AWS Certified SAP on AWS Specialty PAS-C01 (PAS-C01) — Questions 526–600

Option B is correct because using a lifecycle hook with a new AMI ensures patched instances replace old ones without downtime. Option A is wrong because updating the launch configuration does not affect running instances. Option C is wrong because patching in place may require downtime and manual steps.

Option D is wrong because stopping the instance causes downtime.

Option C is correct because Amazon RDS for SQL Server with Multi-AZ provides automatic failover to a standby in another AZ. Option A is wrong because Amazon Aurora is not compatible with SQL Server. Option B is wrong because SQL Server on EC2 is not managed.

Option D is wrong because Amazon DynamoDB is NoSQL and not compatible with SQL Server.

Options A and B are correct. Elastic Load Balancing distributes traffic to multiple application servers. EC2 Auto Recovery automatically recovers an instance from hardware failure.

Option C (S3) is for storage. Option D (CloudFront) is a CDN. Option E (Route 53) is for DNS, not HA for services.

The correct answer is C because AWS Elastic Load Balancer (specifically Network Load Balancer) can be used to distribute traffic between ASCS instances for high availability. Option A is incorrect because AWS Global Accelerator improves performance but not high availability for ASCS. Option B is incorrect because Route 53 is for DNS and can be used for health checks but not as the primary HA mechanism for ASCS.

Option D is incorrect because EC2 Auto Scaling is for scaling compute capacity, not for managing ASCS failover.

Option A is correct. The volume is of type io2 with 10,000 IOPS, which is supported. The instance start will attach the volume and boot normally.

Option B is wrong because volume type is supported. Option C is wrong because multi-attach is disabled but not required. Option D is wrong because size is acceptable.

Option A is correct because using a pre-configured AMI with SAP software pre-installed eliminates the need for installation at launch. Option B is wrong because instance store is ephemeral. Option C is wrong because Elastic Beanstalk is not the best for SAP.

Option D is wrong because increasing instance size does not reduce launch time.

Option D is correct because the rule allows traffic from sg-12345 but only on port 3300. SAP HANA default port is 3<instance_number>15, not 3300. Option A is wrong because the rule is for TCP.

Option B is wrong because source is a security group, not IP. Option C is wrong because the rule is inbound, not outbound.

Option B is correct because to restore from S3, the HANA database user or the backup tool needs s3:GetObject permission to read the backup files. Option A is wrong because s3:PutObject is for writing backups. Option C is wrong because ec2:DescribeInstances is not needed for restore from S3.

Option D is wrong because kms:Decrypt may be needed if encryption is used, but the question asks for required permission, and GetObject is essential.

Option B is correct because AWS DMS can perform ongoing replication to keep the target in sync, then a short cutover achieves <1 hour downtime. Option A (AWS MGN) is for server-level replication, not optimized for database migration with minimal downtime. Option C (SAP HSR) is specific to SAP HANA.

Option D (SAP DMO) is a methodology but typically used for system copy or upgrade, not real-time replication.

Option B is correct because AWS Systems Manager Patch Manager automates patching with minimal downtime when used with a maintenance window. Option A is wrong because manual patching is not automated. Option C is wrong because OpsWorks is not designed for OS patching.

Option D is wrong because Auto Scaling groups are for scaling, not patching.

Options A, C, and E are correct. Option A (EC2 CPU utilization) helps detect compute bottlenecks. Option C (EBS volume queue length) indicates I/O pressure.

Option E (SAP work process usage) shows application-level saturation. Option B (NetworkIn) is less critical for health. Option D (SwapUsage) is important but not a standard CloudWatch metric; it requires custom agent.

Option B is correct because Amazon EventBridge can ingest CloudTrail events and route them to targets such as SNS for notifications based on event patterns. Option A is wrong because Amazon Inspector is for vulnerability assessment. Option C is wrong because AWS Config is for resource compliance.

Option D is wrong because AWS Trusted Advisor provides best practice checks, not real-time event filtering.

Option A is correct because Amazon S3 provides 99.999999999% durability and is cost-effective for storing backups. S3 lifecycle policies can move older backups to Glacier for further cost savings. Option B is incorrect because Amazon EBS Snapshots are stored in S3 but are more expensive for long-term retention.

Option C is incorrect because Amazon EFS is a file system, not optimized for backup storage. Option D is incorrect because AWS Storage Gateway is for on-premises integration.

Option B is correct because the Deny statement denies s3:DeleteObject when SecureTransport is false, but the user may be using HTTPS (SecureTransport true), which is fine. However, the error is likely due to missing s3:ListBucket permission to list objects in the bucket. Option A is wrong because the policy allows PutObject.

Option C is wrong because the Deny condition only applies when SecureTransport is false. Option D is wrong because the Allow statement exists.

Options A, B, and E are correct. Option A: Memory is critical for HANA. Option B: Network performance impacts throughput.

Option E: Intel/AMD vs ARM affects HANA certification. Option C is wrong because EBS optimization is not a primary factor. Option D is wrong because GPU is not relevant for HANA.

Option D is correct because AWS Systems Manager automates patching with maintenance windows and supports high availability by targeting instances in an Auto Scaling group. Option A (Lambda with Run Command) is possible but less efficient. Option B (manual patching via SSH) is not automated.

Option C (CloudFormation update) is complex and not ideal for patching.

The web tier stores session data in the local file system of the EC2 instance. When the instance is replaced or restarted (e.g., due to Auto Scaling, instance failure, or a maintenance event), that local session data is lost. Since the application code was not modified to use a shared session store (like ElastiCache or DynamoDB), users lose their sessions and are logged out.

This is the most likely cause because the migration explicitly minimized code changes and did not address the stateless web tier requirement.

Option A is correct - verify memory allocation is a key step. Option C is correct - check CPU utilization. Option D is correct - review slow queries.

Option B is incorrect - scaling up before analysis may be premature. Option E is incorrect - checking IAM roles is not directly related to HANA performance.

The SAP application server typically needs a large disk for /usr/sap. The template currently has a 100 GB root volume and a 200 GB additional volume, total 300 GB. However, /usr/sap is usually mounted on a separate volume.

The 200 GB volume is likely for /usr/sap, but 200 GB may not be enough if the requirement is at least 300 GB. The correct action is to increase the second volume size to at least 300 GB. Increasing root volume or adding a third volume are alternatives but less direct.

The correct answer is D because placing the SAP application servers and HANA database in the same Availability Zone minimizes network latency. Option A is incorrect because spreading across AZs increases latency. Option B is incorrect because using different VPCs adds unnecessary latency.

Option C is incorrect because different Regions have much higher latency.

Option C is correct because AWS Compute Optimizer analyzes utilization and recommends optimal instance types. Option A is wrong because AWS Trusted Advisor provides cost optimization checks but not detailed instance recommendations. Option B is wrong because Amazon CloudWatch provides metrics but not recommendations.

Option D is wrong because AWS Cost Explorer provides cost usage data, not instance recommendations.

Options B and D are correct. B: Multi-AZ RDS provides HA for database. D: Cross-AZ replication provides DR.

Option A is wrong because auto scaling is for stateless apps. Option C is wrong because EBS snapshots are not for HA. Option E is wrong because CloudWatch does not provide HA.

Option A is correct because increasing the VolumeSize to 100 in the BlockDeviceMapping will allocate a 100 GB root volume. Option B is wrong because modifying the template after launch doesn't change the running instance. Option C is wrong because changing InstanceType does not affect volume size.

Option D is wrong because changing ImageId changes the AMI, not the volume size.

AWS DMS can perform ongoing replication with minimal downtime. Option B is correct because it supports continuous data replication. Option A is wrong because AWS SMS is for server migration.

Option C is wrong because AWS DataSync is for file-based data transfer. Option D is wrong because AWS SCT is a schema conversion tool.

Option D (Stop the SAP HANA database, change the EC2 instance type to one with more memory, restart the database) is correct because it directly increases memory with minimal downtime. Option A (Add swap space) is not a permanent solution. Option B (Modify instance type while running) is not supported for all instance types.

Option C (Add more EBS volumes) does not increase RAM.

Option A is correct. SAP HANA System Replication with log shipping can provide a low RPO by continuously replicating data to another region. Option B is wrong because EBS snapshots are periodic and may not achieve low RPO.

Option C is wrong because S3 cross-region replication is object-level, not database-level. Option D is wrong because AWS Database Migration Service is for migrations, not ongoing replication for DR.

Option A is correct because UpdatePolicy with AutoScalingRollingUpdate allows control of the rolling update, including MinInstancesInService to keep at least one instance running. Option B is wrong because DesiredCapacity only sets the target count. Option C is wrong because HealthCheckGracePeriod is for health checks.

Option D is wrong because MaxSize does not control rolling updates.

Option A is correct because updating the ALB security group to restrict inbound traffic to the corporate IP range is the simplest and most effective solution. Option B is wrong because a WAF is not necessary for IP restriction; security groups can do it. Option C is wrong because a NACL can also restrict, but security groups are stateful and easier.

Option D is wrong because moving the ALB to a private subnet would block all internet traffic.

Option D is correct because the first step is to check the CloudWatch logs for DMS to find detailed error messages. Option A is wrong because restarting without investigation may lead to the same error. Option B is wrong because modifying table mappings may not be the issue.

Option C is wrong because creating a new task without understanding the failure is inefficient.

Storing backups directly to S3 via the SAP HANA Backint interface using an AWS Backint agent is the fastest and most cost-effective method. Option C is correct. EBS snapshots are slower for database backup and require additional steps.

Using EC2 instance store is not durable. NFS on EFS adds latency.

Option D is correct because archiving old logs to Amazon S3 Glacier frees space and provides cost-effective long-term storage. Option A is wrong because log rotation must be configured before deleting. Option B is wrong because manual deletion is error-prone.

Option C is wrong because increasing volume size is temporary.

Option A is correct: Amazon EFS provides a shared NFS file system with strong consistency and is suitable for concurrent access. Option B is wrong: Amazon S3 is object storage, not a file system. Option C is wrong: Amazon FSx for Windows File Server supports SMB, not NFS typically used by SAP on Linux.

Option D is wrong: Instance store is ephemeral and not shared.

If the bucket policy denies access even if the IAM role allows, the explicit deny in the bucket policy overrides. The error indicates a permissions issue. The role might lack proper trust policy only if it can't assume, but the error suggests access denied to S3.

The bucket policy is likely the cause. KMS key issues would give a different error. VPC endpoint issues would cause connectivity errors.

Option C is correct because HANA log volumes require high IOPS and low latency; gp3 may not provide sufficient performance. Options A (encryption) is not shown. Option B (DeleteOnTermination) is false, which is fine for data persistence.

Option D (device name) is not an issue.

Option B is correct because io2 Block Express volumes provide higher IOPS and lower latency than gp3, which is critical for SAP HANA. Option A is wrong because increasing gp3 volume size does not guarantee latency reduction. Option C is wrong because moving to a larger instance increases costs significantly.

Option D is wrong because increasing Provisioned IOPS on gp3 increases costs without addressing the underlying latency issue of gp3.

Option B is correct because CloudWatch alarms can monitor CPU utilization metrics and trigger alerts. Option A is incorrect because CloudTrail records API calls. Option C is incorrect because Config monitors resource configurations.

Option D is incorrect because VPC Flow Logs capture network traffic.

Options A, B, and D are correct. A Multi-AZ deployment with synchronous replication (A) provides HA. A cluster manager (B) automates failover.

An Elastic IP (D) provides a static IP for failover. Option C (Single AZ) does not provide HA. Option E (ALB) is not needed for database HA.

Options B and D are correct. Verifying network ACLs is important because they can block traffic even if security groups allow it. Checking route tables ensures that subnets are properly connected.

Option A is wrong because VPC Flow Logs are useful for analysis but not the first step. Option C is wrong because NACLs are stateless and need both inbound and outbound rules. Option E is wrong because internet gateway is not needed for internal traffic.

Option C is correct because CloudWatch provides metrics and logs for EC2 and RDS, allowing you to analyze CPU, memory, and database wait events. Option A is wrong because X-Ray is for distributed tracing, not database analysis. Option B is wrong because CloudTrail is for API auditing.

Option D is wrong because Trusted Advisor provides recommendations, not detailed performance analysis.

SAP HANA backup and restore is the most common method for large databases; using AWS Direct Connect speeds up the transfer. Option A is wrong because DMS does not support SAP HANA as a source. Option B is wrong because SAP HANA system replication requires low latency and is not ideal for one-time migration.

Option D is wrong because AWS Snowball would introduce additional logistics and potential delays.

Option D is correct because the AWS Backup service can orchestrate snapshots across multiple EBS volumes with application-consistent or crash-consistent behavior. Option A is wrong because individual snapshots without coordination may not be crash-consistent. Option B is wrong because stopping the instance causes downtime.

Option C is wrong because EBS Multi-Attach is for shared volumes, not for snapshot consistency.

Option A is correct because Amazon Route 53 can be used with health checks to automatically redirect traffic to a standby HANA instance. Option B is wrong because AWS CloudFormation is for infrastructure provisioning, not automatic recovery. Option C is wrong because AWS Lambda can be used for custom automation but is not the primary service for this.

Option D is wrong because Amazon CloudWatch monitors but does not automatically recover the instance.

SAP HANA System Replication can achieve near-zero downtime if network latency and bandwidth are adequate. With 10 Gbps, initial sync can be fast. Backup/restore would exceed 4 hours.

DMS with CDC may have overhead. Snowball Edge is not needed given bandwidth.

Option D is correct because increasing EBS optimization or changing to io2 volumes with higher IOPS reduces latency. Option A is wrong because increasing instance size may not help if the bottleneck is EBS. Option B is wrong because read replica does not help write latency.

Option C is wrong because moving to EFS introduces network latency.

Security best practices include using security groups to control traffic (A) and encrypting data in transit using TLS (D). Setting inbound rules to 0.0.0.0/0 (B) is insecure. Storing credentials in plaintext (C) is bad practice.

Disabling CloudTrail (E) removes auditing.

Option C is correct. Amazon EFS provides a shared NFS filesystem that can be mounted from multiple instances across AZs, offering high availability and consistent performance. Option A is wrong because EBS volumes cannot be attached to multiple instances across AZs (Multi-Attach only works within same AZ).

Option B is wrong because S3 is object storage, not a filesystem. Option D is wrong because Local SSDs are ephemeral and not shared.

Option A is incorrect because increasing timeout may hide issues but not solve latency. Option B is incorrect because using a VPN over internet adds overhead and latency. Option C is correct because using AWS Global Accelerator optimizes the network path and reduces latency impact.

Option D is incorrect because disabling preload may reduce performance but not address latency.

Option D is correct because Backint backups can consume significant CPU and I/O, impacting database performance. Option A (EBS volume limit) is unlikely with RAID 0. Option B (matching instance type) is not needed.

Option C (S3 performance) is not the bottleneck.

Amazon CloudWatch can monitor EC2 metrics like CPU and memory (with agent). AWS Systems Manager can run scripts to collect HANA-specific metrics. CloudTrail is for API auditing.

Trusted Advisor is for best practices. Config tracks configuration. CloudWatch and Systems Manager are valid monitoring tools.

Option A, B, and C are correct. The SAP System Migration tool (SWPM) requires source and target systems to have the same operating system (A), the target OS must have the required kernel libraries (B), and the target system must have a running HANA database (C). Option D is not a prerequisite; the migration can be done without a proxy.

Option E is not required; the source DB can be shut down during migration.

Option B is correct because AWS Systems Manager can use State Manager to enforce configurations, including kernel parameters. Option A is wrong because EC2 User Data runs once at launch. Option C is wrong because CloudFormation can provision resources but not easily configure kernel parameters.

Option D is wrong because OpsWorks is a configuration management service but not the best fit for this task.

Option C is correct: Generate a presigned URL that provides temporary access to a specific object. It is secure because permissions are time-limited and scoped to a single object. Option A is wrong: Creating an IAM user for the auditor is not time-limited and requires managing credentials.

Option B is wrong: Making the bucket public is insecure. Option D is wrong: Sharing AWS credentials is a security risk.

Option B is correct because the AWS-UpdateSSMAgent document can be used as a step in State Manager associations to update the agent on targeted instances. Option A is incorrect because running the document manually does not provide automation. Option C is incorrect because the SSM Agent is automatically updated by default only for new instances in certain regions, but not guaranteed.

Option D is incorrect because patching is for OS updates, not SSM Agent.

The instance is running, so the issue is likely network configuration. A network ACL is stateless and must allow both inbound and outbound traffic. If the outbound rule denies traffic, responses are blocked.

Security groups are stateful. The instance state is running, so it is not stopped or terminated. The command only checks state, not health checks.

Option B is correct because CloudTrail logs all API calls. Option A is wrong because CloudWatch monitors performance. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Option D is wrong because Config tracks configuration changes.