Knowledge + Practice

CCNA Technology Questions

75 of 389 questions · Page 1/6 · Technology · Answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

A.Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

B.Store the data in Amazon S3 and use Athena for querying

C.Refactor the application to use Amazon DynamoDB as the database

D.Replatform the application by migrating the Oracle database to Amazon RDS for Oracle

AnswerD

Migrating to RDS for Oracle preserves the existing SQL dialect and stored procedures, minimizing code changes while leveraging managed database services.

Why this answer

The company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Exam trap

The trap here is that candidates may assume any AWS-managed database service (like Aurora or DynamoDB) is automatically better, overlooking the critical requirement to minimize code changes by keeping the same database engine.

How to eliminate wrong answers

Option A is wrong because migrating to Amazon Aurora with PostgreSQL compatibility would require rewriting complex Oracle-specific stored procedures (e.g., PL/SQL) to PostgreSQL-compatible code (PL/pgSQL), which contradicts the requirement to minimize application code changes. Option B is wrong because storing data in Amazon S3 and using Athena for querying is not suitable for transactional workloads with complex stored procedures; Athena is designed for serverless ad-hoc querying of data lakes, not for OLTP operations with stored procedures. Option C is wrong because refactoring the application to use Amazon DynamoDB would require significant application code changes, including replacing SQL queries and stored procedures with NoSQL API calls, which violates the goal of minimizing changes.

Practice this question →

2

Multi-Selectmedium

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and be accessible only within the VPC. Which TWO steps should the solutions architect take to meet these requirements? (Choose TWO.)

Select 2 answers

A.Attach an Internet Gateway to the VPC and configure route tables for the private subnets.

B.Place the Fargate tasks in public subnets to allow them to communicate with each other through the internet gateway.

C.Use AWS Cloud Map for service discovery and register a public DNS name for each service.

D.Use an internal Application Load Balancer to distribute traffic between services.

E.Create a VPC endpoint for Amazon ECS to allow the service to call the ECS API without internet access.

AnswersD, E

Internal ALB routes traffic within the VPC.

Why this answer

An internal Application Load Balancer (ALB) operates within a VPC and does not expose a public endpoint, ensuring that traffic between microservices remains private. It distributes incoming requests to Fargate tasks based on defined rules, enabling secure, internal communication without internet access.

Exam trap

The trap here is that candidates often confuse public subnets with the ability to communicate privately, or assume that an internet gateway is required for any inter-service communication, when in fact internal load balancers and VPC endpoints provide fully private connectivity.

Practice this question →

3

MCQhard

A company has an SAP HANA database running on an EC2 instance with EBS volumes. The database requires 10,000 IOPS consistently. The current volume type is gp3 with 3000 IOPS. Which change should be made to meet the IOPS requirement?

A.Change the volume type to io2 Block Express and provision 10,000 IOPS.

B.Increase the volume size of the gp3 volume to automatically increase IOPS.

C.Increase the IOPS on the existing gp3 volume to 10,000.

D.Add an instance store volume and move the data to it.

AnswerA

io2 Block Express volumes support high IOPS and are suitable for SAP HANA.

Why this answer

Io2 Block Express volumes are designed for high-performance workloads and can provision up to 256,000 IOPS, easily meeting the 10,000 IOPS requirement. Option B is wrong because increasing the volume size of a gp3 volume does not automatically increase IOPS beyond the baseline; gp3 IOPS are provisioned independently of size. Option C is wrong because while gp3 can be provisioned up to 16,000 IOPS, io2 Block Express offers consistent low-latency performance needed for SAP HANA.

Option D is wrong because instance store volumes are ephemeral and data is lost on instance stop or termination, making them unsuitable for persistent database storage.

Practice this question →

4

MCQeasy

A company runs SAP ERP on AWS using a single EC2 instance for the database and application. The system has been in production for two years. The SAP administrator receives a notification that the EC2 instance's underlying hardware is scheduled for retirement in two weeks. The administrator needs to minimize downtime and ensure the SAP system is available during the maintenance. Which action should the administrator take?

A.Reboot the instance to move it to healthy hardware.

B.Request an extension of the retirement date from AWS Support.

C.Create an AMI of the instance and launch a new instance from the AMI.

D.Stop the instance and then start it again to migrate to new hardware.

AnswerD

Stopping and starting the instance migrates it to healthy hardware with minimal downtime (the stop/start cycle takes a few minutes).

Why this answer

Stopping and starting the instance migrates it to new hardware with minimal downtime (the stop/start cycle takes a few minutes). Option A is wrong because rebooting does not change the underlying hardware; the instance stays on the same degraded hardware. Option B is wrong because scheduled hardware retirement events cannot be extended by requesting a delay from AWS Support.

Option C is wrong because creating an AMI and launching a new instance takes longer, may cause IP/hostname changes, and requires additional configuration, making it more disruptive than stop/start.

Practice this question →

5

MCQmedium

A company migrates its SAP HANA database to an EC2 instance with 1 TB of memory. The system is used for both OLTP and OLAP workloads. The performance team notices that memory utilization is high but the CPU is underutilized. Which configuration change would best improve overall system throughput?

A.Use a smaller instance type with higher CPU to memory ratio

B.Enable HANA Large Pages to reduce TLB misses and improve memory access

C.Increase the swap space on the instance store volumes

D.Disable HANA compression to reduce CPU overhead

AnswerB

Large pages improve memory access efficiency.

Why this answer

HANA Large Pages (also known as huge pages) reduce the number of Translation Lookaside Buffer (TLB) misses by mapping large contiguous memory regions with fewer page table entries. In a 1 TB memory system, the default 4 KB page size causes excessive TLB pressure, especially under OLAP workloads with large data scans. Enabling large pages improves memory access efficiency, allowing the CPU to spend less time on page walks and more time on actual processing, thereby improving overall throughput without requiring a hardware change.

Exam trap

The trap here is that candidates often assume high memory utilization means the instance is undersized and needs a different instance type, but the real bottleneck is inefficient memory access due to small page sizes, not a lack of memory capacity.

How to eliminate wrong answers

Option A is wrong because using a smaller instance type with a higher CPU-to-memory ratio would reduce the available memory, which is critical for SAP HANA's in-memory processing; this would likely cause memory pressure and degrade performance, not improve throughput. Option C is wrong because increasing swap space on instance store volumes would force the database to use disk-based paging, which is orders of magnitude slower than RAM and would severely degrade OLTP and OLAP performance. Option D is wrong because disabling HANA compression would increase the data footprint in memory, exacerbating memory utilization issues and potentially increasing CPU overhead due to more data to process, not reducing it.

Practice this question →

6

MCQhard

A company is deploying SAP S/4HANA on AWS and needs to ensure that the system can handle a sudden increase in user load during month-end closing. Which architectural change would best address this requirement?

A.Configure auto-scaling for the SAP application tier based on CPU utilization.

B.Deploy the application across multiple Availability Zones.

C.Increase the provisioned IOPS on the database EBS volumes.

D.Use a larger EC2 instance type for the application server.

AnswerA

Auto-scaling adds compute capacity automatically during high load.

Why this answer

SAP S/4HANA on AWS supports auto-scaling for the application tier (ASCS/PAS/AAS) using AWS Auto Scaling groups based on CPU utilization. This allows the system to dynamically add or remove application server instances to handle sudden spikes in user load during month-end closing, ensuring performance without manual intervention.

Exam trap

The trap here is that candidates often confuse high availability (multi-AZ) with elasticity (auto-scaling), or assume that vertical scaling (larger instance) is the only way to handle load spikes, missing the cloud-native horizontal scaling approach.

How to eliminate wrong answers

Option B is wrong because deploying across multiple Availability Zones improves high availability and fault tolerance, but does not directly address sudden increases in user load; it does not scale capacity dynamically. Option C is wrong because increasing provisioned IOPS on database EBS volumes improves disk throughput and latency, but does not add compute capacity to handle more concurrent users. Option D is wrong because using a larger EC2 instance type for the application server provides a fixed increase in capacity, but does not offer the elasticity needed to handle sudden, unpredictable load spikes; it also leads to over-provisioning during normal periods.

Practice this question →

7

MCQmedium

An SAP system running on AWS is experiencing high CPU utilization on the database server. The database is SAP HANA running on an r5.8xlarge instance. Which metric in Amazon CloudWatch would best indicate whether the CPU is being consumed by the HANA process or by other OS processes?

A.CPUUtilization metric from the EC2 instance

B.HANA CPU metric from SAP HANA CloudWatch integration

C.CPUCreditUsage metric

D.Custom metrics collected by the CloudWatch agent for the hdbindexserver process

AnswerD

The CloudWatch agent can collect per-process CPU metrics, allowing identification of HANA CPU usage.

Why this answer

The CloudWatch agent can be configured to collect custom metrics for specific processes, such as hdbindexserver (the main SAP HANA index server process). By monitoring the CPU utilization of this specific process, you can directly determine whether the HANA database process itself is consuming the CPU, as opposed to other OS-level processes like kernel threads, system daemons, or other applications. This granularity is not available from the EC2 instance-level CPUUtilization metric.

Exam trap

The trap here is that candidates assume the SAP HANA CloudWatch integration (Option B) provides CPU metrics, but it actually focuses on database-level metrics like memory, connection count, and SQL throughput, not per-process OS CPU usage.

How to eliminate wrong answers

Option A is wrong because the EC2 instance-level CPUUtilization metric aggregates all CPU usage across all processes, including both HANA and non-HANA processes, so it cannot isolate whether the CPU is consumed by the HANA process specifically. Option B is wrong because SAP HANA CloudWatch integration provides HANA-specific metrics like memory and SQL performance, but it does not expose a direct 'HANA CPU' metric that breaks down CPU usage per HANA process; the integration focuses on database-level KPIs, not OS process-level CPU. Option C is wrong because CPUCreditUsage is a metric for burstable T-series instances (e.g., t3, t2) to track CPU credit consumption, and r5.8xlarge is a standard instance type that does not use CPU credits, making this metric irrelevant.

Practice this question →

8

MCQmedium

An SAP system administrator is setting up monitoring for SAP NetWeaver on AWS. They want to send custom SAP application metrics to CloudWatch for alerting. What is the most efficient way to achieve this?

A.Use SAP Solution Manager to export metrics to CloudWatch via API

B.Use AWS Lambda to periodically query SAP and push metrics to CloudWatch

C.Install the Amazon CloudWatch Agent on the EC2 instance and configure it to collect SAP metrics

D.Configure AWS Systems Manager to collect SAP metrics

AnswerC

The CloudWatch Agent can collect custom metrics from the OS and applications, including SAP, and publish them to CloudWatch efficiently.

Why this answer

The CloudWatch Agent can collect custom metrics from the OS and applications, including SAP, and publish them to CloudWatch. AWS Lambda can be used but requires custom code and more overhead. SAP Solution Manager does not natively integrate with CloudWatch.

AWS Systems Manager is for management, not custom metric publishing.

Practice this question →

9

MCQhard

A company is migrating a legacy application to AWS. The application uses a custom TCP protocol and requires session persistence. The application runs on a fleet of EC2 instances behind a Network Load Balancer (NLB). The current configuration uses a TCP listener with 'source IP' stickiness. However, some clients are being routed to different instances mid-session, causing application errors. What is the most likely cause and solution?

A.The NLB does not support source IP stickiness; use a Classic Load Balancer instead.

B.Clients are behind a NAT gateway, so the source IP changes between requests, breaking stickiness. Use a 'stitched' cookie or switch to an Application Load Balancer.

C.The NLB has cross-zone load balancing enabled, which distributes traffic across instances in different Availability Zones.

D.The idle timeout of the NLB is too low, causing the NLB to close connections prematurely.

AnswerB

NAT changes the source IP, which defeats source IP stickiness.

Why this answer

Clients behind a NAT gateway will have their source IP address translated to the NAT gateway's public IP, which remains consistent for all requests from that gateway. However, if multiple clients share the same NAT gateway, the source IP is the same, but the NLB's source IP stickiness is based on the client's source IP as seen by the NLB. If the NAT gateway uses multiple public IPs or if clients are behind different NAT gateways, the source IP can change between requests, breaking stickiness.

The solution is to use a 'stitched' cookie or switch to an Application Load Balancer, which supports cookie-based session persistence independent of source IP.

Exam trap

The trap here is that candidates assume source IP stickiness works identically for all clients, failing to consider that NAT gateways or proxy servers can cause the source IP to change between requests, which is a common scenario in hybrid or multi-VPC architectures.

How to eliminate wrong answers

Option A is wrong because Network Load Balancers do support source IP stickiness (also known as client IP stickiness) for TCP listeners; Classic Load Balancers are legacy and not recommended for new deployments. Option C is wrong because cross-zone load balancing distributes traffic across instances in different Availability Zones but does not cause mid-session routing changes; it actually helps maintain stickiness by keeping traffic within the same target group. Option D is wrong because the idle timeout of an NLB is configurable (default 350 seconds) and affects connection persistence, but it would cause connections to drop entirely, not route to different instances mid-session.

Practice this question →

10

MCQeasy

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP system are logged for auditing purposes. Which AWS service should be enabled?

A.AWS Config

B.AWS CloudTrail

C.Amazon CloudWatch

D.VPC Flow Logs

AnswerB

CloudTrail provides a record of API activity in your account.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to AWS services, including the caller identity, time, source IP, and request parameters. For SAP systems requiring audit logs of AWS interactions, CloudTrail provides the necessary event history for security analysis, resource change tracking, and compliance auditing.

Exam trap

The trap here is that candidates often confuse AWS Config (configuration tracking) with CloudTrail (API auditing), or assume VPC Flow Logs cover all logging needs, but only CloudTrail provides the detailed API call records required for auditing AWS service interactions.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and recording resource configuration changes over time, not for logging API calls. Option C is wrong because Amazon CloudWatch is a monitoring service for metrics, logs, and alarms, but it does not natively capture API call-level audit trails. Option D is wrong because VPC Flow Logs capture IP traffic metadata at the network interface level (e.g., source/destination IP, ports, protocol), not API calls to AWS services.

Practice this question →

11

MCQmedium

An SAP application running on an EC2 instance is experiencing high latency during peak hours. The instance is in a private subnet with a NAT Gateway for outbound internet. Which action would most effectively reduce latency for SAP users?

A.Increase the EC2 instance size to a larger type with more CPU and memory.

B.Move the instance to a public subnet and assign a public IP address.

C.Replace the NAT Gateway with an Internet Gateway.

D.Enable EBS optimization on the instance.

AnswerA

Larger instance type directly improves compute performance, reducing application latency.

Why this answer

Increasing the EC2 instance size to a larger type with more CPU and memory directly addresses the root cause of high latency during peak hours for an SAP application: resource contention. SAP is compute and memory-intensive; when the instance's vCPUs and RAM are saturated, request queuing and processing delays occur. A larger instance type provides more dedicated resources, reducing processing time per transaction and thus lowering latency for users.

Exam trap

The trap here is that candidates often confuse network latency (which NAT Gateway or subnet changes might affect) with application latency caused by resource exhaustion, leading them to incorrectly choose network-related fixes instead of scaling the instance.

How to eliminate wrong answers

Option B is wrong because moving the instance to a public subnet and assigning a public IP address does not reduce latency caused by resource saturation; it only changes network routing and exposes the instance directly to the internet, which introduces security risks without addressing CPU/memory bottlenecks. Option C is wrong because replacing the NAT Gateway with an Internet Gateway does not reduce latency for SAP users; the NAT Gateway is not the source of high latency in this scenario, and an Internet Gateway would only change outbound internet routing, not improve instance performance. Option D is wrong because enabling EBS optimization on the instance improves I/O performance between the instance and EBS volumes, but the problem is high latency due to CPU/memory exhaustion, not storage throughput; EBS optimization does not increase compute capacity.

Practice this question →

12

MCQmedium

Your company is running SAP Business Suite on Oracle on AWS. The database is hosted on an EC2 instance with EBS volumes configured as RAID 0 for performance. You are planning to migrate to SAP HANA on AWS. The new HANA database will be hosted on a single EC2 instance with EBS io2 volumes. You need to ensure minimal downtime during the migration. Which approach should you take?

A.Use SAP HANA System Replication (HSR) with DMO to replicate data while the source is running, then perform a final cutover.

B.Use AWS Database Migration Service (DMS) to continuously replicate from Oracle to HANA.

C.Use SAP Landscape Management (LaMa) to automate the migration with minimal downtime.

D.Perform a classic migration using SAP Software Update Manager (SUM) with database migration option (DMO) in a single step, stopping the source system.

AnswerA

HSR with DMO allows minimal downtime by replicating changes during the migration.

Why this answer

The correct approach is to use SAP HANA System Replication (HSR) with a Database Migration Option (DMO) migration. This allows continuous data replication from the source Oracle database to the target SAP HANA database while the source system remains operational, minimizing downtime. The final cutover is performed quickly.

Option B (AWS DMS) is not suitable because AWS DMS does not support SAP HANA as a target. Option C (SAP LaMa) is a landscape management tool that can automate some migration steps but does not in itself provide near-zero downtime replication; it would typically be used with other methods. Option D (classic DMO with SUM in a single step) requires stopping the source system, resulting in extended downtime.

Practice this question →

13

MCQmedium

An SAP application running on AWS is experiencing high latency for database write operations. The system uses SAP ASE on Amazon EC2 with gp2 EBS volumes. Which change is most likely to improve write performance?

A.Move database write logs to Amazon S3 for better throughput.

B.Migrate to io1/io2 EBS volumes with provisioned IOPS.

C.Migrate to gp3 EBS volumes with higher baseline performance.

D.Use instance store volumes for database data files.

AnswerB

Provisioned IOPS volumes are designed for consistent, low-latency database workloads.

Why this answer

SAP ASE on Amazon EC2 with gp2 EBS volumes is experiencing high latency for database write operations. gp2 volumes use a burst-bucket model that can exhaust IOPS credits under sustained heavy writes, causing throttled performance. Migrating to io1 or io2 EBS volumes with provisioned IOPS guarantees consistent, low-latency write throughput, which directly addresses the bottleneck for database write workloads.

Exam trap

The trap here is that candidates assume gp3's higher baseline performance (3000 IOPS vs gp2's 100 IOPS baseline) is sufficient for all workloads, but they overlook that provisioned IOPS volumes are the only AWS block storage option that guarantees consistent performance for latency-sensitive database writes, especially under sustained load.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service with significantly higher latency and no support for database-level write operations such as transaction logs or redo logs; it cannot replace low-latency block storage required by SAP ASE. Option C is wrong because while gp3 offers higher baseline performance than gp2, it still uses a shared resource model and does not provide the guaranteed, consistent IOPS that io1/io2 deliver for sustained write-heavy workloads like SAP database transactions. Option D is wrong because instance store volumes are ephemeral and provide temporary block storage that is not durable; using them for database data files would risk data loss on instance stop/termination, and they lack the persistent, provisioned IOPS needed for reliable SAP ASE write performance.

Practice this question →

14

Multi-Selecthard

A company is planning to migrate its SAP HANA database to AWS. The database is 5 TB in size and requires high IOPS for online transaction processing (OLTP) workloads. Which THREE AWS storage options are suitable for SAP HANA data volumes? (Choose THREE.)

Select 3 answers

A.EC2 instance store (NVMe SSD)

B.Amazon EBS io2 Block Express volumes

C.Amazon S3

D.Amazon EBS gp3 volumes

E.Amazon EFS

AnswersA, B, D

Instance store provides very high IOPS, but data is ephemeral; suitable for /hana/data with replication.

Why this answer

EC2 instance store (NVMe SSD) provides very high IOPS and low latency directly attached to the host, which is suitable for SAP HANA data volumes that require high performance for OLTP workloads. However, instance store is ephemeral, so it must be used with replication or backup strategies for persistence.

Exam trap

The trap here is that candidates may confuse Amazon S3 or EFS as suitable for database workloads due to their scalability, but they lack the block-level access and consistent high IOPS required for SAP HANA data volumes.

Practice this question →

15

Drag & Dropmedium

Drag and drop the steps to set up an SAProuter connection between an on-premises network and AWS for SAP support access into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

SAProuter setup involves deploying instance, configuring SAProuter, opening port, establishing connectivity, and routing.

Practice this question →

16

MCQmedium

An SAP administrator runs the AWS CLI command shown in the exhibit to describe an EBS volume attached to an EC2 instance running SAP HANA. The instance is in the us-east-1a Availability Zone. The administrator needs to create a volume in us-east-1b and copy the data from the existing volume. What is the most efficient way to achieve this?

A.Use rsync to copy data from the instance to a new volume in us-east-1b over the network

B.Detach the volume from the instance and attach it to an instance in us-east-1b

C.Create a snapshot of the volume and then create a new volume in us-east-1b from the snapshot

D.Create an AMI from the instance and launch a new instance in us-east-1b

AnswerC

Snapshots are AZ-independent and can be used to create volumes in different AZs.

Why this answer

Creating a snapshot of the existing volume is the most efficient way to copy data across Availability Zones. Then, create a new volume in us-east-1b from that snapshot. Detaching the volume and attaching it to an instance in us-east-1b is not possible because the volume is tied to its AZ.

Creating an AMI is unnecessary overhead. Using rsync over the network would require an instance in the same AZ and network bandwidth.

Practice this question →

17

MCQeasy

A company runs SAP Business Suite on AWS and wants to implement a disaster recovery (DR) solution with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The primary site is in us-east-1, and DR site will be in us-west-2. The database is running on SAP ASE. The company wants to minimize changes to the existing SAP environment and avoid complex replication setups. What is the most suitable DR approach?

A.Deploy a Multi-AZ database in the primary region.

B.Set up SAP ASE native replication to a standby database in the DR region.

C.Use AWS Backup to schedule snapshots of the EBS volumes and copy them to the DR region.

D.Use AWS Database Migration Service to continuously replicate data to the DR region.

AnswerC

Simple and meets RPO/RTO with proper scheduling.

Why this answer

AWS Backup can schedule EBS snapshots every hour, meeting the RPO of 1 hour, and snapshots can be copied to the DR region (us-west-2). Restoring from these snapshots can be automated to achieve the RTO of 4 hours. This approach requires minimal changes to the existing SAP environment and avoids complex replication setups.

Option A is incorrect because Multi-AZ replication is for high availability within a single region, not for disaster recovery across regions. Option B is incorrect because SAP ASE native replication would require significant changes to the database configuration and licensing, contradicting the requirement to minimize changes. Option D is incorrect because AWS Database Migration Service is designed for ongoing data replication and is not the best fit for a simple backup/restore DR strategy.

Practice this question →

18

MCQeasy

An SAP system uses a custom RFC destination to an external SOAP web service. After a recent network change, the RFC call fails with a timeout error. The SAP administrator has verified that the web service is reachable from the SAP application server using ping. What is the MOST likely cause of the timeout?

A.The DNS resolution is incorrect for the web service hostname.

B.The SAP router configuration is blocking the connection.

C.The SSL certificate of the web service has expired.

D.A firewall between the application server and the web service is blocking the required port.

AnswerD

Firewall rules may block the specific port while allowing ICMP.

Why this answer

The RFC call uses a specific port (e.g., 443 for HTTPS or 80 for HTTP) to communicate with the SOAP web service. A firewall blocking that port would cause a timeout, as the ping test (ICMP) succeeds but the TCP handshake on the required port fails. The SAP administrator's verification of reachability via ping only confirms ICMP-level connectivity, not application-layer port access.

Exam trap

The trap here is that candidates confuse ICMP reachability (ping) with TCP port-level connectivity, assuming that if a server responds to ping, all network paths are open.

How to eliminate wrong answers

Option A is wrong because DNS resolution issues would typically cause a 'host not found' error, not a timeout; the ping success already indicates DNS is working. Option B is wrong because the SAP router is used for SAP-specific RFC traffic between SAP systems, not for external SOAP web service calls via RFC destinations. Option C is wrong because an expired SSL certificate would cause a handshake failure or certificate validation error, not a timeout; the connection would still be established before the SSL/TLS negotiation fails.

Practice this question →

19

MCQhard

An SAP system administrator is troubleshooting an issue where an application cannot connect to an SAP HANA database running on an EC2 instance. The security group for the HANA instance allows inbound traffic on port 39013 (SQL) from the application server's security group. The network ACLs for the subnet allow all traffic. What could be the cause of the connectivity issue?

A.The security group for the HANA instance does not allow inbound traffic on port 39013 from the application server's IP address.

B.The network ACL for the application server's subnet does not allow outbound traffic on port 39013.

C.The network ACL for the HANA instance's subnet is missing an outbound rule to allow return traffic on ephemeral ports.

D.The security group for the application server does not allow outbound traffic on port 39013.

AnswerC

C is correct: NACLs are stateless; outbound rules for return traffic are required.

Why this answer

The network ACL is stateless and must allow both inbound and outbound traffic; the outbound rule for ephemeral ports may be missing. Option A is incorrect because the security group allows the port. Option B is incorrect because the NACL allows all inbound traffic.

Option D is incorrect because the security group allows the application server's security group.

Practice this question →

20

MCQmedium

A company is running an SAP HANA database on an EC2 instance with EBS volumes. The database experiences high write latency during peak hours. Which configuration change would most effectively reduce latency?

A.Switch to gp3 EBS volumes with maximum throughput.

B.Increase the EC2 instance size to a compute-optimized type.

C.Use EBS io2 Block Express volumes with multi-attach enabled.

D.Migrate the data to instance store volumes.

AnswerC

io2 Block Express volumes offer up to 256,000 IOPS and sub-millisecond latency, meeting SAP HANA performance requirements.

Why this answer

SAP HANA is a high-performance in-memory database that requires extremely low-latency storage for its data and log volumes. EBS io2 Block Express volumes provide up to 256,000 IOPS per volume with single-digit millisecond latency, and multi-attach enables a cluster configuration for high availability. This directly addresses high write latency during peak hours by delivering consistent, ultra-low latency performance that gp3 or larger instances cannot match.

Exam trap

The trap here is that candidates often choose gp3 (Option A) because it is the newer, cost-effective general-purpose volume, but they overlook that SAP HANA's strict latency requirements demand the premium io2 Block Express, not just high throughput.

How to eliminate wrong answers

Option A is wrong because gp3 volumes, while offering baseline performance, have a maximum IOPS of 16,000 per volume (without bursting) and cannot match the sub-millisecond latency and high IOPS required by SAP HANA under heavy write loads. Option B is wrong because increasing the EC2 instance size to a compute-optimized type (e.g., C5) does not improve storage latency; compute-optimized instances are designed for CPU-intensive tasks, not for addressing EBS volume performance bottlenecks. Option D is wrong because instance store volumes are ephemeral and do not persist data across stops or terminations, making them unsuitable for a production SAP HANA database that requires durable, consistent storage for logs and data.

Practice this question →

21

MCQhard

A company is planning a migration of their SAP ERP system to AWS. They want to use SAP HANA as the database. The current on-premises database size is 2 TB. The migration must have minimal downtime. Which combination of AWS services and methods should be used to achieve a near-zero downtime migration?

A.Use AWS DMS with a SAP HANA source and target, configuring ongoing replication to minimize downtime

B.Use AWS Database Migration Service (DMS) with an SAP HANA source and S3 as target

C.Use SAP HANA System Replication (HSR) to replicate data to an EC2 instance in AWS

D.Use AWS Backup to perform a continuous backup of the on-premises HANA database and restore to AWS

AnswerA

DMS supports ongoing replication to keep data in sync with minimal downtime.

Why this answer

AWS DMS with a SAP HANA source and target, configuring ongoing replication, is correct because it supports near-zero downtime migration by continuously replicating changes from the on-premises HANA database to the target HANA database on AWS until cutover. DMS uses log-based change data capture (CDC) to capture ongoing transactions, allowing the source to remain operational during the bulk load and then switch with minimal interruption.

Exam trap

The trap here is that candidates may confuse SAP HANA System Replication (HSR) as a native AWS service or assume AWS Backup can handle on-premises continuous backups, when in fact AWS DMS with CDC is the only option that provides a managed, near-zero downtime migration path for SAP HANA to AWS.

How to eliminate wrong answers

Option B is wrong because using S3 as a target for AWS DMS with a SAP HANA source is not a valid migration path for SAP HANA; DMS cannot replicate directly to S3 for a HANA target, and S3 is not a database target for HANA workloads. Option C is wrong because SAP HANA System Replication (HSR) replicates data to an EC2 instance, but this requires a pre-configured HANA instance on AWS and does not provide a managed migration service; it also involves complex setup and potential downtime during the initial synchronization and cutover. Option D is wrong because AWS Backup does not support continuous backup of on-premises HANA databases; it is designed for AWS resources, and even if used, it would require a full backup and restore, which cannot achieve near-zero downtime due to the time needed for backup transfer and restoration.

Practice this question →

22

Multi-Selecthard

A company is designing a disaster recovery (DR) strategy for its SAP system on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The system uses SAP HANA as the database. Which THREE components must be configured to enable a successful DR failover?

Select 3 answers

A.SAP HANA system replication across regions.

B.Amazon Route53 DNS failover configuration.

C.AWS Backup cross-region backup copy for the HANA database.

D.S3 Cross-Region Replication for SAP transport files.

E.AWS Transit Gateway peering between the two regions.

AnswersA, B, C

SAP HANA system replication across regions ensures data consistency and near-synchronous replication for DR failover.

Why this answer

The correct three components are SAP HANA system replication across regions (A), Amazon Route53 DNS failover configuration (B), and AWS Backup cross-region backup copy for the HANA database (C). SAP HANA system replication ensures data consistency and near-synchronous replication between the primary and DR sites. Route53 DNS failover automatically redirects traffic to the DR site in case of a failure.

AWS Backup cross-region copy provides an additional backup of the HANA database in the DR region, ensuring backup availability. Option D (S3 Cross-Region Replication) is not essential for HANA replication; transport files can be handled separately. Option E (AWS Transit Gateway peering) provides network connectivity but is not a DR failover component.

Practice this question →

23

MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application uses Auto Scaling and a MySQL RDS Multi-AZ DB instance. Users report intermittent connection timeouts, and CloudWatch metrics show CPUUtilization spikes to 90% on the DB instance. The application queries are read-heavy with occasional writes. What is the MOST cost-effective design change to improve performance?

A.Implement ElastiCache Redis cluster to cache query results and reduce DB load.

B.Enable RDS Performance Insights and create a CloudWatch alarm to reboot the DB instance on high CPU.

C.Add an RDS read replica in the same region and configure the application to route read queries to the replica.

D.Switch the DB instance to a larger instance type to handle the load.

AnswerC

A read replica offloads read traffic, reducing CPU on the primary, and is cost-effective for read-heavy workloads.

Why this answer

The most cost-effective design change because adding an RDS read replica offloads read-heavy queries from the primary DB instance, reducing CPU utilization without requiring a larger instance. Since the workload is read-heavy with occasional writes, a read replica handles SELECT traffic while the Multi-AZ primary manages writes, improving performance at a lower cost than scaling up.

Exam trap

The trap here is that candidates often choose ElastiCache (Option A) thinking caching always reduces DB load, but for a read-heavy workload with occasional writes, an RDS read replica is more cost-effective and directly addresses the CPU spikes from read queries without the overhead of cache invalidation and additional infrastructure.

How to eliminate wrong answers

Option A is wrong because ElastiCache Redis caches query results, which reduces DB load for repeated queries but does not address the root cause of high CPU from read-heavy queries that may not be cacheable; it also adds complexity and cost for a workload better served by a read replica. Option B is wrong because enabling Performance Insights and rebooting the DB instance on high CPU is a reactive measure that does not prevent CPU spikes, and rebooting causes downtime, which is unacceptable for a critical application. Option D is wrong because switching to a larger instance type increases cost significantly without optimizing the read-heavy workload, whereas a read replica provides dedicated read capacity at a lower incremental cost.

Practice this question →

24

MCQeasy

A company runs a critical SAP application on AWS. The SAP team needs to reduce network latency between application servers and the database. Which AWS service should be used to achieve this?

A.Amazon Route 53

B.AWS Global Accelerator

C.VPC Peering

D.Placement Groups (cluster)

AnswerD

Cluster placement groups place instances in a single AZ with low-latency networking.

Why this answer

Placement Groups with a cluster placement strategy are designed to provide the lowest possible network latency and highest throughput by ensuring that EC2 instances are placed in a single Availability Zone with low-latency, high-bandwidth networking. For a critical SAP application where the application servers and database must communicate with minimal latency, a cluster placement group is the correct choice because it leverages non-blocking, fully bisectional bandwidth between instances, reducing network hops and jitter.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator (which improves latency for external users) with internal network optimization, or they assume VPC Peering provides performance benefits, when in fact only placement groups directly reduce latency between EC2 instances in the same Availability Zone.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 is a DNS and traffic routing service that does not reduce network latency between EC2 instances; it only resolves domain names to IP addresses. Option B is wrong because AWS Global Accelerator improves latency for global users by directing traffic to the nearest edge location, but it does not reduce latency between application servers and a database within the same AWS region or VPC. Option C is wrong because VPC Peering connects VPCs at the network layer but does not optimize or reduce latency between instances within the same VPC; it simply enables routing between separate VPCs without any performance guarantees.

Practice this question →

25

Multi-Selectmedium

Which THREE of the following are best practices for securing an SAP HANA database on AWS? (Choose 3.)

Select 3 answers

A.Assign a public IP address to the HANA instance for easy access

B.Disable the HANA password policy to simplify user access

C.Enable encryption at rest for EBS volumes attached to the HANA instance

D.Enable SAP HANA data encryption for data in transit and at rest

E.Use security groups to restrict inbound traffic to the HANA database

AnswersC, D, E

Encryption protects data at rest.

Why this answer

Encrypting EBS volumes at rest protects the underlying storage of the SAP HANA database from unauthorized physical access or snapshot theft. AWS KMS-managed keys or customer-managed keys can be used to enforce encryption for all data written to the EBS block devices, which is a fundamental security best practice for any sensitive workload on AWS.

Exam trap

The trap here is that candidates may think disabling password policies simplifies management (Option B) or that public IPs are needed for remote access (Option A), but the exam tests understanding that security hardening requires encryption, access restriction, and strong authentication, not convenience.

Practice this question →

26

MCQeasy

An SAP system administrator needs to ensure high availability for an SAP HANA database using AWS services. What is the recommended architecture?

A.Deploy SAP HANA on EC2 instances in a cluster across multiple Availability Zones with synchronous replication

B.Use Amazon RDS for SAP HANA with Multi-AZ deployment

C.Use Amazon RDS Multi-AZ for SAP HANA database

D.Deploy a single EC2 instance in one Availability Zone and take daily snapshots

AnswerA

SAP HANA can be deployed as a multi-node cluster using EC2 instances in different AZs with synchronous replication and automatic failover using cluster software like Pacemaker.

Why this answer

SAP HANA can be deployed as a multi-node cluster using EC2 instances in different Availability Zones with synchronous replication and automatic failover using cluster software like Pacemaker. RDS does not support SAP HANA. A single EC2 instance in one AZ is not highly available.

Multi-AZ RDS is for other databases, not SAP HANA.

Practice this question →

27

Multi-Selecthard

Which TWO AWS services can be used to monitor the health and performance of an SAP HANA database on AWS?

Select 2 answers

A.AWS Trusted Advisor

B.Amazon CloudWatch

C.AWS Config

D.SAP HANA monitoring tools (e.g., HANA cockpit)

E.VPC Flow Logs

AnswersB, D

CloudWatch can monitor metrics and logs from HANA.

Why this answer

Amazon CloudWatch (option B) can monitor OS-level metrics and custom metrics from SAP HANA via the CloudWatch agent or API. SAP HANA monitoring tools like HANA cockpit (option D) provide built-in health and performance monitoring. AWS Trusted Advisor (option A) offers best-practice recommendations, not real-time monitoring.

AWS Config (option C) tracks resource configuration changes. VPC Flow Logs (option E) capture network traffic metadata.

Practice this question →

28

MCQhard

An SAP system running on AWS is experiencing intermittent connectivity issues between the SAP application servers and the database server. Both are in the same VPC but different subnets. The security groups and network ACLs are correctly configured. The issue occurs only during peak hours. Which of the following is the most likely cause?

A.Security group outbound rules are blocking return traffic.

B.The VPC peering connection is throttling traffic.

C.Network ACLs do not have rules to allow ephemeral ports for return traffic.

D.Security group inbound rules are misconfigured.

AnswerC

NACLs are stateless; failing to allow ephemeral ports can cause intermittent connectivity during high traffic.

Why this answer

The intermittent connectivity issue during peak hours points to a resource exhaustion problem. Network ACLs are stateless, meaning they must explicitly allow both inbound and outbound traffic, including ephemeral ports (typically 1024-65535) used for return traffic. If the NACL outbound rules do not allow these ephemeral ports, return traffic from the database server to the application server will be dropped, especially under high load when many connections are established simultaneously.

Exam trap

The trap here is that candidates often confuse the stateless nature of network ACLs with the stateful behavior of security groups, assuming that allowing inbound traffic automatically permits return traffic, which is not the case for NACLs.

How to eliminate wrong answers

Option A is wrong because security group outbound rules are stateful; if outbound rules were blocking return traffic, the issue would be persistent, not intermittent, and security groups automatically allow return traffic for allowed inbound connections. Option B is wrong because the question states both servers are in the same VPC, so no VPC peering connection is involved; VPC peering throttling would only apply to cross-VPC traffic. Option D is wrong because security group inbound rules are stateful and correctly configured per the question; misconfigured inbound rules would cause a persistent failure, not an intermittent one during peak hours.

Practice this question →

29

MCQeasy

A company is planning to migrate its SAP HANA database to AWS. The database size is 3 TB, and they need high I/O performance with low latency. The SAP workload is critical and requires high availability. Which AWS storage solution should they choose for the HANA data volume?

A.Amazon EBS gp3 volumes.

B.EC2 Instance Store volumes.

C.Amazon EFS with Provisioned Throughput.

D.Amazon EBS io2 Block Express volumes.

AnswerD

io2 Block Express offers high performance, low latency, and high durability, making it ideal for SAP HANA.

Why this answer

AWS strongly recommends using Amazon EBS io2 Block Express volumes for SAP HANA data volumes due to their high performance, low latency, and high durability, which meet SAP's critical workload and high availability requirements. Option A (EBS gp3) is cost-effective but may not provide the consistent low latency required for SAP HANA. Option B (EC2 Instance Store) offers low latency but is ephemeral and does not provide data persistence, making it unsuitable for database data.

Option C (EFS with Provisioned Throughput) is a file system, not block storage, and is not supported for SAP HANA data volumes.

Practice this question →

30

MCQhard

An SAP administrator runs the AWS CLI command shown in the exhibit. The SAP HANA instance is running on an r5.4xlarge in us-east-1a. The administrator wants to change the instance type to r5.8xlarge to improve performance. What must the administrator do first?

A.Create an AMI of the instance and launch a new instance with the larger type.

B.Detach the EBS volumes and attach them to a new instance.

C.Stop the instance from the AWS Management Console.

D.Modify the instance type in the instance settings while it is running.

AnswerC

Instance must be stopped to modify instance type.

Why this answer

To change the instance type of an EC2 instance, the instance must first be stopped. While stopped, you can modify the instance type via the AWS Management Console, CLI, or SDK. After the instance is stopped, the administrator can change the type from r5.4xlarge to r5.8xlarge and then start the instance again.

Exam trap

The trap here is that candidates may think the instance type can be changed while running (Option D) because some instance attributes can be modified on the fly, but the instance type specifically requires the instance to be stopped.

How to eliminate wrong answers

Option A is wrong because creating an AMI and launching a new instance is unnecessary and more disruptive; the instance type can be changed directly on a stopped instance without rebuilding from an AMI. Option B is wrong because detaching EBS volumes and attaching them to a new instance is overly complex and not required; the instance type change does not affect the attached EBS volumes. Option D is wrong because the instance type cannot be modified while the instance is running; the instance must be in the 'stopped' state to change the instance type.

Practice this question →

31

MCQhard

An SAP environment on AWS uses Amazon FSx for NetApp ONTAP for shared storage. The system is experiencing high write latency. The storage administrator suspects the volume is not optimized for SAP workloads. Which configuration change would most likely reduce write latency?

A.Enable data compression on the volume.

B.Enable tiering policy to allow all data to be served from the SSD tier.

C.Enable the capacity pool tiering to auto-tier cold data to Amazon S3.

D.Increase the size of the volume.

AnswerB

Moving data to SSD tier reduces latency compared to HDD.

Why this answer

Enabling the tiering policy to allow all data to be served from the SSD tier ensures that all volume data resides on the high-performance SSD storage pool of the FSx for ONTAP file system. This eliminates read/write latency caused by accessing data from the capacity pool (Amazon S3), which has higher latency. For SAP workloads that require consistent low-latency I/O, keeping all data on the SSD tier is critical to reduce write latency.

Exam trap

The trap here is that candidates may confuse tiering policies with performance optimization, thinking that moving cold data to S3 (Option C) improves performance, when in fact it increases latency for any data that is accessed after being tiered, and does not reduce write latency for active SAP workloads.

How to eliminate wrong answers

Option A is wrong because data compression reduces storage space but adds CPU overhead for compression/decompression, which can increase write latency rather than reduce it. Option C is wrong because enabling auto-tiering to move cold data to Amazon S3 would move some data to the capacity pool, increasing latency when that data is accessed, and does not address write latency for active SAP data. Option D is wrong because increasing the volume size does not inherently improve performance; it only provides more capacity, and write latency is determined by the underlying storage tier and configuration, not volume size.

Practice this question →

32

MCQhard

A customer runs SAP HANA on an AWS Multi-AZ deployment with a primary and secondary instance. They want to ensure automatic failover in case of instance failure. What is the recommended approach?

A.Implement SAP HANA System Replication in a multi-AZ configuration with automatic failover using AWS services.

B.Set up a Route 53 health check to redirect traffic to the secondary instance manually.

C.Use Amazon RDS for SAP HANA with Multi-AZ enabled.

D.Configure an Auto Scaling group with a lifecycle hook to launch a new HANA instance.

AnswerA

HANA System Replication with automatic failover is the recommended method.

Why this answer

SAP HANA System Replication (HSR) in a multi-AZ configuration, combined with AWS services like Amazon Route 53 health checks and custom scripts for automatic failover, provides the recommended approach for ensuring automatic failover upon instance failure. HSR replicates data synchronously or asynchronously between primary and secondary HANA instances, and when integrated with AWS, you can automate the failover process without manual intervention, meeting the requirement for high availability.

Exam trap

The trap here is that candidates may assume Amazon RDS supports SAP HANA because RDS offers Multi-AZ for other databases, but SAP HANA is not a supported RDS engine, and the correct approach involves native SAP HANA replication with AWS infrastructure automation.

How to eliminate wrong answers

Option B is wrong because Route 53 health checks can only redirect traffic based on endpoint health, but they do not perform the actual failover of the SAP HANA database; manual intervention is still required to promote the secondary instance, which contradicts the requirement for automatic failover. Option C is wrong because Amazon RDS does not support SAP HANA as a database engine; RDS supports engines like MySQL, PostgreSQL, Oracle, and SQL Server, but not SAP HANA, making this option technically invalid. Option D is wrong because Auto Scaling groups are designed to launch new EC2 instances based on scaling policies, but they do not handle the complex stateful failover of SAP HANA, such as promoting a secondary instance or ensuring data consistency, and lifecycle hooks cannot automate the HANA replication promotion process.

Practice this question →

33

MCQeasy

A company runs its SAP system on AWS and uses a Multi-AZ RDS for Oracle database for the SAP Central Services (SCS) instance. The SCS instance is currently on a single EC2 instance in one Availability Zone. The company wants to ensure high availability for the SCS service. What should they do?

A.Implement an SAP ASCS/ERS cluster using two EC2 instances and a shared file system.

B.Place the SCS instance on a larger EC2 instance and use EBS snapshots for recovery.

C.Use an Application Load Balancer to distribute traffic to multiple SCS instances.

D.Configure the SCS instance on the existing RDS for Oracle database.

AnswerA

This is the standard HA setup for SAP Central Services on AWS.

Why this answer

SAP Central Services (SCS) can be made highly available by implementing an SAP ASCS/ERS cluster using two EC2 instances and a shared file system (such as Amazon FSx for Windows or EBS Multi-Attach) with a floating IP. This provides automatic failover in case of instance or AZ failure. Option B is incorrect because placing the SCS on a larger EC2 instance with EBS snapshots does not provide high availability; it only offers data backup and recovery, not automatic failover.

Option C is incorrect because an Application Load Balancer is designed for HTTP/HTTPS traffic and cannot handle SAP-specific protocols used by SCS. Option D is incorrect because the RDS for Oracle database is used for the SAP database, not for the SCS instance; the SCS requires its own file system and cannot run on RDS.

Practice this question →

34

Multi-Selecthard

An SAP system running on AWS is experiencing high latency in the application layer. The system uses a load balancer to distribute traffic across multiple EC2 instances. Which THREE actions could help diagnose the latency issue? (Choose THREE.)

Select 3 answers

A.Monitor the EC2 instance CPU and memory utilization using Amazon CloudWatch metrics.

B.Check AWS Config rules for any non-compliant resources.

C.Use Amazon CloudWatch detailed monitoring to get 1-minute metrics for EC2 instances.

D.Enable and analyze the Application Load Balancer access logs to identify slow requests.

E.Review VPC Flow Logs to check for packet loss or throttling.

AnswersA, C, D

High CPU/memory can cause latency.

Why this answer

High application-layer latency in an SAP system on AWS can stem from insufficient CPU or memory resources on the EC2 instances. Amazon CloudWatch metrics for CPU utilization and memory utilization (via the CloudWatch agent) directly reveal whether the instances are resource-constrained, which is a common cause of slow request processing. Monitoring these metrics helps isolate whether the latency is due to compute bottlenecks rather than network or load balancer issues.

Exam trap

The trap here is that candidates may confuse VPC Flow Logs (which show network metadata) with tools that measure actual packet loss or throttling, but Flow Logs only record whether packets were accepted or rejected by security groups/NACLs, not performance metrics like latency or throughput.

Practice this question →

35

MCQmedium

A company runs an SAP HANA system on AWS. The system uses a three-node cluster with HANA System Replication (HSR) in a scale-out configuration. The cluster spans three Availability Zones. Which architecture ensures the highest availability for the SAP HANA database?

A.Use a cluster of nodes across three Availability Zones with HANA System Replication and automatic failover.

B.Configure HANA System Replication in active/active mode across all nodes.

C.Use Amazon RDS for SAP HANA with Multi-AZ deployment.

D.Deploy all nodes in a single Availability Zone with synchronous replication.

AnswerA

B is correct: multi-AZ with HSR provides high availability.

Why this answer

Deploying a three-node cluster across three Availability Zones with HANA System Replication and automatic failover maximizes availability by distributing the data across multiple AZs and ensuring automatic failover in case of an AZ failure. Option B is incorrect because HANA System Replication in active/active mode is not supported for scale-out configurations; typical HSR implementations use active/standby or multi-target replication. Option C is incorrect because Amazon RDS for SAP HANA does not exist; SAP HANA on AWS must be deployed on EC2 instances.

Option D is incorrect because deploying all nodes in a single Availability Zone introduces a single point of failure, reducing availability compared to a multi-AZ deployment.

Practice this question →

36

Matchingmedium

Match the AWS managed service to its SAP-related capability.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Track SAP license usage and compliance

Patch management and automation for SAP instances

Monitoring SAP metrics and logs

Best practice checks for SAP on AWS

Why these pairings

Correct matches: Amazon EFS for shared file storage, Amazon FSx for Windows File Server for SMB storage, Amazon Route 53 for DNS, Amazon CloudWatch for monitoring. Common confusions include mistaking EFS for block storage and FSx for Lustre for SAP HANA.

Practice this question →

37

MCQhard

A company is designing an SAP HANA disaster recovery solution across AWS Regions. The primary site is in us-east-1 and the DR site is in us-west-2. The database size is 5 TB. The RTO is 1 hour and RPO is 15 minutes. Which method should be used for SAP HANA replication?

A.Use AWS Database Migration Service (DMS) to continuously replicate changes.

B.Configure SAP HANA System Replication in synchronous mode between the two regions.

C.Use AWS Backup to copy EBS snapshots to the DR region every 15 minutes.

D.Configure SAP HANA System Replication in asynchronous mode to the DR region.

AnswerD

Asynchronous replication allows cross-region replication with acceptable RPO.

Why this answer

SAP HANA System Replication with asynchronous mode can replicate across regions with RPO of seconds to minutes. Option A is wrong because AWS DMS does not support SAP HANA as a target database. Option B is wrong because synchronous mode over long distances introduces high latency and is not feasible for cross-region replication.

Option C is wrong because EBS snapshots alone cannot achieve a 15-minute RPO due to snapshot frequency limits and longer recovery time.

Practice this question →

38

Multi-Selecteasy

Which TWO AWS services can be used to monitor the performance of an SAP HANA database running on EC2? (Choose two.)

Select 2 answers

A.AWS Systems Manager

B.AWS CloudTrail

C.AWS Trusted Advisor

D.AWS Config

E.Amazon CloudWatch

AnswersA, E

Systems Manager can collect OS and application metrics.

Why this answer

AWS Systems Manager (SSM) is correct because it provides the Run Command and Inventory features that can execute scripts (e.g., SAP HANA SQL queries) and collect OS-level metrics (CPU, memory, disk) from EC2 instances. Amazon CloudWatch is correct because it can ingest custom metrics from the SAP HANA database (e.g., via the SAP HANA plugin for CloudWatch Agent) and monitor standard EC2 metrics like CPU utilization and memory, enabling performance monitoring and alarming.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with CloudWatch (monitoring), or assume AWS Config can monitor performance because it tracks resource state, but neither provides the real-time metric collection needed for SAP HANA performance monitoring.

Practice this question →

39

MCQeasy

An SAP administrator needs to ensure that all changes to an SAP system's AWS resources are tracked and that alerts are sent when SSH access to EC2 instances is modified. Which AWS service should be used?

A.AWS Config

B.Amazon CloudWatch

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerD

Records API calls for auditing.

Why this answer

AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure, including changes to EC2 security groups that control SSH access. By enabling CloudTrail, you can monitor for events like AuthorizeSecurityGroupIngress and trigger alerts via CloudWatch Events or Lambda when SSH (port 22) rules are modified, meeting the audit and alerting requirements.

Exam trap

A common trap in AWS SAP on AWS Specialty exams is confusing AWS Config (which tracks configuration state and compliance) with AWS CloudTrail (which records API calls). This question specifically requires tracking API modifications (e.g., changes to security group rules for SSH) and sending alerts, which is a CloudTrail capability, not just configuration compliance.

How to eliminate wrong answers

Option A is wrong because AWS Config evaluates resource configurations against desired rules and can detect drift, but it does not natively track real-time API calls or send alerts for specific SSH modifications; it focuses on configuration compliance, not event-driven monitoring. Option B is wrong because Amazon CloudWatch monitors performance metrics and logs, but it cannot directly track API-level changes to EC2 security groups unless CloudTrail logs are streamed to it; it is a downstream consumer, not the primary tracking service. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations (e.g., security groups open to 0.0.0.0/0) but does not track or alert on individual API modifications to SSH rules.

Practice this question →

40

MCQeasy

A company is designing a multi-tier web application on AWS. The web tier must scale based on CPU utilization, and the application tier must scale based on request count. Both tiers are deployed in a VPC with public and private subnets. Which combination of AWS services should the company use?

A.Application Load Balancer for the web tier and Network Load Balancer for the application tier

B.Classic Load Balancer for both tiers

C.Network Load Balancer for the web tier and Application Load Balancer for the application tier

D.Amazon API Gateway for the web tier and Application Load Balancer for the application tier

AnswerA

This is a standard architecture: ALB handles HTTP/HTTPS traffic and can scale based on CPU; NLB handles TCP traffic and can scale based on request count.

Why this answer

The web tier requires an Application Load Balancer (ALB) to distribute HTTP/HTTPS traffic and can scale based on CPU utilization using an Auto Scaling group with a target tracking policy. The application tier needs a Network Load Balancer (NLB) to handle high request counts at the transport layer (TCP/UDP), which is ideal for scaling based on request count per target. This combination allows each tier to use the most appropriate load balancer for its scaling metric and protocol requirements.

Exam trap

The trap here is that candidates often assume the web tier should use an NLB for high performance, but the ALB is required for HTTP/HTTPS traffic and CPU-based scaling, while the NLB is better suited for the application tier when scaling based on request count at the transport layer.

How to eliminate wrong answers

Option B is wrong because the Classic Load Balancer (CLB) is a legacy service that does not support advanced routing or scaling based on request count per target, and it lacks the granularity needed for separate tier scaling. Option C is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot inspect HTTP/HTTPS headers or route based on CPU utilization metrics, making it unsuitable for the web tier. Option D is wrong because Amazon API Gateway is a serverless API management service, not a load balancer, and it cannot directly integrate with Auto Scaling groups for CPU-based scaling of EC2 instances in a web tier.

Practice this question →

41

MCQeasy

An SAP administrator needs to ensure that the SAP landscape on AWS is compliant with the SAP license requirements. What is the responsibility of the customer regarding SAP licensing on AWS?

A.AWS provides SAP licenses as part of the EC2 instance pricing

B.The customer must bring their own SAP licenses and ensure compliance with SAP licensing terms

C.SAP licensing is automatically handled by AWS Support

D.SAP licenses are included when using SAP HANA on AWS

AnswerB

Customers are responsible for their own SAP licenses and compliance with SAP's licensing policies.

Why this answer

Customers are responsible for bringing their own SAP licenses and ensuring compliance with SAP licensing terms. AWS does not provide SAP licenses. AWS provides the infrastructure.

SAP licensing is not automatically covered by AWS Support.

Practice this question →

42

MCQeasy

An SAP administrator needs to ensure that an Amazon RDS for SAP ASE database is automatically backed up daily and the backups are retained for 30 days. The database is currently in a Multi-AZ deployment. What is the simplest way to achieve this?

A.Create a manual snapshot every day using AWS Backup.

B.Enable Multi-AZ, which automatically backs up the database.

C.Configure automated backups with a retention period of 30 days in the RDS instance settings.

D.Set up a scheduled Lambda function to create snapshots.

AnswerC

Configuring automated backups in the Amazon RDS instance settings with a retention period of 30 days automatically creates daily backups and retains them for 30 days, meeting the requirement with minimal effort.

Why this answer

The simplest way to achieve daily automated backups with 30-day retention is to configure automated backups directly in the Amazon RDS instance settings. By setting the backup retention period to 30 days, RDS will automatically take daily snapshots and retain them for 30 days without any additional configuration. Option A is incorrect because manual snapshots are not automated and would require manual intervention.

Option B is incorrect because while Multi-AZ provides high availability, it does not automatically create backups; backups are a separate feature. Option D is incorrect because using a scheduled Lambda function adds unnecessary complexity when the built-in automated backup feature is simpler and sufficient.

Practice this question →

43

MCQhard

The exhibit shows the block device mapping of an EC2 instance running SAP HANA. The root volume (/dev/xvda) has DeleteOnTermination set to true, and the data volume (/dev/sdf) has DeleteOnTermination set to false. If the instance is terminated, what happens to the data volume?

A.Only the data volume is deleted; the root volume remains.

B.Both volumes are detached and moved to Amazon S3.

C.Both volumes are deleted.

D.Only the root volume is deleted; the data volume remains.

AnswerD

The data volume's DeleteOnTermination is false, so it persists.

Why this answer

The DeleteOnTermination attribute controls whether a volume is deleted when its associated EC2 instance is terminated. For the root volume (/dev/xvda), this attribute is set to true, so it will be deleted upon termination. For the data volume (/dev/sdf), it is set to false, meaning the volume will be detached from the instance and preserved in your AWS account, allowing you to reattach it to another instance or take snapshots.

Therefore, only the root volume is deleted, and the data volume remains.

Exam trap

The trap here is that candidates often assume all volumes attached to an instance are deleted on termination, ignoring the specific DeleteOnTermination flag, or they confuse the behavior with instance store volumes which are always ephemeral.

How to eliminate wrong answers

Option A is wrong because it reverses the behavior: the root volume (with DeleteOnTermination=true) is deleted, not the data volume. Option B is wrong because volumes are not moved to Amazon S3; they remain as EBS volumes in the same Availability Zone, and termination does not trigger any S3 transfer. Option C is wrong because the data volume has DeleteOnTermination set to false, so it is not deleted; only the root volume is deleted.

Practice this question →

44

MCQhard

A company is running SAP HANA on an EC2 instance with multiple EBS volumes for data and log. The instance is experiencing high write latency on the log volume. The administrator notices that the log volume is a gp2 EBS volume with 1,000 GB size and 3,000 IOPS baseline. The average write IOPS to the log volume is 4,000, with peaks up to 5,500. Which action should the administrator take to resolve the latency?

A.Replace the gp2 volume with an io2 Block Express volume provisioned at 6,000 IOPS.

B.Change the volume type to st1 (throughput optimized) to improve throughput.

C.Add a second log volume and stripe them using LVM.

D.Increase the gp2 volume size to 2,000 GB to double the baseline IOPS.

AnswerA

io2 Block Express provides consistent low latency and high IOPS.

Why this answer

The gp2 volume's baseline IOPS is 3,000, but the log volume requires an average of 4,000 write IOPS with peaks up to 5,500, which exceeds the burst balance, causing latency. Replacing with an io2 Block Express volume provisioned at 6,000 IOPS provides consistent high IOPS and low latency, ideal for SAP HANA log volumes. Option B is incorrect because st1 volumes are throughput-optimized, not IOPS-optimized, and would not address the IOPS bottleneck.

Option C is incorrect because striping additional gp2 volumes adds complexity and still relies on burst performance, which may not sustain the required IOPS. Option D is incorrect because while increasing gp2 size to 2,000 GB doubles baseline IOPS to 6,000, gp2 still uses a burst model; if the burst balance is depleted, latency can occur. io2 Block Express provides provisioned, consistent performance without bursting.

Practice this question →

45

Multi-Selectmedium

An SAP Basis administrator is planning to migrate an SAP NetWeaver system from on-premises to AWS. The system uses a proprietary storage backend for the transport directory. Which AWS storage options are suitable for the SAP transport directory to provide shared access across multiple EC2 instances? (Choose TWO.)

Select 2 answers

A.Amazon FSx for Lustre

B.EC2 instance store

C.Amazon EBS with multi-attach

D.Amazon EFS

E.Amazon S3

AnswersA, D

FSx for Lustre provides high-performance shared storage suitable for SAP transport directories.

Why this answer

Amazon EFS provides a shared file system accessible from multiple Linux instances. Amazon FSx for Lustre is a high-performance file system for HPC and can be used for SAP transport directories if performance is critical. S3 is object storage, not a file system.

EBS can only be attached to one instance at a time (except multi-attach which is limited). Instance store is ephemeral.

Practice this question →

46

MCQmedium

An SAP Basis administrator needs to monitor the performance of their SAP HANA database running on an EC2 instance. The administrator wants to visualize key metrics such as CPU utilization, memory usage, and disk I/O in a single dashboard. Which AWS service should be used to create this dashboard?

A.Amazon CloudWatch Dashboards

B.AWS Config

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerA

CloudWatch Dashboards visualize metrics from multiple sources.

Why this answer

Amazon CloudWatch Dashboards is the correct service because it allows you to create custom, single-pane-of-glass views that aggregate metrics from multiple sources, including EC2 instances. For SAP HANA on EC2, you can pull CPU utilization, memory usage, and disk I/O metrics from CloudWatch (enabled via the CloudWatch Agent or EC2 detailed monitoring) and display them together on one dashboard for real-time performance monitoring.

Exam trap

The trap here is that candidates may confuse AWS Config or CloudTrail with monitoring services, but neither provides real-time metric visualization; CloudWatch Dashboards is the only service designed for aggregating and displaying live performance data in a customizable view.

How to eliminate wrong answers

Option B (AWS Config) is wrong because it is a service for evaluating, auditing, and recording configuration changes of AWS resources, not for visualizing real-time performance metrics like CPU, memory, or disk I/O. Option C (AWS Trusted Advisor) is wrong because it provides best-practice recommendations for cost optimization, security, fault tolerance, and performance limits, but it does not offer customizable dashboards for live metric visualization. Option D (AWS CloudTrail) is wrong because it records API activity and user actions for auditing and governance, not for monitoring system-level performance metrics such as CPU utilization or disk I/O.

Practice this question →

47

MCQmedium

An SAP Basis administrator is troubleshooting a performance issue on an SAP NetWeaver application server running on Amazon EC2. The administrator notices that the CPU utilization is low but the application response times are high. The system is using an Amazon EBS gp2 volume. Which configuration change is most likely to improve performance?

A.Increase the IOPS of the EBS gp2 volume or switch to io1.

B.Change the EBS volume to instance store.

C.Move the EC2 instance to a larger instance family.

D.Increase the number of vCPUs on the EC2 instance.

AnswerA

Higher IOPS improves disk throughput, reducing I/O wait.

Why this answer

Low CPU utilization with high application response times on an SAP NetWeaver server indicates that the bottleneck is I/O latency, not compute capacity. Amazon EBS gp2 volumes have a baseline IOPS performance that scales with volume size, and if the volume is small or the workload exceeds the burst balance, throughput can be throttled. Increasing the IOPS (by resizing the gp2 volume or switching to io1/io2 with provisioned IOPS) directly addresses the I/O bottleneck, reducing latency and improving application response times.

Exam trap

The trap here is that candidates assume low CPU utilization means the instance is underpowered, leading them to choose a larger instance or more vCPUs, when in fact the symptom points to an I/O bottleneck that requires increasing EBS IOPS or switching to a provisioned IOPS volume.

How to eliminate wrong answers

Option B is wrong because instance store volumes are ephemeral and provide only temporary, block-level storage that is not persistent; they are unsuitable for SAP databases or critical application data that require durability and snapshot capabilities. Option C is wrong because moving to a larger instance family increases CPU and memory resources, but the problem is low CPU utilization, indicating the bottleneck is I/O, not compute. Option D is wrong because increasing the number of vCPUs does not resolve I/O latency; the issue is storage throughput, not processing power.

Practice this question →

48

Multi-Selectmedium

A company is deploying SAP NetWeaver on AWS and needs to configure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The solution must use AWS native services. Which TWO actions should be taken?

Select 2 answers

A.Associate an Elastic IP address with the active ASCS instance using a script.

B.Place an Application Load Balancer in front of the ASCS instances.

C.Set up AWS Direct Connect for redundant connectivity.

D.Deploy AWS Global Accelerator for failover.

E.Use Amazon Route 53 with health checks and failover routing policy.

AnswersA, E

Elastic IP can be moved during failover to provide a stable endpoint.

Why this answer

An Elastic IP address can be programmatically reassigned to the standby ASCS instance using a script (e.g., AWS CLI or custom automation) during a failover event. This provides a stable virtual IP address that clients use to connect to the active ASCS, meeting the high availability requirement without relying on a load balancer, which is not suitable for SAP Central Services due to its stateful nature and the need for a fixed IP address.

Exam trap

The trap here is that candidates often assume a load balancer (like ALB) is the standard AWS high availability solution, but for stateful SAP services requiring a fixed IP address, Elastic IP reassignment is the correct AWS-native approach, not a load balancer.

Practice this question →

49

Multi-Selectmedium

A company runs its SAP HANA database on a single EC2 instance with EBS storage. The database is critical and the company needs to ensure data durability and recoverability in case of a disaster. Which TWO actions should the company take?

Select 2 answers

A.Enable Multi-AZ deployment for the HANA database on RDS.

B.Take periodic EBS snapshots and copy them to another region.

C.Configure automated backups of the HANA database to Amazon S3.

D.Use Cross-Region Replication for the EBS volumes.

E.Set up HANA System Replication to a secondary instance in a different Availability Zone.

AnswersB, C

Correct. Periodic EBS snapshots copied to another region provide cross-region backup for disaster recovery and ensure data durability.

Why this answer

Taking periodic EBS snapshots and copying them to another region provides cross-region disaster recovery and data durability. Option C is correct: backing up the HANA database to Amazon S3 provides durable, off-site storage. Option A is incorrect because the database runs on EC2, not RDS, so Multi-AZ for RDS is not applicable.

Option D is incorrect because Cross-Region Replication is for S3 buckets, not EBS volumes. Option E is incorrect because HANA System Replication to a different AZ provides high availability within a region, but does not protect against regional disasters; it is not sufficient for disaster recovery.

Practice this question →

50

MCQhard

An SAP ERP system on AWS is experiencing intermittent connectivity issues between the SAP application servers and the database server. Both are in the same VPC, but in different subnets. The security group for the database allows traffic from the application security group. Network ACLs are default (allow all). Despite this, some application servers cannot connect during peak loads. What is the most likely cause?

A.The security group inbound rule for the database has reached its rule evaluation limit.

B.The connection tracking table for the database security group is full, dropping new connections.

C.The application servers are using a single NAT Gateway for outbound traffic, causing a bottleneck.

D.The database is accessed through a VPC Endpoint, which is rate-limiting connections.

AnswerB

Security groups maintain connection tracking; when the table fills, new connections are dropped until old ones expire.

Why this answer

AWS security groups are stateful and track connections. Under peak loads, the connection tracking table can become full, causing new connections to be dropped. Option A is wrong because security groups do not have a rule evaluation limit; they evaluate all rules.

Option C is wrong because a NAT Gateway is used for outbound internet traffic, not for internal VPC communication. Option D is wrong because VPC Endpoints are used for accessing AWS services privately, not for database connectivity.

Practice this question →

51

MCQeasy

An SAP administrator is configuring backups for an SAP HANA database running on Amazon EC2. The backup must be stored in Amazon S3 for long-term retention. Which AWS service should be used to automate the backup process?

A.AWS Backup

B.Amazon S3 Lifecycle policies

C.AWS Lambda

D.Amazon EBS Snapshots

AnswerA

AWS Backup can orchestrate HANA backups with pre/post scripts.

Why this answer

AWS Backup is the correct choice because it provides a fully managed, policy-driven backup service that can automate and centralize backups for SAP HANA databases running on Amazon EC2. It integrates natively with SAP HANA using Backint agents, enabling automated, consistent, and application-aware backups directly to Amazon S3 for long-term retention without custom scripting.

Exam trap

The trap here is that candidates often confuse AWS Backup with Amazon S3 Lifecycle policies, thinking that lifecycle rules alone can automate database backups, but lifecycle policies only manage existing S3 objects and cannot initiate the backup process from SAP HANA.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Lifecycle policies manage object transitions and expiration within S3 itself, but they do not automate the backup process from an SAP HANA database; they only act on objects already in S3. Option C is wrong because AWS Lambda can be used to trigger backup scripts, but it is not a managed backup service and requires custom code, error handling, and orchestration, making it less reliable and more complex than AWS Backup. Option D is wrong because Amazon EBS Snapshots capture block-level data of EC2 instance volumes, but they are not application-consistent for SAP HANA without additional quiescing steps, and they do not natively support SAP HANA's Backint interface for database-aware backups.

Practice this question →

52

MCQhard

A company is running SAP on AWS and wants to implement encryption at rest for all data. The company uses AWS KMS with Customer Managed Keys (CMKs) for the EBS volumes. The SAP application servers need to access an S3 bucket that contains sensitive data. How should the company ensure that the S3 bucket is encrypted with the same CMK?

A.Use client-side encryption before uploading to S3

B.Configure the S3 bucket to use SSE-KMS with the same CMK

C.Add a bucket policy that denies if encryption is not present

D.Enable default encryption on the S3 bucket with SSE-S3

AnswerB

SSE-KMS allows specifying a particular CMK.

Why this answer

SSE-KMS (Server-Side Encryption with AWS KMS) allows you to specify a Customer Managed Key (CMK) to encrypt objects in S3. By configuring the S3 bucket to use the same CMK that is already used for EBS volumes, the company ensures a unified encryption key strategy for all data at rest, meeting the requirement for consistent encryption across services.

Exam trap

The trap here is that candidates often confuse SSE-S3 (which uses an AWS-managed key) with SSE-KMS (which allows a customer-managed key), and assume that enabling default encryption with SSE-S3 satisfies the requirement to use the same CMK.

How to eliminate wrong answers

Option A is wrong because client-side encryption encrypts data before it is uploaded to S3, which does not use the same AWS KMS CMK for server-side encryption and introduces key management complexity outside of AWS KMS. Option C is wrong because a bucket policy that denies if encryption is not present only enforces that some form of encryption is applied, but does not specify or enforce the use of the same CMK; it could allow SSE-S3 or other keys. Option D is wrong because SSE-S3 uses an AWS-managed key, not a customer-managed CMK, so it cannot be the same key used for EBS volumes.

Practice this question →

53

MCQmedium

An SAP Basis team is planning to migrate an SAP ERP system from on-premises to AWS. The system currently uses Oracle Database and runs on a physical server with 256 GB RAM. The team wants to minimize downtime and ensure the migration is supported by SAP. Which AWS service or feature should they use to perform the migration?

A.Use AWS VM Import/Export to migrate the physical server as an AMI.

B.Use AWS CloudEndure Migration to replicate the entire server to AWS.

C.Use AWS Database Migration Service (DMS) to replicate the Oracle database to Amazon RDS for Oracle.

D.Use SAP's Software Provisioning Manager (SWPM) to perform a homogeneous system copy to AWS.

AnswerD

SWPM is the SAP-recommended tool for system copy and migration.

Why this answer

SAP explicitly supports homogeneous system copies using Software Provisioning Manager (SWPM) for migrating SAP systems to AWS. This method allows the team to perform a database-level export/import while keeping the same operating system and database platform (Oracle), minimizing downtime by using SAP's validated tools and processes. AWS provides no native service that is SAP-certified for this specific migration scenario, making SWPM the only supported approach.

Exam trap

The trap here is that candidates often assume AWS-native migration services like DMS or CloudEndure are universally applicable, but SAP has strict certification requirements that exclude these tools for homogeneous system copies, making SWPM the only correct choice despite its manual nature.

How to eliminate wrong answers

Option A is wrong because AWS VM Import/Export converts physical servers into AMIs, but this process is not supported by SAP for production SAP systems and does not handle SAP-specific licensing, kernel parameters, or database consistency requirements. Option B is wrong because AWS CloudEndure Migration replicates entire servers at the block level, but it is not certified by SAP for migrating SAP systems and can cause database inconsistencies or unsupported configurations. Option C is wrong because AWS Database Migration Service (DMS) is designed for heterogeneous migrations (e.g., Oracle to Amazon RDS for Oracle) but does not support homogeneous system copies where the target database remains Oracle on EC2; additionally, DMS is not SAP-certified for migrating SAP ERP databases.

Practice this question →

54

MCQmedium

An SAP workload on AWS uses a Multi-AZ RDS for Oracle instance for its database. The application team reports that a recent batch job caused a spike in database connections and CPU utilization, leading to performance degradation. The database administrator wants to be notified when CPU utilization exceeds 80% for 5 minutes. Which combination of AWS services should be used to set up this monitoring and notification?

A.Amazon EventBridge with AWS Lambda

B.AWS Trusted Advisor with Amazon Simple Email Service (SES)

C.Amazon CloudWatch with an Amazon CloudWatch Alarm and Amazon SNS

D.Amazon Inspector with Amazon Simple Notification Service (SNS)

AnswerC

Amazon CloudWatch can monitor the CPU utilization metric of the RDS instance. A CloudWatch alarm can be configured to trigger when CPU utilization exceeds 80% for 5 consecutive periods (each period is 1 minute by default), and the alarm can publish to an Amazon SNS topic to send notifications.

Why this answer

Amazon CloudWatch can monitor the CPU utilization metric of the RDS instance. A CloudWatch alarm can be configured to trigger when CPU utilization exceeds 80% for 5 consecutive periods (each period is 1 minute by default), and the alarm can publish to an Amazon SNS topic to send notifications. Option A is incorrect because Amazon EventBridge with AWS Lambda would require custom code and is not the simplest monitoring solution for this use case.

Option B is incorrect because AWS Trusted Advisor provides best practice checks and recommendations, not real-time metric monitoring and alerting. Option D is incorrect because Amazon Inspector is a security assessment service that scans for vulnerabilities, not a monitoring and notification service for metrics.

Practice this question →

55

MCQmedium

A company runs a production web application on AWS using an Application Load Balancer (ALB) with a target group of EC2 instances in an Auto Scaling group. The application uses a custom Amazon Machine Image (AMI) that includes the web server and application code. The Auto Scaling group has a launch template that references the AMI. The company updates the application code weekly and creates a new AMI version. The operations team manually updates the launch template to reference the new AMI and then initiates an instance refresh. Recently, a misconfiguration caused the launch template to point to an old AMI after an instance refresh, resulting in a rollback of the application code. The company wants to automate the deployment process to ensure that new AMIs are deployed consistently and safely. Which solution meets these requirements?

A.Use EC2 Image Builder to create and test the new AMI, then use AWS CodePipeline to automatically update the launch template and perform a rolling instance refresh.

B.Use AWS CodePipeline to run a script that updates the launch template with the new AMI ID and triggers an instance refresh.

C.Use AWS CloudFormation with a custom resource that validates the AMI and updates the Auto Scaling group.

D.Use AWS CodeDeploy to deploy the application code directly to the existing instances, bypassing the AMI update.

AnswerA

EC2 Image Builder automates AMI creation and testing; CodePipeline orchestrates the deployment pipeline.

Why this answer

EC2 Image Builder automates the creation, testing, and validation of AMIs, ensuring only compliant images are produced. AWS CodePipeline can then automatically update the launch template with the new AMI ID and trigger a rolling instance refresh, eliminating manual steps and preventing misconfigurations like pointing to an old AMI.

Exam trap

The trap here is that candidates often choose a simpler automation option (like Option B) that updates the launch template but lacks the integrated AMI creation and testing pipeline, failing to address the root cause of deploying an untested or incorrect AMI.

How to eliminate wrong answers

Option B is wrong because it only runs a script to update the launch template and trigger an instance refresh, but lacks the automated AMI creation and testing pipeline, so it does not prevent deployment of untested or incorrect AMIs. Option C is wrong because AWS CloudFormation custom resources can validate AMIs but do not natively automate the full AMI build, test, and deployment lifecycle; they also add complexity and potential for custom resource failures. Option D is wrong because it bypasses the AMI update entirely, which contradicts the requirement to deploy new AMIs consistently; CodeDeploy is designed for in-place or blue/green deployments of application code, not for managing AMI-based infrastructure updates.

Practice this question →

56

Multi-Selectmedium

Which TWO AWS services can be used to monitor SAP system performance and send alerts? (Choose two.)

Select 2 answers

A.AWS Config

B.Amazon CloudWatch

C.Amazon Inspector

D.AWS Lambda

E.AWS Trusted Advisor

AnswersB, D

CloudWatch monitors metrics and sends alarms.

Why this answer

Amazon CloudWatch is correct because it can monitor SAP system performance by collecting and tracking metrics such as CPU utilization, memory usage, and disk I/O from EC2 instances running SAP. It can also send alerts via CloudWatch Alarms when thresholds are breached, using actions like Amazon SNS notifications or Auto Scaling.

Exam trap

The trap here is that candidates may confuse AWS Config's configuration tracking with performance monitoring, or assume AWS Trusted Advisor's recommendations include real-time alerting, when in fact neither service provides the metric-based alerting required for SAP performance monitoring.

Practice this question →

57

Multi-Selectmedium

Which TWO of the following are best practices for securing an SAP HANA database on AWS? (Choose two.)

Select 2 answers

A.Deploy the HANA instance in a private subnet without direct internet access.

B.Disable SSL/TLS for client connections to improve performance.

C.Use a single Availability Zone to simplify network security group management.

D.Enable encryption at rest for the HANA data and log volumes using AWS KMS.

E.Assign a public IP address to the HANA instance for easy access from the internet.

AnswersA, D

Private subnet reduces attack surface.

Why this answer

Deploying the HANA instance in a private subnet without direct internet access ensures that the database is not exposed to the public internet, reducing the attack surface. This follows the AWS security best practice of using private subnets for sensitive workloads, with access only through bastion hosts or VPN/Direct Connect. It also aligns with SAP's own security recommendations for HANA deployments.

Exam trap

The trap here is that candidates may think disabling SSL/TLS improves performance (Option B) without recognizing that the performance gain is negligible compared to the catastrophic security risk, or they may incorrectly assume a public IP is acceptable for administrative access, overlooking the fundamental network isolation requirement for production databases.

Practice this question →

58

MCQmedium

An SAP environment on AWS consists of several EC2 instances running SAP NetWeaver and a separate HANA database instance. The system is using an Application Load Balancer (ALB) to distribute traffic to the web dispatchers. Recently, the ALB health checks are failing for one of the web dispatchers, causing it to be taken out of service. You investigate and find that the web dispatcher is running and can be reached directly via its private IP. The health check is configured to check the /sap/public/health endpoint. What is the most likely reason for the health check failure?

A.The security group for the web dispatcher does not allow traffic from the ALB.

B.The web dispatcher is configured to redirect HTTP requests to HTTPS, and the health check is using HTTP.

C.The web dispatcher instance is running out of memory, causing slow responses.

D.The web dispatcher has multiple IP addresses and the health check targets the wrong one.

AnswerB

A redirect response (3xx) is considered unhealthy by ALB; the health check should use HTTPS or the web dispatcher should not redirect.

Why this answer

The ALB health check expects a 200 OK response. If the web dispatcher is configured to redirect HTTP to HTTPS, the health check (which uses HTTP) receives a redirect (3xx) response instead of 200, causing the ALB to mark it as unhealthy. Option A is incorrect because if the security group blocked traffic from the ALB, direct access via private IP would also be blocked.

Option C is incorrect because slow responses would cause timeout, not a redirect. Option D is incorrect because a single instance typically has one IP address for the web dispatcher service.

Exam trap

A common trap is to think that a redirect (3xx) response is acceptable for health checks. ALB requires a 200 OK from the target. Any other response, including redirects, is considered unhealthy.

Practice this question →

59

MCQmedium

A company runs a critical SAP application on an SAP HANA database in a single Availability Zone on AWS. The database is 2 TB in size. The company needs to implement a disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The DR region must be in a different AWS Region. Which solution meets these requirements with the LEAST operational overhead?

A.Configure SAP HANA System Replication (HSR) in a multitier setup with a primary in the source region and a synchronous secondary in the DR region. Use HANA takeover for failover.

B.Use AWS Database Migration Service (DMS) to continuously replicate data from the HANA database to a HANA database in the DR region.

C.Deploy a second HANA node in a different Availability Zone in the same region and configure HANA System Replication. Use AWS Global Accelerator to route traffic to the standby.

D.Use AWS Backup to schedule daily snapshots of the HANA database and copy them to the DR region. In the event of a disaster, restore the latest snapshot to a new HANA instance.

AnswerB

Correct. AWS DMS can continuously replicate HANA data with change data capture, meeting the RPO of 15 minutes. The target database can be pre-provisioned, and automated failover can be configured using DMS ongoing replication, achieving an RTO of 2 hours. This is a managed service, reducing operational overhead.

Why this answer

AWS Database Migration Service (DMS) with continuous replication (change data capture) can achieve an RPO of 15 minutes for a 2 TB SAP HANA database across AWS Regions. The RTO of 2 hours is achievable by provisioning the target HANA instance in advance and applying changes. This solution uses a fully managed AWS service, reducing operational overhead compared to manual scripting or third-party tools.

While SAP HANA System Replication (HSR) is native, cross-region synchronous replication is not feasible due to latency; asynchronous HSR could meet the RPO but is not listed as an option. DMS provides continuous replication with minimal setup and monitoring, making it the best choice among the given options.

Exam trap

The trap is that candidates assume SAP HANA System Replication is always the best solution for HANA DR, but synchronous replication across AWS Regions is not feasible due to latency. They may overlook AWS DMS as a viable managed alternative that can meet the RPO/RTO with lower operational overhead.

How to eliminate wrong answers

Option B is wrong because AWS Database Migration Service (DMS) is designed for one-time migrations or ongoing replication with change data capture, but it does not support SAP HANA as a target for continuous replication in a DR scenario and introduces significant operational overhead for failover and consistency management. Option C is wrong because it places the secondary in a different Availability Zone within the same region, which does not satisfy the requirement for a different AWS Region for DR. Option D is wrong because daily snapshots cannot achieve an RPO of 15 minutes, and restoring from snapshots would exceed the 2-hour RTO due to the time required to copy and restore 2 TB of data.

Practice this question →

60

MCQeasy

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

A.Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

B.AWS Database Migration Service (DMS) with ongoing replication.

C.AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

D.AWS Snowball Edge to ship the data physically, then import to RDS.

AnswerB

DMS supports full load plus change data capture (CDC) for minimal downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Exam trap

The trap here is that candidates often choose Snowball Edge for large datasets without considering the minimal downtime requirement, forgetting that physical shipping introduces hours or days of latency and cannot provide ongoing replication, while DMS with CDC is the only option that keeps the source online during migration.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration only speeds up uploads to S3 over the public internet but does not provide ongoing replication or CDC; restoring a dump from S3 to RDS would require taking the source database offline for the entire dump and restore process, violating the minimal downtime requirement. Option C is wrong because AWS Storage Gateway is designed for hybrid storage (e.g., file shares, volume backups) and cannot replicate live Oracle database changes or perform CDC; it would only copy static database files, requiring a full outage for the initial copy and lacking incremental sync. Option D is wrong because AWS Snowball Edge is a physical data transfer device intended for large datasets over slow or unreliable networks; while it can move 2 TB, the shipping time (days) and the need to stop writes during data extraction make it unsuitable for minimal downtime, and it does not support ongoing replication.

Practice this question →

61

MCQmedium

A company is migrating its SAP landscape to AWS and wants to ensure that all SAP systems can communicate with each other using private IP addresses only. The systems are deployed in multiple VPCs. Which AWS solution should be used to enable private connectivity between these VPCs?

A.VPC Peering.

B.VPC Endpoints.

C.AWS Site-to-Site VPN.

D.AWS Direct Connect.

AnswerA

VPC Peering enables private routing between VPCs.

Why this answer

VPC Peering is the correct solution because it enables direct, private IP connectivity between VPCs using the AWS global network, with no gateways or VPN connections required. Traffic stays within AWS and never traverses the public internet, satisfying the requirement for SAP systems to communicate using only private IP addresses across multiple VPCs.

Exam trap

The trap here is that candidates may confuse VPC Peering with VPC Endpoints, thinking both provide private connectivity, but VPC Endpoints only connect to AWS services, not to other VPCs.

How to eliminate wrong answers

Option B is wrong because VPC Endpoints (Gateway or Interface endpoints) provide private connectivity to AWS services (like S3 or DynamoDB) from within a VPC, not between VPCs. Option C is wrong because AWS Site-to-Site VPN establishes encrypted tunnels over the public internet between on-premises networks and a VPC, not between VPCs. Option D is wrong because AWS Direct Connect is a dedicated physical connection from on-premises to AWS, used for hybrid connectivity, not for inter-VPC communication.

Practice this question →

62

MCQmedium

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

A.The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.

B.The S3 bucket has versioning enabled, which requires additional permissions.

C.The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.

D.The bucket policy does not grant the s3:PutObject permission to the IAM role.

AnswerA

The bucket policy condition requires this header; without it, the request is denied.

Why this answer

The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Exam trap

The trap here is that candidates assume the bucket policy alone is sufficient for cross-account uploads, overlooking the requirement for the `bucket-owner-full-control` ACL header to transfer object ownership to the bucket owner.

How to eliminate wrong answers

Option B is wrong because enabling versioning does not require additional permissions for PutObject; versioning affects object version IDs but does not block uploads due to ownership issues. Option C is wrong because the resource ARN `arn:aws:s3:::my-bucket` is correct for granting permissions on the bucket itself; the wildcard `/*` is needed only for object-level operations, but the policy already uses `arn:aws:s3:::my-bucket/*` in the Resource element (the question states the bucket policy is shown above, and the correct ARN is used). Option D is wrong because the bucket policy does grant s3:PutObject to the IAM role; the failure is not due to missing permission but due to missing ACL header.

Practice this question →

63

MCQeasy

An SAP system running on AWS is experiencing high CPU usage on the application server during peak hours. The system is already using the largest instance type available in the current generation. What is the most cost-effective solution to handle the peak load?

A.Upgrade to a larger instance type from a different instance family

B.Purchase Reserved Instances to reduce cost and allocate more resources

C.Add an additional SAP application server in the same Availability Zone

D.Use Auto Scaling to automatically add instances during peak hours

AnswerC

Horizontal scaling distributes load across multiple servers.

Why this answer

SAP on AWS supports horizontal scaling by adding more application servers to distribute the load, which is the most cost-effective approach when the current instance type is already the largest available. Option C correctly adds an additional SAP application server in the same Availability Zone, leveraging SAP's native architecture to handle peak CPU usage without incurring the cost of a larger, potentially unavailable instance.

Exam trap

The trap here is that candidates often confuse Auto Scaling (Option D) with SAP's native horizontal scaling, but Auto Scaling is not a standard SAP feature and requires significant custom implementation, making Option C the correct and most cost-effective answer.

How to eliminate wrong answers

Option A is wrong because upgrading to a larger instance type from a different instance family is not possible if the current generation's largest instance is already in use; AWS instance families have fixed maximum sizes, and moving to a different family (e.g., from compute-optimized to memory-optimized) may not provide the required CPU performance and could introduce compatibility issues with SAP's certified instance types. Option B is wrong because purchasing Reserved Instances reduces hourly cost but does not allocate more resources or solve the immediate high CPU usage during peak hours; it is a billing optimization, not a scaling solution. Option D is wrong because Auto Scaling is not natively supported for SAP application servers in a traditional SAP architecture; SAP systems require manual or orchestrated addition of application servers, and Auto Scaling would need custom scripts and careful state management to avoid disrupting SAP's distributed processes.

Practice this question →

64

MCQeasy

An SAP administrator needs to migrate an on-premises SAP ERP system to AWS. The current system runs on a single Windows Server with SQL Server and uses 2 TB of storage. The migration must minimize downtime and use native AWS tools. Which service should be used to replicate the on-premises server to AWS?

A.AWS CloudFormation

B.AWS Snowball

C.AWS Database Migration Service (DMS)

D.AWS Server Migration Service (SMS)

AnswerD

SMS replicates entire server volumes to AWS, minimizing downtime.

Why this answer

AWS Server Migration Service (SMS) is the correct choice because it is designed to automate the replication of on-premises live server volumes (including Windows Server with SQL Server) to AWS as Amazon Machine Images (AMIs), enabling incremental replication with minimal downtime. It uses agentless replication via the AWS Replication Agent or hypervisor-level integration, making it ideal for migrating the entire server, including the OS and SQL Server database, without requiring separate database-level tools.

Exam trap

The trap here is that candidates often confuse AWS DMS as the go-to migration tool for any SQL Server workload, but DMS only handles the database layer, not the entire server including the SAP application and Windows OS, which SMS is specifically built for in server-level migrations.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation is an Infrastructure as Code (IaC) service for provisioning and managing AWS resources, not a replication or migration tool for live server volumes. Option B is wrong because AWS Snowball is a physical data transfer device intended for large-scale offline data migration (typically >10 TB or low-bandwidth scenarios), not for minimizing downtime via online replication of a 2 TB server. Option C is wrong because AWS Database Migration Service (DMS) is specialized for migrating databases (e.g., SQL Server to Amazon RDS or EC2-hosted SQL Server) but does not replicate the entire server OS, file system, or application stack; it would leave the Windows Server and SAP application layer unmigrated.

Practice this question →

65

MCQeasy

A company is deploying SAP S/4HANA on AWS and needs to choose the storage for the HANA data volume. Which EBS volume type provides the highest consistent IOPS for this workload?

A.EBS io2 Block Express

B.EBS gp3

C.EBS io1

D.EBS st1

AnswerA

io2 Block Express offers up to 256,000 IOPS.

Why this answer

EBS io2 Block Express is designed for mission-critical applications like SAP HANA, offering the highest consistent IOPS of any EBS volume type, with up to 256,000 IOPS. Option B (gp3) provides baseline performance but lower maximum IOPS than io2 Block Express. Option C (io1) is an older provisioned IOPS type with lower maximum IOPS (up to 64,000) compared to io2 Block Express.

Option D (st1) is throughput-optimized and not suitable for high IOPS workloads.

Practice this question →

66

MCQeasy

A company is running SAP BusinessObjects on AWS. The application is deployed on EC2 instances with an Application Load Balancer. Users are reporting that the application is sometimes unreachable. What is the most likely cause?

A.The target group health checks are failing intermittently on the EC2 instances.

B.The security group for the instances is not allowing traffic from the load balancer.

C.The load balancer is not configured with sticky sessions.

D.The Route 53 TTL is too short for DNS resolution.

AnswerA

Unhealthy instances are removed from the load balancer, causing connection failures.

Why this answer

Intermittent unreachability of an application behind an Application Load Balancer (ALB) is most commonly caused by health checks failing on the target EC2 instances. When health checks fail intermittently, the ALB will periodically mark the instances as unhealthy and stop routing traffic to them, causing the application to become unreachable during those windows. This matches the symptom of 'sometimes unreachable' rather than a persistent failure.

Exam trap

The trap here is that candidates often confuse intermittent reachability with misconfigured security groups or DNS, but the key phrase 'sometimes unreachable' points directly to a dynamic health check failure rather than a static configuration error.

How to eliminate wrong answers

Option B is wrong because if the security group for the instances were not allowing traffic from the load balancer, the application would be persistently unreachable, not intermittent. Option C is wrong because sticky sessions (session affinity) affect which instance handles a user's session, not overall reachability of the application. Option D is wrong because a short Route 53 TTL affects how quickly DNS changes propagate, not the real-time reachability of an already-resolved endpoint; DNS resolution is cached by clients and intermediate resolvers, so a short TTL would not cause intermittent unreachability.

Practice this question →

67

MCQeasy

A company wants to ensure that their SAP HANA database backups are stored securely and can be retained for 7 years for compliance. Which AWS service should they use to archive the backups?

A.Amazon EBS Snapshots

B.Amazon S3 Glacier Deep Archive

C.Amazon S3 Intelligent-Tiering

D.Amazon S3 Standard

AnswerB

Glacier Deep Archive provides the lowest cost for 7-year retention, meeting compliance requirements.

Why this answer

Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage class designed for long-term retention of data that is accessed infrequently, with a default retrieval time of 12 hours. This meets the 7-year compliance requirement for SAP HANA backups while minimizing storage costs, as the backups are unlikely to be accessed frequently after the initial retention period.

Exam trap

The trap here is that candidates often choose Amazon S3 Intelligent-Tiering because it automates cost savings, but they overlook that it does not include the deep archive tier and incurs additional monitoring costs, making it less suitable for long-term, infrequently accessed backups compared to Glacier Deep Archive.

How to eliminate wrong answers

Option A is wrong because Amazon EBS Snapshots are stored in Amazon S3 but are not directly accessible as objects, cannot be retained for 7 years without incurring high costs due to incremental snapshot storage, and lack lifecycle management for archival to lower-cost tiers. Option C is wrong because Amazon S3 Intelligent-Tiering is designed for data with unknown or changing access patterns and automatically moves data between frequent, infrequent, and archive tiers, but it does not provide the lowest-cost deep archive tier for 7-year retention and incurs monitoring and automation charges that make it less cost-effective for purely archival data. Option D is wrong because Amazon S3 Standard is optimized for frequently accessed data with low latency and high throughput, making it prohibitively expensive for 7-year retention of backups that are rarely accessed, and it does not offer the cost savings of a dedicated archival storage class.

Practice this question →

68

MCQhard

An SAP administrator notices that the SAP HANA database performance has degraded significantly during peak hours. The HANA instance is running on an r5.8xlarge EC2 instance with EBS gp2 volumes. Monitoring shows high I/O wait times on the data volume. Which change is MOST likely to improve performance?

A.Enable Multi-AZ deployment for SAP HANA.

B.Upgrade the EC2 instance to a larger size like r5.16xlarge.

C.Change the EBS volume type from gp2 to gp3 with 3000 IOPS.

D.Use Amazon EBS io2 Block Express volumes with high IOPS.

AnswerD

io2 volumes provide consistent low-latency performance suitable for HANA workloads.

Why this answer

The performance degradation is due to high I/O wait times on the data volume, indicating that the EBS volume's IOPS limit is being saturated. Amazon EBS io2 Block Express volumes provide up to 256,000 IOPS per volume with consistent sub-millisecond latency, which directly addresses the I/O bottleneck for SAP HANA workloads. In contrast, gp3 volumes are capped at 16,000 IOPS, which is insufficient for peak-hour demands on an r5.8xlarge instance.

Exam trap

The trap here is that candidates often assume upgrading the instance size (Option B) will fix I/O bottlenecks, overlooking that EBS volume performance is a separate constraint, or they choose gp3 (Option C) thinking it is always an improvement, without considering that the specified 3000 IOPS is too low for the workload.

How to eliminate wrong answers

Option A is wrong because Multi-AZ deployment for SAP HANA is a high-availability feature that does not improve I/O performance; it adds replication overhead and may increase latency. Option B is wrong because upgrading to a larger EC2 instance (r5.16xlarge) increases CPU and memory but does not resolve the underlying EBS volume IOPS bottleneck; the instance's EBS bandwidth may increase, but the gp2 volume's IOPS limit remains the constraint. Option C is wrong because gp3 with 3000 IOPS provides only 3000 baseline IOPS, which is lower than the gp2 volume's baseline (which scales with size) and is insufficient for high I/O wait times; gp3's maximum IOPS is 16,000, which may still be inadequate for peak SAP HANA workloads.

Practice this question →

69

MCQeasy

An SAP system needs to store audit logs for 7 years to meet compliance requirements. The logs are accessed rarely. Which storage class is MOST cost-effective?

A.Amazon S3 Standard

B.Amazon S3 Glacier Deep Archive

C.Amazon S3 One Zone-Infrequent Access

D.Amazon S3 Intelligent-Tiering

AnswerB

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for long-term archival of rarely accessed data, making it the best choice for 7-year compliance logs.

Why this answer

S3 Glacier Deep Archive is the lowest cost for long-term archival. Option A is incorrect because S3 Standard is for frequently accessed data. Option C is incorrect because S3 One Zone-IA is for infrequent access but not archival.

Option D is incorrect because S3 Intelligent-Tiering incurs monitoring costs and is not as cost-effective for rarely accessed logs over 7 years.

Practice this question →

70

MCQmedium

Refer to the exhibit. An IAM policy is attached to an IAM user. Which EC2 instance can the user terminate?

A.Only instance i-1234567890abcdef0

B.Any instance with tag 'Environment:Production'

C.None, because the Deny statement overrides the Allow for that instance

D.Any instance in the account

AnswerC

Explicit Deny always wins over Allow.

Why this answer

The explicit Deny for all instances (*) overrides the Allow for the specific instance i-1234567890abcdef0, as Deny always wins. Option A is incorrect because the Deny applies to all instances, including i-1234567890abcdef0. Option B is incorrect because the Deny covers all instances, regardless of tags.

Option D is incorrect because the Deny explicitly denies access to all instances.

Practice this question →

71

Multi-Selecthard

An SAP system on AWS is experiencing performance issues during peak hours. The system includes SAP application servers and a HANA database. The CloudWatch metrics show high CPU utilization on the application servers and high disk read latency on the database EBS volumes. Which THREE actions should be taken to improve performance?

Select 3 answers

A.Increase the provisioned IOPS on the EBS volumes attached to the HANA database.

B.Upgrade the HANA database to a larger instance type with more CPU and memory.

C.Add more SAP application servers to the Auto Scaling group.

D.Add a NAT Gateway to the VPC to improve network performance.

E.Deploy a read replica for the HANA database.

AnswersA, B, C

Higher IOPS reduces read latency.

Why this answer

Increasing provisioned IOPS on the EBS volumes reduces disk read latency, addressing the high disk read latency issue. Option B is correct because upgrading the HANA database to a larger instance type provides more CPU and memory, which helps with high CPU utilization and overall performance. Option C is correct because adding more SAP application servers distributes the load, reducing high CPU utilization on existing servers.

Option D is incorrect because a NAT Gateway is for outbound internet traffic and does not improve internal network performance or address CPU/disk latency. Option E is incorrect because a read replica for HANA would not help with disk read latency or CPU utilization; it is typically used for disaster recovery or offloading reporting, not for improving performance of the primary database under high write or read load.

Practice this question →

72

MCQhard

An SAP administrator creates this IAM policy for an EC2 instance role used by SAP HANA Backint to back up to S3. The backups are failing with access denied errors for S3 operations. What is the most likely cause?

A.The policy does not allow s3:ListBucket action.

B.The policy does not include kms:Encrypt action.

C.The policy uses a wildcard in the resource ARN for the bucket.

D.The policy does not include kms:ReEncrypt action.

AnswerB

Backint needs kms:Encrypt to write encrypted objects.

Why this answer

SAP HANA Backint for S3 typically uses Server-Side Encryption with AWS KMS (SSE-KMS) to encrypt backups at rest. The IAM policy must include the `kms:Encrypt` action on the KMS key to allow the EC2 instance role to encrypt objects during upload. Without this permission, the S3 PutObject call fails with an access denied error, even if the S3 actions are correctly allowed.

Exam trap

The trap here is that candidates often focus only on S3 permissions (like ListBucket or wildcard ARNs) and overlook that KMS permissions are required when the S3 bucket uses SSE-KMS, which is a common default for SAP HANA backups in AWS.

How to eliminate wrong answers

Option A is wrong because `s3:ListBucket` is not required for Backint backup operations; Backint only needs `s3:PutObject` and `s3:GetObject` for writing and reading backup files, and `s3:ListBucket` is used for listing objects, which is not part of the backup workflow. Option C is wrong because using a wildcard in the resource ARN for the bucket (e.g., `arn:aws:s3:::bucket-name/*`) is standard and correct for granting access to objects within the bucket; the issue is not the wildcard but the missing KMS permissions. Option D is wrong because `kms:ReEncrypt` is used for re-encrypting data under a different KMS key, which is not relevant to the initial encryption of backups being uploaded; Backint requires `kms:Encrypt` and `kms:Decrypt` for the backup and restore operations.

Practice this question →

73

MCQhard

A company runs SAP S/4HANA on AWS. The system is critical and requires high availability. The database is SAP HANA running on two EC2 instances in a cluster. The company wants to ensure that the secondary instance can take over quickly in case of primary failure. Which AWS service should be used to implement a floating IP address that can be moved between the instances?

A.AWS Global Accelerator

B.Amazon Route 53

C.Elastic IP addresses

D.VPC Peering

AnswerC

Elastic IP addresses are the appropriate AWS service for a floating IP that can be moved between EC2 instances. They can be reassigned quickly via the AWS console, CLI, or scripts, allowing the secondary instance to take over the same IP address upon primary failure.

Why this answer

Elastic IP addresses are static public IPv4 addresses that can be allocated to an AWS account and reassigned between EC2 instances. When a primary SAP HANA instance fails, the Elastic IP can be disassociated from the failed instance and associated with the secondary instance. This provides a floating IP that can be moved quickly, supporting high availability.

Route 53 DNS failover changes DNS resolution, but does not provide a floating IP address that is directly moved between instances.

Exam trap

The trap here is that candidates often assume Route 53 is the only way to implement failover with a fixed endpoint. However, the requirement is for a floating IP address that moves between instances, which is exactly what Elastic IP addresses provide. Route 53 changes DNS records, not the IP address itself.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator provides static anycast IP addresses and traffic management at the edge, but it does not support moving a floating IP between EC2 instances within a VPC; it is designed for global traffic distribution, not intra-VPC failover. Option C is wrong because Elastic IP addresses are static public IPv4 addresses that can be remapped between instances, but they are not recommended for SAP HANA cluster failover due to the time required for API calls to reassociate the EIP and the lack of automatic health-based failover without additional scripting. Option D is wrong because VPC Peering connects two VPCs for routing traffic, but it does not provide any IP address mobility or failover capability between instances within the same VPC.

Practice this question →

74

MCQmedium

An SAP administrator notices that the SAP application server is unable to establish an RFC connection to the SAP HANA database. The database is running on an EC2 instance in the same VPC. Security groups and NACLs allow all traffic. What is the most likely cause?

A.The VPC has overlapping CIDR blocks with the on-premises network.

B.The application server uses TCP instead of the required UDP protocol.

C.The application server is configured to connect to the wrong port number.

D.The HANA database instance was rebooted for maintenance.

AnswerC

HANA uses port 3<instance number>13. Misconfiguration is a common issue.

Why this answer

The SAP HANA database listens on a specific TCP port, typically 3<instance_number>13 (e.g., 30013 for instance 00). If the application server is configured with a different port number, it cannot establish an RFC connection. Option C is correct because a port mismatch is a common misconfiguration.

Option A (overlapping CIDR) would cause routing issues at the network layer, but since security groups and NACLs allow all traffic, this is less likely. Option B (UDP protocol) is incorrect because RFC connections use TCP, not UDP. Option D (reboot) would be temporary and the connection would resume after the database restarts.

Practice this question →

75

MCQhard

A company runs SAP S/4HANA on AWS with a production database on an r5.24xlarge instance and 15 application servers on r5.4xlarge instances. The system has been stable for months. Recently, the database instance started experiencing high CPU utilization during peak hours, causing performance degradation. The company has reserved capacity for the database instance. The SAP team has already optimized the SQL queries and reduced the CPU usage by 20%, but the CPU still spikes to 95% during peak hours. The team is considering upgrading the database instance to a larger type. However, the next larger instance type (r5.32xlarge) is not available in the current Availability Zone. The company needs a solution that minimizes downtime and cost. What should be done?

A.Stop the database instance, change to a larger instance type in a different Availability Zone, and use a placement group with the application servers.

B.Migrate the database to a different instance family, such as x1e.32xlarge.

C.Use an Auto Scaling group to automatically scale the database instance.

D.Add more application servers to distribute the load.

AnswerA

Provides more CPU and maintains low latency.

Why this answer

Stopping the database instance allows changing to a larger instance type. Since r5.32xlarge is not available in the current AZ, the instance must be moved to a different AZ where it is available. Note that cluster placement groups cannot span Availability Zones, so to use a placement group, the application servers would also need to be moved to the same AZ, increasing downtime.

Therefore, the most cost-effective and minimally disruptive approach is to simply move the database instance to the new AZ and accept the minimal cross-AZ latency, which is acceptable for SAP workloads. This avoids the need to recertify a different instance family as in option B, and options C and D do not address the database bottleneck.

Practice this question →

Page 1 of 6 · 389 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Technology questions.

Start 20-question session