Knowledge + Practice

CCNA Operations and Maintenance Questions

75 of 460 questions · Page 1/7 · Operations and Maintenance · Answers revealed

Practice these questions Domain overview All questions

1

MCQeasy

A company needs to monitor the CPU utilization of SAP EC2 instances and send an alert if it exceeds 90% for 5 consecutive minutes. Which AWS service should be used?

A.AWS Config

B.Amazon CloudWatch Alarms

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerB

Amazon CloudWatch Alarms monitor Amazon CloudWatch metrics and automatically perform actions when a metric breaches a defined threshold for a specified number of evaluation periods.

Why this answer

Amazon CloudWatch Alarms (option B) monitor metrics like CPU utilization and can trigger actions such as sending alerts when a threshold is exceeded for a specified duration. Option A (AWS Config) is used for configuration compliance and inventory. Option C (AWS Trusted Advisor) provides best-practice checks.

Option D (AWS CloudTrail) is for API auditing and governance.

Practice this question →

2

MCQhard

An SAP system is experiencing slow performance. The SAP team suspects a memory bottleneck in the HANA database. The database runs on an r5.24xlarge instance with 768 GB RAM. CloudWatch metrics show the HANA memory usage is consistently above 90%. Which action should be taken first?

A.Reduce the number of HANA services.

B.Upgrade the instance to a larger memory-optimized type.

C.Increase the HANA memory allocation parameter in the global.ini file.

D.Increase the swap space on the instance.

AnswerC

Adjusting the memory allocation can reduce pressure without changing instance type.

Why this answer

The HANA database may have a memory allocation parameter that is lower than the available physical memory, causing a bottleneck even when RAM is available. Increasing this parameter in the global.ini file allows HANA to use more memory, addressing the issue without scaling up. Option A is wrong because reducing HANA services does not directly increase memory availability for the database; it may reduce workload but not the memory bottleneck.

Option B is wrong because upgrading the instance is a more disruptive and costly step that should be considered only after tuning parameters. Option D is wrong because swap space is much slower than RAM and is a temporary fix, not a solution for a persistent memory bottleneck.

Practice this question →

3

MCQmedium

Refer to the exhibit. An SAP administrator has created this IAM policy for a backup user. The user can list and download backups but cannot delete them. However, the user is unable to list the objects in the bucket. What is the most likely cause?

A.The IAM policy does not include s3:ListBucket for the bucket.

B.There is an additional bucket policy that denies s3:ListBucket to this user.

C.The user needs s3:GetObjectVersion permission to list objects.

D.The Deny statement also denies s3:ListBucket because of the wildcard resource.

AnswerB

Correct. The user has the necessary IAM permissions to list, so the inability to list must be due to a bucket policy that denies s3:ListBucket.

Why this answer

The IAM policy shown grants s3:ListBucket permission on the bucket, so the user should be able to list objects. However, the user cannot list objects, indicating an additional bucket policy explicitly denies s3:ListBucket for this user. Bucket policies override IAM permissions when a Deny is present.

Option A is incorrect because the policy does include s3:ListBucket. Option C is incorrect because s3:GetObjectVersion is not required to list objects. Option D is incorrect because the Deny statement only affects s3:DeleteObject, not s3:ListBucket.

Practice this question →

4

MCQmedium

A company runs SAP HANA on AWS and uses AWS Systems Manager to automate patching of the operating system. After a recent patching cycle, the SAP HANA database failed to start. The administrator checked the logs and found that the HANA service was not starting due to a missing library dependency. What should the administrator do to prevent this issue in future patching cycles?

A.Use AWS Systems Manager Patch Manager to apply patches but exclude the library in question

B.Test patches in a non-production environment and create a new AMI after successful validation

C.Create a script to reinstall the missing library after patching

D.Set up a maintenance window that stops HANA before patching and starts it after

AnswerB

Testing and creating a new AMI ensures the image is validated and includes all dependencies.

Why this answer

Testing patches in a non-production environment before applying them to production allows the administrator to identify issues like missing library dependencies. After successful validation, creating a new AMI ensures that all patches and dependencies are captured consistently, preventing the HANA database from failing to start due to missing libraries.

Practice this question →

5

MCQhard

A company is running SAP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. They have set up a cluster using Amazon Route 53 with health checks. During a failover test, the ASCS instance fails but the DNS record does not update immediately. What is the most likely cause?

A.The TTL on the DNS record is set too high

B.The health check is not configured to check the ASCS service port

C.The Route 53 record is using simple routing instead of failover

D.The Route 53 record set is not updatable

AnswerA

High TTL causes clients to cache old IPs, delaying failover.

Why this answer

The TTL (Time to Live) on the DNS record determines how long clients cache the DNS response. If the TTL is set too high, clients continue to use the old (failed) IP address even after Route 53 updates the record based on the health check. This delays failover.

Options B and C are incorrect because health checks and routing policies do affect failover, but the immediate cause of the delay is the TTL. Option D is incorrect because Route 53 record sets are updatable.

Practice this question →

6

MCQhard

An organization runs SAP ERP on a single EC2 instance with a separate RDS for Oracle database. The Operations team needs to patch the operating system of the EC2 instance without causing downtime for the SAP application. What is the most effective approach?

A.Create an AMI of the instance, launch a new instance from the AMI, and patch it.

B.Use an Auto Scaling group with a launch template that references a patched AMI, and perform a rolling update.

C.Apply patches using AWS Systems Manager Patch Manager during a maintenance window.

D.Use AWS Systems Manager to run a script that patches the OS without rebooting.

AnswerA

Correct. Creating an AMI from the running instance does not cause downtime. Launching a new instance from that AMI and patching it creates a patched copy. Then switching traffic to the new instance (e.g., via Elastic IP reassignment) achieves patching with minimal or no downtime.

Why this answer

It allows creating a patched copy of the instance without affecting the running SAP application. By creating an AMI of the running EC2 instance, you capture the current state. Launching a new instance from this AMI and patching it does not impact the original instance. Then you can redirect traffic to the new instance (e.g., by updating an Elastic IP or DNS) to complete the cutover with minimal downtime. This is a classic blue/green deployment pattern.

Option B is incorrect because a rolling update requires multiple instances in an Auto Scaling group to maintain availability. With a single instance, there is no instance to serve traffic during the update.

Option C is incorrect because AWS Systems Manager Patch Manager applies patches in-place, which typically requires a reboot, causing downtime for the SAP application.

Option D is incorrect because most operating system patches require a reboot to take effect; running a script without rebooting does not fully apply the patches, leaving the system vulnerable and potentially not in compliance.

Exam trap

Candidates may think that creating an AMI and launching a new instance requires stopping the original instance, but you can create an AMI without stopping the instance.

Practice this question →

7

MCQhard

An SAP Basis administrator is troubleshooting a slow-running SAP HANA query. The administrator wants to identify which SQL statements are consuming the most CPU time in the HANA database. Which SAP HANA view or tool should they query?

A.M_ACTIVE_STATEMENTS

B.M_TABLES

C.M_LOAD_HISTORY

D.M_SERVICE_REPLICATION

AnswerA

Shows currently running statements with CPU time.

Why this answer

(M_ACTIVE_STATEMENTS) is correct because this SAP HANA view provides real-time information about currently executing SQL statements, including their CPU time consumption. Option B (M_TABLES) is incorrect as it shows metadata about tables, not active queries. Option C (M_LOAD_HISTORY) is incorrect as it shows historical load data.

Option D (M_SERVICE_REPLICATION) is incorrect as it displays replication status for services.

Practice this question →

8

Multi-Selecteasy

Which TWO services can be used to centrally manage and enforce backup policies for SAP systems on AWS? (Choose TWO.)

Select 2 answers

A.Amazon Data Lifecycle Manager

B.AWS Backup

C.AWS CloudFormation

D.AWS Config

E.Amazon S3

AnswersA, B

DLM automates creation, retention, and deletion of EBS snapshots.

Why this answer

Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. For SAP systems, you can use DLM to enforce backup policies for the underlying EBS volumes (e.g., /usr/sap, /sapmnt, data volumes) by scheduling snapshots and applying retention rules. AWS Backup provides a centralized, policy-based backup service that supports SAP HANA databases (via Backint integration) and EC2 instances, enabling you to define backup plans, assign resources, and enforce compliance across your SAP landscape.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance evaluation (which can detect missing backups) with actual backup policy enforcement, or they assume Amazon S3's storage capabilities include policy management, when in fact only DLM and AWS Backup provide the scheduling, retention, and enforcement mechanisms required for centralized backup management.

Practice this question →

9

MCQmedium

An operations team needs to ensure that all changes to AWS resources related to SAP systems are tracked and audited. Which AWS service should they use?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Config

D.AWS Trusted Advisor

AnswerA

CloudTrail logs all API activity for auditing.

Why this answer

CloudTrail records API calls for auditing. Option B is wrong because Config tracks configuration changes, not API calls. Option C is wrong because CloudWatch is for monitoring.

Option D is wrong because Trusted Advisor is for best practices.

Practice this question →

10

MCQhard

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

A.The SQS visibility timeout is too short; increase it.

B.The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

C.The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.

D.The reserved concurrency is set too low; increase the reserved concurrency for the function.

AnswerD

Reserved concurrency limits concurrent executions, causing throttling when exceeded.

Why this answer

Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Exam trap

The trap here is that candidates often confuse throttling with message processing failures and incorrectly focus on DLQ or visibility timeout settings, rather than recognizing that reserved concurrency directly controls the maximum number of concurrent Lambda executions and is the primary cause of throttling when set too low.

How to eliminate wrong answers

Option A is wrong because the SQS visibility timeout controls how long a message is hidden after being polled, not the cause of Lambda throttling; a short visibility timeout would cause duplicate processing, not throttling. Option B is wrong because a dead-letter queue (DLQ) captures messages that fail processing after multiple retries, but it does not prevent throttling or address the root cause of messages staying in the queue due to concurrency limits. Option C is wrong because the redrive policy's maxReceiveCount determines how many times a message can be received before being sent to a DLQ, and reducing it would send messages to the DLQ sooner, not resolve throttling issues.

Practice this question →

11

MCQmedium

An SAP administrator needs to ensure that all EC2 instances in the SAP landscape have the correct patches and configurations. Which AWS service can be used to automate OS patch management?

A.AWS CloudFormation

B.AWS Systems Manager Patch Manager

C.AWS OpsWorks

D.AWS Config

AnswerB

AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates.

Why this answer

AWS Systems Manager Patch Manager automates the patching of EC2 instances, making it the correct choice for OS patch management. Option A is wrong because AWS CloudFormation is used for infrastructure as code, not patching. Option C is wrong because AWS OpsWorks is for configuration management with Chef/Puppet.

Option D is wrong because AWS Config is for compliance auditing, not patching.

Practice this question →

12

MCQeasy

An SAP administrator needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?

A.AWS Config

B.AWS CloudTrail

C.Amazon CloudWatch Logs

D.VPC Flow Logs

AnswerB

CloudTrail provides a record of API activity.

Why this answer

AWS CloudTrail records API calls for auditing. Option A is incorrect because AWS Config monitors configuration changes. Option C is incorrect because Amazon CloudWatch Logs is for storing log data.

Option D is incorrect because VPC Flow Logs capture network traffic information.

Practice this question →

13

MCQmedium

A company is running SAP ERP on AWS and uses SAP HANA as the database. The system administrator needs to apply an OS patch that requires a reboot. The SAP HANA database is running in a scale-out configuration across multiple EC2 instances. What is the best approach to minimize downtime?

A.Perform a rolling reboot of the HANA nodes, rebooting one node at a time.

B.Take EBS snapshots of all volumes before patching, then patch one by one.

C.Create an AMI of the master node and launch a new instance with the patch applied.

D.Stop all EC2 instances, apply the patch, and start them in sequence.

AnswerA

Correct. Performing a rolling reboot allows the HANA database to remain online by rebooting nodes sequentially, ensuring availability during patching.

Why this answer

SAP HANA scale-out supports rolling updates; rebooting one node at a time allows the database to remain operational during the patching process. Option B is wrong because taking EBS snapshots is a backup step, not a method to apply the patch with minimal downtime. Option C is wrong because creating an AMI and launching a new instance introduces unnecessary complexity and still causes downtime for the master node.

Option D is wrong because stopping all instances results in full downtime, which contradicts the goal of minimizing downtime.

Practice this question →

14

Multi-Selecthard

A company is running SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to SAP Web Dispatchers. The operations team notices that some requests are failing with 502 errors. Which THREE actions should be taken to troubleshoot the issue?

Select 3 answers

A.Disable cross-zone load balancing to isolate the issue.

B.Increase the idle timeout setting on the ALB.

C.Review the ALB access logs to identify the target response codes.

D.Verify the security group rules for the ALB and the target instances.

E.Check the health check configuration and target group health status.

AnswersC, D, E

Access logs provide detailed information about the requests and responses.

Why this answer

Options C, D, and E are correct actions to troubleshoot 502 errors. Option C: Reviewing ALB access logs helps identify the target response codes, which can indicate why requests are failing. Option D: Verifying security group rules ensures that the ALB and target instances can communicate properly.

Option E: Checking the health check configuration and target group health status can reveal if targets are unhealthy, causing 502 errors. Option A is incorrect because disabling cross-zone load balancing does not directly address 502 errors. Option B is incorrect because increasing the idle timeout is not a typical solution for 502 errors; idle timeouts usually affect 504 errors.

Practice this question →

15

MCQmedium

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

A.The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint

B.The CodeDeploy agent on the instances is outdated

C.The instances are not registered as managed instances with the SSM ManagedInstance role

D.The instances do not have an IAM instance profile attached

AnswerA

Missing outbound HTTPS from the instance to the SSM endpoint prevents communication.

Why this answer

The error 'Unable to retrieve patch baseline' indicates that the EC2 instances cannot communicate with the AWS Systems Manager service to fetch the patch baseline configuration. Since the instances are in a private subnet with a VPC endpoint for SSM, the most likely cause is that the VPC endpoint's security group does not allow HTTPS outbound traffic (port 443) to the endpoint itself. Without this outbound rule, the SSM Agent on the instance cannot establish the TLS connection required to retrieve the patch baseline from the SSM API.

Exam trap

The trap here is that candidates often assume the error is due to missing IAM permissions (Option D) or instance registration (Option C), but the specific error message 'Unable to retrieve patch baseline' is a network connectivity error, not an authorization error, and the VPC endpoint security group misconfiguration is the classic cause in private subnet scenarios.

How to eliminate wrong answers

Option B is wrong because the CodeDeploy agent is unrelated to Systems Manager Patch Manager; the error is specific to SSM communication, not CodeDeploy. Option C is wrong because the 'SSM ManagedInstance role' is not a valid AWS concept; instances use an IAM instance profile with the AmazonSSMManagedInstanceCore policy to register as managed instances, and the error message points to a network connectivity issue, not registration. Option D is wrong because while an IAM instance profile is required for SSM operations, the error 'Unable to retrieve patch baseline' is a network-level error, not an authorization error (which would typically return 'AccessDenied' or similar).

Practice this question →

16

Multi-Selecteasy

Which TWO AWS services can be used to monitor the health of SAP application servers? (Choose 2)

Select 2 answers

A.Amazon Route 53

B.Amazon S3

C.AWS CloudTrail

D.Amazon CloudWatch

E.AWS Systems Manager

AnswersD, E

Monitors EC2 metrics and logs.

Why this answer

The correct answers are D (Amazon CloudWatch) and E (AWS Systems Manager). CloudWatch can monitor EC2 CPU/memory metrics and SAP application-specific metrics via custom metrics or the SAP Host Agent integration. Systems Manager can run custom scripts for health checks, such as checking SAP service status, and can be used with Automation or Run Command to perform health checks across multiple instances.

Option A (Route 53) is for DNS routing and basic IP health checks, not application-level SAP monitoring. Option B (S3) is object storage, not for monitoring. Option C (CloudTrail) is for API auditing, not real-time health monitoring.

Practice this question →

17

MCQmedium

An SAP system is deployed on EC2 instances with EBS volumes. The operations team needs to implement a backup strategy that provides point-in-time recovery for the EBS volumes with minimal downtime. Which AWS service should they use?

A.AWS Storage Gateway

B.AWS Backup

C.Amazon EBS Snapshots

D.Amazon S3

AnswerC

EBS Snapshots are designed for point-in-time backup of EBS volumes.

Why this answer

Amazon EBS Snapshots are the correct service for point-in-time recovery of EBS volumes with minimal downtime. They capture the volume data at a specific point in time and can be taken while the volume is attached and in use, with minimal performance impact (by taking snapshots during low usage). Option A, AWS Storage Gateway, is used for hybrid cloud storage, not for direct EBS backups.

Option B, AWS Backup, is a centralized backup service that can automate EBS snapshots, but the question asks which service provides point-in-time recovery for EBS volumes directly; EBS Snapshots are the underlying mechanism. Option D, Amazon S3, is object storage and not directly for EBS volume backups.

Practice this question →

18

MCQhard

An SAP system running on AWS is experiencing intermittent connectivity issues between the application server and the database server. Both servers are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. Which AWS service can help diagnose the network path and identify packet loss?

A.AWS Direct Connect

B.VPC Flow Logs

C.AWS CloudTrail

D.AWS Site-to-Site VPN

AnswerB

VPC Flow Logs capture network traffic information for analysis.

Why this answer

VPC Flow Logs capture metadata about IP traffic within the VPC, including accepted and rejected connections. By analyzing flow logs, you can identify packet loss, rejected requests, or other connectivity issues between subnets. Option A (AWS Direct Connect) is for dedicated on-premises connectivity, not for internal VPC traffic.

Option C (AWS CloudTrail) records API calls, not network traffic. Option D (AWS Site-to-Site VPN) is for connecting remote networks, not for analyzing internal VPC paths.

Practice this question →

19

MCQmedium

A company runs SAP HANA on AWS using a single EC2 instance with EBS volumes. The system experiences performance degradation during peak hours. Which approach would provide the MOST immediate improvement in disk I/O performance without downtime?

A.Add additional EBS volumes and configure RAID 0 across them.

B.Migrate the EC2 instance to a larger instance type.

C.Modify the EBS volume type and IOPS using Elastic Volumes.

D.Create a new EBS volume with higher performance and copy data using rsync.

AnswerC

Elastic Volumes allow online modification of volume type and IOPS without downtime.

Why this answer

EBS Elastic Volumes allow modifying the volume type (e.g., to gp3 or io2) and IOPS online without detaching the volume or stopping the instance, providing immediate I/O improvement. Option A is incorrect because adding EBS volumes and configuring RAID 0 requires downtime and reconfiguration. Option B is incorrect because migrating to a larger instance type does not directly improve disk I/O; it improves compute performance.

Option D is incorrect because creating a new volume and copying data with rsync involves downtime and does not provide immediate improvement.

Practice this question →

20

Multi-Selecteasy

An SAP administrator is setting up monitoring for an SAP HANA database. Which TWO metrics should be monitored from the HANA database using Amazon CloudWatch?

Select 2 answers

A.CPU utilization of the HANA process

B.SAPS (SAP Application Performance Standard)

C.EBS volume queue length

D.Network packet loss

E.Memory usage (used memory / total memory)

AnswersA, E

CPU utilization directly affects query performance.

Why this answer

Options A and E are correct because CPU utilization and memory usage (used memory / total memory) are critical for SAP HANA performance and are directly available from the HANA database via Amazon CloudWatch. Option B (SAPS) is an application performance standard, not a native CloudWatch metric. Option C (EBS volume queue length) is an infrastructure-level metric for storage, not HANA-specific.

Option D (Network packet loss) is a network metric not directly from HANA.

Practice this question →

21

Multi-Selecteasy

A company is planning to run SAP HANA on AWS. Which three are best practices for configuring the EC2 instance for SAP HANA? (Choose THREE.)

Select 3 answers

A.Enable CPU hyper-threading

B.Use burstable instance types (T2/T3)

C.Use EBS-optimized instances

D.Allocate swap space on the instance

E.Use placement groups for HANA instances

AnswersA, C, E

Hyper-threading is recommended for HANA.

Why this answer

(Enable CPU hyper-threading) is correct. For SAP HANA, hyper-threading is enabled by default and recommended for production workloads as it improves performance. Option C (Use EBS-optimized instances) is correct because EBS-optimized instances provide dedicated throughput between EC2 and EBS, ensuring consistent storage performance for HANA data and log volumes.

Option E (Use placement groups for HANA instances) is correct. Placement groups enable low-latency, high-throughput networking between instances in the same group, which is critical for HANA scale-out or HA setups. Option B (Use burstable instance types (T2/T3)) is incorrect because burstable instances rely on CPU credits and are not designed for sustained high CPU utilization; they are not suitable for production HANA workloads.

Option D (Allocate swap space on the instance) is incorrect because SAP HANA relies on in-memory processing and swap space is not recommended; it can degrade performance and is typically disabled.

Practice this question →

22

Multi-Selecthard

An SAP system on AWS is experiencing high latency. Which THREE metrics should be examined in Amazon CloudWatch to diagnose the issue?

Select 3 answers

A.NetworkIn/NetworkOut

B.DiskReadBytes

C.StatusCheckFailed

D.CPUUtilization

E.EBS VolumeQueueLength

AnswersA, D, E

Network metrics can reveal congestion.

Why this answer

Options A, D, and E are correct. A (NetworkIn/NetworkOut) can indicate network bandwidth saturation, which causes latency. D (CPUUtilization) can indicate CPU bottleneck, leading to processing delays.

E (EBS VolumeQueueLength) indicates storage I/O wait, a common cause of latency in SAP systems. B (DiskReadBytes) alone is less informative without queue length; high read/write bytes don't necessarily indicate latency. C (StatusCheckFailed) is for instance health, not performance latency.

Practice this question →

23

MCQeasy

An operations team needs to monitor the disk space usage of SAP application servers running on EC2. Which combination of AWS services should they use?

A.Amazon CloudWatch and AWS CloudTrail

B.Amazon CloudWatch agent and Amazon CloudWatch alarms

C.AWS Lambda and Amazon DynamoDB

D.Amazon S3 and Amazon SNS

AnswerB

CloudWatch agent collects disk metrics, and alarms can notify when thresholds are exceeded.

Why this answer

Amazon CloudWatch agent is required to collect custom metrics like disk space usage from EC2 instances, as the standard CloudWatch metrics only cover CPU, memory, network, and disk I/O. By installing the agent and configuring it to report disk space metrics, you can then set CloudWatch alarms to trigger notifications when thresholds are breached, enabling proactive monitoring of SAP application servers.

Exam trap

The trap here is that candidates assume standard EC2 CloudWatch metrics include disk space usage, but they only include disk read/write operations (I/O), not percentage of disk space used, so the CloudWatch agent is mandatory for this specific monitoring requirement.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events, not system-level metrics like disk space usage; it cannot monitor disk space. Option C is wrong because AWS Lambda and Amazon DynamoDB are serverless compute and database services, not designed for collecting or alerting on EC2 disk metrics; they lack native agent-based metric collection. Option D is wrong because Amazon S3 is object storage and Amazon SNS is a notification service; while SNS can send alerts, S3 cannot collect or analyze disk space data from EC2 instances, and this combination omits the necessary metric collection agent.

Practice this question →

24

MCQmedium

An SAP administrator runs the CLI commands shown in the exhibit for a production EC2 instance. The output indicates that the instance is running but the system status is impaired. Which action should the administrator take to recover the instance?

A.Reboot the instance using the AWS console.

B.Restart the SAP application services.

C.Configure EC2 Auto Recovery and wait for recovery.

D.Stop and start the instance.

AnswerC

EC2 Auto Recovery is the correct automated method to recover from a system status impairment, moving the instance to healthy hardware.

Why this answer

EC2 Auto Recovery is the correct action when the system status check fails (impaired) because it automatically recovers the instance by moving it to new hardware while preserving its configuration. Option A (reboot) does not address underlying hardware issues. Option B (restart SAP services) is irrelevant to hardware impairment.

Option D (stop and start) does move the instance to new hardware, but it is a manual process and not the recommended automated recovery method. EC2 Auto Recovery is designed specifically for this scenario.

Exam trap

The trap is confusing a stop/start action with EC2 Auto Recovery. Both move the instance to new hardware, but Auto Recovery is automated and triggered by the status check failure, while stop/start is manual and may cause additional downtime.

Practice this question →

25

MCQhard

A company recently migrated SAP ERP to AWS. The SAP application logs indicate repeated 'ORA-1555 snapshot too old' errors in the Oracle database. Which AWS-specific parameter could be causing this?

A.Enhanced Networking is disabled

B.Incorrect Oracle DB parameter settings

C.EBS snapshot schedule is too frequent

D.EBS volume queue depth is too low causing I/O throttling

AnswerD

Low queue depth leads to I/O bottlenecks and rollback segments issues.

Why this answer

'ORA-1555 snapshot too old' errors occur when Oracle needs to read consistent undo data that has been overwritten. In AWS, EBS volume queue depth that is too low can cause I/O throttling, leading to longer transaction times and increased likelihood of undo segment overwrites before a query completes. Option A is wrong because Enhanced Networking affects network throughput, not storage I/O.

Option B is incorrect because while Oracle DB parameters like UNDO_RETENTION can influence this error, the question asks for an AWS-specific parameter. Option C is wrong because EBS snapshots are point-in-time copies and do not directly cause live transaction rollbacks.

Practice this question →

26

Multi-Selectmedium

An SAP system administrator is troubleshooting a failed HANA database backup to Amazon S3. The backup job returns an error: 'Access Denied'. Which TWO actions should the administrator take to resolve the issue?

Select 2 answers

A.Review the S3 bucket policy for any deny statements that may block the backup.

B.Enable S3 Transfer Acceleration on the bucket.

C.Check the IAM role attached to the EC2 instance for S3 permissions.

D.Verify that the S3 bucket's KMS key is enabled.

E.Set up a VPC endpoint for S3.

AnswersA, C

Bucket policies can explicitly deny access to certain principals.

Why this answer

Options A and C are correct because reviewing the S3 bucket policy for deny statements that may block the backup is a direct step to resolve an 'Access Denied' error, and checking the IAM role attached to the EC2 instance for S3 permissions is also a primary cause of access issues. Option B is incorrect because S3 Transfer Acceleration improves speed, not access. Option D is incorrect because the KMS key being enabled is not a direct cause of access denied; rather, the IAM role must have permission to use the key.

Option E is incorrect because a VPC endpoint is not required if using public S3.

Practice this question →

27

Multi-Selecteasy

Which TWO AWS services can be used to automate the deployment of SAP infrastructure using infrastructure as code? (Choose 2)

Select 2 answers

A.AWS Service Catalog

B.AWS CloudFormation

C.AWS OpsWorks

D.AWS CodeDeploy

E.AWS Elastic Beanstalk

AnswersA, B

Correct. AWS Service Catalog allows you to deploy pre-approved CloudFormation templates, automating SAP infrastructure deployment as infrastructure as code.

Why this answer

AWS CloudFormation (Option B) allows you to define and provision SAP infrastructure using infrastructure as code templates. AWS Service Catalog (Option A) enables you to create, manage, and deploy pre-approved CloudFormation templates for SAP infrastructure, automating the deployment process. Options C (OpsWorks) is for configuration management with Chef/Puppet, not for infrastructure as code.

Option D (CodeDeploy) handles application deployments, not infrastructure provisioning. Option E (Elastic Beanstalk) is a PaaS service for web applications, not used for automating SAP infrastructure deployment as infrastructure as code.

Practice this question →

28

MCQhard

A company runs SAP HANA on AWS using a multi-node scale-out configuration. During a routine maintenance window, the administrator needs to apply an HANA database software update. What is the BEST practice to minimize downtime?

A.Perform a rolling update by updating one node at a time while keeping the system operational.

B.Use HANA System Replication to fail over to a standby system, then update the primary.

C.Stop all HANA services, apply the update to all nodes, then restart.

D.Create a new HANA cluster with the updated version and migrate data.

AnswerA

Correct. Rolling updates allow updating nodes individually without taking the entire system offline, minimizing downtime.

Why this answer

HANA scale-out supports rolling updates, allowing nodes to be updated one by one while the system remains operational, minimizing downtime. Option B is less optimal because using HSR failover adds complexity and is typically reserved for planned migration or disaster recovery, not routine updates. Option C would cause full downtime as it requires stopping all services.

Option D is inefficient for a minor software update as it involves creating a new cluster and migrating data.

Practice this question →

29

MCQhard

A company is deploying SAP S/4HANA on AWS and needs to ensure high availability for the central services (ASCS and ERS). The architecture uses two EC2 instances in different Availability Zones with a shared file system using Amazon EFS for /sapmnt. The SAP system is configured with an enqueue replication server. The operations team needs to automate the failover of the ASCS instance in case of a failure. The team is considering using AWS services for this purpose. Which approach should the team use?

A.Use Amazon Route 53 with health checks and a custom script to update DNS record on failover.

B.Use an Application Load Balancer with a target group containing both ASCS instances.

C.Use an Auto Scaling group with a minimum of 2 instances and a lifecycle hook to handle failover.

D.Enable EC2 Auto Recovery to automatically recover the ASCS instance on new hardware.

AnswerA

DNS-based failover can redirect clients to the secondary ASCS instance.

Why this answer

Route 53 health checks can monitor the ASCS instance and a custom script can update DNS records to point to the standby instance on failure, enabling failover across Availability Zones. Option B is incorrect because an Application Load Balancer cannot properly direct traffic to a single active ASCS instance and does not handle the stateful nature of SAP enqueue replication. Option C is incorrect because Auto Scaling is designed for scaling out, not for failover of stateful services like ASCS.

Option D is incorrect because EC2 Auto Recovery only recovers the same instance on new hardware if it fails, but it does not failover to a different Availability Zone, which is required for high availability.

Practice this question →

30

MCQhard

An SAP HANA database on AWS experiences a failover from the primary to the secondary node. After the failover, the secondary node (now primary) is running on a different AZ. The SAP application cannot connect to the new primary. What is the MOST likely cause?

A.HANA system replication is not configured correctly.

B.The security group for the new primary does not allow inbound traffic from the app.

C.The EBS volumes are not attached to the new primary.

D.The application connection string points to the old primary's IP address.

AnswerD

After failover, the new primary has a different private IP; the app must use a virtual IP or DNS that updates.

Why this answer

After a failover, the new primary node has a different private IP address than the old primary. The SAP application's connection string likely points to the old primary's IP, so it cannot connect to the new primary. Option A is incorrect because HANA system replication can be configured correctly and still cause connectivity issues if the application does not update its connection information.

Option B is incorrect because security groups are attached to instances and can be updated, but the issue is typically the IP address change. Option C is incorrect because EBS volumes are automatically attached during a managed failover; connectivity issues stem from network configuration, not storage.

Practice this question →

31

MCQmedium

A company manages a multi-account AWS environment using AWS Organizations. The operations team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket. What is the MOST efficient way to enforce this configuration?

A.Configure CloudTrail in the management account with an S3 bucket policy that grants access to all member accounts.

B.Deploy an AWS CloudFormation StackSet with a template that enables CloudTrail and configures the S3 bucket in every account and region.

C.Create a custom script using AWS CLI to enable CloudTrail in each account and region.

D.Use AWS Service Catalog to publish a CloudTrail product and require each account to launch it.

AnswerB

StackSets provide centralized, consistent deployment and drift detection.

Why this answer

AWS CloudFormation StackSets allow you to deploy a CloudTrail configuration template across multiple accounts and regions in a single, automated operation. This approach ensures consistent enforcement of the policy without manual intervention, leveraging the centralized management capabilities of AWS Organizations.

Exam trap

The trap here is that candidates often assume a single CloudTrail configuration in the management account with a shared S3 bucket is sufficient, but CloudTrail must be enabled independently in each account to capture its own API activity.

How to eliminate wrong answers

Option A is wrong because configuring CloudTrail in the management account only enables it for that account, not for member accounts; the S3 bucket policy alone does not enable CloudTrail in other accounts. Option C is wrong because a custom CLI script is less efficient, error-prone, and does not provide automated drift detection or centralized rollback compared to StackSets. Option D is wrong because AWS Service Catalog requires each account to manually launch the product, which does not enforce the configuration automatically across all accounts.

Practice this question →

32

Multi-Selectmedium

Which TWO actions should be taken to improve the high availability of a single-instance SAP HANA database running on EC2? (Choose two.)

Select 2 answers

A.Set up HANA System Replication to a second EC2 instance in a different Availability Zone.

B.Enable Multi-AZ on the RDS instance.

C.Move the HANA data files to Amazon FSx for Lustre.

D.Increase the instance size to a larger type.

E.Configure automated EBS snapshots for the HANA data volumes.

AnswersA, E

HANA System Replication provides automatic failover across AZs.

Why this answer

HANA System Replication provides a standby instance in a different Availability Zone for automatic failover, improving high availability. Option E is correct because automated EBS snapshots enable point-in-time recovery, reducing recovery time after a failure. Option B is incorrect because Multi-AZ RDS is a feature for RDS databases, not for EC2-hosted SAP HANA.

Option C is incorrect because moving HANA data files to FSx for Lustre does not inherently improve availability. Option D is incorrect because increasing instance size improves performance, not availability.

Practice this question →

33

MCQhard

An SAP Basis administrator notices that the SAP application server logs show repeated connection timeouts to the database. The database is running on an RDS for SAP HANA instance. The application server and database are in the same VPC but different subnets. The security groups allow inbound traffic from the application server's security group on port 3xx17. Network ACLs allow both inbound and outbound traffic on ephemeral ports. Despite this, connections fail intermittently. What is the most likely cause?

A.The RDS instance's DNS name resolves to a different IP address intermittently.

B.The network ACL is stateful and blocking return traffic.

C.The security group for the RDS instance does not allow inbound traffic on the HANA internal communication port (e.g., 3xx18).

D.The application server's subnet has a route table that points to a NAT gateway instead of the database subnet.

AnswerC

Correct. SAP HANA requires an additional internal communication port (e.g., 3xx18) to be allowed in the security group. Without it, connections may fail intermittently.

Why this answer

SAP HANA uses multiple ports for internal communication. While port 3xx17 (SQL) is allowed, the missing inbound rule for the HANA internal communication port (e.g., 3xx18) causes intermittent connection timeouts. Option A is incorrect because RDS DNS names are stable and do not change intermittently.

Option B is incorrect because network ACLs are stateless, but the problem states both inbound and outbound are allowed on ephemeral ports, so return traffic is not blocked. Option D is incorrect because route tables within a VPC use local routes for database traffic, and NAT gateways do not affect intra-VPC traffic.

Practice this question →

34

Multi-Selectmedium

Which THREE factors should be considered when planning a recovery point objective (RPO) and recovery time objective (RTO) for an SAP system on AWS?

Select 3 answers

A.Storage type (EBS vs. instance store)

B.AWS Region and Availability Zone

C.EC2 instance type and size

D.Number of SAP users

E.Backup frequency and retention period

AnswersA, C, E

EBS volumes can be restored faster, affecting RTO.

Why this answer

RPO is determined by backup frequency and replication lag; RTO is affected by instance size and storage type; cross-region replication can help but RTO depends on failover time.

Practice this question →

35

MCQmedium

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy. The primary site is in us-east-1, and the DR site is in us-west-2. The database is SAP HANA. Which approach provides the lowest RPO?

A.SAP HANA system replication in asynchronous mode.

B.Database backups to S3 and cross-region replication of S3 bucket.

C.EBS snapshots replicated to the DR region using cross-region snapshot copy.

D.SAP HANA system replication in synchronous mode across regions.

AnswerD

Synchronous replication ensures data is committed at both sites, minimizing data loss.

Why this answer

SAP HANA system replication in synchronous mode across regions provides near-zero RPO (Recovery Point Objective) as data is replicated synchronously to the DR region, ensuring minimal data loss. Option A (asynchronous mode) may have higher RPO due to potential data loss in case of failover. Options B and C (backups to S3 with cross-region replication and EBS snapshots) have significantly higher RPO as they are point-in-time backups, not real-time replication.

Practice this question →

36

MCQmedium

A company runs SAP on AWS and has configured a cross-region DR strategy using Amazon EBS snapshots. The DR region is in us-west-2. After a region-wide outage, the administrator attempts to restore the snapshots but finds the latest snapshot is incomplete. What is the most likely cause?

A.The IAM role used for copying snapshots does not have permissions

B.The latest snapshot copy had not completed before the outage

C.The snapshots are encrypted with a KMS key that is not available in us-west-2

D.The snapshot ID used for recovery is not valid

AnswerB

Cross-region copy takes time; if outage occurs during copy, snapshot may be partial.

Why this answer

Cross-region snapshot copies are asynchronous and may fail if the source region becomes unavailable. Option A is wrong because IAM does not prevent copying. Option C is wrong because KMS keys can be used cross-region with proper configuration.

Option D is wrong because the snapshot ID would not become invalid.

Practice this question →

37

MCQmedium

A company runs SAP HANA on AWS and wants to back up the database using Backint integration. Which AWS service is required to store the backups?

A.Amazon S3 Glacier

B.Amazon EBS

C.Amazon EFS

D.Amazon S3

AnswerD

Backint for SAP HANA on AWS sends backups to an S3 bucket.

Why this answer

Backint for SAP HANA on AWS is an interface that allows SAP HANA to back up directly to Amazon S3. Amazon S3 is the supported storage service for Backint integration. Option A (Amazon S3 Glacier) is an archival storage class and not directly used by Backint for backups.

Option B (Amazon EBS) provides block storage volumes, but Backint does not interface with EBS for database backups. Option C (Amazon EFS) is a file storage service and is not compatible with the Backint API. Therefore, Option D (Amazon S3) is correct.

Practice this question →

38

MCQmedium

Refer to the exhibit. An SAP administrator uses the CloudFormation template snippet to create an application server. After deployment, the administrator cannot connect to the instance using AWS Systems Manager Session Manager. What is the most likely missing configuration?

A.The UserData script fails to install the SSM Agent

B.The instance does not have an IAM instance profile with Systems Manager permissions

C.The security group does not allow outbound traffic to the Systems Manager endpoint

D.The instance type does not support Systems Manager

AnswerB

An IAM role with AmazonSSMManagedInstanceCore policy is required for Session Manager.

Why this answer

Session Manager requires the SSM Agent and an IAM role with proper permissions. The template installs the agent via UserData, but it does not attach an IAM instance profile. Without the profile, the instance cannot authenticate to Systems Manager.

The security group allows HTTPS inbound, but that is for web traffic, not SSM. The instance type is fine.

Practice this question →

39

MCQmedium

A company runs an SAP HANA database on an EC2 instance with a large EBS volume. The operations team receives alerts that the volume's burst balance has dropped to 10%. Which action should be taken to prevent performance degradation?

A.Change the volume type to io2 with provisioned IOPS.

B.Increase the volume size to increase the baseline IOPS.

C.Enable EBS optimization on the instance.

D.Convert the volume to gp3.

AnswerB

Increasing volume size raises baseline IOPS and improves burst balance replenishment.

Why this answer

Increasing the volume size increases the baseline IOPS and burst balance replenishment rate. Option A is wrong because io2 volumes do not have a burst bucket; they use provisioned IOPS instead and thus do not experience burst balance depletion. Option C is wrong because EBS optimization improves network throughput but does not affect burst balance.

Option D is wrong because converting to gp3 changes the volume type but does not directly address the burst balance issue; gp3 volumes have a baseline performance but may still have burst credits if the volume is small, so the correct action to replenish burst balance is to increase volume size.

Practice this question →

40

MCQeasy

A company runs SAP on AWS and needs to ensure that all changes to the SAP system's underlying infrastructure are recorded and auditable. Which AWS service should be enabled to meet this requirement?

A.Amazon CloudWatch Logs

B.AWS CloudTrail

C.AWS Config

D.AWS Trusted Advisor

AnswerB

CloudTrail records all AWS API calls for audit purposes.

Why this answer

AWS CloudTrail records API calls for auditing. CloudWatch Logs is for log monitoring. Config tracks resource configuration changes.

Trusted Advisor provides best-practice checks. CloudTrail is the primary service for API activity auditing.

Practice this question →

41

MCQmedium

An SAP system fails to send emails via SAPconnect using SMTP. The EC2 instance has a public IP and the security group allows outbound traffic on port 25. The SMTP server is an on-premises relay. What is the most likely reason for the failure?

A.The security group does not allow outbound traffic on port 25.

B.AWS blocks outbound traffic on port 25 by default for EC2 instances.

C.The EC2 instance does not have a public IP address associated.

D.The route table does not have a default route to an internet gateway.

AnswerB

AWS restricts port 25 outbound; you need to request removal or use a different port.

Why this answer

The most likely reason is that AWS blocks outbound traffic on port 25 by default for EC2 instances to prevent spam. This restriction applies even if the security group allows outbound port 25 traffic. Option A is incorrect because the security group allows outbound traffic on port 25, but the default AWS block overrides it.

Option C is incorrect because the instance has a public IP. Option D is incorrect because the route table is not the issue; the instance has a public IP and can reach the internet, but port 25 is blocked at the AWS level.

Practice this question →

42

MCQmedium

An SAP system uses a Multi-AZ RDS for Oracle instance. During a recent failover, the application experienced a long outage because the SAP application server did not automatically reconnect to the new database endpoint. What is the most efficient way to resolve this issue?

A.Reduce the DNS TTL for the RDS endpoint and ensure the application re-resolves DNS on connection failure.

B.Reboot the application server after every failover.

C.Deploy an Application Load Balancer in front of the RDS instance.

D.Modify the application connection string to use the standby instance IP directly.

AnswerA

Low TTL and re-resolution enable fast failover recovery.

Why this answer

The RDS endpoint remains the same after failover; the issue is DNS caching. Reducing the TTL ensures the application picks up the new IP quickly. Option B (rebooting) is disruptive and not a fix.

Option C (modifying the connection string) is not needed. Option D (using a load balancer) adds complexity and latency.

Practice this question →

43

MCQhard

An SAP system uses a large Amazon RDS for Oracle instance. The operations team wants to minimize downtime during a major version upgrade. Which strategy should they use?

A.Take a snapshot of the database and restore it as a new instance with the upgraded version

B.Create a read replica, upgrade it, and then promote it to the primary

C.Modify the DB instance and apply the upgrade immediately

D.Use AWS Database Migration Service (DMS) to migrate to a new instance

AnswerB

Minimizes downtime by failing over to the upgraded replica.

Why this answer

Using a read replica allows you to upgrade the replica and then promote it, minimizing downtime. Option A (taking a snapshot and restoring) has downtime. Option C (modifying the DB instance) causes downtime.

Option D (using AWS DMS) requires complex setup and may introduce latency.

Practice this question →

44

MCQeasy

A company runs an SAP HANA database on AWS. The operations team wants to automate the monitoring of HANA alert logs and send notifications when critical alerts occur. Which AWS service should they use to collect and analyze the logs?

A.AWS CloudTrail

B.Amazon S3 Event Notifications

C.AWS Lambda scheduled functions

D.Amazon CloudWatch Logs with metric filters and alarms

AnswerD

CloudWatch Logs can ingest and monitor log files, triggering alarms on specific patterns.

Why this answer

Amazon CloudWatch Logs can ingest HANA alert logs via the CloudWatch agent and trigger alarms based on metric filters. CloudTrail records API activity, not application logs. S3 Event Notifications do not analyze log content.

Lambda alone does not provide log collection.

Practice this question →

45

MCQeasy

A SAP administrator wants to monitor the CPU utilization of an SAP application server running on an EC2 instance. Which AWS service should be used to set up an alarm when CPU utilization exceeds 90% for 5 minutes?

A.AWS CloudTrail

B.AWS Trusted Advisor

C.Amazon CloudWatch

D.AWS Config

AnswerC

CloudWatch Alarms can monitor metrics and trigger actions based on thresholds.

Why this answer

Amazon CloudWatch is the correct service for monitoring CPU utilization and setting alarms. CloudWatch collects metrics like CPUUtilization from EC2 instances, and you can create a CloudWatch Alarm that triggers when the metric exceeds a threshold (e.g., 90%) for a specified duration (e.g., 5 minutes). The other options are incorrect: AWS CloudTrail logs API calls for auditing, not metrics; AWS Trusted Advisor provides best practice recommendations; and AWS Config tracks resource configuration changes.

Therefore, CloudWatch (Option C) is the correct choice.

Practice this question →

46

MCQeasy

A company is running SAP on AWS and needs to automate OS-level patching for their SAP application servers. Which AWS service should they use to schedule and apply patches?

A.Amazon CloudWatch Events

B.AWS OpsWorks

C.AWS Systems Manager Patch Manager

D.Amazon EC2 Auto Scaling

AnswerC

Patch Manager automates OS patching across EC2 instances.

Why this answer

AWS Systems Manager Patch Manager is specifically designed to automate OS-level patching for EC2 instances, including SAP application servers. Option A is wrong because Amazon CloudWatch Events is for scheduling and responding to events, not for patching. Option B is wrong because AWS OpsWorks is a configuration management service that uses Chef/Puppet, but it is not primarily for patching.

Option D is wrong because Amazon EC2 Auto Scaling handles instance scaling, not patching.

Practice this question →

47

MCQeasy

An operations team receives an alert that an SAP application server EC2 instance is unreachable. The team checks the AWS Management Console and sees that the instance status check shows "Instance reachability check failed". What is the most likely cause?

A.The operating system on the instance is not responding.

B.The security group associated with the instance is blocking all traffic.

C.The EBS root volume is detached from the instance.

D.The instance was stopped by an Auto Scaling group.

AnswerA

Correct. The instance reachability check fails when the OS is not responding, often due to kernel panic or OS crash.

Why this answer

An instance reachability check failure typically indicates OS-level issues such as a crashed OS or kernel panic. Therefore, option A is correct. Option B is incorrect because security group issues would cause network connectivity failure but not necessarily a status check failure.

Option C is incorrect because a stopped instance would show a different status. Option D is incorrect because EBS volume issues would be reported as a volume status check failure.

Practice this question →

48

Drag & Dropmedium

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Troubleshooting should start with logs, then check database status, network, security groups, and authentication.

Practice this question →

49

Matchingmedium

Match the AWS service to its function in SAP disaster recovery.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Replicates servers to another AWS Region

Replicates backups to secondary Region

Traffic routing to standby region

Point-in-time backups for HANA data volumes

Why these pairings

In SAP disaster recovery on AWS, AWS Elastic Disaster Recovery (DRS) handles continuous replication, Amazon Route 53 manages DNS-based failover, and AWS Global Accelerator provides static IPs for traffic shifting. Common confusions involve mixing the distinct roles of these services.

Practice this question →

50

MCQeasy

A company is running SAP on AWS and needs to ensure high availability for their SAP Central Services (ASCS) instance. They plan to use a multi-AZ deployment with a floating IP. Which AWS service should they use to manage the floating IP and failover?

A.Elastic Load Balancer

B.Amazon Route 53

C.AWS Global Accelerator

D.Amazon CloudFront

AnswerB

Route 53 can provide DNS failover with health checks, acting as a floating IP.

Why this answer

Amazon Route 53 can be used to associate a DNS name with a health check and failover to a secondary IP in another AZ. Option A is wrong because Elastic Load Balancer (ELB) is for distributing traffic, not for floating IPs. Option C is wrong because AWS Global Accelerator improves performance, not floating IP failover.

Option D is wrong because Amazon CloudFront is a CDN.

Practice this question →

51

Multi-Selectmedium

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which TWO actions should they take?

Select 2 answers

A.Set up SAP HANA System Replication to another AWS region.

B.Implement a Pilot Light strategy using EC2 instances in standby.

C.Use AWS CloudFormation to automate infrastructure deployment in the DR region.

D.Use AWS Backup to schedule backups every 15 minutes.

E.Take EBS snapshots every 15 minutes.

AnswersA, C

HANA System Replication provides near-real-time data replication.

Why this answer

To achieve an RPO of 15 minutes and RTO of 2 hours, the company should use SAP HANA System Replication to replicate data to another AWS region (Option A), which provides near-real-time replication meeting the RPO. Additionally, using AWS CloudFormation to automate infrastructure deployment in the DR region (Option C) enables rapid provisioning of the DR environment, meeting the RTO. Option B (Pilot Light with EC2 standby) may not meet the RTO if manual steps are required.

Option D (AWS Backup with 15-minute schedules) is not suitable for SAP HANA databases and may not meet RTO. Option E (EBS snapshots every 15 minutes) is not feasible due to performance impact and recovery time.

Practice this question →

52

MCQhard

An SAP system running on AWS experiences periodic performance degradation. Analysis shows that the issue occurs when an on-premises monitoring system polls the SAP application server. Which AWS service can help mitigate this by caching or throttling requests?

A.Amazon Route 53

B.AWS WAF

C.Amazon CloudFront

D.Elastic Load Balancing

AnswerB

WAF can create rules to rate-limit or block excessive requests.

Why this answer

(AWS WAF) is correct because AWS WAF can rate-limit incoming requests from specific IP addresses, reducing the load caused by frequent polling from the on-premises monitoring system. Option A (Amazon Route 53) is a DNS service and cannot throttle or cache application-level requests. Option C (Amazon CloudFront) caches content but is not designed for application-level throttling of requests to an SAP application server.

Option D (Elastic Load Balancing) distributes traffic but does not provide request throttling or rate limiting.

Practice this question →

53

MCQeasy

An SAP administrator needs to automate the daily backup of an SAP HANA database running on EC2. Which AWS service should be used to schedule and manage the backup process?

A.Amazon S3 Lifecycle policies

B.AWS Backup

C.AWS Data Pipeline

D.Amazon CloudWatch Events

AnswerB

AWS Backup automates backup scheduling and retention.

Why this answer

AWS Backup is the correct service because it provides a centralized backup service that can schedule and manage backups for EC2 instances, including SAP HANA databases running on EC2. It supports automated backups, retention policies, and integration with SAP HANA. Option A is incorrect because Amazon S3 Lifecycle policies manage the lifecycle of objects in S3, not database backups.

Option C is incorrect because AWS Data Pipeline is used for data movement and transformation, not backup scheduling. Option D is incorrect because Amazon CloudWatch Events can trigger actions based on events but does not manage backup processes itself.

Practice this question →

54

MCQmedium

A company is running an SAP application on an SAP HANA database in a multi-AZ deployment on AWS. The operations team notices that the system is experiencing high latency during peak hours. Upon investigation, they find that the EBS volumes attached to the HANA instances are frequently exceeding the provisioned IOPS limit. Which of the following is the MOST effective action to resolve this issue?

A.Increase the volume size of the EBS volumes to increase the baseline IOPS.

B.Switch from Provisioned IOPS SSD (io2) to General Purpose SSD (gp3) volumes.

C.Enable EBS optimization on the EC2 instances.

D.Reduce the number of concurrent connections to the SAP HANA database.

AnswerA

Increasing volume size directly increases the baseline IOPS for gp3 volumes or allows higher provisioned IOPS for io2 volumes, resolving the IOPS limit issue.

Why this answer

Increasing the volume size of EBS volumes increases the baseline IOPS (for gp3) or allows higher provisioned IOPS (for io2), directly addressing the IOPS limit. Option B is wrong because switching to General Purpose SSD (gp3) may not guarantee the needed IOPS if burst credits are exhausted. Option C is wrong because enabling EBS optimization is already enabled for current generation instances and does not increase IOPS limits.

Option D is wrong because reducing concurrent connections does not address the IOPS limit of the EBS volumes.

Practice this question →

55

MCQmedium

The operations team uses the IAM policy above for a group of administrators. An administrator tries to terminate an EC2 instance that is tagged with Environment=Production. What will happen?

A.The termination will be denied because the Deny condition applies to all instances

B.The termination will be allowed because the Deny condition is not met

C.The termination will be allowed because the Deny does not apply to Production instances

D.The termination will be denied because there is no explicit Allow for TerminateInstances

AnswerD

Without an explicit Allow, the action is implicitly denied.

Why this answer

The Deny statement has a condition that denies termination only when the tag is NOT Production. Since the instance is tagged Production, the condition is not met, so the Deny does not apply. The Allow statement does not include TerminateInstances, so there is no explicit Allow for termination.

The default is implicit Deny, so the action is denied.

Practice this question →

56

Multi-Selecthard

An SAP environment on AWS includes multiple EC2 instances running SAP application servers. The operations team needs to capture and analyze all API calls made to AWS services by these instances. Which THREE services should be used together?

Select 3 answers

A.Amazon Athena

B.AWS CloudTrail

C.Amazon S3

D.AWS Config

E.Amazon GuardDuty

AnswersA, B, C

Athena can query CloudTrail logs directly in S3 using SQL.

Why this answer

AWS CloudTrail captures API calls, Amazon S3 stores the logs, and Amazon Athena allows querying the logs. Alternatively, CloudWatch Logs can be used, but Athena is more cost-effective for ad-hoc analysis. The three correct services are CloudTrail, S3, and Athena.

Practice this question →

57

MCQeasy

A company is running SAP on AWS and wants to send alerts when the CPU utilization of an EC2 instance exceeds 90% for 5 minutes. Which AWS service should be used to create this alarm?

A.AWS Lambda

B.AWS Config

C.Amazon Simple Notification Service (SNS)

D.Amazon CloudWatch Alarms

AnswerD

CloudWatch Alarms monitor metrics and send notifications when thresholds are breached.

Why this answer

Amazon CloudWatch Alarms (Option D) are the correct AWS service for creating alarms based on metrics such as CPU utilization. They monitor CloudWatch metrics and perform actions (e.g., send notifications via SNS) when thresholds are breached. Option A (AWS Lambda) can be a target action for an alarm but is not the alarm service itself.

Option B (AWS Config) evaluates resource configurations against rules, not metric thresholds. Option C (Amazon SNS) is a notification service that can be triggered by CloudWatch Alarms but does not create the alarm.

Practice this question →

58

MCQmedium

A company is running an SAP HANA database on an EC2 instance. The operations team notices that the SAP application is responding slowly during peak hours. CloudWatch metrics show high CPU utilization and increased swap usage. Which combination of actions should the team take to resolve the performance issue?

A.Enable Auto Scaling for the EC2 instance to automatically add more instances.

B.Resize the EC2 instance to a larger instance type with more vCPUs and memory.

C.Change the instance type to a compute-optimized instance to improve CPU performance.

D.Add more EBS volumes and increase the number of read replicas.

AnswerB

Vertical scaling addresses both high CPU and memory pressure, reducing swap usage.

Why this answer

Increasing both vCPUs and memory addresses the high CPU utilization and high swap usage (indicating memory pressure). Option A is wrong because Auto Scaling horizontally adds instances, which is not appropriate for a single SAP HANA database that typically runs vertically. Option C is wrong because compute-optimized instances prioritize CPU over memory, but the issue also involves memory shortage (swap usage).

Option D is wrong because adding EBS volumes and read replicas targets storage and read scaling, not CPU or memory bottlenecks.

Practice this question →

59

MCQmedium

An SAP system on AWS experiences intermittent performance degradation during peak hours. CloudWatch metrics show high CPU utilization on the application server but normal on the database server. The application server is an m5.2xlarge instance. Which action should the operations team take FIRST to diagnose the issue?

A.Change the application server instance type to a compute-optimized instance like c5.4xlarge.

B.Increase the provisioned IOPS on the database server's EBS volumes.

C.Increase the network bandwidth of the application server.

D.Scale out the application tier by adding more application servers behind a load balancer.

AnswerA

Compute-optimized instances provide higher CPU performance.

Why this answer

The application server is experiencing high CPU utilization; switching to a compute-optimized instance (like c5.4xlarge) helps determine if the performance issue is due to insufficient CPU resources. Option B is incorrect because the database server shows normal CPU, so increasing IOPS on its EBS volumes would not address the application server's CPU bottleneck. Option C is incorrect because the problem is not network-related; increasing network bandwidth would not alleviate CPU contention.

Option D is incorrect because scaling out by adding more servers may help but is not the first diagnostic step; the first step should be to test a compute-optimized instance to isolate the CPU issue.

Practice this question →

60

MCQeasy

An SAP administrator needs to back up the SAP HANA database daily. The backups must be stored securely and retained for 30 days. Which storage option is the most cost-effective?

A.Amazon S3 Standard

B.Amazon S3 Glacier

C.Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

D.Amazon EBS Snapshots

AnswerC

S3 Standard-IA is cost-effective for infrequent access with immediate retrieval.

Why this answer

S3 Standard-IA is for infrequently accessed data with lower cost. Option A is incorrect because S3 Standard is more expensive. Option B is incorrect because Glacier is for long-term archival, not 30-day retention.

Option D is incorrect because EBS snapshots are for volumes, not database backups directly.

Practice this question →

61

MCQeasy

A company has an SAP system running on AWS that uses an Application Load Balancer (ALB) to distribute traffic to multiple EC2 instances. The operations team notices that the ALB is returning 503 errors intermittently. Which of the following is the MOST likely cause?

A.The security group attached to the ALB is blocking inbound traffic from the targets.

B.The target instances are failing health checks.

C.The ALB does not have enough capacity to handle the traffic.

D.The SSL certificate on the ALB has expired.

AnswerB

Correct. 503 errors are typically returned when the target instances fail health checks and become unhealthy.

Why this answer

503 errors are typically returned when the target instances fail health checks and become unhealthy. Option A is wrong because if the security group blocked inbound traffic from the targets, it would cause timeout or 502 errors, not 503. Option C is wrong because insufficient ALB capacity can lead to latency or 502 errors, but 503 specifically indicates unhealthy targets.

Option D is wrong because an expired SSL certificate would result in 502 errors (bad gateway), not 503.

Practice this question →

62

MCQhard

A company is running SAP HANA on AWS and needs to perform an in-place upgrade from HANA 1.0 to 2.0. The database size is 2 TB and the team wants to minimize downtime. Which approach is most appropriate?

A.Stop the HANA database, take a full backup, launch a new EC2 instance with HANA 2.0, and restore the backup.

B.Set up HANA System Replication from the current HANA 1.0 instance to a new EC2 instance running HANA 2.0, then perform a takeover.

C.Use AWS Database Migration Service (DMS) to continuously replicate data to a new HANA 2.0 instance.

D.Create an EBS snapshot of the HANA data volume and attach it to a new EC2 instance with HANA 2.0.

AnswerB

This minimizes downtime as the target is pre-built and the takeover is fast.

Why this answer

The most appropriate approach to minimize downtime for an in-place upgrade from HANA 1.0 to 2.0 is to use HANA System Replication (HSR). HSR allows you to replicate data from the current HANA 1.0 instance to a new EC2 instance running HANA 2.0. Once replication is complete and consistent, a takeover is performed, switching the workload to the HANA 2.0 instance with minimal downtime.

Option A (stop, backup, restore) results in longer downtime because the database must be offline for the entire backup and restore process. Option C (AWS DMS) is not designed for HANA version upgrades and does not support the necessary system replication mechanisms. Option D (EBS snapshot) is a backup method that also incurs significant downtime and does not perform the upgrade; you would still need to upgrade the database on the new instance.

Practice this question →

63

Multi-Selecthard

A company runs SAP on AWS and wants to automate the patching of SAP application servers. The servers are in an Auto Scaling group. Which THREE steps should be included in the automation?

Select 3 answers

A.Update the Auto Scaling group's launch configuration or launch template to use the new AMI.

B.Create a new AMI with the patches applied.

C.Use AWS Systems Manager to apply patches to running instances.

D.Perform an instance refresh to gradually replace instances.

E.Terminate all existing instances at once.

AnswersA, B, D

This ensures new instances use the patched AMI.

Why this answer

Options A, B, and D are correct because the recommended approach for patching SAP application servers in an Auto Scaling group is to use immutable updates: create a new AMI with patches (B), update the launch configuration/template to reference the new AMI (A), and then perform an instance refresh to gradually replace instances (D). This minimizes downtime. Option C (using Systems Manager to patch running instances) is not recommended for Auto Scaling groups because it can lead to inconsistent state and doesn't benefit from the rolling update mechanism.

Option E (terminating all instances at once) would cause downtime.

Practice this question →

64

MCQeasy

An SAP administrator needs to rotate the SSL/TLS certificate for the SAP Web Dispatcher running on an EC2 instance. The new certificate is stored in AWS Certificate Manager (ACM). How should the administrator deploy the certificate to the Web Dispatcher?

A.Export the certificate from ACM using the AWS CLI and install it on the EC2 instance.

B.Download the certificate from ACM and manually install it on the EC2 instance.

C.Configure ACM to automatically push the certificate to the EC2 instance.

D.Import the new certificate into ACM and associate it with an Application Load Balancer in front of the Web Dispatcher.

AnswerA

ACM supports exporting certificates for use on EC2 instances.

Why this answer

ACM allows you to export a certificate (including the private key) using the AWS CLI with the `export-certificate` command. This exported certificate can then be installed manually on the EC2 instance running SAP Web Dispatcher. Option B is incorrect because ACM certificates cannot be downloaded directly as files; they must be exported via the CLI or SDK.

Option C is incorrect because ACM does not natively support automatic push of certificates to EC2 instances. Option D is incorrect because associating the certificate with an Application Load Balancer is an alternative approach but not required; the question asks how to deploy the certificate directly to the Web Dispatcher on EC2, not via a load balancer.

Practice this question →

65

MCQhard

A company runs SAP on AWS and wants to implement a disaster recovery solution with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes. The primary site is in us-east-1, and the DR site is in us-west-2. Which strategy meets these requirements for SAP HANA database?

A.Use AWS Database Migration Service (DMS) for ongoing replication

B.Take EBS snapshots every 15 minutes and copy them to us-west-2

C.Use Amazon S3 Cross-Region Replication for HANA data files

D.Configure SAP HANA System Replication across regions

AnswerD

HANA System Replication provides low RPO and meets RTO.

Why this answer

HANA System Replication with log shipping can achieve RPO of minutes and RTO within hours. Option A is incorrect because EBS snapshots cannot achieve 15-minute RPO. Option B is incorrect because S3 cross-region replication is for files, not live HANA replication.

Option C is incorrect because DMS is for heterogeneous migrations, not real-time HANA replication.

Practice this question →

66

MCQmedium

A company uses SAP NetWeaver with an Oracle database on EC2. The operations team wants to automate the patching of the operating system while ensuring minimal downtime. Which AWS Systems Manager capability should be used?

A.AWS Systems Manager Automation

B.AWS Systems Manager Run Command

C.AWS Systems Manager OpsCenter

D.AWS Systems Manager Patch Manager

AnswerD

Patch Manager automates the process of patching managed instances.

Why this answer

(AWS Systems Manager Patch Manager) is correct because it automates OS patching with scheduling and maintenance windows, minimizing downtime for SAP NetWeaver on EC2. Option A (Automation) is for running predefined workflows, not specifically for patching. Option B (Run Command) is for ad-hoc command execution, not automated patching.

Option C (OpsCenter) is for managing operational issues, not patching.

Practice this question →

67

MCQeasy

A company runs its SAP landscape on AWS and uses an Application Load Balancer (ALB) to distribute traffic to multiple web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the most likely cause?

A.The security groups for the ALB are blocking incoming traffic.

B.The SSL certificate on the ALB has expired.

C.The CloudFront distribution in front of the ALB is misconfigured.

D.The target group health checks are failing, causing the ALB to mark instances as unhealthy.

AnswerD

503 errors occur when no healthy targets are available.

Why this answer

503 errors from an ALB typically indicate that the target instances are unhealthy or the ALB cannot route traffic to them, often due to failed health checks. Option A is wrong because security groups blocking traffic would cause 504 or timeout errors, not 503. Option B is wrong because an expired SSL certificate on the ALB would cause 502 errors (bad gateway), not 503.

Option C is wrong because CloudFront is not in the path; the question describes an ALB distributing traffic directly to web dispatchers, so CloudFront misconfiguration is irrelevant.

Practice this question →

68

MCQhard

A company runs an SAP system on AWS and wants to implement a disaster recovery (DR) strategy that provides a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. The primary site is in us-east-1 and the DR site is in us-west-2. Which approach meets these requirements?

A.Use Amazon EBS cross-Region replication for all volumes

B.Use AWS Backup to copy snapshots to the DR region every 15 minutes

C.Configure SAP HANA system replication to the DR region and use automatic failover

D.Take daily backups of the SAP HANA database and store in S3, then restore in us-west-2

AnswerC

Provides low RTO and RPO.

Why this answer

Configuring SAP HANA system replication to the DR region with automatic failover provides an RTO of less than 2 hours and an RPO of 15 minutes or less. Option A is incorrect because Amazon EBS cross-Region replication does not exist for EBS volumes; snapshots must be copied manually or via AWS Backup, and the RPO would be higher. Option B is incorrect because AWS Backup can copy snapshots, but the minimum backup frequency is hourly (not every 15 minutes), and restoring from snapshots would exceed the RTO.

Option D is incorrect because daily backups to S3 have an RPO of 24 hours, which exceeds the required 15 minutes.

Practice this question →

69

MCQhard

An SAP system administrator notices that nightly SAP HANA backups to Amazon S3 are failing intermittently with 'Access Denied' errors. The backups are initiated by an AWS Lambda function that uses an IAM role. The role has a policy that grants s3:PutObject on the backup bucket. Which additional IAM action is most likely required to resolve the issue?

A.s3:ListBucket

B.s3:PutObjectAcl

C.s3:DeleteObject

D.s3:GetObject

AnswerB

Required to set object ownership, especially when bucket policy enforces bucket owner full control.

Why this answer

s3:PutObjectAcl is required when the bucket owner and the object uploader are different, or when the bucket policy requires the uploader to set ACLs to give the bucket owner full control. In this scenario, the Lambda function's IAM role likely needs this permission to successfully write objects to the S3 bucket, especially if the bucket is owned by a different AWS account or has a bucket policy that enforces specific ACLs. Without s3:PutObjectAcl, the upload may fail with 'Access Denied' when the bucket policy requires the uploader to grant the bucket owner full control.

Option A (s3:ListBucket) is for listing objects, not uploading. Option C (s3:DeleteObject) is for deleting, not uploading. Option D (s3:GetObject) is for reading, not writing.

Practice this question →

70

MCQeasy

A company is running SAP on AWS and needs to monitor the available memory on their SAP application servers. Which AWS service can be used to collect and visualize memory utilization metrics?

A.AWS Config

B.Amazon Inspector

C.Amazon CloudWatch with CloudWatch Agent

D.AWS CloudTrail

AnswerC

CloudWatch Agent collects memory metrics and sends them to CloudWatch.

Why this answer

Amazon CloudWatch with the CloudWatch Agent is the correct choice because the agent can be installed on EC2 instances to collect custom metrics, including memory utilization, which is not available by default from the hypervisor. The agent sends these metrics to CloudWatch, where you can visualize them using dashboards or set alarms. This directly addresses the need to monitor SAP application server memory on AWS.

Exam trap

The trap here is that candidates assume EC2 instance metrics in CloudWatch automatically include memory utilization, but they do not—only the CloudWatch Agent can collect and publish those OS-level metrics.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and auditing resource configurations against desired policies, not for collecting or visualizing runtime performance metrics like memory utilization. Option B is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a monitoring tool for OS-level metrics such as memory usage. Option D is wrong because AWS CloudTrail records API activity and user actions for auditing and governance, not for collecting system-level performance metrics from EC2 instances.

Practice this question →

71

MCQmedium

A company runs SAP on AWS and uses an Application Load Balancer (ALB) to distribute traffic to web dispatchers. The operations team notices that some requests are failing with 503 errors. What is the MOST likely cause?

A.The SSL certificate on the ALB has expired.

B.Security groups allow too much traffic.

C.The target instances are failing health checks.

D.The ALB is out of capacity.

AnswerC

Unhealthy targets cause ALB to return 503 errors.

Why this answer

503 errors from an ALB indicate that the target instances are unhealthy or not responding. Option A is wrong because 503 errors are not caused by SSL certificate issues. Option B is wrong because security groups would cause connection timeouts, not 503.

Option D is wrong because ALB capacity is automatically scaled.

Practice this question →

72

MCQeasy

An operations team needs to automate the patching of EC2 instances running SAP applications. The instances are part of an Auto Scaling group. The team wants to apply patches without causing downtime to the SAP system. Which approach should they use?

A.Use AWS Systems Manager Patch Manager with a maintenance window that patches all instances simultaneously

B.Use AWS CodeDeploy to deploy patches as a new application version

C.Use AWS Systems Manager Patch Manager with a maintenance window and configure the Auto Scaling group to perform a rolling update

D.Use AWS OpsWorks to manage patching, configuring a rolling update

AnswerC

Patches can be applied during a maintenance window, and rolling updates ensure availability.

Why this answer

AWS Systems Manager Patch Manager can be integrated with an Auto Scaling group to perform a rolling update, which updates instances in batches, ensuring that the SAP application remains available throughout the patching process. This approach minimizes downtime by replacing or updating instances incrementally rather than all at once, which is critical for SAP systems that require high availability.

Exam trap

The trap here is that candidates might assume patching all instances simultaneously is acceptable for SAP systems, overlooking the critical requirement for zero downtime, or they might confuse CodeDeploy's application deployment capabilities with OS patching needs.

How to eliminate wrong answers

Option A is wrong because patching all instances simultaneously would cause downtime for the SAP system, as the instances would be unavailable at the same time. Option B is wrong because AWS CodeDeploy is designed for deploying application code, not for OS-level patching of EC2 instances; it does not manage system patches or integrate with Patch Manager for this purpose. Option D is wrong because AWS OpsWorks is a configuration management service that uses Chef or Puppet, but it is not the recommended or native service for automated patching of EC2 instances in an Auto Scaling group; Patch Manager with rolling updates is the standard approach.

Practice this question →

73

MCQmedium

A company runs SAP on AWS and uses AWS Backup to back up the SAP HANA database. The backup job fails with an error indicating insufficient IAM permissions. What is the most likely missing permission?

A.ec2:DescribeInstances

B.kms:Decrypt

C.rds:CreateDBSnapshot

D.s3:PutObject

AnswerB

If the backup is encrypted, AWS Backup requires kms:Decrypt to access the key.

Why this answer

AWS Backup requires permissions to decrypt the KMS key used to encrypt the SAP HANA database or its backup target. If the IAM role assigned to AWS Backup lacks the `kms:Decrypt` action for the specific KMS key, the backup job fails with an insufficient IAM permissions error. This is because AWS Backup must read the encrypted data before transferring it to the backup vault.

Exam trap

The trap here is that candidates often assume the missing permission is `s3:PutObject` because backups are stored in S3, but the error occurs before the data is written, during the decryption step when the source is encrypted with a KMS key.

How to eliminate wrong answers

Option A is wrong because `ec2:DescribeInstances` is used to list or describe EC2 instances, not to perform backup operations on SAP HANA databases; it is not required for the backup job itself. Option C is wrong because `rds:CreateDBSnapshot` is specific to Amazon RDS instances, not SAP HANA on EC2, which uses AWS Backup with custom resources or the SAP HANA Backint agent. Option D is wrong because `s3:PutObject` is needed for writing backup data to an S3 bucket, but the error specifically indicates insufficient IAM permissions, and the most common missing permission in encrypted environments is `kms:Decrypt`, not the S3 write action.

Practice this question →

74

MCQhard

An SAP system on AWS uses a Multi-AZ deployment for the database layer with synchronous replication. The application servers are in the same region but different Availability Zones. During a recent failure of the primary database instance, the automatic failover to the standby instance took longer than expected, exceeding the RTO of 5 minutes. Upon investigation, the team finds that the standby instance was not fully synchronized at the time of failure. What could be the cause?

A.The EBS volumes on the standby instance have lower IOPS than the primary.

B.The Multi-AZ configuration uses a single network interface.

C.The security groups on the standby instance block replication traffic.

D.The network latency between the Availability Zones is high.

AnswerD

High latency can cause synchronous replication to slow down.

Why this answer

In a Multi-AZ deployment with synchronous replication, high network latency between Availability Zones can cause the primary database to wait for acknowledgment from the standby. This increases transaction commit time and can lead to the standby falling behind, especially if the primary continues processing transactions while waiting. During failover, the standby may not be fully synchronized, causing longer failover time and exceeding RTO.

Option A is unlikely because EBS IOPS affect storage performance but not replication lag directly; Option B is incorrect because Multi-AZ uses multiple network interfaces; Option C is incorrect because blocked replication traffic would cause complete failure, not just lag.

Exam trap

Candidates often assume that replication lag is caused by storage performance or network configuration errors, but in a synchronous replication setup, network latency is a primary factor affecting synchronization.

Practice this question →

75

Multi-Selecthard

A company runs a production web application on EC2 instances behind an ALB. The operations team receives an alert that the application is returning HTTP 503 errors. Which THREE steps should be taken to diagnose the issue?

Select 3 answers

A.Review VPC Flow Logs to identify if traffic is reaching the ALB.

B.Check the ALB's HealthyHostCount metric in CloudWatch.

C.Check the CPU utilization of the EC2 instances in the Auto Scaling group.

D.Verify the health check settings on the target group.

AnswersB, C, D

Indicates if targets are passing health checks.

Why this answer

The ALB's HealthyHostCount metric in CloudWatch shows the number of healthy targets registered to the target group. A value of zero or a persistent drop indicates that all EC2 instances are failing health checks, which directly causes HTTP 503 errors because the ALB has no healthy targets to forward traffic to. This metric is the first place to check when diagnosing 503 errors, as it pinpoints whether the issue is with target health rather than network connectivity or load.

Exam trap

The PAS-C01 exam often tests the misconception that CPU utilization or instance-level metrics are the primary cause of 503 errors, when in reality the ALB's health check mechanism and target group configuration are the direct cause, and CPU issues are only one possible underlying reason for health check failures.

Practice this question →

Page 1 of 7 · 460 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Operations and Maintenance questions.

Start 20-question session