

Exam trap

The trap here is that candidates often focus on CPU and memory metrics (like SwapUsage) because they are common in general server monitoring, but for SAP on AWS, storage I/O performance (EBS Queue Length) and SAP-specific work process utilization are more directly tied to application responsiveness and must be included alongside CPU Utilization.

Full explanation →
494
MCQeasy

A company runs SAP on AWS and uses AWS CloudTrail to monitor API activity. The security team wants to receive real-time notifications when specific SAP-related API calls are made. Which AWS service should they use to filter and forward these events?

A.Amazon Inspector
B.AWS Config
C.Amazon EventBridge
D.AWS Trusted Advisor
AnswerC

Amazon EventBridge can ingest CloudTrail events and route them to targets like SNS based on event patterns, enabling real-time notifications.

Why this answer

Amazon EventBridge can ingest CloudTrail events and route them to targets such as SNS for real-time notifications based on event patterns. Option A is incorrect because Amazon Inspector is used for vulnerability assessment, not event filtering. Option B is incorrect because AWS Config is used for resource compliance and configuration history, not real-time event forwarding.

Option D is incorrect because AWS Trusted Advisor provides best practice checks and recommendations, not real-time event filtering.

Full explanation →
495
MCQmedium

A company is migrating its SAP ERP system to AWS. The system requires high availability for the SAP Central Services (ASCS) instance. Which AWS architecture should be used to meet this requirement?

A.Use a multi-AZ deployment with Amazon FSx for NetApp ONTAP as a shared file system and place ASCS on two EC2 instances in different Availability Zones with an Elastic IP address.
B.Use Amazon S3 to store the ASCS configuration and launch a single EC2 instance with an Auto Scaling group.
C.Deploy ASCS on a single EC2 instance in one Availability Zone with an EBS volume snapshot for recovery.
D.Use Amazon RDS for SAP Central Services running in a Multi-AZ configuration.
AnswerA

This provides high availability with failover across AZs.

Why this answer

SAP ASCS requires a highly available shared file system and a floating IP address for failover. Amazon FSx for NetApp ONTAP provides a highly available, NFS-based shared file system that supports the SAP transport and profile directories across Availability Zones. Placing two EC2 instances in different AZs with an Elastic IP address allows the ASCS instance to be failed over manually or via a cluster manager, meeting the high availability requirement.

Exam trap

The trap here is that candidates confuse SAP Central Services (ASCS) with a database service and incorrectly select Amazon RDS, or assume that a single-instance recovery solution like EBS snapshots meets high availability requirements, when in fact SAP ASCS requires a clustered architecture with shared storage and a floating IP.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object store and does not support the POSIX file system semantics required by SAP ASCS for shared directories like /usr/sap/trans and profile files; Auto Scaling groups are designed for stateless scaling, not for stateful SAP ASCS failover. Option C is wrong because a single EC2 instance with an EBS snapshot provides only backup and recovery, not high availability; it cannot achieve the sub-minute failover required for SAP ASCS. Option D is wrong because Amazon RDS is a managed database service for relational databases, not for SAP Central Services, which is an application service that requires a shared file system and cluster management, not a database.

Full explanation →
496
MCQmedium

A company is designing a backup strategy for SAP HANA on AWS. The HANA database is 2 TB in size. The company requires daily full backups and hourly incremental backups. Which AWS service should be used to store the backups cost-effectively with high durability?

A.Amazon S3 with lifecycle policies to transition to Glacier.
B.Amazon EBS Snapshots stored in Amazon S3.
C.AWS Storage Gateway with volume gateway.
D.Amazon EFS for shared backup storage.
AnswerA

S3 offers durability and cost-effectiveness for backups.

Why this answer

Amazon S3 with lifecycle policies to transition to Glacier is correct because S3 provides 99.999999999% durability and cost-effective storage for SAP HANA backups. Lifecycle policies automatically move older backups to lower-cost tiers like Glacier, reducing costs while meeting the 2 TB database's daily full and hourly incremental backup requirements.

Exam trap

The trap here is that candidates often choose EBS Snapshots (Option B) because they assume snapshots are the native backup method for SAP HANA on AWS, but they fail to recognize that SAP HANA requires file-based backups for point-in-time recovery and that S3 offers superior cost optimization through lifecycle policies.

How to eliminate wrong answers

Option B is wrong because Amazon EBS Snapshots are stored in Amazon S3 internally, but they are not directly accessible or manageable as backup files for SAP HANA; they are tied to EBS volumes and lack the flexibility for granular backup scheduling and lifecycle management. Option C is wrong because AWS Storage Gateway with volume gateway provides block storage for on-premises applications to cache data in AWS, but it is not designed for direct backup storage of SAP HANA databases and introduces unnecessary complexity and latency. Option D is wrong because Amazon EFS is a file system for shared access, not optimized for backup storage; it lacks the cost efficiency of S3's tiered storage and does not support lifecycle transitions to Glacier for long-term retention.

Full explanation →
497
Multi-Selectmedium

Which THREE factors should be considered when choosing an EC2 instance type for an SAP HANA production system? (Choose three.)

Select 3 answers
A.GPU capabilities for parallel processing.
B.Amount of memory (RAM) required.
C.Network throughput and latency.
D.Support for EBS optimization.
E.Processor architecture (Intel/AMD vs ARM).
AnswersB, C, E

HANA is memory-intensive.

Why this answer

SAP HANA is an in-memory database that loads all data into RAM for processing, making memory the primary determinant of instance sizing. The amount of RAM required directly dictates the EC2 instance family and size, as SAP HANA certified instances are specifically validated for memory-to-vCPU ratios and total memory capacity.

Exam trap

The trap here is that candidates may mistakenly choose GPU capabilities (Option A) due to confusion with machine learning or HPC workloads, or select EBS optimization (Option D) as a primary factor, when in reality SAP HANA's memory-centric design and certification requirements make RAM, network performance, and processor architecture the decisive criteria.

Full explanation →
498
MCQeasy

A company runs SAP on AWS and needs to automate the patching of SAP application servers. The solution should apply patches during a defined maintenance window and ensure high availability. What is the most efficient approach?

A.Use AWS Systems Manager Patch Manager with a maintenance window.
B.Update the CloudFormation stack to replace instances with new AMIs.
C.Use AWS Lambda to invoke Run Command on each instance sequentially.
D.Manually connect to each instance via SSH and apply patches.
AnswerA

Patch Manager automates patching with scheduled maintenance windows and can target Auto Scaling groups for HA.

Why this answer

AWS Systems Manager Patch Manager integrates with maintenance windows to automate patching during defined times. It can target instances in an Auto Scaling group, ensuring high availability by patching a subset at a time. This is the most efficient and automated approach.

Option B (CloudFormation update) is more suited for infrastructure updates, not routine patching. Option C (Lambda invoking Run Command sequentially) adds complexity without leveraging Patch Manager's built-in scheduling. Option D (manual SSH) is not automated.

Full explanation →
499
MCQeasy

A company is migrating its on-premises web application to AWS. The application consists of a stateless web tier and a stateful database tier running on a single server. The web tier uses session data stored in the local file system. The database tier runs on MySQL. The company wants to minimize changes to the application code during migration. They plan to use Amazon EC2 for the web server and Amazon RDS for MySQL for the database. After migrating the web server to an EC2 instance and the database to RDS, users report that they are being logged out of the application frequently. What is the most likely cause of this issue?

A.The web server's session data is stored locally and is lost when the EC2 instance is replaced or restarted.
B.The RDS instance's backup window is causing database connections to drop.
C.The application's session timeout setting was reduced during migration.
D.The security group for the web server is blocking inbound session cookies.
AnswerA

Since the application stores sessions locally, any instance replacement leads to session loss.

Why this answer

The web tier stores session data in the local file system of the EC2 instance. When the instance is replaced or restarted (e.g., due to Auto Scaling, instance failure, or a maintenance event), that local session data is lost. Since the application code was not modified to use a shared session store (like ElastiCache or DynamoDB), users lose their sessions and are logged out.

This is the most likely cause because the migration explicitly minimized code changes and did not address the stateless web tier requirement.

Exam trap

The trap here is that candidates may assume session data is automatically preserved across EC2 instance lifecycles, or they may incorrectly blame RDS connectivity or security group rules, when the real issue is the lack of a shared, durable session store for the stateless web tier.

How to eliminate wrong answers

Option B is wrong because RDS backup windows do not cause database connections to drop; RDS remains available during backups (Multi-AZ or single-AZ with I/O suspension), and any brief I/O suspension would not cause web session loss. Option C is wrong because there is no evidence that the session timeout setting was changed; the problem is session data persistence, not timeout duration. Option D is wrong because security groups do not block inbound session cookies; security groups filter network traffic at the IP/port level, not application-layer HTTP cookies.

Full explanation →
500
Multi-Selecthard

Which THREE steps should be taken when troubleshooting a slow-running SAP HANA database on AWS? (Select THREE.)

Select 3 answers
A.Immediately scale up the EC2 instance type
B.Review HANA SQL plan cache for slow queries
C.Check CloudWatch metrics for CPU utilization and disk I/O
D.Review IAM roles attached to the instance
E.Verify HANA memory allocation and check for memory pressure
AnswersB, C, E

Slow queries can indicate performance issues.

Why this answer

To troubleshoot a slow-running SAP HANA database on AWS, start by reviewing the HANA SQL plan cache to identify slow queries (B). Check CloudWatch metrics for CPU utilization and disk I/O to detect resource bottlenecks (C). Verify HANA memory allocation and check for memory pressure, as memory issues are a common cause of slowdowns (E).

Scaling up the EC2 instance (A) is premature without analysis, and reviewing IAM roles (D) is unrelated to performance troubleshooting.

Full explanation →
501
MCQhard

A company has an SAP HANA database running on a r5.8xlarge EC2 instance with 3.5 TB of data. They want to back up the database to Amazon S3 using Backint. What is the most cost-effective and performant backup strategy?

A.Use EBS snapshots and copy them to S3.
B.Use multiple parallel Backint streams to a single S3 bucket with S3 Standard storage.
C.Use multiple parallel Backint streams to multiple S3 buckets with S3 Glacier storage.
D.Use a single Backint stream to one S3 bucket with S3 Standard storage.
AnswerB

Parallel streams improve throughput; single bucket is simpler and cost-effective.

Why this answer

Backint is the native SAP HANA backup integration that sends backup data directly to Amazon S3. Using multiple parallel Backint streams maximizes throughput by leveraging S3's high request rate limits, and S3 Standard storage provides the low-latency access needed for frequent backups and restores without incurring retrieval costs. This combination is both cost-effective and performant for a 3.5 TB database.

Exam trap

The trap here is that candidates often choose S3 Glacier for cost savings, overlooking the retrieval latency and costs for frequent backups, or they choose a single stream assuming simplicity, missing the performance benefits of parallelism for large datasets.

How to eliminate wrong answers

Option A is wrong because EBS snapshots capture the entire volume, including unused blocks, and require copying to S3, which adds latency and cost without leveraging Backint's native SAP integration for HANA. Option C is wrong because S3 Glacier storage incurs retrieval fees and delays (minutes to hours) that are unsuitable for frequent backups and rapid restores required by SAP HANA. Option D is wrong because a single Backint stream creates a bottleneck, limiting throughput to a single connection and failing to utilize S3's parallel processing capabilities, resulting in slower backup times for a 3.5 TB dataset.

Full explanation →
502
MCQhard

A company is migrating an SAP application server to AWS using CloudFormation. The template snippet is shown in the exhibit. The SAP application requires at least 300 GB of disk space for /usr/sap. Which change should be made to the template?

A.Change the instance type to a larger size to provide more instance storage.
B.Increase the root volume (/dev/xvda) size to 300 GB.
C.Increase the size of the second volume (/dev/xvdb) to 300 GB.
D.Add a third EBS volume of 100 GB for /usr/sap.
AnswerC

The second volume is likely for /usr/sap; increase to 300 GB.

Why this answer

The SAP application server typically needs a large disk for /usr/sap. The template currently has a 100 GB root volume and a 200 GB additional volume, total 300 GB. However, /usr/sap is usually mounted on a separate volume.

The 200 GB volume is likely for /usr/sap, but 200 GB may not be enough if the requirement is at least 300 GB. The correct action is to increase the second volume size to at least 300 GB. Increasing root volume or adding a third volume are alternatives but less direct.

Full explanation →
503
MCQhard

A company is designing a multi-zone SAP system on AWS. They want to minimize network latency between SAP application servers and the SAP HANA database. What is the best practice for deploying these components?

A.Deploy in different VPCs and use VPC peering.
B.Deploy in different AWS Regions.
C.Deploy application servers and HANA in the same AZ and same VPC.
D.Deploy application servers in one AZ and HANA in another AZ.
AnswerC

Same AZ and VPC minimizes latency.

Why this answer

Deploying both the SAP application servers and the SAP HANA database in the same Availability Zone (AZ) and the same VPC minimizes network latency because traffic stays within a single data center, using low-latency, high-bandwidth links. SAP HANA is latency-sensitive, and even single-digit millisecond increases can degrade performance; co-location in the same AZ ensures the lowest possible round-trip time (RTT) for SQL queries and data transfers.

Exam trap

The trap here is that candidates often assume cross-AZ deployment provides high availability without considering the latency penalty, but for SAP HANA, latency is prioritized over AZ-level redundancy in this design scenario, and the question explicitly asks for minimizing latency, not maximizing availability.

How to eliminate wrong answers

Option A is wrong because deploying in different VPCs and using VPC peering introduces additional network hops and potential bandwidth constraints, increasing latency compared to a single VPC. Option B is wrong because deploying in different AWS Regions incurs inter-Region latency (typically tens of milliseconds), which is unacceptable for SAP HANA's real-time processing requirements. Option D is wrong because deploying application servers in one AZ and HANA in another AZ adds cross-AZ latency (typically 1-2 ms), which can still impact performance for latency-critical SAP workloads, whereas same-AZ placement eliminates this entirely.

Full explanation →
504
MCQmedium

A company runs SAP ERP on AWS. The system needs to be highly available with automatic failover in case of an Availability Zone failure. Which architecture should be used?

A.Route 53 failover routing policy
B.Auto Scaling group with multiple EC2 instances in different AZs
C.SAP HANA System Replication across two Availability Zones with automatic failover
D.AWS RDS Multi-AZ deployment
AnswerC

HANA SR across AZs provides automatic failover for HA.

Why this answer

SAP HANA System Replication (HSR) across two Availability Zones with automatic failover is the correct architecture because it provides synchronous or asynchronous replication of the SAP HANA database at the storage or log level, enabling automatic failover to a standby instance in a different AZ when the primary fails. This meets the requirement for high availability and automatic failover during an AZ failure, as HSR is the native SAP mechanism for database-level HA on AWS, unlike generic AWS services that do not handle SAP-specific application state or replication requirements.

Exam trap

The trap here is that candidates confuse generic AWS high-availability services (like Auto Scaling or RDS Multi-AZ) with SAP-specific requirements, failing to recognize that SAP HANA requires its own replication mechanism (HSR) and that RDS does not support SAP HANA at all.

How to eliminate wrong answers

Option A is wrong because Route 53 failover routing policy only handles DNS-level traffic routing to healthy endpoints, not automatic failover of the SAP ERP application or database; it cannot initiate database failover or maintain session state, and it requires health checks that do not replace SAP HANA's replication and takeover logic. Option B is wrong because an Auto Scaling group with multiple EC2 instances in different AZs provides compute-level redundancy but does not manage SAP HANA database replication or automatic failover; it lacks the database synchronization and takeover mechanisms needed for SAP ERP, and scaling out instances does not address database state consistency. Option D is wrong because AWS RDS Multi-AZ deployment is designed for relational databases like MySQL, PostgreSQL, or Oracle, not for SAP HANA; SAP HANA is an in-memory database that requires its own replication technology (HSR) and is not supported by RDS Multi-AZ, which also does not provide SAP-specific application-aware failover.

Full explanation →
505
MCQmedium

A company is running SAP ERP on AWS and wants to reduce costs by right-sizing the EC2 instances. The administrator has identified that the current instances are over-provisioned for CPU and memory. Which AWS service can provide recommendations for instance type changes based on historical usage?

A.AWS Trusted Advisor
B.AWS Compute Optimizer
C.Amazon CloudWatch
D.AWS Cost Explorer
AnswerB

Compute Optimizer uses machine learning to recommend optimal AWS resources.

Why this answer

AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, I/O, network) from Amazon CloudWatch and provides actionable recommendations for right-sizing EC2 instances, including instance type changes. For SAP ERP workloads, it can identify over-provisioned instances by comparing actual usage patterns against the performance characteristics of different instance families, directly addressing the goal of reducing costs without compromising performance.

Exam trap

The trap here is that candidates confuse AWS Trusted Advisor's general cost optimization checks (which include idle instance detection) with Compute Optimizer's specific right-sizing recommendations based on historical utilization, leading them to select Trusted Advisor instead of the service designed for this exact purpose.

How to eliminate wrong answers

Option A (AWS Trusted Advisor) is wrong because it provides general cost optimization checks (e.g., idle instances, reserved instance coverage) but does not analyze historical CPU/memory utilization to recommend specific instance type changes; its recommendations are based on static rules, not machine learning on usage patterns. Option C (Amazon CloudWatch) is wrong because it is a monitoring and observability service that collects and stores metrics and logs, but it does not generate instance type recommendations; it provides the raw data that Compute Optimizer uses, but lacks the analysis engine to produce right-sizing suggestions. Option D (AWS Cost Explorer) is wrong because it focuses on visualizing and analyzing historical cost and usage data (e.g., spend trends, reserved instance recommendations), not on analyzing EC2 instance performance metrics to recommend instance type changes for right-sizing.

Full explanation →
506
Multi-Selecteasy

A company is running SAP HANA on an EC2 instance. The administrator needs to ensure that the instance is resilient to an Availability Zone failure. Which actions should the administrator take? (Choose TWO.)

Select 2 answers
A.Configure Auto Scaling to automatically launch a new instance in another AZ.
B.Use Amazon CloudWatch to monitor instance health and trigger a recovery.
C.Set up SAP HANA System Replication between instances in two Availability Zones.
D.Deploy a second HANA instance in a different AZ and configure replication.
E.Take daily EBS snapshots of the HANA data volume.
AnswersC, D

HSR provides data replication across AZs.

Why this answer

SAP HANA System Replication (HSR) provides synchronous or asynchronous replication of the HANA database to a secondary instance in a different Availability Zone (AZ). This ensures that if the primary AZ fails, the secondary instance can be promoted to primary with minimal data loss, meeting the resilience requirement. HSR is the native SAP mechanism for disaster recovery across AZs and is fully supported on AWS.

Exam trap

The trap here is that candidates often confuse instance-level recovery (e.g., CloudWatch recovery or Auto Scaling) with database-level replication, failing to recognize that SAP HANA requires a dedicated replication mechanism like HSR to maintain data consistency across AZs.

Full explanation →
507
MCQeasy

Refer to the exhibit. A CloudFormation template is used to launch an EC2 instance for SAP. The instance launches but the root volume is only 50 GB. The SAP installation requires at least 100 GB for the root volume. How should the template be modified?

A.Change VolumeSize from 50 to 100 in the BlockDeviceMapping.
B.Change the InstanceType to a larger instance.
C.Modify the running instance's root volume size using the AWS Management Console.
D.Change the ImageId to an AMI with a larger root volume.
AnswerA

Increasing the VolumeSize value will allocate a larger root volume.

Why this answer

The CloudFormation template explicitly defines the root volume size in the BlockDeviceMapping property. By changing VolumeSize from 50 to 100, the template will provision a new EC2 instance with a 100 GB root volume, meeting the SAP installation requirement. The BlockDeviceMapping overrides the default root volume size from the AMI, so this is the precise way to control volume size at launch.

Exam trap

This question tests the misconception that changing the instance type or AMI alone can adjust root volume size, when in fact the BlockDeviceMapping is the explicit mechanism to control root volume size at launch.

How to eliminate wrong answers

Option B is wrong because changing the InstanceType to a larger instance does not affect the root volume size; instance types control CPU, memory, and network performance, not storage capacity. Option C is wrong because modifying the running instance's root volume size using the AWS Management Console requires stopping the instance and detaching the volume, which is not a template modification and does not address the root cause in the CloudFormation code. Option D is wrong because changing the ImageId to an AMI with a larger root volume is unreliable and unnecessary; AMIs have a default root volume size that can be overridden by BlockDeviceMapping, and the correct approach is to adjust the template parameter rather than depend on a different AMI.

Full explanation →
508
MCQeasy

A company is migrating a large Oracle database to Amazon RDS for Oracle. They want to minimize downtime during the migration. Which AWS service should they use to replicate data in real time?

A.AWS Server Migration Service (SMS)
B.AWS Schema Conversion Tool (SCT)
C.AWS Database Migration Service (DMS)
D.AWS DataSync
AnswerC

DMS supports ongoing replication to minimize downtime.

Why this answer

AWS DMS (Database Migration Service) supports ongoing replication with minimal downtime, making it ideal for migrating large databases like Oracle to Amazon RDS for Oracle while keeping the source and target in sync. Option A (AWS SMS) is for server migration, not database replication. Option B (AWS SCT) is a schema conversion tool, not for real-time data replication.

Option D (AWS DataSync) is for file-based data transfer, not database replication.

Full explanation →
509
MCQmedium

An administrator is reviewing a CloudFormation template to deploy an SAP ASCS instance. The template snippet is shown in the exhibit. What is a potential issue with this configuration for a production deployment?

A.The AMI ID is not specified correctly.
B.The instance type m5.large is not certified for SAP ASCS.
C.The security group is not defined in the template.
D.The tags are not sufficient for SAP discovery.
AnswerB

SAP ASCS requires certified instance types; m5.large is not certified.

Why this answer

The m5.large instance type is not certified for SAP ASCS on AWS. SAP requires specific instance types that have passed SAP's certification tests for high-availability and performance requirements of the ASCS (ABAP Central Services) role. Using an uncertified instance type can lead to unsupported configurations, potential performance issues, and lack of SAP support.

Exam trap

The trap here is that candidates often assume any instance type in a family (e.g., m5) is automatically certified for SAP, but SAP certification is granular per specific size and role, and m5.large is explicitly excluded for ASCS in production.

How to eliminate wrong answers

Option A is wrong because the AMI ID is not specified in the template snippet shown, but this is not inherently an issue—the AMI can be provided as a parameter or mapped later, and the question focuses on the ASCS deployment configuration, not the AMI. Option C is wrong because security groups can be referenced by name or ID without being defined inline in the same template; they may exist externally or be imported, and this does not directly affect ASCS certification. Option D is wrong because tags are not a certification requirement for SAP ASCS; while tags help with resource identification and automation, insufficient tags do not prevent a production deployment or violate SAP certification.

Full explanation →
510
MCQhard

An SAP administrator receives an alert that the SAP HANA database is using 95% of its allocated memory. The system is running on an EC2 instance with 1 TB of RAM. The administrator needs to add more memory without significant downtime. Which action should be taken?

A.Modify the EC2 instance type to a larger size while the instance is running.
B.Add additional EBS volumes to the instance to increase memory capacity.
C.Stop the SAP HANA database, change the EC2 instance type to one with more memory, then restart the database.
D.Increase the swap space on the instance to provide virtual memory.
AnswerC

This provides the needed memory increase with controlled downtime.

Why this answer

To increase the RAM of an EC2 instance running SAP HANA, you must stop the instance (and the database) and change the instance type to one with more memory. This is the only way to add memory with minimal downtime, as memory cannot be added dynamically. Option A is incorrect because changing the instance type while running is not supported for all instance types and requires a stop for memory changes.

Option B is incorrect because EBS volumes provide storage, not memory. Option D is incorrect because swap space is virtual memory and not a suitable solution for SAP HANA, which requires physical RAM for performance.

Full explanation →
511
MCQeasy

An SAP administrator is planning a Disaster Recovery (DR) strategy for SAP HANA on AWS. The DR site is in a different AWS Region. Which AWS service can replicate SAP HANA data to the DR region with low Recovery Point Objective (RPO)?

A.Amazon EBS snapshots copied to the DR region
B.SAP HANA System Replication with log shipping
C.AWS Database Migration Service (DMS) with ongoing replication
D.Amazon S3 cross-region replication
AnswerB

HANA System Replication provides continuous synchronization with low RPO.

Why this answer

SAP HANA System Replication with log shipping is the correct choice because it provides near-synchronous or synchronous replication of HANA data and transaction logs to a secondary system in another AWS Region, enabling a Recovery Point Objective (RPO) of seconds or even zero data loss. This native HANA feature is optimized for SAP workloads and integrates directly with HANA's persistence layer, making it the most suitable DR method for low RPO requirements.

Exam trap

The trap here is that candidates often confuse Amazon EBS snapshots or S3 replication as viable low-RPO solutions for SAP HANA, but these are not designed for real-time database replication and cannot match the sub-second RPO of HANA's native log shipping mechanism.

How to eliminate wrong answers

Option A is wrong because Amazon EBS snapshots are point-in-time copies of block-level data, and copying them to a DR region introduces significant delays (snapshot creation time, transfer time) that result in a high RPO, often minutes to hours, not low RPO. Option C is wrong because AWS Database Migration Service (DMS) with ongoing replication is designed for heterogeneous database migrations and continuous replication to supported targets, but it does not natively support SAP HANA as a source for ongoing replication to another HANA instance, and it cannot achieve the sub-second RPO that HANA System Replication offers. Option D is wrong because Amazon S3 cross-region replication is an object-level replication feature for S3 buckets, not a mechanism for replicating live SAP HANA database data, which requires transaction-consistent log shipping or block-level replication.

Full explanation →
512
Multi-Selectmedium

An SAP system on AWS uses an Oracle database. The administrator wants to automate the creation of daily backups and retain them for 30 days. Which THREE AWS services can be used together to achieve this? (Choose three.)

Select 3 answers
A.Amazon S3 lifecycle policies
B.AWS Lambda
C.Amazon EBS snapshots
D.AWS Backup
E.Amazon CloudWatch Events
AnswersA, C, D

To expire old backups.

Why this answer

Amazon S3 lifecycle policies (A) are correct because they can be used to automatically transition backup data to lower-cost storage tiers (e.g., S3 Standard-IA or S3 Glacier) and expire objects after a specified retention period (30 days). This enables cost-effective, automated management of daily backups without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Lambda or CloudWatch Events as primary backup services, when in fact they are only orchestration or scheduling tools that require additional services to actually create and manage backups.

Full explanation →
513
MCQhard

An SAP administrator is reviewing a CloudFormation template that defines an Auto Scaling group for SAP application servers. The exhibit shows the relevant section. The group currently has 2 instances running. The administrator wants to ensure that during a rolling update, at least one instance remains available. Which property should be added?

A.UpdatePolicy attribute with AutoScalingRollingUpdate and MinInstancesInService set to 1.
B.Set MaxSize to 1.
C.Set DesiredCapacity to 3.
D.Add a HealthCheckGracePeriod of 300 seconds.
AnswerA

This ensures that during updates, at least one instance remains in service.

Why this answer

Adding an UpdatePolicy with AutoScalingRollingUpdate and MinInstancesInService set to 1 ensures that during a rolling update, at least one instance remains available, preventing complete downtime. Option B is wrong because setting MaxSize to 1 would limit the maximum number of instances to 1, which could cause issues if the current count is 2 and a rolling update is performed; it does not guarantee availability during updates. Option C is wrong because increasing DesiredCapacity to 3 would add more instances but does not control the rolling update behavior to maintain at least one running instance.

Option D is wrong because HealthCheckGracePeriod only defines a grace period for health checks after an instance launches; it does not enforce availability during a rolling update.

Full explanation →
514
MCQeasy

A company wants to automate the installation of SAP software on AWS. Which AWS service is most appropriate for orchestrating the deployment of SAP systems?

A.AWS CloudFormation
B.AWS OpsWorks
C.AWS CodeDeploy
D.AWS Lambda
AnswerA

CloudFormation allows infrastructure as code to provision all AWS resources for SAP.

Why this answer

AWS CloudFormation is the most appropriate service for orchestrating the deployment of SAP systems because it allows you to define the entire infrastructure as code using templates, enabling automated, repeatable, and consistent provisioning of SAP landscapes. It supports custom resources and nested stacks, which are essential for managing the complex dependencies and multi-tier architecture typical of SAP deployments on AWS.

Exam trap

The trap here is that candidates often confuse AWS OpsWorks or CodeDeploy with infrastructure orchestration, but the PAS-C01 exam specifically tests the understanding that CloudFormation is the primary service for automating the provisioning of SAP systems on AWS, while OpsWorks and CodeDeploy serve different purposes in configuration management and application deployment, respectively.

How to eliminate wrong answers

Option B (AWS OpsWorks) is wrong because it is designed for configuration management using Chef or Puppet, not for orchestrating the deployment of complex SAP systems; it lacks native support for SAP-specific resources and templates. Option C (AWS CodeDeploy) is wrong because it is intended for deploying application code to EC2 instances or on-premises servers, not for provisioning the underlying infrastructure or orchestrating multi-tier SAP landscapes. Option D (AWS Lambda) is wrong because it is a serverless compute service for running event-driven code, not a deployment orchestration tool; it cannot manage the lifecycle of infrastructure resources like EC2 instances, storage, and networking required for SAP.

Full explanation →
515
MCQmedium

A company uses SAP BusinessObjects (BO) on AWS. The BO servers run on EC2 instances in a private subnet. Users access the BI Launch Pad through an Application Load Balancer (ALB) in a public subnet. The company recently received a security audit finding that the ALB is accessible from the internet on port 443, but the security group allows inbound traffic from 0.0.0.0/0. The audit requires that only the company's corporate IP range (203.0.113.0/24) should be allowed. Additionally, the company wants to reduce the attack surface by blocking traffic from other IPs. What should the company do to meet the security requirement?

A.Deploy AWS WAF on the ALB and create a rule to allow only the corporate IP range.
B.Modify the security group attached to the ALB to allow only inbound traffic from 203.0.113.0/24 on port 443.
C.Replace the security group with a network ACL on the ALB subnet to allow only the corporate IP range.
D.Move the ALB to a private subnet and use a VPN for user access.
AnswerB

Security groups can restrict traffic by source IP.

Why this answer

The correct answer because modifying the security group attached to the ALB to restrict inbound traffic on port 443 to only the corporate IP range (203.0.113.0/24) is the most direct and effective way to meet the requirement. Security groups are stateful and can enforce IP-based restrictions. Option A is not the best choice because AWS WAF is not necessary for simple IP allowlisting; it's more suited for complex rules like rate limiting or SQL injection prevention.

Option C is incorrect because while a network ACL can also restrict traffic, it is stateless and requires separate inbound and outbound rules, and it applies to the subnet rather than the ALB directly, which is less granular. Option D is unnecessary because moving the ALB to a private subnet would block all internet traffic, preventing even corporate users from accessing BI Launch Pad without additional VPN setup, which is more complex than needed.

Full explanation →
516
MCQhard

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

A.Examine the S3 server access logs for the bucket.
B.Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.
C.Review the configuration timeline in AWS Config for the S3 bucket.
D.Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.
AnswerB

CloudTrail records all API calls with details.

Why this answer

AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Exam trap

The trap here is that candidates confuse AWS Config's configuration timeline (which shows what changed and when, but not who) with CloudTrail's audit trail (which shows who made the API call), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because S3 server access logs record object-level requests (GET, PUT, DELETE) and do not capture management-plane API calls like PutBucketPolicy; they would not show who modified the bucket policy. Option C is wrong because the AWS Config configuration timeline shows resource configuration changes and compliance status over time, but it does not record the identity of the user or service that made the change. Option D is wrong because AWS Systems Manager Automation is designed for operational runbooks and remediation, not for querying audit logs; using it to check CloudWatch Logs is an inefficient, roundabout approach compared to directly querying CloudTrail.

Full explanation →
517
MCQmedium

The exhibit shows the output of the describe-replication-tasks command. The task status is 'failed'. Which action should be taken to troubleshoot the failure?

A.Restart the replication task with a different migration type.
B.Modify the table mappings to exclude all tables.
C.Create a new replication task with the same settings.
D.Review the CloudWatch logs for the replication instance and task.
AnswerD

CloudWatch logs provide detailed error messages for troubleshooting.

Why this answer

The first step is to check the CloudWatch logs for DMS to find detailed error messages. Option A is wrong because restarting without investigation may lead to the same error. Option B is wrong because modifying table mappings may not be the issue.

Option C is wrong because creating a new task without understanding the failure is inefficient.

Full explanation →
518
MCQmedium

A company is running SAP on AWS and needs to back up the SAP HANA database daily. The database is 1 TB in size and the backup must be completed within 2 hours. The backup will be stored in Amazon S3. Which approach provides the fastest backup time while minimizing cost?

A.Copy the backup files to an EC2 instance store, then upload to S3
B.Take EBS snapshots of the volume
C.Use the SAP HANA Backint agent to stream backups directly to S3
D.Mount an Amazon EFS file system and write backups to it
AnswerC

Backint is optimized for HANA backup to S3, fast and cost-effective.

Why this answer

The SAP HANA Backint agent is the native, certified integration for SAP HANA backups to Amazon S3. It streams backup data directly to S3 via the Backint API, eliminating intermediate storage and minimizing data transfer overhead. This approach achieves the fastest backup time because it avoids the latency of writing to instance store, EBS, or EFS before reaching S3, and it incurs only S3 storage costs without additional compute or storage fees.

Exam trap

The trap here is that candidates often assume EBS snapshots are the fastest because they are block-level and incremental, but they fail to recognize that SAP HANA requires application-consistent backups and that Backint is the only option that integrates directly with SAP HANA's backup framework for fast, certified backups to S3.

How to eliminate wrong answers

Option A is wrong because copying backup files to EC2 instance store (ephemeral storage) first adds an unnecessary intermediate write step, and instance store data is lost on instance stop/termination, requiring additional upload time to S3. Option B is wrong because EBS snapshots capture the entire volume, not just the HANA database changes, and restoring from snapshots requires additional steps to make the data usable for SAP HANA; they also do not integrate with SAP HANA's backup catalog. Option D is wrong because mounting an Amazon EFS file system and writing backups to it introduces network file system latency and throughput limitations, and EFS is not optimized for high-throughput sequential writes of large database backups, making it slower than direct S3 streaming.

Full explanation →
519
MCQmedium

A company is running SAP ERP on AWS and needs to encrypt data at rest for all SAP-related storage. Which combination of AWS services can be used to achieve this? (Select TWO.)

A.AWS Identity and Access Management (IAM)
B.Amazon S3 server-side encryption
C.AWS WAF
D.Amazon EBS encryption
E.Amazon CloudWatch Logs
AnswerB, D

Encrypts objects stored in S3, such as backups.

Why this answer

Amazon EBS encryption (Option D) provides at-rest encryption for the block storage volumes used by SAP EC2 instances, ensuring data on the underlying disks is encrypted. Amazon S3 server-side encryption (Option B) encrypts data at rest in S3 buckets, which can be used for SAP backups, log archives, or other SAP-related object storage. Together, they cover the primary storage types for SAP on AWS.

Exam trap

The trap here is that candidates may confuse access control services (IAM) or security monitoring (WAF, CloudWatch) with encryption services, failing to recognize that only storage-level services like EBS and S3 provide native at-rest encryption for SAP data.

How to eliminate wrong answers

Option A is wrong because AWS Identity and Access Management (IAM) is an access control service that manages permissions and authentication, not data encryption at rest. Option C is wrong because AWS WAF is a web application firewall that protects against web exploits, not a data encryption service. Option E is wrong because Amazon CloudWatch Logs is a monitoring and logging service that stores log data but does not provide native encryption at rest for SAP storage; it relies on underlying service encryption, but it is not a direct encryption mechanism for SAP-related storage.

Full explanation →
520
MCQeasy

An SAP system administrator receives an alert that an EBS volume attached to an SAP application server is at 95% capacity. The volume is 100 GB gp2 and stores log files. What is the MOST efficient way to resolve the space issue?

A.Increase the volume size using Amazon EBS Elastic Volumes.
B.Delete the oldest log files manually.
C.Configure log rotation and move old logs to Amazon S3 Glacier.
D.Attach an additional EBS volume for log storage.
AnswerC

Automating archiving to S3 Glacier frees space and retains logs for compliance.

Why this answer

Configuring log rotation ensures logs are managed systematically, and moving old logs to Amazon S3 Glacier provides cost-effective long-term storage while freeing up space on the EBS volume. Option A is incorrect because simply increasing the volume size is a temporary fix and does not address the root cause of log accumulation. Option B is incorrect because manual deletion is error-prone and not scalable.

Option D is incorrect because attaching an additional EBS volume also provides a temporary solution and adds management overhead without addressing log management best practices.

Full explanation →
521
MCQhard

A company runs SAP on AWS and uses a shared file system for SAP transport files. The system must support concurrent access from multiple SAP application servers and provide strong consistency. The transport files are typically small (less than 1 MB) and are frequently read and written. Which file storage solution should be used?

A.Amazon FSx for Windows File Server
B.Amazon S3
C.Amazon EFS
D.Amazon EC2 instance store
AnswerC

EFS provides NFS shared storage with strong consistency, ideal for SAP transport directories.

Why this answer

Amazon EFS (Elastic File System) provides a fully managed, POSIX-compliant, shared file system that supports concurrent access from multiple EC2 instances (SAP application servers) with strong consistency. It uses the NFSv4.1 protocol, which ensures that read-after-write consistency is maintained across all clients, making it ideal for SAP transport files that are frequently read and written.

Exam trap

The trap here is that candidates confuse object storage (S3) with file storage, or assume that any shared storage (like FSx for Windows) works for Linux-based SAP workloads, overlooking the specific POSIX and consistency requirements of SAP transport files.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server uses the SMB protocol and is designed for Windows-based workloads, not for SAP on Linux, and its consistency model is not as strong as NFS for concurrent POSIX operations. Option B is wrong because Amazon S3 is an object storage service, not a file system; it does not support POSIX file locking or concurrent read/write semantics required for SAP transport files, and its eventual consistency model (though strong for new PUTs) can lead to stale reads in some scenarios. Option D is wrong because Amazon EC2 instance store provides ephemeral block storage that is local to a single instance, cannot be shared across multiple SAP application servers, and data is lost on instance stop or termination.

Full explanation →
522
MCQmedium

An SAP HANA database on AWS is configured with automatic backups to Amazon S3. The backup process is failing with the error 'Access Denied'. The administrator has confirmed the S3 bucket exists and the IAM role attached to the EC2 instance has the correct permissions. What could be the issue?

A.The S3 bucket has a bucket policy that denies access to the IAM role
B.The IAM role's trust policy does not allow the EC2 service
C.The S3 bucket is encrypted with AWS KMS and the role lacks kms:Decrypt permissions
D.The VPC does not have an S3 VPC endpoint configured
AnswerA

A bucket policy with an explicit deny overrides IAM permissions.

Why this answer

If the bucket policy denies access even if the IAM role allows, the explicit deny in the bucket policy overrides. The error indicates a permissions issue. The role might lack proper trust policy only if it can't assume, but the error suggests access denied to S3.

The bucket policy is likely the cause. KMS key issues would give a different error. VPC endpoint issues would cause connectivity errors.

Full explanation →
523
MCQeasy

A solutions architect is designing a disaster recovery plan for a critical application that runs on Amazon RDS for PostgreSQL. The application requires a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which RDS deployment option meets these requirements?

A.A single-AZ deployment with cross-Region automated backups.
B.A single-AZ deployment with a standby instance manually promoted.
C.A Multi-AZ deployment with synchronous replication.
D.A Multi-AZ deployment with a Read Replica in a different Region.
AnswerC

Multi-AZ provides synchronous replication and automatic failover.

Why this answer

Amazon RDS Multi-AZ deployments with synchronous replication provide automatic failover to a standby instance in a different Availability Zone, ensuring data is committed to both primary and standby before acknowledging a write. This achieves an RPO of effectively zero (less than 5 seconds) and an RTO typically under 1 minute, meeting the stated requirements.

Exam trap

The trap here is confusing Multi-AZ synchronous replication (which provides automatic failover and near-zero RPO) with cross-Region Read Replicas (which use asynchronous replication and require manual promotion, thus failing both RPO and RTO requirements).

How to eliminate wrong answers

Option A is wrong because cross-Region automated backups have an RPO of up to 5 minutes or more due to the asynchronous nature of backup uploads, and RTO involves restoring from a snapshot which takes significantly longer than 1 minute. Option B is wrong because a single-AZ deployment with manual promotion requires you to detect the failure and manually promote a standby (if any), resulting in RTO far exceeding 1 minute and no synchronous replication to guarantee RPO under 5 seconds. Option D is wrong because a Read Replica in a different Region uses asynchronous replication, which can have replication lag exceeding 5 seconds, and promoting it requires manual intervention, failing the RTO requirement.

Full explanation →
524
MCQhard

A company is migrating a large SAP ERP system to AWS. The source system runs on IBM Db2. The target is SAP HANA on AWS. Which tool should be used for schema conversion?

A.AWS Database Migration Service (AWS DMS)
B.SAP HANA Studio
C.AWS Schema Conversion Tool (AWS SCT)
D.SAP DMO
AnswerC

AWS SCT converts source schemas to target format, supporting Db2 to HANA.

Why this answer

AWS SCT supports schema conversion from IBM Db2 to SAP HANA. SAP HANA Studio and SAP DMO are SAP tools, but SCT is the AWS-native option for heterogeneous migrations. AWS DMS is for data migration, not schema conversion.

Full explanation →
525
MCQhard

A company runs SAP on AWS and is experiencing high latency for database queries after moving the SAP HANA database to a larger instance type. CloudWatch metrics show that the EBS volume queue length is consistently high. What is the most likely cause of the latency?

A.The instance's network bandwidth is saturated.
B.The instance's CPU is under-provisioned.
C.The EBS volume does not have enough provisioned IOPS.
D.The EBS volume is not encrypted.
AnswerC

Insufficient IOPS leads to requests queuing.

Why this answer

A consistently high EBS volume queue length indicates that the volume is receiving more I/O requests than it can process, causing requests to queue up. Since the SAP HANA database was moved to a larger instance type, the workload likely demands more IOPS than the EBS volume is provisioned for, leading to throttling and increased latency. Option C correctly identifies that insufficient provisioned IOPS is the most likely cause.

Exam trap

The trap here is that candidates may confuse a high EBS queue length with network or CPU bottlenecks, but the queue length is a direct indicator of I/O throttling due to insufficient provisioned IOPS, not resource saturation elsewhere.

How to eliminate wrong answers

Option A is wrong because network bandwidth saturation would manifest as network-related metrics (e.g., network throughput, packet drops) and would not directly cause a high EBS volume queue length; the queue length is a storage-level metric. Option B is wrong because CPU under-provisioning would show high CPU utilization or CPU credit exhaustion in CloudWatch, not a consistently high EBS queue length; the queue length is specific to I/O operations. Option D is wrong because EBS volume encryption does not affect I/O performance or queue depth; encryption is a security feature that adds minimal overhead on modern instance types with hardware acceleration.

Full explanation →
Page 6

Page 7 of 22

Page 8

All pages

12345678910111213141516171819202122

Practice PAS-C01 by domain

Target a specific domain to shore up weak areas.

Design of SAP Workloads on AWSTechnologyMigrationOperations and Maintenance
See all domains with question counts →