Courseiva

CCNA Operations and Maintenance Questions

75 of 460 questions · Page 6/7 · Operations and Maintenance · Answers revealed

Practice these questionsDomain overviewAll questions
376
MCQmedium

An SAP workload running on AWS is experiencing intermittent performance issues. The operations team suspects that a recent change to a security group is causing traffic to be dropped. Which AWS service should the team use to analyze network traffic patterns and identify the source of the issue?

A.Amazon Inspector
B.AWS Config
C.AWS CloudTrail
D.VPC Flow Logs
AnswerD

VPC Flow Logs capture IP traffic information and can be analyzed to identify dropped packets due to security group rules.

Why this answer

VPC Flow Logs capture IP traffic information and can be used to analyze network traffic patterns, helping to diagnose security group rule issues.

Practice this question →
377
Multi-Selecteasy

Which TWO AWS services can be used to monitor the health of SAP systems and send notifications? (Select TWO.)

Select 2 answers
A.AWS Config
B.Amazon CloudWatch
C.AWS CloudTrail
D.Amazon Athena
E.Amazon Simple Notification Service (SNS)
AnswersB, E

Amazon CloudWatch monitors metrics and logs, can set alarms, and integrate with SNS for notifications. Correct.

Why this answer

Amazon CloudWatch (option B) is used to monitor metrics and logs from SAP systems, and can trigger alarms based on thresholds. Amazon SNS (option E) is used to send notifications (e.g., email, SMS) when alarms are triggered. AWS Config (A) tracks configuration changes, not health.

AWS CloudTrail (C) logs API calls for auditing. Amazon Athena (D) is a query service, not for monitoring.

Practice this question →
378
Multi-Selectmedium

Which THREE AWS services can be used to automate the patching of SAP application servers on EC2? (Choose 3).

Select 3 answers
A.AWS Auto Scaling
B.AWS OpsWorks
C.AWS CodeDeploy
D.AWS CloudFormation
E.AWS Systems Manager Patch Manager
AnswersB, C, E

OpsWorks can manage configurations and patching.

Why this answer

AWS OpsWorks is correct because it provides a configuration management service that uses Chef or Puppet to automate the patching and lifecycle management of SAP application servers on EC2. You can define custom recipes or manifests to apply OS and application patches consistently across your SAP infrastructure, ensuring compliance and reducing manual effort.

Exam trap

The trap here is that candidates often confuse infrastructure provisioning tools like CloudFormation with operational automation tools, or assume Auto Scaling can handle patching because it can replace instances with new AMIs, but it does not patch existing instances directly.

Practice this question →
379
Multi-Selectmedium

An SAP system administrator needs to perform a backup of an SAP HANA database running on EC2. Which TWO AWS services can be used together to create consistent backups? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.Amazon EBS snapshots
C.AWS Backup
D.AWS CloudFormation
E.AWS Storage Gateway
AnswersB, C

EBS snapshots provide consistent backups when used with application quiescing.

Why this answer

(Amazon EBS snapshots) captures block-level data and can be made consistent for SAP HANA by using pre/post snapshot scripts. Option C (AWS Backup) can automate and orchestrate EBS snapshots, ensuring consistency and integration with HANA backup processes. Option A (Amazon S3) is an object storage service, not directly used for creating consistent database backups.

Option D (AWS CloudFormation) is for infrastructure as code and does not create backups. Option E (AWS Storage Gateway) is for hybrid cloud storage, not for database backups.

Practice this question →
380
MCQeasy

An SAP administrator notices that the SAP application performance has degraded over the past week. The system is running on Amazon EC2 with EBS volumes. Which AWS service should be used to analyze the performance impact of the EBS volumes?

A.Amazon Inspector
B.AWS CloudTrail
C.Amazon CloudWatch
D.AWS Trusted Advisor
AnswerC

CloudWatch provides detailed metrics for EBS performance analysis.

Why this answer

(Amazon CloudWatch) is correct because it provides metrics for EBS volumes like throughput, IOPS, and latency. Option A (Amazon Inspector) is for security assessment. Option B (AWS CloudTrail) logs API calls.

Option D (AWS Trusted Advisor) provides best practices but not detailed performance analysis.

Practice this question →
381
MCQeasy

A company has an SAP system running on AWS with a production database on an RDS for SAP ASE instance. The operations team needs to perform a minor version upgrade of the database engine. The upgrade must be applied with minimal downtime. The team has a maintenance window scheduled for the upcoming weekend. Which action should the team take to apply the upgrade?

A.Enable auto minor version upgrade on the DB instance and let the upgrade occur during the maintenance window.
B.Manually upgrade the DB instance using the AWS Management Console immediately.
C.Modify the DB instance to specify the new engine version and apply immediately.
D.Create a new DB instance with the new version and migrate the data.
AnswerA

This minimizes downtime and is automated.

Why this answer

Setting the AutoMinorVersionUpgrade flag to true allows RDS to apply minor upgrades automatically during the maintenance window with minimal downtime. Option B is wrong because manual upgrade via the console can cause downtime if not done during a maintenance window. Option C is wrong because modifying the DB instance to a new version immediately can cause downtime.

Option D is wrong because creating a new instance and migrating requires additional setup and downtime.

Practice this question →
382
MCQmedium

A company runs its SAP HANA database on an EC2 instance in a single Availability Zone. The system is critical and requires high availability. The current setup uses an EBS volume for data storage. During a recent failure simulation, the database took 45 minutes to recover because the EBS volume had to be reattached and the database had to replay logs. The operations team wants to reduce recovery time to less than 15 minutes. Which solution should they implement?

A.Deploy a second EC2 instance in a different Availability Zone and configure SAP HANA system replication.
B.Use AWS Backup to create more frequent snapshots.
C.Increase the provisioned IOPS of the EBS volume.
D.Move the database to Amazon S3 for faster access.
AnswerA

Deploying a second EC2 instance in a different AZ with SAP HANA system replication ensures a synchronous standby that can take over within minutes, reducing RTO to under 15 minutes.

Why this answer

Deploying a second EC2 instance in a different Availability Zone with SAP HANA system replication (synchronous replication) provides a standby database that can be promoted quickly, reducing recovery time to minutes. Option B is incorrect because more frequent snapshots still require restoring and log replay, which takes longer. Option C is incorrect because increasing provisioned IOPS improves performance but does not affect recovery time during failure.

Option D is incorrect because Amazon S3 is an object storage service not suitable for low-latency database operations like SAP HANA.

Practice this question →
383
MCQeasy

An SAP administrator needs to ensure that an EC2 instance hosting SAP HANA is rebooted automatically after a hardware failure. Which AWS feature provides this capability?

A.Placement group
B.Auto Scaling group
C.EC2 Auto Recovery
D.Elastic IP address
AnswerC

Auto Recovery automatically recovers an instance from hardware failure.

Why this answer

EC2 Auto Recovery is the correct AWS feature because it automatically recovers an EC2 instance when a hardware failure on the underlying physical host is detected. For SAP HANA workloads, this ensures the instance is rebooted on a healthy host without manual intervention, maintaining high availability for critical database operations.

Exam trap

The trap here is that candidates often confuse Auto Scaling groups (which replace instances) with EC2 Auto Recovery (which recovers the same instance), leading them to choose Auto Scaling for automatic reboot, but Auto Scaling does not reboot the same instance and can cause data loss for stateful applications like SAP HANA.

How to eliminate wrong answers

Option A is wrong because a placement group controls the physical proximity of instances (e.g., cluster placement groups for low-latency networking) but does not provide automatic recovery from hardware failures. Option B is wrong because an Auto Scaling group replaces instances based on scaling policies or health checks, but it does not reboot the same instance; it terminates and launches a new one, which would lose the SAP HANA instance's state and attached EBS volumes unless properly configured. Option D is wrong because an Elastic IP address is a static public IPv4 address that can be remapped to another instance, but it has no capability to detect or recover from hardware failures.

Practice this question →
384
Multi-Selecteasy

Which TWO AWS services can be used to perform automated backups of an SAP HANA database running on EC2? (Choose 2.)

Select 2 answers
A.Amazon CloudWatch Events
B.Amazon S3
C.AWS CloudTrail
D.AWS Backup
E.Amazon Data Lifecycle Manager
AnswersD, E

AWS Backup supports HANA backups via pre-scripts.

Why this answer

The correct options are D (AWS Backup) and E (Amazon Data Lifecycle Manager). AWS Backup provides automated backup for SAP HANA databases through its integration with SAP HANA Backup. Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots, which can be used for backing up HANA data.

CloudWatch Events (A) can trigger responses but does not perform backups. Amazon S3 (B) is object storage, not a backup automation service. AWS CloudTrail (C) is for auditing API calls, not backups.

Practice this question →
385
MCQeasy

A company is running SAP on AWS and wants to automate the creation of consistent snapshots of EBS volumes attached to SAP HANA instances. Which AWS service is BEST suited for this task?

A.AWS Lambda
B.AWS CloudFormation
C.Amazon S3
D.AWS Backup
AnswerD

AWS Backup is a fully managed backup service that can automate EBS snapshots with scheduling.

Why this answer

(AWS Backup) is correct because it is a fully managed backup service that can automate scheduled backups of EBS volumes, including those attached to SAP HANA instances. Option A is wrong because AWS Lambda would require custom scripting to manage snapshot creation and retention. Option B is wrong because AWS CloudFormation is for infrastructure as code, not backup automation.

Option C is wrong because Amazon S3 is object storage, not for EBS snapshots.

Practice this question →
386
MCQeasy

A company runs SAP on AWS and uses a Multi-AZ RDS for SAP ASE database. The operations team receives an alert that the database instance failed over automatically. After the failover, the SAP application servers are unable to connect to the database. The team checks the RDS console and sees that the DB instance status is 'available' and the endpoint is the same as before. The security groups and network ACLs have not changed. What is the MOST likely reason for the connectivity issue?

A.The RDS endpoint changed after the failover.
B.The application servers have cached the old database IP address and need to flush DNS.
C.The DNS record for the RDS endpoint did not update after the failover.
D.The security group for the database instance no longer allows traffic from the application servers.
AnswerB

Correct. The application servers have cached the old IP address associated with the DNS name. Flushing the DNS cache on the application servers resolves the endpoint to the new IP, allowing connections to the new primary.

Why this answer

The RDS endpoint remains the same after a failover because the DNS record is updated to point to the new primary. However, the application servers may have cached the previous DNS resolution (old IP address). When the failover occurs, the application servers still try to connect to the old IP, which is no longer the primary.

Flushing the DNS cache on the application servers resolves this issue. Option B is correct because the database endpoint DNS name does not change, but the IP address it resolves to changes; DNS caching prevents the application from connecting. Option A is incorrect because the endpoint does not change.

Option C is incorrect because the DNS record is updated; the issue is client-side caching. Option D is incorrect because security groups remain unchanged after a failover.

Practice this question →
387
MCQhard

A company uses SAP S/4HANA on AWS with a multi-AZ deployment. The primary database is in us-east-1a and the secondary in us-east-1b. During a failover test, the secondary database becomes active but performance degrades significantly. Which configuration is most likely causing the performance issue?

A.The secondary instance is in a different VPC
B.The secondary instance is a smaller instance type than the primary
C.The secondary instance uses a different storage type (e.g., GP2 instead of Provisioned IOPS)
D.The secondary database is running a different HANA version
AnswerB

Smaller instance type cannot handle the same workload, causing performance degradation.

Why this answer

In a multi-AZ deployment, the secondary instance should match the primary's instance type to ensure consistent performance after failover. If the secondary is smaller, it lacks the CPU, memory, and network resources needed to handle the same workload, leading to performance degradation. Option A is incorrect because both instances should be in the same VPC for proper replication; being in different VPCs would break connectivity.

Option C is incorrect because different storage types (e.g., GP2 vs. Provisioned IOPS) can also cause performance issues, but the question specifically asks about the most likely cause given the scenario. Option D is incorrect because HANA version differences would cause compatibility issues, not necessarily performance degradation.

Practice this question →
388
MCQhard

During a disaster recovery test, an SAP administrator finds that the SAP application cannot connect to the replicated HANA database in the DR region. The replication is done using SAP HANA System Replication. What is the MOST likely cause?

A.The replication link is down because the source database is not accessible.
B.The application connection string still points to the primary database endpoint.
C.The HANA database in the DR region is not synchronized due to network latency.
D.The application server needs to be restarted to recognize the new database.
AnswerB

After failover, the application must use the DR database endpoint.

Why this answer

In SAP HANA System Replication, the database is replicated to the DR region, but the SAP application's connection string must be updated to point to the DR database endpoint. Without this update, the application will still try to connect to the primary database endpoint, which is not accessible during the DR test. Option A is incorrect because the replication link being down does not cause the application connection failure; the issue is the connection string.

Option C is incorrect because even if the DR database is not fully synchronized (which is typical for async replication), the application could still connect to the DR database if the connection string were correct. Option D is incorrect because simply restarting the application server does not update the connection string; the endpoint configuration needs to be changed.

Practice this question →
389
MCQhard

A company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances running a web server. The web servers write logs to an Amazon EFS file system mounted across all instances. The operations team reports that the web application is experiencing intermittent high latency and timeouts. Monitoring shows that the ALB's target response time is normal, but the application's internal processing time is high. Further investigation reveals that the EFS performance metrics show high 'BurstCreditBalance' and 'PercentIOLimit' during the latency spikes. The EFS file system is configured with 'Bursting' throughput mode. The team needs to resolve the latency issue with minimal cost. What should they do?

A.Migrate the log files to Amazon S3 and use S3 Transfer Acceleration for writes.
B.Switch the EFS throughput mode to Provisioned Throughput to guarantee higher performance.
C.Add more EC2 instances to the Auto Scaling group to distribute the I/O load.
D.Increase the size of the EFS file system to increase the baseline throughput and burst credits.
AnswerD

Larger EFS file systems have higher baseline throughput and accumulate more burst credits, reducing I/O wait.

Why this answer

Increasing the size of an EFS file system in Bursting mode raises its baseline throughput and burst credit accumulation rate. The high BurstCreditBalance and PercentIOLimit indicate the file system is exhausting its burst credits and hitting its I/O limit, causing throttling and latency. A larger EFS volume provides a higher baseline throughput, reducing reliance on burst credits and smoothing performance without additional cost for Provisioned Throughput.

Exam trap

The trap here is that candidates assume 'Bursting' mode is always sufficient and look to add compute capacity (Option C) or change storage type (Option A), when the real issue is that the file system is too small to sustain the workload's I/O demands, and resizing it is the most cost-effective fix.

How to eliminate wrong answers

Option A is wrong because migrating logs to S3 with S3 Transfer Acceleration does not address the EFS I/O bottleneck; it changes the storage target but the web servers still write to EFS, and S3 Transfer Acceleration is for accelerating uploads over long distances, not for reducing local file system latency. Option B is wrong because switching to Provisioned Throughput would increase cost unnecessarily; the issue is that the current Bursting mode is insufficient due to small file system size, and Provisioned Throughput is a more expensive solution when simply resizing the file system can resolve the problem at lower cost. Option C is wrong because adding more EC2 instances would increase the aggregate I/O load on the same EFS file system, worsening the contention and latency, not resolving it.

Practice this question →
390
MCQeasy

A company is running SAP on AWS and wants to automate the deployment of new SAP application servers. The company uses AWS CloudFormation to manage infrastructure. Which AWS service should they use to run custom scripts during the CloudFormation stack creation to configure the SAP application?

A.AWS Systems Manager Run Command
B.AWS CodeDeploy
C.AWS Lambda
D.AWS OpsWorks
AnswerC

Lambda can be used as a custom resource in CloudFormation to run scripts.

Why this answer

AWS CloudFormation supports custom resources, which can invoke AWS Lambda functions to run custom scripts during stack creation, making it suitable for configuring SAP applications. Option A is wrong because AWS Systems Manager Run Command is not directly integrated into CloudFormation as a custom resource; it can be invoked via Lambda or other means but not natively. Option B is wrong because AWS CodeDeploy is used for code deployments to existing instances, not for initial configuration during CloudFormation stack creation.

Option D is wrong because AWS OpsWorks is a configuration management service using Chef/Puppet, not directly integrated with CloudFormation for running custom scripts.

Practice this question →
391
Multi-Selecthard

Which THREE of the following are best practices for operating an SAP HANA database on AWS in a production environment?

Select 3 answers
A.Configure a swap partition on the instance store.
B.Ensure the EC2 instance is EBS-optimized.
C.Separate data and log files onto different EBS volumes.
D.Use a single large EBS volume for both data and logs to simplify management.
E.Use multiple EBS volumes striped with LVM or RAID 0 for data and log files.
AnswersB, C, E

EBS-optimized instances provide dedicated network bandwidth to EBS.

Why this answer

EBS-optimized instances provide dedicated bandwidth for EBS, which is essential for HANA workloads. Option C is correct because separating data and log files onto different EBS volumes is a best practice recommended by SAP to improve performance and manageability. Option E is correct because using multiple EBS volumes striped with LVM or RAID 0 aggregates IOPS and throughput, providing the high performance required for production HANA databases.

Option A is incorrect because configuring a swap partition on the instance store is not recommended for HANA; HANA relies on memory and swap usage is discouraged. Option D is incorrect because using a single large EBS volume for both data and logs can lead to performance bottlenecks and is not a best practice.

Practice this question →
392
MCQmedium

An SAP Basis administrator needs to monitor the health of SAP application servers running on EC2. The administrator wants to receive alerts when a server becomes unreachable or when critical SAP processes stop. Which AWS service should be used to create a custom dashboard and set up alarms?

A.AWS CloudTrail
B.Amazon CloudWatch
C.AWS Config
D.AWS Trusted Advisor
AnswerB

CloudWatch monitors instances and can trigger alarms on metrics like status checks or custom process metrics.

Why this answer

CloudWatch can monitor EC2 instances and create alarms based on custom metrics, including process status. Option A is wrong because CloudTrail is for auditing API calls. Option C is wrong because Config is for resource compliance.

Option D is wrong because Trusted Advisor provides best-practice checks but not custom monitoring.

Practice this question →
393
MCQeasy

Refer to the exhibit. An SAP administrator is configuring Route 53 to point a custom domain name to an Application Load Balancer (ALB) that fronts SAP Web Dispatchers. The record set is configured as shown. However, when users access sap.example.com, they receive a 503 error. What is the MOST likely cause?

A.The EvaluateTargetHealth is set to true, which is causing the record to be marked as unhealthy.
B.The security group for the ALB is not allowing inbound traffic on port 443 from the internet.
C.The Alias Target is incorrect; it should be the ALB's DNS name without 'dualstack'.
D.The health check for the ALB target group is failing, causing Route 53 to return 503.
AnswerB

If the ALB security group blocks inbound HTTPS traffic from the internet, users cannot connect, resulting in a 503 error.

Why this answer

A 503 error from an ALB typically indicates that the ALB is not receiving traffic or that the target group is unhealthy. However, in this scenario, the correct answer is B: the security group for the ALB is not allowing inbound traffic on port 443 from the internet. Without that rule, the ALB cannot accept HTTPS requests, resulting in a 503.

EvaluateTargetHealth being true (Option A) is a correct configuration for alias records and does not cause a 503. The Alias Target (Option C) is correctly set to the ALB's DNS name; 'dualstack' is part of that DNS name and is legitimate. A failing target group health check (Option D) would cause a 503, but the question specifies that users receive 503 when accessing the domain, and the most likely cause given the exhibit is the missing security group rule on the ALB.

Practice this question →
394
MCQhard

An SAP system on AWS is experiencing performance degradation. Amazon CloudWatch metrics show high CPU utilization on the application server, but the database server (RDS) metrics are normal. The application team suspects a memory leak. Which action should the operations team take FIRST to confirm the issue?

A.Review the existing CloudWatch CPU utilization and memory metrics for the application server.
B.Install the CloudWatch agent on the application server and enable memory metrics.
C.Reboot the application server and monitor performance after reboot.
D.Increase the instance size of the application server to handle the load.
AnswerB

Installing the agent allows collection of memory metrics, which can confirm a memory leak.

Why this answer

CloudWatch cannot see inside the OS without the CloudWatch agent. Installing the agent and collecting memory metrics is the first step to confirm a memory leak. Option A is wrong because CloudWatch does not provide memory metrics by default.

Option C is wrong because rebooting is disruptive and does not help diagnose. Option D is wrong because switching to a larger instance is a reactive fix, not diagnostic.

Practice this question →
395
MCQeasy

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

A.Modify the security group to allow all traffic temporarily
B.Review CloudWatch metrics for the instance and the ALB target group
C.Terminate the instance and let Auto Scaling launch a new one
D.Attach an additional Elastic Network Interface (ENI) to the instance
AnswerB

CloudWatch metrics provide baseline data for troubleshooting connectivity issues.

Why this answer

Reviewing CloudWatch metrics for the instance and the ALB target group is the correct first step because it provides immediate visibility into the root cause of intermittent connectivity issues. Metrics such as TargetResponseTime, RequestCount, and HealthyHostCount can reveal whether the problem is due to high latency, request failures, or the instance being marked unhealthy by the ALB health checks. This data-driven approach avoids unnecessary changes and aligns with the AWS Well-Architected Framework's principle of observability.

Exam trap

The trap here is that candidates often jump to reactive actions like terminating the instance or modifying security groups, failing to recognize that CloudWatch metrics provide the non-invasive, systematic starting point for diagnosing intermittent issues in an Auto Scaling group behind an ALB.

How to eliminate wrong answers

Option A is wrong because modifying the security group to allow all traffic temporarily bypasses security controls without providing diagnostic information; connectivity issues are rarely caused by overly restrictive security groups in a production environment, and this action could introduce a security risk. Option C is wrong because terminating the instance and letting Auto Scaling launch a new one is a reactive, disruptive action that destroys the evidence needed to diagnose the intermittent issue, and it does not address the underlying cause. Option D is wrong because attaching an additional Elastic Network Interface (ENI) to the instance adds complexity and does not help diagnose connectivity problems; it is typically used for specialized networking scenarios like dual-homed instances or network appliances, not for troubleshooting intermittent ALB connectivity.

Practice this question →
396
MCQhard

An administrator runs the command shown in the exhibit to check the status of an EBS volume attached to an SAP HANA instance. The volume is 200 GB gp3 and is attached to instance i-0a1b2c3d4e5f67890. The administrator wants to increase the I/O performance. The volume is currently set to 3000 IOPS (baseline for gp3). Which action will increase IOPS without downtime?

A.Modify the volume's IOPS setting to a higher value (e.g., 6000) using the modify-volume API.
B.Detach the volume, increase the size to 500 GB, and reattach.
C.Modify the volume type to io2 Block Express and increase IOPS.
D.Take a snapshot of the volume and create a new volume with higher IOPS from the snapshot.
AnswerA

gp3 supports modifying IOPS without downtime.

Why this answer

Gp3 volumes allow modifying IOPS independently of size without detaching or downtime. Option B is incorrect because increasing the size does not directly increase IOPS; gp3 IOPS can be modified independently. Option C is incorrect because changing to io2 Block Express would require detaching or stopping the instance, causing downtime.

Option D is incorrect because creating a new volume from a snapshot requires detaching the original volume, causing downtime, and does not directly increase IOPS on the existing volume.

Practice this question →
397
Multi-Selectmedium

Which TWO of the following are valid methods to monitor the health of an SAP HANA database running on AWS?

Select 2 answers
A.Amazon CloudWatch alarms based on EC2 instance metrics
B.AWS Trusted Advisor checks for HANA best practices
C.AWS Config rules to check HANA configuration
D.SAP HANA SQL queries to check service status
E.AWS CloudTrail logs for HANA API calls
AnswersA, D

Amazon CloudWatch can monitor EC2 instance metrics such as CPU utilization and memory, providing insight into the health of the underlying OS and the HANA database.

Why this answer

Amazon CloudWatch can monitor EC2 instance metrics such as CPU utilization and memory, which are relevant to HANA database health. Option D is correct because SAP HANA provides built-in SQL queries to check service status and perform health checks. Option B is wrong because AWS Trusted Advisor checks for general best practices (e.g., security, cost optimization) and does not include HANA-specific health monitoring.

Option C is wrong because AWS Config is designed for configuration compliance tracking, not real-time health monitoring. Option E is wrong because AWS CloudTrail logs API calls for auditing purposes, not health metrics.

Practice this question →
398
Multi-Selecteasy

An SAP system administrator needs to monitor the health of Amazon RDS for SAP ASE database instances. Which TWO CloudWatch metrics should be used to detect if the database is under memory pressure?

Select 2 answers
A.`WriteIOPS`
B.`ReadIOPS`
C.`FreeableMemory`
D.`SwapUsage`
E.`DatabaseConnections`
AnswersC, D

Low freeable memory indicates the database is using most of the available memory.

Why this answer

`FreeableMemory` shows available memory, and `SwapUsage` indicates memory pressure when swap is used.

Practice this question →
399
Multi-Selectmedium

A company is running SAP HANA on AWS and wants to implement a disaster recovery strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The primary site is in us-east-1, and the DR site is in us-west-2. Which two actions should the company take to meet these objectives? (Choose TWO.)

Select 2 answers
A.Set up SAP HANA System Replication (HSR) in async mode between the two regions.
B.Take daily snapshots of the HANA volumes and copy them to the DR region.
C.Use AWS CloudEndure Disaster Recovery to replicate the entire server.
D.Use AWS Backup to schedule cross-region backups of the HANA database.
E.Pre-configure EC2 instances in the DR region with the same SAP HANA software and configuration.
AnswersA, E

SAP HANA System Replication (HSR) in async mode provides continuous log shipping, enabling an RPO of 15 minutes or less.

Why this answer

SAP HANA System Replication (HSR) in async mode can achieve an RPO of less than 15 minutes by continuously replicating log data to the DR region. Option E is correct because pre-configuring EC2 instances with the same SAP HANA software and configuration in the DR region minimizes the time needed to bring up the DR system, helping meet the 2-hour RTO. Option B is incorrect because daily snapshots cannot achieve a 15-minute RPO.

Option C is incorrect because AWS CloudEndure Disaster Recovery is not optimized for SAP HANA and may not meet the RPO/RTO requirements. Option D is incorrect because AWS Backup does not support HANA log replication and cannot achieve the required RPO.

Exam trap

Many candidates think that any cross-region backup solution can achieve a 15-minute RPO, but only continuous replication like HSR works.

Practice this question →
400
MCQhard

An SAP system uses a shared file system mounted via EFS from multiple EC2 instances. The operations team notices that the file system is not performing well during peak loads. What is the most effective way to improve throughput without changing the application?

A.Enable Provisioned Throughput on the EFS file system
B.Replace EFS with an EBS Multi-Attach volume
C.Migrate the file system to Amazon FSx for Lustre
D.Change the EFS performance mode from General Purpose to Max I/O
AnswerD

Changing to Max I/O performance mode increases throughput for parallel workloads, directly addressing the performance issue without altering the application.

Why this answer

Changing the EFS performance mode from General Purpose to Max I/O increases throughput for parallel workloads, improving performance without modifying the application. Option A (Provisioned Throughput) provides consistent throughput but does not change performance mode. Option B (EBS Multi-Attach) is not suitable for high-throughput shared file systems due to limited concurrent access and throughput constraints.

Option C (FSx for Lustre) is designed for HPC and not typically aligned with SAP shared storage requirements.

Exam trap

Candidates often confuse throughput modes or believe Provisioned Throughput is the only way to improve performance, but changing from General Purpose to Max I/O can significantly enhance throughput for parallel access patterns.

Practice this question →
401
Multi-Selecthard

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Select 2 answers
A.Assign the patch baseline to the instance IDs directly.
B.Ensure that the instances have the appropriate IAM role that allows them to be patched.
C.Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.
D.Check the output of the AWS-RunPatchBaseline SSM document in the Systems Manager Run Command history for the failed instances.
E.Configure a Maintenance Window for the patching operation.
AnswersC, D

The SSM Agent must be online to execute patching commands.

Why this answer

If the SSM Agent is not running or cannot communicate with the AWS Systems Manager service, Patch Manager cannot execute the patching commands. The agent must be in a healthy state and have network connectivity (e.g., via VPC endpoints or internet gateway) to receive the patch baseline and report status. Option D is correct because the AWS-RunPatchBashelline SSM document execution history in Run Command provides detailed logs and error messages for each instance, allowing the team to identify why the patching failed, such as missing dependencies or timeout issues.

Exam trap

The trap here is that candidates may assume the IAM role (Option B) is the primary cause of failure, but the question already indicates the SSM Agent is installed and the instances show a 'Failed' status, which often points to agent communication or execution errors rather than missing permissions.

Practice this question →
402
MCQmedium

A company is running SAP on AWS and wants to implement a patching strategy for the operating system of EC2 instances with minimal downtime. The instances are part of an Auto Scaling group. Which of the following approaches is the MOST appropriate?

A.Apply patches directly to the running instances using AWS Systems Manager Patch Manager and reboot each instance one at a time.
B.Stop the Auto Scaling group, patch the instances, and start the group again.
C.Use AWS Systems Manager Patch Manager to patch all instances at the same time during a maintenance window.
D.Create a new Amazon Machine Image (AMI) with the latest patches, update the launch configuration, and perform a rolling update of the Auto Scaling group.
AnswerD

This approach replaces instances with patched ones without downtime as the Auto Scaling group launches new instances before terminating old ones.

Why this answer

Creating a new AMI with the latest patches, updating the launch configuration, and performing a rolling update of the Auto Scaling group replaces instances with patched AMIs without downtime. Option A is incorrect because applying patches directly to running instances using AWS Systems Manager Patch Manager requires reboots, causing downtime for each instance. Option B is incorrect because stopping the Auto Scaling group stops all instances, resulting in full downtime.

Option C is incorrect because using Patch Manager to patch all instances at the same time during a maintenance window would cause simultaneous reboots, leading to downtime.

Practice this question →
403
MCQhard

A company runs SAP S/4HANA on AWS using an ASCS and PAS cluster with SUSE Linux Enterprise Server. The cluster fails over unexpectedly several times a day. What is the most likely cause and solution?

A.High network latency between nodes; use placement groups
B.Cluster quorum loss due to insufficient votes; add a third node or configure a witness
C.Insufficient memory on the cluster nodes; increase memory
D.Incorrect ASCS instance configuration; verify SAP profiles
AnswerB

Quorum loss triggers failover; adding a node stabilizes the cluster.

Why this answer

In a two-node SAP cluster, if the quorum vote count is insufficient, the cluster may lose quorum and trigger unnecessary failovers. The solution is to add a third node as a quorum device or configure a witness (e.g., an S3 bucket as a quorum disk in SUSE HAE). Option A is incorrect because high network latency would cause communication delays, not frequent failovers.

Option C is incorrect because insufficient memory would cause performance issues, not cluster failovers. Option D is incorrect because incorrect ASCS instance configuration would cause SAP startup failures, not cluster failovers.

Practice this question →
404
MCQeasy

An IAM policy is attached to a user. The user attempts to upload a file to s3://my-bucket/restricted/data.txt. What is the outcome?

A.The upload succeeds because there is no explicit Deny for the specific object.
B.The upload succeeds because the Allow statement for s3:GetObject implies PutObject.
C.The upload fails because the explicit Deny overrides the Allow.
D.The upload succeeds because the Allow for s3:GetObject is on all resources.
AnswerC

Explicit Deny always overrides Allow.

Why this answer

C is correct because IAM policy evaluation follows a default-deny model where an explicit Deny always overrides any Allow. Even though the user has an Allow for s3:GetObject on all resources, the explicit Deny for the specific object path s3://my-bucket/restricted/* takes precedence, causing the upload (which requires s3:PutObject) to fail.

Exam trap

The PAS-C01 exam often tests the misconception that an Allow on one action (like s3:GetObject) somehow implies or grants permissions for other actions (like s3:PutObject), or that the absence of an explicit Deny means the request will succeed, ignoring the explicit Deny's overriding effect.

How to eliminate wrong answers

Option A is wrong because the absence of an explicit Deny for the specific object does not guarantee success; the default implicit deny would block the action if no Allow applies, but here an explicit Deny exists for the prefix. Option B is wrong because s3:GetObject does not imply s3:PutObject; they are distinct actions with separate permissions, and the Allow for GetObject does not grant upload rights. Option D is wrong because the Allow for s3:GetObject on all resources does not cover the s3:PutObject action required for uploading, and the explicit Deny overrides any Allow regardless of resource scope.

Practice this question →
405
Multi-Selecthard

Which THREE are valid steps when performing a cross-Region disaster recovery failover for SAP HANA using AWS? (Choose THREE.)

Select 3 answers
A.Create an EBS snapshot of the primary database volume
B.Start the SAP HANA database on the secondary instance
C.Stop the SAP HANA database on the primary instance
D.Configure SAP HANA System Replication (HSR) between primary and secondary Regions
E.Update DNS records to point to the secondary instance
AnswersB, D, E

The secondary database must be started to serve requests.

Why this answer

Starting the SAP HANA database on the secondary instance is a required step during a cross-Region disaster recovery failover. After promoting the secondary system replication target to primary, the SAP HANA database must be started to make it available for client connections and resume operations.

Exam trap

The trap here is that candidates may mistakenly think creating EBS snapshots is a valid DR failover step, but snapshots are for backup and not part of the SAP HANA System Replication failover process, which relies on log-based replication instead.

Practice this question →
406
MCQmedium

A company runs SAP HANA on AWS and needs to perform a backup of the HANA database to Amazon S3. Which AWS service should be used to orchestrate the backup and ensure consistency?

A.AWS Backup with pre- and post-backup scripts for application-consistent backups.
B.Amazon S3 Lifecycle policies to transition backups to Glacier.
C.Amazon Data Lifecycle Manager (DLM) to schedule EBS snapshots.
D.AWS Storage Gateway file gateway to back up to S3.
AnswerA

AWS Backup with pre- and post-backup scripts can orchestrate application-consistent backups of SAP HANA databases to S3.

Why this answer

AWS Backup supports SAP HANA on EC2 with pre- and post-scripts for application-consistent backups. Option B is wrong because S3 Lifecycle policies manage object lifecycle, not backups. Option C is wrong because DLM manages EBS snapshots, not application-consistent backups.

Option D is wrong because Storage Gateway is for hybrid storage, not SAP HANA backups.

Practice this question →
407
Multi-Selectmedium

A company runs SAP on AWS and needs to implement a disaster recovery (DR) strategy that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The DR region must have the SAP application stack ready but the database can be replayed from backups. Which TWO actions should be taken to meet these requirements? (Choose two.)

Select 2 answers
A.Use a single-region Multi-AZ deployment for the database.
B.Use S3 cross-region replication for the application log files.
C.Set up a cross-region read replica for the Aurora PostgreSQL database.
D.Take daily snapshots of the database and copy them to the DR region.
E.Pre-provision EC2 instances with the SAP application stack in the DR region.
AnswersC, E

Cross-region read replicas provide low RPO (usually seconds) and can be promoted quickly.

Why this answer

Options C and E are correct. A cross-region read replica for Aurora PostgreSQL provides near-real-time replication, meeting the 15-minute RPO. Pre-provisioning EC2 instances with the SAP application stack in the DR region reduces RTO to within 2 hours.

Option A (single-region Multi-AZ) does not provide DR across regions. Option B (S3 cross-region replication for logs) is not sufficient for database recovery. Option D (daily snapshots copied to DR) would exceed the 15-minute RPO.

Practice this question →
408
MCQhard

An SAP administrator receives an alert that the SAP application server is not responding. The administrator checks the EC2 console and sees that the instance state is 'running' but the status checks have failed. Which step should be taken first to restore the SAP application?

A.Terminate the instance and launch a new one using the same AMI.
B.Use the EC2 console to stop and start the instance, which will move it to new underlying hardware.
C.Reboot the EC2 instance from the AWS Management Console.
D.Create a new EC2 instance from the latest AMI and attach the existing EBS volumes.
AnswerB

Stop/start recovers from hardware issues and preserves the instance ID, EBS volumes, and Elastic IP.

Why this answer

When status checks fail, the instance may have underlying hardware issues. Stopping and starting the instance (Option B) moves it to new hardware, which can resolve hardware-related failures and restore the SAP application. Option A is incorrect because terminating the instance loses the existing configuration and EBS volumes (unless termination protection is disabled and volumes are set to survive).

Option C is incorrect because rebooting only restarts the OS; it does not change the underlying hardware, so hardware issues persist. Option D is incorrect because creating a new instance and attaching existing volumes is more time-consuming and complex; the simpler stop/start action should be attempted first.

Practice this question →
409
Multi-Selecthard

Which THREE steps should an administrator take to troubleshoot an issue where an SAP application server cannot connect to the database server after a security group change? (Choose THREE.)

Select 3 answers
A.Check the outbound rules of the application server's security group
B.Modify the route tables to ensure direct communication
C.Restart both the application and database servers
D.Review the network ACL rules for the subnets
E.Verify the inbound rules of the database server's security group allow traffic from the application server
AnswersA, D, E

Security groups are stateful, but outbound rules can affect traffic if not configured properly.

Why this answer

The first step is to verify the security group rules. Then check network ACLs. VPC Flow Logs can confirm if traffic is allowed or denied.

Checking the OS firewall is also important. Restarting instances and changing route tables are too disruptive and unlikely to be the root cause. Changing security groups again without analysis is guesswork.

Practice this question →
410
MCQmedium

A company is migrating an SAP HANA database to AWS and needs to ensure high availability with automatic failover. Which solution meets this requirement with the least administrative overhead?

A.Configure SAP HANA System Replication across two EC2 instances in different Availability Zones and use a custom script for failover.
B.Use AWS SAP HANA Multi-AZ deployment.
C.Deploy a single EC2 instance with an EBS volume and take regular snapshots.
D.Use an Application Load Balancer to distribute traffic to multiple HANA instances.
AnswerA

SAP HANA System Replication with automatic failover is the standard approach for high availability, providing the least administrative overhead when properly configured.

Why this answer

SAP HANA System Replication is the native, widely-used method for high availability with automatic failover. While it requires some initial scripting for failover automation, it has the least administrative overhead among the given options. Option B is not a real AWS service, so it is invalid.

Option C offers no automatic failover, and Option D is not designed for database high availability.

Practice this question →
411
MCQhard

A company is running SAP ERP on a single EC2 instance with an SAP HANA database. The operations team receives an alert that the /hana/data filesystem is 85% full. The filesystem is mounted from an EBS volume. Which of the following actions should be taken to resolve the issue with MINIMAL downtime?

A.Increase the size of the existing EBS volume and extend the filesystem.
B.Add an additional EBS volume and mount it to /hana/data2, then relocate some data.
C.Delete unnecessary log files from the /hana/data directory.
D.Create a new, larger EBS volume, attach it to the instance, and copy the data.
AnswerA

EBS volumes can be resized online, and the filesystem can be extended without stopping the instance.

Why this answer

You can increase the size of an EBS volume and extend the filesystem while the instance is running, without any downtime. The filesystem can be extended online using commands like xfs_growfs for XFS or resize2fs for ext4. Option B is incorrect because adding a new volume and relocating data would require more complex configuration and potential downtime, and it doesn't resolve the issue of the existing filesystem being full.

Option C is incorrect because deleting log files is not a sustainable solution and may not free up enough space, and it is not a best practice for production systems. Option D is incorrect because creating a new larger volume and copying data would require the instance to be stopped to swap volumes, causing downtime.

Practice this question →
412
MCQmedium

A company is running a production SAP HANA database on an AWS EC2 instance with multiple EBS volumes. The operations team notices that the database performance degrades during peak hours. Which AWS service can be used to analyze the disk I/O performance and identify bottlenecks?

A.AWS Trusted Advisor
B.AWS Config
C.Amazon CloudWatch
D.AWS Config
AnswerC

CloudWatch provides detailed EBS metrics for performance analysis.

Why this answer

CloudWatch provides metrics for EBS volumes including read/write throughput and IOPS, which can be used to analyze disk I/O performance. Option A (AWS Trusted Advisor) is wrong because it provides best-practice checks but not real-time performance analysis. Option B (AWS Config) is wrong because it tracks configuration changes, not performance.

Option C is correct. Option D is a duplicate of Option B and is also wrong for the same reason.

Practice this question →
413
MCQeasy

A company is running SAP HANA on AWS and needs to ensure that the database can be recovered to a specific point in time within the last 24 hours. Which backup strategy should be used?

A.Incremental backups using Backint
B.Daily full EBS snapshots
C.Daily SAP HANA full backups
D.Full backups plus log backups every 5 minutes
AnswerD

This combination enables point-in-time recovery by allowing the database to be restored to any point between full backups using log backups.

Why this answer

Full plus log backups enable point-in-time recovery. Option A is wrong because single snapshot does not allow point-in-time. Option B is wrong because full backups only restore to backup time.

Option C is wrong because daily full backups only restore to the time of the backup, not point-in-time.

Practice this question →
414
MCQmedium

An SAP system running on EC2 is experiencing intermittent connectivity issues between application servers and the database server. The network team suspects that the security group rules are too restrictive. What is the best approach to identify which traffic is being blocked?

A.Check the SAP application logs for connection errors.
B.Enable AWS CloudTrail and look for security group modification events.
C.Use Amazon CloudWatch to monitor network packets.
D.Enable VPC Flow Logs on the subnet or ENI and review the logs for rejected traffic.
AnswerD

VPC Flow Logs capture information about IP traffic going to and from network interfaces.

Why this answer

VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC. They can show accepted and rejected traffic, making them ideal for identifying blocked traffic. Option A is wrong because SAP application logs only show connection errors from the application's perspective, not network-level blocking.

Option B is wrong because CloudTrail logs API calls (e.g., security group changes), not network traffic. Option C is wrong because CloudWatch metrics aggregate network data but do not provide per-packet detail to identify rejected traffic.

Practice this question →
415
Multi-Selectmedium

Which THREE AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose 3)

Select 3 answers
A.AWS Config
B.Amazon CloudWatch Logs
C.SAP HANA built-in monitoring (e.g., SAP HANA Studio, SQL queries)
D.Amazon CloudWatch
E.AWS CloudTrail
AnswersB, C, D

CloudWatch Logs can ingest and monitor SAP HANA trace logs.

Why this answer

Options B, C, and D are correct. Amazon CloudWatch can monitor EC2-level metrics like CPU, memory, and disk I/O, which are critical for SAP HANA performance. Amazon CloudWatch Logs can collect and analyze SAP HANA log files for deeper insights.

SAP HANA built-in monitoring (e.g., SAP HANA Studio) provides detailed database performance metrics. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not performance. Option E (AWS CloudTrail) is incorrect because it tracks API calls, not performance.

Practice this question →
416
MCQmedium

A company has an SAP HANA database running on an EC2 instance with EBS volumes. The operations team needs to ensure that database backups are stored in Amazon S3 and are automatically deleted after 90 days. What is the most efficient way to achieve this?

A.Use S3 Object Lock with a retention period of 90 days.
B.Enable S3 Versioning and delete old versions manually.
C.Write a script that runs daily to list backups older than 90 days and delete them.
D.Configure an S3 Lifecycle policy to expire objects after 90 days.
AnswerD

Lifecycle policies automate deletion without custom code.

Why this answer

S3 Lifecycle policies can automatically expire objects after a specified number of days, meeting the requirement for automated deletion after 90 days. Option A is incorrect because S3 Object Lock prevents deletion or modification, not automates it. Option B is incorrect because versioning alone does not delete objects; manual deletion would be needed.

Option C is incorrect because a script is less efficient than a built-in lifecycle policy.

Practice this question →
417
MCQeasy

A company wants to monitor the disk space utilization of their SAP application servers. Which AWS service can provide a centralized view of disk space metrics without installing additional agents?

A.AWS Systems Manager Inventory
B.Amazon CloudWatch
C.AWS CloudTrail
D.Amazon Inspector
AnswerA

Systems Manager Inventory collects OS-level information, including disk space, using the SSM Agent which is often pre-installed.

Why this answer

AWS Systems Manager Inventory (Option A) is correct because it can collect disk space utilization metrics from managed instances without requiring the installation of additional agents—the SSM Agent is either pre-installed on many Amazon Machine Images (AMIs) or installed as part of standard Systems Manager setup, so it is not considered an extra agent. In contrast, Amazon CloudWatch (Option B) requires the CloudWatch agent to collect disk metrics, which would be an additional installation. AWS CloudTrail (Option C) records API calls and does not monitor disk space.

Amazon Inspector (Option D) is a vulnerability assessment service and does not provide disk metrics.

Practice this question →
418
MCQhard

Your company runs SAP ERP on AWS with a multi-AZ deployment. The SAP HANA database is replicated across two Availability Zones using HANA System Replication. The application servers are behind an Application Load Balancer. During a recent Availability Zone failure, the primary HANA instance failed, and the standby took over. However, the application servers continued to try to connect to the primary instance for several minutes, causing downtime. The DNS record for the database endpoint was manually updated after the failover. What is the most effective solution to automate the failover and minimize downtime?

A.Configure a Network Load Balancer in front of the HANA instances
B.Create a custom script on each application server to detect failover and update the connection string
C.Implement Amazon Route 53 DNS failover with health checks on the primary and secondary HANA instances
D.Use an Amazon RDS for SAP HANA instead of self-managed
AnswerC

Route 53 health checks detect primary failure and automatically route to the secondary.

Why this answer

Using Amazon Route 53 with a primary and secondary routing policy and health checks can automatically update DNS to the healthy instance. Option C is correct.

Practice this question →
419
MCQhard

A company runs SAP S/4HANA in a multi-AZ deployment with a standby database in a different Availability Zone. The primary database fails. What is the expected behavior of the SAP HANA system replication?

A.A new standby database is automatically provisioned in the same AZ.
B.The standby database automatically takes over as the new primary.
C.The primary database is automatically restarted in the same AZ.
D.The administrator must manually promote the standby database.
AnswerB

SAP HANA system replication with sync mode enables automatic failover.

Why this answer

With SAP HANA system replication in synchronous mode, the standby database automatically takes over as the new primary when the primary fails, ensuring high availability. Option A is incorrect because a new standby is not automatically provisioned; the existing standby in the other AZ becomes the new primary. Option C is incorrect because the primary database is not restarted in the same AZ; the failover goes to the standby.

Option D is incorrect because automatic failover eliminates the need for manual intervention.

Practice this question →
420
MCQmedium

A company uses Amazon CloudWatch Logs to store SAP application logs. The Security team requires that logs be encrypted at rest using a customer-managed KMS key (CMK). How can this be achieved?

A.Associate the KMS key with the CloudWatch Logs log group.
B.Enable default encryption on the S3 bucket where logs are exported.
C.Use an encrypted EBS volume for the EC2 instances generating the logs.
D.Enable encryption on the CloudWatch Logs log stream.
AnswerA

CloudWatch Logs allows encryption at rest using a KMS CMK associated with the log group.

Why this answer

CloudWatch Logs supports encryption at rest using a customer-managed KMS key (CMK) by associating the key with the log group. This encrypts all log data stored in the log group. Option B is incorrect because S3 default encryption applies only to data stored in S3, not to CloudWatch Logs data that is not exported.

Option C is incorrect because encrypting the EBS volume of EC2 instances does not encrypt the logs after they are sent to CloudWatch Logs. Option D is incorrect because encryption is configured at the log group level, not the log stream level.

Practice this question →
421
MCQeasy

An SAP administrator needs to ensure that all API calls made to create, modify, or delete AWS resources are logged for auditing. Which AWS service should be enabled?

A.Amazon CloudWatch
B.AWS CloudTrail
C.AWS Config
D.Amazon GuardDuty
AnswerB

CloudTrail records all API activity for auditing.

Why this answer

AWS CloudTrail logs API calls. Option A (CloudWatch) is for monitoring metrics. Option C (Config) is for resource configuration.

Option D (GuardDuty) is for security threats.

Practice this question →
422
MCQhard

A company is running an SAP S/4HANA system on AWS. During a planned maintenance window, the operations team needs to apply an SAP kernel patch that requires stopping all SAP instances. Which AWS service can be used to orchestrate the stop/start sequence of multiple EC2 instances and ensure proper dependencies are maintained?

A.AWS Systems Manager Automation
B.AWS Step Functions
C.AWS CloudFormation
D.Amazon EC2 Run Command
AnswerA

Systems Manager Automation can orchestrate stop/start with dependencies and error handling.

Why this answer

(AWS Systems Manager Automation) is correct because it provides runbooks that can orchestrate the stop/start sequence of multiple EC2 instances with dependency management and error handling, ideal for SAP maintenance. Option B (AWS Step Functions) is less suitable because it requires custom Lambda functions to manage EC2 states, adding complexity. Option C (AWS CloudFormation) is for provisioning infrastructure, not ad-hoc operational tasks.

Option D (Amazon EC2 Run Command) is for running individual commands on instances, not for orchestrating multi-step sequences with dependencies.

Practice this question →
423
Multi-Selectmedium

A company is running SAP on AWS and needs to monitor the health of their SAP application servers. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.AWS X-Ray
B.Amazon CloudWatch
C.Amazon Route 53
D.AWS CloudTrail
E.Amazon Inspector
AnswersB, C

CloudWatch can collect health check metrics and set alarms.

Why this answer

Options B (Amazon CloudWatch) and C (Amazon Route 53) are correct. CloudWatch can collect and monitor metrics from SAP application servers, and Route 53 health checks can monitor the endpoints of those servers. Option A (AWS X-Ray) is for request tracing, D (AWS CloudTrail) is for API activity logging, and E (Amazon Inspector) is for security vulnerability assessment.

Practice this question →
424
MCQhard

A company runs SAP Business Suite on AWS. The SAP system frequently crashes with a 'JAVA out of memory' error. The application server is an EC2 instance with 32 GB RAM. Which solution should be implemented to prevent this issue?

A.Increase the EC2 instance memory to 64 GB
B.Reduce the Java heap size in the SAP system
C.Increase the swap space on the EC2 instance
D.Configure Amazon CloudWatch alarms to trigger EC2 Auto Scaling based on memory utilization
AnswerD

Auto scaling adds capacity when memory is high.

Why this answer

By configuring Amazon CloudWatch alarms to trigger EC2 Auto Scaling based on memory utilization, the system can automatically add more application server instances when memory usage is high. This distributes the load and prevents any single instance from running out of Java heap space. Option A is incorrect because manually increasing the EC2 instance memory is a temporary workaround that does not scale automatically.

Option B is incorrect as reducing the Java heap size would increase the likelihood of out-of-memory errors. Option C is incorrect because increasing swap space can cause severe performance degradation and does not resolve the underlying memory shortage.

Practice this question →
425
MCQhard

An SAP system on AWS uses a shared file system for the SAP transport directory. The file system is hosted on an Amazon EFS file system. Recently, the operations team noticed that SAP transports are failing with errors indicating file locking issues. The EFS file system is mounted using the NFS client with default options. What is the most likely cause of the file locking issues?

A.The EFS file system has insufficient throughput for the number of concurrent mounts.
B.The security group for the EFS mount targets does not allow inbound traffic on port 2049.
C.The EFS file system is using access points that restrict permissions.
D.The EFS file system is mounted using NFS version 3, which has limited locking support.
AnswerD

Correct. Default NFS client options often use NFSv3, which has limited locking support. EFS recommends NFSv4.1 for proper file locking, and using NFSv3 can lead to locking failures observed by the operations team.

Why this answer

The default NFS client options typically use NFSv3, which has limited file locking support. SAP transport processes rely on robust file locking to coordinate access to the shared transport directory. NFSv4.1, which EFS recommends, provides proper locking with NFSv4.1 state management and lease-based locking.

Option A is incorrect because insufficient throughput would manifest as performance degradation or timeouts, not file locking failures. Option B is incorrect because a security group blocking inbound traffic on port 2049 (NFS) would cause mount failures or accessibility issues, not specifically locking errors. Option C is incorrect because EFS access points do not affect locking; they manage file system paths and permissions, and restrictions would cause permission errors.

Practice this question →
426
MCQmedium

An SAP system running on AWS has a recurring issue where the SAP application server becomes unresponsive every evening at 8 PM. The administrator suspects a batch job causing high CPU usage. Which set of AWS services can best help identify the root cause?

A.AWS X-Ray and Amazon CloudWatch
B.Amazon CloudWatch and AWS CloudTrail
C.Amazon CloudWatch and AWS Lambda
D.Amazon CloudWatch and AWS Systems Manager Run Command
AnswerD

CloudWatch monitors metrics, Run Command can collect logs and process information.

Why this answer

(Amazon CloudWatch and AWS Systems Manager Run Command) is correct because CloudWatch monitors CPU metrics (e.g., CPUUtilization) to identify high usage patterns, and Run Command can execute scripts on the EC2 instance to collect OS-level logs, process lists, and batch job details during the incident. This combination provides both metric visibility and remediation/forensic capabilities. Option A (X-Ray) is for application tracing, not OS-level CPU analysis.

Option B (CloudTrail) logs API calls, not OS metrics. Option C (Lambda) lacks native OS command execution; Run Command provides direct, secure access to collect logs without additional setup.

Practice this question →
427
MCQeasy

An SAP administrator needs to monitor the free space of EBS volumes across multiple EC2 instances running SAP. Which AWS service should be used to collect and visualize this data?

A.AWS CloudTrail
B.Amazon CloudWatch
C.AWS Config
D.AWS Trusted Advisor
AnswerB

CloudWatch with the unified agent can collect disk metrics from instances.

Why this answer

Amazon CloudWatch can collect custom metrics from EC2 instances using the CloudWatch agent, enabling monitoring of EBS volume free space. Option A is incorrect because AWS CloudTrail logs API calls, not system metrics. Option C is incorrect because AWS Config tracks configuration changes, not real-time performance data.

Option D is incorrect because AWS Trusted Advisor provides best-practice checks, not real-time monitoring.

Practice this question →
428
MCQeasy

An SAP system is running on EC2 instances with EBS volumes. The administrator wants to automate the creation of point-in-time snapshots of the EBS volumes for disaster recovery. Which AWS service is best suited for this?

A.AWS Backup
B.Amazon S3 Lifecycle policies
C.Amazon Data Lifecycle Manager (DLM)
D.AWS CloudFormation
AnswerC

DLM automates creation and retention of EBS snapshots.

Why this answer

Amazon Data Lifecycle Manager (DLM) is specifically designed to automate the creation, retention, and deletion of EBS snapshots for backup and disaster recovery. Option A (AWS Backup) can also back up EBS volumes but is a broader service; DLM is more tailored for EBS snapshot lifecycle management. Option B (Amazon S3 Lifecycle policies) manages object lifecycle in S3, not EBS snapshots.

Option D (AWS CloudFormation) provisions infrastructure but does not directly automate snapshot creation.

Practice this question →
429
MCQhard

A multinational company runs SAP on AWS with a complex landscape including development, quality assurance, and production environments. The production SAP HANA database is running on an r5.8xlarge instance with 3.5 TB of data on EBS gp3 volumes. The operations team has been asked to implement a disaster recovery (DR) strategy that can recover the system in another AWS Region within 4 hours. The maximum acceptable data loss is 30 minutes. The current backup strategy uses daily EBS snapshots stored in the same Region. Which approach should the team take to meet the DR requirements?

A.Take EBS snapshots every 30 minutes and copy them to the DR Region using cross-Region snapshot copy. In the DR Region, have pre-provisioned EC2 instances and EBS volumes ready to attach the restored snapshots
B.Use AWS Backup to schedule daily backups and copy them to the DR Region
C.Set up a pilot light environment in the DR Region with a HANA instance replicating via log shipping
D.Configure SAP HANA System Replication across Regions using a VPN connection
AnswerA

Snapshot copy every 30 minutes meets RPO; pre-provisioning reduces RTO.

Why this answer

Taking EBS snapshots every 30 minutes and copying them cross-Region meets the RPO of 30 minutes, and restoring from snapshots to pre-provisioned instances in the DR Region can achieve an RTO of 4 hours. Option B (AWS Backup daily) fails the RPO of 30 minutes. Option C (pilot light with HANA log shipping) has a longer RTO due to log replay and database recovery.

Option D (HANA System Replication across Regions) typically requires a low-latency connection and may not meet the 4-hour RTO due to potential delays in failover and data synchronization.

Practice this question →
430
MCQeasy

An SAP administrator needs to monitor the CPU utilization of an SAP application server EC2 instance and send an alert if it exceeds 80% for 5 consecutive minutes. Which AWS service should be used?

A.AWS CloudTrail
B.VPC Flow Logs
C.Amazon CloudWatch Alarm
D.AWS Config
AnswerC

CloudWatch Alarms monitor metrics and can send notifications.

Why this answer

Amazon CloudWatch Alarm is the correct service for monitoring CPU utilization and sending alerts when the CPU utilization exceeds 80% for 5 consecutive minutes. CloudWatch Alarms can be configured to monitor any CloudWatch metric (such as CPUUtilization) and trigger actions like sending a notification via Amazon SNS. Option A (AWS CloudTrail) is incorrect because it records API calls for auditing, not metric monitoring.

Option B (VPC Flow Logs) is incorrect as it captures network traffic information, not CPU metrics. Option D (AWS Config) is incorrect because it evaluates resource compliance against rules, not performance metrics.

Practice this question →
431
MCQeasy

A company wants to ensure that its SAP systems on AWS are compliant with internal security policies. Which AWS service can be used to continuously monitor and evaluate resource configurations?

A.Amazon Inspector
B.AWS Config
C.AWS CloudTrail
D.Amazon GuardDuty
AnswerB

Config evaluates resource configurations against rules.

Why this answer

AWS Config is the correct service because it continuously monitors and evaluates the configurations of AWS resources against desired policies, such as internal security policies for SAP systems. It provides detailed configuration snapshots, compliance history, and automated remediation via AWS Config Rules, which can be custom or managed, to ensure ongoing compliance.

Exam trap

The trap here is that candidates often confuse AWS Config with AWS CloudTrail, thinking both are for auditing, but CloudTrail tracks who did what and when (API activity), while Config tracks what the resource looks like (configuration state) over time.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating resource configurations against internal policies. Option C is wrong because AWS CloudTrail records API activity and provides audit logs of actions taken on AWS resources, but it does not monitor or evaluate the state or configuration of those resources over time. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes continuous streams of metadata (e.g., DNS logs, VPC Flow Logs) for malicious activity, not for configuration compliance assessment.

Practice this question →
432
MCQeasy

A company wants to ensure that its SAP system backups are stored in a different AWS Region to comply with disaster recovery requirements. Which AWS service should be used to copy EBS snapshots to another Region?

A.AWS Backup
B.Amazon Data Lifecycle Manager
C.Amazon S3 Cross-Region Replication
D.AWS CloudFormation StackSets
AnswerA

AWS Backup can copy backups across Regions.

Why this answer

AWS Backup is the correct answer because it provides a centralized backup service that can copy EBS snapshots across AWS Regions as part of backup plans. Amazon Data Lifecycle Manager (DLM) can automate snapshot creation and retention, but its cross-Region copy capabilities are limited compared to AWS Backup's comprehensive backup policies. Option C, S3 Cross-Region Replication, applies to S3 objects, not EBS snapshots.

Option D, CloudFormation StackSets, is used for infrastructure provisioning across accounts/regions, not for backup.

Practice this question →
433
MCQeasy

An SAP system administrator needs to automate the patching of Amazon RDS for SAP ASE databases. Which AWS service can be used to schedule and apply database patches automatically?

A.AWS OpsWorks
B.Amazon RDS maintenance window
C.AWS Systems Manager Maintenance Windows
D.AWS Systems Manager Patch Manager
AnswerB

Amazon RDS maintenance window is the correct feature because it allows you to define a schedule for automatic patching of RDS databases.

Why this answer

Amazon RDS maintenance window is a built-in feature that allows you to schedule automatic patching for RDS databases, including SAP ASE. It is the appropriate mechanism for automating patching. Options A (AWS OpsWorks) is for configuration management.

Option C (AWS Systems Manager Maintenance Windows) can orchestrate tasks but cannot directly apply RDS patches; RDS manages patching internally. Option D (AWS Systems Manager Patch Manager) is designed for EC2 instances, not RDS.

Practice this question →
434
Multi-Selectmedium

A company is designing a disaster recovery plan for a critical application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses an RDS Multi-AZ database. Which TWO actions should the operations team take to minimize recovery time and data loss?

Select 2 answers
A.Configure automated EBS snapshots for EC2 instances and copy them to a secondary region.
B.Enable cross-region read replicas for the RDS database and promote to master if needed.
C.Create an AMI from a running instance and share it with the secondary region.
D.Use Route53 health checks to automatically failover traffic to a standby environment.
AnswersA, B

Snapshots can be used to restore volumes in another region.

Why this answer

Automated EBS snapshots, when copied to a secondary region, provide a mechanism to restore EC2 instances and their data in the event of a regional failure. This minimizes recovery time by having the snapshots available in the DR region, and minimizes data loss by ensuring point-in-time backups are replicated off-site. The snapshots can be used to launch new instances or create AMIs in the secondary region, supporting the recovery of the Auto Scaling group.

Exam trap

The trap here is that candidates may assume creating an AMI from a running instance (Option C) is sufficient for DR, but they overlook that it does not provide ongoing incremental replication, leading to significant data loss compared to automated EBS snapshots copied to a secondary region.

Practice this question →
435
MCQmedium

A company is running SAP on EC2 instances with EBS volumes. They need to take daily snapshots of the EBS volumes and retain them for 90 days. Which approach is most cost-effective?

A.Use Amazon Data Lifecycle Manager (DLM) to automate snapshots and set a retention policy of 90 days.
B.Use S3 Lifecycle policies to transition snapshots to Glacier after 90 days.
C.Create a script that takes snapshots daily and stores them indefinitely.
D.Use AWS Backup to schedule backups and set retention to 90 days.
AnswerA

DLM automates and manages lifecycle, costing only for storage.

Why this answer

Amazon Data Lifecycle Manager (DLM) automates the creation and deletion of EBS snapshots, allowing you to set a retention policy of 90 days. This is cost-effective as old snapshots are automatically deleted. Option B is incorrect because S3 Lifecycle policies manage objects in S3, not EBS snapshots; snapshots are stored in S3 but are managed by DLM or AWS Backup.

Option C is incorrect because storing snapshots indefinitely would incur unnecessary costs. Option D, AWS Backup, is a managed service that can be used but may have additional costs compared to DLM, and DLM is specifically designed for cost-effective snapshot management.

Practice this question →
436
MCQhard

An operations team is troubleshooting a performance issue in an SAP environment where the database server's memory usage is consistently high. The team suspects that the SAP buffer cache is not sized optimally. Which CloudWatch metric should be monitored to confirm this?

A.`ReadIOPS` for the RDS instance
B.`DatabaseConnections` for the RDS instance
C.`FreeableMemory` for the RDS instance
D.`SwapUsage` for the RDS instance
AnswerC

Low freeable memory indicates the database is using most of the available memory, which could be due to a large buffer cache.

Why this answer

The `DatabaseMemoryUsedPercent` metric for Amazon RDS provides the percentage of memory used by the database engine, including buffer cache. A consistently high value may indicate an oversized buffer cache relative to available memory, but the question asks for a metric to confirm. However, the correct metric for RDS memory is `FreeableMemory`.

The buffer cache size can be inferred from `FreeableMemory`. Alternatively, for EC2-based SAP, the OS metrics are needed. Given the options, `FreeableMemory` is the best indicator.

Practice this question →
437
MCQeasy

A company is migrating its SAP environment to AWS and wants to automate the installation of SAP software on EC2 instances. Which AWS service is best suited for this purpose?

A.AWS CloudFormation
B.AWS Elastic Beanstalk
C.Amazon EC2 Launch Templates
D.AWS OpsWorks
AnswerA

CloudFormation can automate the entire SAP deployment using custom resources.

Why this answer

(AWS CloudFormation) is correct because CloudFormation allows infrastructure as code and can use custom resource providers for SAP installation. Option B (AWS Elastic Beanstalk) is for web applications, not SAP. Option C (Amazon EC2 Launch Templates) only configures EC2 instances at launch, not full SAP installation.

Option D (AWS OpsWorks) is for Chef/Puppet automation but not SAP-specific.

Practice this question →
438
MCQmedium

An SAP system administrator notices that the SAP HANA database backup job to Amazon S3 is failing intermittently. The backup script uses the AWS CLI. Which step should be taken to diagnose the issue?

A.Enable S3 Transfer Acceleration on the bucket
B.Check AWS CloudTrail logs for S3 API call errors
C.Configure S3 Lifecycle policy to expire incomplete multipart uploads
D.Modify the backup script to use the AWS SDK instead of CLI
AnswerB

CloudTrail logs show failed API calls and error codes.

Why this answer

AWS CloudTrail logs record API calls made to Amazon S3, including errors, which can help diagnose why the backup job is failing. Option A is wrong because S3 Transfer Acceleration only improves upload speed, not reliability. Option C is wrong because S3 Lifecycle policies manage object expiration and are unrelated to diagnosing backup failures.

Option D is wrong because switching from AWS CLI to SDK does not address the root cause; diagnostics should focus on API call errors, permissions, or network issues.

Practice this question →
439
Multi-Selecteasy

A company wants to automatically recover an SAP HANA database EC2 instance if it becomes impaired due to underlying hardware issues. Which THREE components are required for this automatic recovery?

Select 3 answers
A.A CloudWatch alarm that monitors the StatusCheckFailed metric.
B.An instance that is configured for EC2 Auto Recovery.
C.A single Availability Zone deployment.
D.Multiple Availability Zones for the instance.
E.An Elastic IP address associated with the instance.
AnswersA, B, C

The alarm triggers the recovery action.

Why this answer

A CloudWatch alarm monitoring the StatusCheckFailed metric triggers the EC2 Auto Recovery process when the instance becomes impaired. Option B is correct because the instance must be explicitly configured for EC2 Auto Recovery; this is a prerequisite for automatic recovery. Option C is correct because EC2 Auto Recovery operates within a single Availability Zone; the instance is recovered in the same AZ.

Option D is incorrect because multiple Availability Zones are not used—this feature does not support multi-AZ recovery. Option E is incorrect because an Elastic IP address is not required for automatic recovery; if an Elastic IP is associated, it will be remapped automatically, but it is not a component of the recovery configuration.

Practice this question →
440
Multi-Selectmedium

An SAP system is deployed on EC2 with a Multi-AZ RDS for SAP ASE database. The operations team needs to ensure that database backups are stored in a separate AWS account for compliance. Which TWO actions should they take?

Select 2 answers
A.Share the snapshots publicly and then copy them to the target account.
B.Configure S3 cross-region replication for the automated backups.
C.Use AWS KMS with cross-account permissions to allow the target account to decrypt and copy the snapshots.
D.Use AWS Backup with a cross-account backup policy to copy snapshots to the target account.
E.Enable automatic cross-account backup in the RDS console.
AnswersC, D

Cross-account KMS keys enable secure sharing of encrypted snapshots.

Why this answer

The correct answers are C and D. Option C: Using AWS KMS with cross-account permissions allows the target account to decrypt and copy encrypted snapshots, enabling secure cross-account backup. Option D: AWS Backup with a cross-account backup policy can automatically copy RDS snapshots to another account, meeting compliance requirements.

Option A is wrong because sharing snapshots publicly is a severe security risk. Option B is wrong because S3 cross-region replication is for S3 objects, not RDS snapshots. Option E is wrong because the RDS console does not have an automatic cross-account backup feature; this requires AWS Backup or manual snapshot sharing with KMS.

Practice this question →
441
MCQeasy

An SAP system on AWS uses Amazon RDS for its database. The operations team needs to perform a point-in-time recovery (PITR) to restore the database to a specific timestamp. Which AWS feature enables PITR for RDS?

A.Manual DB snapshots
B.Read Replicas
C.Automated backups
D.Multi-AZ deployment
AnswerC

Automated backups enable point-in-time recovery to any second within the retention period.

Why this answer

Automated backups (option C) enable point-in-time recovery (PITR) for Amazon RDS. They provide continuous backups that allow restoring the database to any point within the retention period. Option A (Manual DB snapshots) are user-initiated and not used for PITR.

Option B (Read Replicas) are for read scaling, not recovery. Option D (Multi-AZ deployment) provides high availability, not PITR.

Practice this question →
442
MCQmedium

A company runs SAP on AWS and uses a central syslog server to collect logs from all SAP instances. The operations team wants to use a managed AWS service to centralize log storage and enable real-time analysis. Which service should they use?

A.Amazon Athena
B.Amazon CloudWatch Logs
C.Amazon Kinesis Data Firehose
D.Amazon S3
AnswerB

Amazon CloudWatch Logs is a managed service that centralizes logs from multiple sources, enabling real-time monitoring and analysis with CloudWatch Logs Insights. It is the best fit for this requirement.

Why this answer

Amazon CloudWatch Logs is a managed service that can aggregate logs from multiple Amazon EC2 instances and other sources, providing centralized storage and real-time monitoring and analysis. It is the most appropriate choice for this use case because it offers built-in log aggregation, real-time analysis with CloudWatch Logs Insights, and integration with AWS services. Amazon Athena (Option A) is an interactive query service for analyzing data in Amazon S3, not designed for real-time log ingestion from multiple sources.

Amazon Kinesis Data Firehose (Option C) is a streaming data delivery service that can capture and load data into destinations like S3 or Redshift, but it requires additional setup for real-time analysis and is more complex for simple log centralization. Amazon S3 (Option D) is an object storage service that can store logs but does not natively provide real-time analysis capabilities.

Practice this question →
443
Multi-Selectmedium

Which TWO actions should be taken to ensure high availability for an SAP NetWeaver system on AWS? (Choose TWO.)

Select 2 answers
A.Assign Elastic IP addresses to the instances for failover
B.Place all EC2 instances in a single Availability Zone
C.Use Amazon EC2 Spot Instances for cost savings
D.Deploy the ASCS instance in an Auto Scaling group
E.Use Amazon RDS Multi-AZ for the database
AnswersA, E

Elastic IPs can be remapped to standby instances during failover.

Why this answer

To ensure high availability for an SAP NetWeaver system on AWS, two key actions are: A) Assign Elastic IP addresses to the instances for failover, which allows rapid IP remapping to a standby instance in case of failure; and E) Use Amazon RDS Multi-AZ for the database, which provides automatic failover to a standby replica in a different Availability Zone. Option B (placing instances in a single AZ) reduces availability. Option C (using Spot Instances) risks interruption and is not suitable for production SAP systems.

Option D (deploying ASCS in an Auto Scaling group) is not recommended because ASCS is stateful and cannot scale horizontally.

Practice this question →
444
MCQmedium

A company has an SAP environment with a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 15 minutes. Which backup strategy meets these requirements?

A.Daily full backups to Amazon S3 and log backups every 30 minutes.
B.Weekly full backups and daily differential backups.
C.Incremental backups every 15 minutes and log backups every 5 minutes.
D.Hourly EBS snapshots and continuous log shipping to S3.
AnswerC

Frequent incremental and log backups can achieve 15-minute RPO and 2-hour RTO.

Why this answer

Incremental backups (every 15 minutes) combined with log backups (every 5 minutes) allow for a recovery point objective (RPO) of 15 minutes and can meet the 2-hour recovery time objective (RTO) if the database is appropriately sized and restore procedures are optimized. Option A is incorrect because log backups every 30 minutes result in a potential data loss of up to 30 minutes, exceeding the required 15-minute RPO. Option B is incorrect because weekly full and daily differential backups provide an RPO of up to 24 hours.

Option D is incorrect because hourly EBS snapshots do not provide the granularity needed for a 15-minute RPO and restoring from snapshots can be slower than from SAP HANA-native backups.

Practice this question →
445
MCQeasy

An SAP system administrator needs to automate the patching of SAP applications on EC2 instances. Which AWS service should they use?

A.Amazon Inspector
B.AWS Systems Manager Patch Manager
C.AWS OpsWorks
D.AWS Config
AnswerB

AWS Systems Manager Patch Manager automates OS and application patching across EC2 instances using a predefined patch baseline, directly satisfying the SAP administrator’s need to schedule and apply SAP application updates without manual intervention. Its integration with Systems Manager’s Run Command and maintenance windows enforces compliance against the specific constraint of automating patching on EC2, not just monitoring or deploying infrastructure.

Why this answer

AWS Systems Manager Patch Manager automates patching for managed instances, including SAP applications on EC2. Option A (Amazon Inspector) is for vulnerability assessment, not patching. Option C (AWS OpsWorks) is for configuration management with Chef/Puppet, not specifically for patching.

Option D (AWS Config) is for configuration compliance monitoring, not patching.

Practice this question →
446
Multi-Selecteasy

Which TWO AWS services can be used to automate the start and stop of SAP EC2 instances based on a schedule? (Select TWO.)

Select 2 answers
A.AWS Lambda with CloudWatch Events
B.AWS Systems Manager Run Command
C.AWS Instance Scheduler
D.AWS Auto Scaling
E.AWS OpsWorks
AnswersA, C

Can schedule start/stop.

Why this answer

The correct answers are A (AWS Lambda with CloudWatch Events) and C (AWS Instance Scheduler). Option A allows you to run a custom Lambda function triggered by CloudWatch Events on a schedule (e.g., cron expression) to start or stop EC2 instances. Option C is a purpose-built AWS solution for scheduling instance start and stop times.

Options B (Systems Manager Run Command) is used for ad-hoc command execution, not for recurring scheduling. Option D (Auto Scaling) manages capacity based on scaling policies, not for scheduled start/stop of existing instances. Option E (AWS OpsWorks) is a configuration management service (Chef/Puppet) and not designed for scheduling instance power states.

Practice this question →
447
MCQmedium

An operations team uses this IAM policy for a role assumed by SAP administrators. An administrator tries to stop a production SAP HANA instance in the us-west-2 region but receives an access denied error. What is the cause?

A.The Allow statement's resource ARN specifies us-east-1, but the instance is in us-west-2.
B.The Allow statement only permits stopping instances with the tag Environment=production, and the instance does not have that tag.
C.The Deny statement requires the resource to have a specific tag, which is missing.
D.The Deny statement with a condition on aws:RequestedRegion prevents actions outside us-east-1.
AnswerD

The condition denies all actions if the request is not in us-east-1.

Why this answer

The Deny statement includes a condition using aws:RequestedRegion that blocks any action unless the request is made in us-east-1. Since the administrator's request is in us-west-2, the condition fails and the Deny applies, causing the access denied error. Option A is incorrect because the Allow statement's resource ARN is for us-east-1, but the Deny overrides the Allow; the resource region is not the primary issue.

Option B is incorrect because even if the instance has the tag, the Deny still overrides. Option C is incorrect because the Deny does not require a tag; it checks the region.

Exam trap

Candidates often focus on the Allow statement's region-specific resource ARN and overlook the Deny statement's condition on aws:RequestedRegion, which explicitly blocks all actions outside us-east-1.

Practice this question →
448
Multi-Selecteasy

Which TWO options are valid methods to back up an SAP HANA database on AWS? (Choose 2)

Select 2 answers
A.Use Amazon RDS automated backups
B.Use SAP HANA Backint with AWS Backup
C.Use AWS Database Migration Service (DMS)
D.Copy HANA data files to Amazon S3 using AWS CLI
E.Create application-consistent EBS snapshots using pre and post scripts
AnswersB, E

Backint integrates HANA backup with AWS.

Why this answer

Options B and E are correct. B: SAP HANA Backint integrated with AWS Backup provides a certified and native backup solution for HANA databases. E: Creating application-consistent EBS snapshots using pre and post scripts ensures data consistency and is a valid backup method.

Option A is incorrect because Amazon RDS automated backups are not applicable to SAP HANA running on EC2; RDS is a managed service for relational databases, not HANA. Option C is incorrect because AWS DMS is designed for database migration, not backup. Option D is incorrect because copying HANA data files to S3 using AWS CLI does not ensure consistency and is not a supported backup method for HANA.

Practice this question →
449
MCQmedium

An SAP system experiences an unplanned failover of the HANA database. The database administrator needs to investigate the root cause. Which AWS service should be used to analyze the timeline of events leading to the failover?

A.AWS CloudTrail
B.Amazon CloudWatch Logs
C.Amazon VPC Flow Logs
D.AWS Config
AnswerA

CloudTrail records API calls and events, enabling root cause analysis of failover.

Why this answer

AWS CloudTrail records API calls and events, which can help trace actions leading to failover. Option B (Amazon CloudWatch Logs) collects logs but not API activity. Option C (Amazon VPC Flow Logs) captures network traffic.

Option D (AWS Config) tracks configuration changes but not real-time events.

Practice this question →
450
MCQmedium

Your organization runs SAP S/4HANA on AWS. The system is critical and must have high availability. The architecture includes two SAP application servers behind an Application Load Balancer, and the HANA database uses replication to a standby in another Availability Zone. During a recent test of a failure scenario, you noticed that when the standby HANA instance takes over, the application servers cannot connect because the database hostname changes. What is the best solution to ensure application servers can connect to the database without manual intervention after a failover?

A.Configure the application servers with both database IP addresses and retry logic
B.Use Amazon Route 53 with a weighted record that points to the primary and standby instances, and use health checks to automatically fail over
C.Place the database behind a Network Load Balancer
D.Update the application server configuration to use the standby hostname as a fallback
AnswerB

Route 53 health checks can detect primary failure and route to the standby.

Why this answer

Amazon Route 53 can be configured with a weighted or failover routing policy that uses health checks to automatically update DNS resolution. When the primary HANA instance fails, the health check detects the failure and Route 53 directs traffic to the standby instance, ensuring application servers can connect without manual intervention or hostname changes.

Practice this question →
← PreviousPage 6 of 7 · 460 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Operations and Maintenance questions.

Start 20-question session