Knowledge + Practice

CCNA Technology Questions

75 of 389 questions · Page 2/6 · Technology · Answers revealed

Practice these questions Domain overview All questions

76

MCQmedium

A company runs its SAP HANA database on an EC2 instance (r5.8xlarge) with 8 EBS gp2 volumes (1 TB each) in a RAID 0 stripe. The database is critical and requires high availability. The current architecture uses a single EC2 instance in one Availability Zone. The company wants to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. The DR site must be in a different AWS Region. The SAP HANA database size is 4 TB. The company has a 1 Gbps Direct Connect connection between the primary and DR Regions. The database workload is write-intensive with an average write throughput of 200 MB/s. Which solution meets the RPO and RTO requirements?

A.Set up HANA System Replication (HSR) in asynchronous mode from the primary to a secondary EC2 instance in the DR Region. Use the same instance type and EBS configuration. In case of failure, perform a HSR takeover.

B.Take EBS snapshots of the RAID array every 15 minutes and replicate them to the DR Region using EBS snapshot copy. In the DR Region, restore the snapshots to new volumes and attach them to a new EC2 instance.

C.Back up the HANA database to Amazon S3 every 15 minutes using the HANA backup tool, and set up cross-Region replication for the S3 bucket. In the DR Region, restore the latest backup to a new EC2 instance.

D.Use AWS Database Migration Service (DMS) to continuously replicate changes to a target HANA database in the DR Region.

AnswerA

HANA System Replication (HSR) in asynchronous mode can achieve an RPO of seconds, well within the 15-minute requirement. The 1 Gbps Direct Connect connection, with HANA's built-in compression, can handle the 200 MB/s write throughput (approximately 1.6 Gbps uncompressed, compressed to ~800 Mbps or less). Using the same instance type and EBS RAID 0 configuration ensures performance parity after takeover. HSR takeover can be completed in minutes, meeting the 4-hour RTO. Option A is correct.

Why this answer

HANA System Replication (HSR) in asynchronous mode can achieve an RPO of seconds, well within the 15-minute requirement. The 1 Gbps Direct Connect connection, with HANA's built-in compression, can handle the 200 MB/s write throughput (approximately 1.6 Gbps uncompressed, compressed to ~800 Mbps or less). Using the same instance type and EBS RAID 0 configuration ensures performance parity after takeover.

HSR takeover can be completed in minutes, meeting the 4-hour RTO. Option B is incorrect because EBS snapshots of a RAID array require stopping I/O for consistency, and taking snapshots every 15 minutes is impractical; restoring 4 TB from snapshots would significantly exceed the 4-hour RTO. Option C is incorrect because backing up to S3 every 15 minutes can impact database performance, and restoring from S3 takes longer than 4 hours due to data transfer and re-import time.

Option D is incorrect because AWS DMS does not natively support SAP HANA as a target for continuous replication; it is designed for heterogeneous migrations, not HANA-specific replication.

Practice this question →

77

MCQmedium

An SAP administrator created the IAM policy shown in the exhibit. When trying to terminate an EC2 instance with ID i-abc123 in us-west-2, the action fails. What is the reason?

A.There is an implicit Deny for all actions not explicitly allowed.

B.The ec2:TerminateInstances action is restricted to instances in us-east-1 only.

C.The policy is missing a condition key to allow termination in us-west-2.

D.The ec2:StartInstances and ec2:StopInstances actions are not granted for the specific instance.

AnswerB

The resource ARN specifies us-east-1, so terminating instances in other regions is denied.

Why this answer

The policy includes a condition that restricts the ec2:TerminateInstances action to the us-east-1 region using the ec2:Region condition key. Since the instance i-abc123 is in us-west-2, the condition is not satisfied, causing the action to fail. AWS IAM policies evaluate conditions before allowing an action, and if the condition is not met, the action is denied.

Exam trap

The trap here is that candidates often overlook the condition key in the policy and assume the action is universally allowed, failing to realize that conditions can restrict actions to specific regions, resources, or other attributes, leading them to incorrectly choose the implicit deny option.

How to eliminate wrong answers

Option A is wrong because an implicit Deny applies only to actions not explicitly allowed, but here the ec2:TerminateInstances action is explicitly allowed with a condition that is not met, resulting in an explicit deny from the condition evaluation, not an implicit deny. Option C is wrong because the policy does not require a condition key to allow termination in us-west-2; rather, the existing condition explicitly restricts termination to us-east-1, and adding a condition key for us-west-2 would not override the current restriction without modifying the condition. Option D is wrong because the ec2:StartInstances and ec2:StopInstances actions are irrelevant to the failure; the issue is specifically with ec2:TerminateInstances, and those actions are not mentioned in the policy or the scenario.

Practice this question →

78

MCQhard

An SAP system on AWS sends large amounts of batch data via RFC calls between two EC2 instances in the same VPC. The application team reports high network latency. Which configuration change would most effectively reduce latency?

A.Assign Elastic IP addresses to both instances.

B.Enable Elastic Network Adapter (ENA) on both instances.

C.Place both EC2 instances in the same cluster placement group.

D.Use Elastic Fabric Adapter (EFA) for network communication.

AnswerC

A cluster placement group provides low-latency, single-rack, non-blocking 10 Gbps network connectivity between instances, directly addressing the high network latency reported for batch RFC calls. This configuration satisfies the stem’s constraint of both EC2 instances residing in the same VPC, as the group enforces physical proximity within a single Availability Zone, minimising hop count and packet jitter for sustained data flows.

Why this answer

Cluster placement groups provide low-latency, high-throughput network connectivity by placing instances in a single Availability Zone within a logical group, ensuring they are in close physical proximity. For SAP RFC batch data transfer between two EC2 instances in the same VPC, this reduces network hops and latency significantly compared to instances placed in different racks or AZs.

Exam trap

The trap here is that candidates confuse high-throughput features (ENA, EFA) with low-latency features, or assume Elastic IPs reduce network distance, when the key is physical proximity via a cluster placement group.

How to eliminate wrong answers

Option A is wrong because Elastic IP addresses are static public IPv4 addresses that do not reduce latency; they only provide persistent public IPs and can even add overhead if traffic is routed through an internet gateway. Option B is wrong because ENA is a virtual network adapter that enhances throughput and reduces CPU overhead for high-bandwidth workloads, but it does not directly reduce latency between two instances in the same VPC; it is already enabled by default on modern instance types. Option D is wrong because EFA is designed for tightly coupled HPC and MPI workloads using OS-bypass, not for standard TCP/IP-based RFC calls; it requires specialized application support and does not benefit SAP batch data transfers.

Practice this question →

79

MCQhard

An SAP administrator is trying to set up an AWS CLI script that queries EC2 instance metadata. The script runs on an EC2 instance with an IAM role attached. The IAM role has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" } ] } What is the most likely cause of the error?

A.The instance does not have an IAM instance profile associated, or the profile name does not match the role name.

B.The IAM policy does not specify a resource ARN.

C.The IAM role does not have the ec2:DescribeInstances action allowed.

D.The AWS CLI is not configured with the correct region.

AnswerA

If the instance profile is not attached or is misconfigured, the role's permissions are not applied, causing the authorization error.

Why this answer

The most likely cause is that the EC2 instance does not have an IAM instance profile associated, or the profile name does not match the role name. Without a properly attached instance profile, the AWS CLI cannot obtain temporary credentials from the instance metadata service (IMDS), so any API call—including ec2:DescribeInstances—will fail with an access denied or credential error, regardless of the IAM policy being correctly configured.

Exam trap

The trap here is that candidates assume the IAM policy itself is the problem, when in fact the issue is the missing or mismatched instance profile that prevents credential retrieval from the instance metadata service.

How to eliminate wrong answers

Option B is wrong because the ec2:DescribeInstances action supports the wildcard resource ARN ("*") and does not require a specific resource ARN; omitting a resource ARN is not an error. Option C is wrong because the policy explicitly allows ec2:DescribeInstances, so the role does have the required action allowed. Option D is wrong because the AWS CLI region configuration affects which regional endpoint is called, but it does not cause an authentication or authorization failure; the error described is due to missing credentials, not a region mismatch.

Practice this question →

80

Multi-Selecteasy

A company is setting up SAP HANA database backups to Amazon S3. Which TWO actions are required to ensure secure and efficient backup operations? (Choose TWO.)

Select 2 answers

A.Create an IAM role for the EC2 instance running SAP HANA with permissions to write to the S3 bucket.

B.Enable S3 Transfer Acceleration on the backup bucket.

C.Enable server-side encryption with AWS KMS for the S3 bucket.

D.Set up an S3 Lifecycle policy to move older backups to Amazon Glacier.

E.Configure a VPC Endpoint for S3 to keep traffic within the AWS network.

AnswersA, E

The instance needs permissions to write backups to S3.

Why this answer

The EC2 instance running SAP HANA must assume an IAM role that grants permissions to write backup files to the S3 bucket. This follows the principle of least privilege and avoids embedding long-term credentials in the instance, which is a security best practice for automated backup operations.

Exam trap

The trap here is that candidates often confuse optional security or cost-saving features (like KMS encryption or Glacier lifecycle policies) with mandatory requirements for secure and efficient backup operations, leading them to select options that are beneficial but not strictly required.

Practice this question →

81

MCQmedium

A company needs to automate the start and stop of SAP applications in non-production environments to reduce costs. The SAP systems run on multiple EC2 instances. Which AWS service can be used to schedule start and stop actions?

A.AWS OpsWorks

B.AWS Lambda with custom code

C.AWS Instance Scheduler

D.Amazon CloudWatch Events

AnswerC

Instance Scheduler is a ready-made solution that uses Lambda and DynamoDB to start/stop instances.

Why this answer

AWS Instance Scheduler is a purpose-built solution that automates the start and stop of EC2 instances based on a defined schedule, making it ideal for reducing costs in non-production SAP environments. It uses AWS CloudFormation to deploy a scheduler that triggers Lambda functions to stop and start instances at specified times, and it natively supports tagging to identify which instances to manage, without requiring custom code.

Exam trap

The trap here is that candidates often choose AWS Lambda with custom code (Option B) because they know Lambda can be scheduled with CloudWatch Events, but they overlook that AWS Instance Scheduler is a pre-built, managed solution that eliminates the need for custom development and maintenance, which is the most cost-effective and reliable approach for this specific use case.

How to eliminate wrong answers

Option A is wrong because AWS OpsWorks is a configuration management service (using Chef or Puppet) for managing application stacks, not a scheduling service for EC2 start/stop actions. Option B is wrong because while AWS Lambda with custom code could technically achieve this, it is not a managed service for scheduling; it requires building and maintaining custom logic, whereas AWS Instance Scheduler provides a ready-to-deploy, AWS-managed solution. Option D is wrong because Amazon CloudWatch Events (now Amazon EventBridge) can trigger actions based on schedules, but it cannot directly start or stop EC2 instances; it would need to invoke a Lambda function or other target, and it lacks the built-in tagging and scheduling logic that Instance Scheduler provides out of the box.

Practice this question →

82

MCQmedium

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. During a flash sale, the application experiences a sudden spike in traffic, but the Auto Scaling group does not scale out quickly enough, causing some requests to fail. Which solution would improve the scaling responsiveness?

A.Increase the cooldown period for the dynamic scaling policy.

B.Add a scheduled scaling action to increase capacity before the flash sale.

C.Decrease the cooldown period for the dynamic scaling policy.

D.Disable scale-in to prevent the Auto Scaling group from terminating instances during the sale.

AnswerB

Scheduled scaling proactively adds capacity ahead of known traffic spikes.

Why this answer

A scheduled scaling action proactively increases capacity before the flash sale, eliminating the lag inherent in dynamic scaling policies. Dynamic scaling reacts to metrics like average CPU utilization, which can take minutes to trigger and propagate, causing request failures during sudden spikes. By pre-scaling, the Auto Scaling group has sufficient instances ready to handle the traffic surge immediately.

Exam trap

The trap here is that candidates often focus on tuning cooldown periods or disabling scale-in, thinking these improve responsiveness, when the real issue is the inherent latency of reactive scaling during unpredictable spikes.

How to eliminate wrong answers

Option A is wrong because increasing the cooldown period would delay further scaling actions after a scale-out, making the group even less responsive to sudden spikes. Option C is wrong because decreasing the cooldown period might allow faster subsequent scaling but does not address the initial delay in detecting and reacting to the traffic spike. Option D is wrong because disabling scale-in prevents termination of instances but does not add new instances; it only protects existing ones, which are already insufficient during the flash sale.

Practice this question →

83

MCQeasy

An SAP system is running on an EC2 instance with a single Amazon EBS volume for data and log files. The database administrator wants to increase the IOPS performance without changing the instance type. Which action should be taken?

A.Modify the EBS volume to provisioned IOPS (io1/io2).

B.Enable EBS optimization on the EC2 instance.

C.Change the EC2 instance type to a larger size.

D.Migrate the data to an instance store volume.

AnswerA

You can modify an EBS volume to increase IOPS, including switching to io1/io2.

Why this answer

The correct action is to modify the EBS volume to use provisioned IOPS (io1 or io2), as this directly increases the IOPS performance of the volume without changing the instance type. The current single EBS volume is likely a gp2 or gp3 type, which has a baseline IOPS limit; switching to io1/io2 allows you to specify a higher, consistent IOPS level that meets the SAP database's performance requirements.

Exam trap

The trap here is that candidates may confuse EBS optimization (which improves network throughput for EBS) with increasing the volume's IOPS performance, leading them to select Option B, but EBS optimization does not change the volume's IOPS limit.

How to eliminate wrong answers

Option B is wrong because EBS optimization is a feature that ensures dedicated network bandwidth for EBS traffic, but it does not increase the IOPS limit of the volume itself; it only prevents network contention. Option C is wrong because changing the instance type to a larger size would increase the maximum IOPS the instance can support, but the question explicitly states 'without changing the instance type,' so this violates the constraint. Option D is wrong because instance store volumes are ephemeral and provide temporary, block-level storage that does not persist data across stops or terminations, making them unsuitable for SAP database data and log files that require durability.

Practice this question →

84

Multi-Selecthard

A company is designing a highly available SAP NetWeaver system on AWS. The architecture includes two EC2 instances running the ABAP application server in an Auto Scaling group. Which THREE components are required to maintain session persistence and distribute traffic? (Choose THREE.)

Select 3 answers

A.Health checks on the target group to detect unhealthy instances

B.A shared file system (e.g., Amazon EFS) for /sapmnt

C.An Application Load Balancer (ALB) or Network Load Balancer (NLB)

D.Sticky sessions (session affinity) enabled on the load balancer

E.A Multi-AZ deployment for the SAP application servers

AnswersA, C, D

Health checks are essential to route traffic only to healthy instances.

Why this answer

Health checks on the target group are required to detect unhealthy EC2 instances running the ABAP application server. When an instance fails a health check, the load balancer automatically stops routing traffic to it, ensuring that only healthy instances serve requests. This is critical for maintaining high availability in an SAP NetWeaver environment, as it prevents session failures caused by underlying instance issues.

Exam trap

The trap here is that candidates often confuse infrastructure components (like shared storage or Multi-AZ) with the specific mechanisms that enforce session persistence and traffic distribution, leading them to select options that are important for overall architecture but not directly required for the stated goal.

Practice this question →

85

MCQeasy

An SAP on AWS deployment uses an Auto Scaling group for the SAP application tier. The application is stateless and can scale out and in based on CPU utilization. Which scaling policy should be used to add new instances during peak load and remove them when the load decreases?

A.Simple scaling policy based on CPU utilization.

B.Target tracking scaling policy with a target CPU utilization of 70%.

C.Step scaling policy with multiple steps for different CPU thresholds.

D.Scheduled scaling policy to add instances during business hours.

AnswerB

Target tracking automatically adjusts capacity to maintain the target.

Why this answer

A target tracking scaling policy is the simplest and most automated way to maintain a target CPU utilization. Option A is wrong because simple scaling does not adjust dynamically. Option C is wrong because step scaling requires manual configuration of steps.

Option D is wrong because scheduled scaling is for predictable loads, not dynamic.

Practice this question →

86

MCQmedium

An SAP system is running on AWS and needs to be migrated from a current generation instance (r3) to a newer generation (r5). What is the recommended process to minimize downtime?

A.Modify the instance type while the instance is running.

B.Stop the instance, change the instance type, and start the instance.

C.Create an AMI of the r3 instance and launch an r5 instance from it.

D.Launch a new r5 instance and migrate the SAP system.

AnswerB

Minimal downtime by changing type after stop.

Why this answer

Stopping the instance is required to change the instance type for EC2 instances that are not configured for 'Stop/Start' hibernation or Nitro-based instance compatibility. For SAP systems running on current-generation instances (r3), which are Xen-based, a stop is necessary to modify the instance type to r5 (Nitro-based). This process minimizes downtime by allowing the instance to be stopped, changed, and started in a controlled manner, typically taking only a few minutes.

Exam trap

The trap here is that candidates assume modifying an instance type while running is always possible (Option A), but AWS only supports this for Nitro-based instances with specific configurations (e.g., instances that support 'Modify Instance Type' without stopping). The r3 instances are Xen-based and require a stop to change the instance type to r5 (Nitro-based). Therefore, stopping the instance is necessary.

How to eliminate wrong answers

Option A is wrong because modifying the instance type while the instance is running is only supported for instances that are Nitro-based and have 'Stop/Start' hibernation enabled; r3 instances are Xen-based and do not support live instance type changes, so attempting this would result in an error or require a stop. Option C is wrong because creating an AMI of the r3 instance and launching an r5 instance from it introduces additional downtime for AMI creation and does not preserve the existing instance's state (e.g., network interfaces, Elastic IPs, or instance store data) without manual reconfiguration, making it less efficient than a direct instance type change. Option D is wrong because launching a new r5 instance and migrating the SAP system requires a full data migration (e.g., using SAP tools like SWPM or database replication), which involves significant downtime and complexity compared to simply changing the instance type on the existing instance.

Practice this question →

87

MCQmedium

An SAP administrator needs to ensure that Amazon EBS snapshots of SAP HANA data volumes are crash-consistent. The HANA database is on a single EC2 instance with multiple EBS volumes. What is the correct approach?

A.Configure the volumes as a RAID 0 array and take a snapshot of the array.

B.Take snapshots of each volume individually while the instance is running.

C.Stop the EC2 instance, take snapshots of all volumes, then start the instance.

D.Use AWS Backup with application-consistent snapshots using pre- and post-scripts.

AnswerD

AWS Backup can orchestrate snapshots across multiple volumes and run scripts to freeze the filesystem and database, ensuring consistency.

Why this answer

AWS Backup with application-consistent snapshots uses pre- and post-scripts to quiesce the SAP HANA database, ensuring that all EBS volumes are captured in a crash-consistent state. This approach coordinates the snapshot process across multiple volumes without stopping the EC2 instance, maintaining data integrity for SAP HANA's data volumes.

Exam trap

The trap here is that candidates may assume stopping the instance (Option C) is the only way to ensure crash consistency, overlooking AWS Backup's ability to achieve the same result without downtime using application-consistent snapshots.

How to eliminate wrong answers

Option A is wrong because RAID 0 arrays do not inherently provide crash consistency across snapshots; snapshotting the array as a whole is not supported by EBS, and individual volume snapshots would still be inconsistent without coordination. Option B is wrong because taking snapshots of each volume individually while the instance is running can result in inconsistent data across volumes, as writes may occur between snapshots, leading to a non-crash-consistent state. Option C is wrong because stopping the EC2 instance ensures crash consistency but causes downtime, which is unnecessary and disruptive for production SAP HANA environments; AWS Backup with scripts achieves the same goal without downtime.

Practice this question →

88

MCQhard

A company is running SAP HANA in a multi-node scale-out configuration on AWS. The cluster uses AWS Placement Groups with the 'cluster' placement strategy. The system is experiencing network latency between nodes. Which change should the company make to reduce latency?

A.Change the placement group to 'spread' to reduce interference.

B.Use larger instance sizes to increase network bandwidth.

C.Enable Enhanced Networking (ENA) on all instances in the cluster.

D.Use EBS-optimized instances to improve storage performance.

AnswerC

ENA provides higher throughput and lower latency for inter-node communication.

Why this answer

Enabling Enhanced Networking (ENA) on all instances reduces network latency and jitter by offloading network processing to dedicated hardware on the Elastic Network Adapter. For SAP HANA scale-out clusters requiring low-latency inter-node communication, ENA provides higher packet-per-second performance and lower latency compared to the default Xen-net driver, directly addressing the latency issue in the cluster placement group.

Exam trap

The trap here is that candidates confuse bandwidth with latency, assuming larger instances or storage optimizations will fix network latency, when the real fix is reducing driver overhead via Enhanced Networking.

How to eliminate wrong answers

Option A is wrong because changing from 'cluster' to 'spread' placement would increase latency by placing instances on separate hardware racks, which is the opposite of what is needed for low-latency inter-node communication. Option B is wrong because larger instance sizes increase network bandwidth but do not inherently reduce latency; latency is primarily affected by network path and driver overhead, not bandwidth. Option D is wrong because EBS-optimized instances improve storage I/O performance by dedicating bandwidth to Amazon EBS, which does not affect network latency between nodes in the cluster.

Practice this question →

89

Multi-Selectmedium

A company is migrating an SAP HANA database to AWS. Which TWO configurations are required to ensure high availability for the SAP HANA database in a multi-AZ setup?

Select 2 answers

A.Deploy SAP HANA System Replication across two Availability Zones.

B.Use a single EBS volume with synchronous replication to both nodes.

C.Configure EBS Multi-Attach to allow both HANA instances to share the same data volume.

D.Implement a cluster manager such as Pacemaker to orchestrate failover.

E.Place an Application Load Balancer in front of the HANA database endpoints.

AnswersA, D

SAP HANA System Replication replicates data between separate HANA instances in different AZs for high availability.

Why this answer

SAP HANA System Replication (HSR) is the native mechanism for replicating data between primary and secondary HANA instances across Availability Zones, ensuring synchronous or asynchronous data consistency. This is the foundational requirement for high availability in a multi-AZ setup, as it provides real-time data replication to a standby node in a different AZ.

Exam trap

The trap here is that candidates often confuse network-level load balancers (like ALB) with database-specific failover mechanisms, or assume EBS features like Multi-Attach or replication can substitute for HANA-native replication and cluster management.

Practice this question →

90

MCQhard

An SAP customer has a mission-critical system running on AWS. They need to ensure that the SAP application can survive an Availability Zone failure without manual intervention. The SAP application is stateless. The database is SAP HANA with System Replication. What is the most comprehensive architecture to achieve automatic failover?

A.Deploy the SAP application in an Auto Scaling group across multiple AZs and configure SAP HANA System Replication with automatic failover using AWS resources

B.Use Amazon Route 53 health checks to switch DNS to a standby instance in another AZ

C.Deploy the SAP application in an Auto Scaling group across two AZs and use Amazon RDS Multi-AZ for HANA

D.Deploy the SAP application behind an Application Load Balancer and use SAP HANA System Replication with manual failover scripts

AnswerA

Auto Scaling for app tier and HSR automatic failover for DB tier provide full automation.

Why this answer

It combines stateless SAP application auto-scaling across multiple Availability Zones (AZs) with SAP HANA System Replication (HSR) configured for automatic failover. HSR uses synchronous replication to keep the standby HANA database in sync, and when combined with AWS services like Amazon Route 53 health checks or a cluster manager (e.g., Pacemaker), the failover occurs automatically without manual intervention. This architecture ensures both the application and database tiers survive an AZ failure seamlessly.

Exam trap

The trap here is that candidates often assume Amazon RDS Multi-AZ supports SAP HANA, but RDS Multi-AZ is only available for Amazon Aurora, MySQL, MariaDB, Oracle, PostgreSQL, and SQL Server — not for SAP HANA, which requires native HSR for high availability.

How to eliminate wrong answers

Option B is wrong because Route 53 health checks alone only redirect DNS traffic to a standby instance; they do not handle the database failover or ensure the SAP HANA System Replication is automatic, leaving the database tier vulnerable. Option C is wrong because Amazon RDS Multi-AZ does not support SAP HANA; SAP HANA requires native HSR and is not available as an RDS managed service, so this option is technically invalid. Option D is wrong because it specifies manual failover scripts, which contradicts the requirement for automatic failover without manual intervention; the question explicitly demands no manual steps.

Practice this question →

91

MCQmedium

An SAP administrator executed the AWS CLI command shown in the exhibit. The EC2 instance i-0abcd1234efgh5678 is a SAP HANA database server. Which statement about the storage configuration is correct?

A.The root volume (/dev/xvda) will persist after instance termination.

B.The volume /dev/sdf is an instance store volume.

C.The data volume (/dev/sdf) will persist after instance termination.

D.The instance is booting from an instance store volume.

AnswerC

The command sets DeleteOnTermination to false for /dev/sdf, ensuring the volume persists after termination.

Why this answer

/dev/sdf has DeleteOnTermination set to false, meaning it will not be deleted when the instance is terminated, preserving the data. Option A is incorrect because /dev/xvda will be deleted. Option B is incorrect because /dev/sdf is an EBS volume, not an instance store volume.

Option D is incorrect because the command only shows block device mappings, not the root device type.

Practice this question →

92

Multi-Selecteasy

A company is designing a disaster recovery (DR) strategy for its SAP HANA database on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO actions are required to enable HANA System Replication (HSR) across AWS Regions? (Choose 2)

Select 2 answers

A.Enable cross-Region replication of EBS snapshots.

B.Set up a VPN or Direct Connect connection between the Regions for secure, low-latency communication.

C.Configure HSR with asynchronous replication mode.

D.Use S3 Cross-Region Replication to copy HANA data files.

E.Deploy an Application Load Balancer in front of the HANA instances in both Regions.

AnswersB, C

Correct. Low-latency network connectivity is needed for HSR.

Why this answer

Options B and C are correct. Option B is correct because HSR requires low-latency network connectivity between the primary and DR sites, which can be provided by VPN or Direct Connect. Option C is correct because for cross-region HSR, asynchronous replication mode is required since synchronous replication would introduce unacceptable latency over long distances.

Option A is incorrect because EBS snapshots are not used for HSR; HSR uses log replication. Option D is incorrect because S3 Cross-Region Replication is not used for HANA data files; HSR replicates log volumes. Option E is incorrect because HSR is a database-level replication, not an application-level load balancer.

Practice this question →

93

MCQeasy

An SAP administrator needs to ensure that all API calls made to AWS services by the SAP application are logged for auditing purposes. The administrator wants to store these logs in Amazon S3 for long-term retention. Which AWS service should be used to capture the API calls?

A.VPC Flow Logs

B.AWS CloudTrail

C.AWS Config

D.Amazon CloudWatch Logs

AnswerB

CloudTrail records API calls for auditing.

Why this answer

AWS CloudTrail records API calls and can deliver logs to S3. Option A is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Option D is wrong because Config records configuration changes.

Practice this question →

94

MCQhard

A company runs its SAP ERP system on AWS. The SAP application servers are in an Auto Scaling group across two Availability Zones. The SAP HANA database runs on a single EC2 instance in us-east-1a. The database instance has an Elastic IP and uses EBS io1 volumes with 5000 provisioned IOPS. During a recent deployment, the company experienced a complete outage when the Availability Zone us-east-1a became unavailable due to a power failure. The database was unavailable for 6 hours until the zone recovered. The company wants to implement a highly available architecture that can automatically recover from an AZ failure with minimal data loss. The Recovery Point Objective (RPO) is 15 minutes and Recovery Time Objective (RTO) is 30 minutes. What should the company do?

A.Set up HANA System Replication with synchronous replication to a secondary instance in us-east-1b and configure automatic takeover.

B.Take EBS snapshots every 15 minutes and copy them to another region.

C.Move the HANA database to a larger instance in the same Availability Zone and increase IOPS to 10000.

D.Migrate the HANA database to Amazon RDS for SAP HANA with Multi-AZ enabled.

AnswerA

Correct. HANA System Replication with synchronous mode across AZs provides automatic failover, meeting both RPO and RTO.

Why this answer

HANA System Replication with synchronous replication to a secondary instance in a different Availability Zone (us-east-1b) provides automatic takeover, meeting the RPO of 15 minutes (synchronous replication ensures no data loss) and RTO of 30 minutes (automatic failover). Option B is wrong because EBS snapshots every 15 minutes cannot guarantee RPO and RTO; restore time from snapshots often exceeds 30 minutes, and cross-region copying adds latency. Option C is wrong because scaling within the same AZ does not address AZ failure; the single point of failure remains.

Option D is wrong because Amazon RDS for SAP HANA does not exist; HANA is not supported on RDS. The correct architecture requires HANA System Replication across AZs.

Exam trap

Candidates may mistakenly think that RDS Multi-AZ is available for SAP HANA, but HANA is not a supported engine on Amazon RDS. HANA must be managed on EC2 with HANA System Replication.

Practice this question →

95

Multi-Selecteasy

A company is running SAP HANA on AWS with a single Availability Zone (AZ). They want to improve high availability (HA) by deploying across multiple AZs. Which THREE components must be configured to support a multi-AZ SAP HANA HA setup? (Select THREE.)

Select 3 answers

A.Amazon Route 53 health checks for automatic failover

B.Elastic Load Balancer (ALB or NLB) for the SAP application tier

C.Amazon CloudFront distribution in front of the application servers

D.SAP HANA System Replication across AZs

E.Shared file system such as Amazon FSx for NetApp ONTAP for /sapmnt and /usr/sap/trans

AnswersB, D, E

Correct. An Elastic Load Balancer (ALB or NLB) is essential to distribute traffic to SAP application servers across multiple AZs, ensuring that if one AZ fails, traffic is routed to healthy servers in another AZ.

Why this answer

To achieve multi-AZ high availability for SAP HANA on AWS, three core components are required. First, SAP HANA System Replication must be configured to replicate data synchronously or asynchronously across AZs, ensuring database failover capability. Second, a shared file system (e.g., Amazon FSx for NetApp ONTAP or Amazon EFS) is needed for directories like /sapmnt and /usr/sap/trans so that all application servers can access consistent files after failover.

Third, an Elastic Load Balancer (ALB or NLB) distributes traffic to SAP application servers across AZs, enabling automatic failover at the application tier. Option A (Route 53 health checks) is a DNS-level component that can support failover but is not a direct requirement for the multi-AZ HA architecture itself; it is often used in conjunction but not considered a core component. Option C (CloudFront) is a CDN service and has no role in SAP HA.

Exam trap

Candidates often confuse the need for a load balancer with DNS failover, thinking Route 53 health checks alone are sufficient. However, for the application tier, a load balancer is essential to distribute traffic across AZs and handle failures automatically.

Practice this question →

96

MCQhard

An SAP system administrator is troubleshooting a performance issue on an SAP application server running on an EC2 instance. The /usr/sap directory is on an EBS volume. The administrator notices high I/O wait times. Which action should be taken to improve I/O performance?

A.Migrate the /usr/sap directory to Amazon EFS

B.Move the /usr/sap directory to an instance store volume

C.Change the EBS volume type to io2 Block Express with provisioned IOPS

D.Increase the instance size to a larger instance type

AnswerC

io2 volumes with provisioned IOPS can significantly improve I/O performance for high-throughput workloads like SAP.

Why this answer

The io2 Block Express volume type provides up to 256,000 provisioned IOPS and sub-millisecond latency, which directly addresses high I/O wait times caused by insufficient IOPS on the EBS volume hosting /usr/sap. SAP application servers are sensitive to storage latency, and increasing provisioned IOPS reduces queue depth and wait times for database and log writes.

Exam trap

The trap here is that candidates confuse compute scaling (Option D) with storage performance tuning, overlooking that I/O wait is a storage-layer metric that requires adjusting EBS volume type or IOPS, not instance size.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a network file system with higher latency than EBS, which would likely worsen I/O wait times for SAP's transactional workloads. Option B is wrong because instance store volumes are ephemeral and data is lost on instance stop/termination, making them unsuitable for persistent SAP directories like /usr/sap. Option D is wrong because increasing instance size improves CPU and memory but does not directly address EBS volume I/O performance; the bottleneck is at the storage layer, not the compute layer.

Practice this question →

97

MCQmedium

A company runs its SAP application on EC2 instances in a private subnet. The SAP application needs to access an on-premises database through a VPN connection. The company wants to improve network performance and reduce latency between the SAP application and the on-premises database. Which action should the company take?

A.Set up AWS Direct Connect between the VPC and on-premises data center.

B.Increase the VPN tunnel bandwidth to 10 Gbps.

C.Create a VPC Peering connection to the on-premises network.

D.Add a NAT Gateway to the private subnet.

AnswerA

Direct Connect provides dedicated, low-latency connection.

Why this answer

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering lower and consistent latency compared to VPN connections that traverse the internet. Option B is incorrect because increasing VPN bandwidth does not reduce latency; latency is primarily affected by distance and internet routing. Option C is incorrect because VPC Peering is used to connect two VPCs, not to connect a VPC to an on-premises network.

Option D is incorrect because a NAT Gateway enables outbound internet access from private subnets and does not provide connectivity to on-premises databases.

Practice this question →

98

MCQmedium

A company runs SAP ERP on AWS with a Sybase ASE database. The database is on an EC2 instance with a single 500 GB gp2 EBS volume. The volume shows 100% credit balance consumption frequently, causing I/O throttling. What should the company do to resolve the throttling?

A.Increase the gp2 volume size to 1,000 GB to gain more I/O credits.

B.Migrate the volume to gp3 with appropriate IOPS and throughput settings.

C.Enable EBS optimization on the EC2 instance.

D.Move the database to Amazon RDS for Sybase ASE.

AnswerB

gp3 volumes provide consistent baseline IOPS and throughput without burst credits, solving the throttling issue.

Why this answer

The gp2 volume's credit balance is fully consumed because the workload's sustained I/O demand exceeds the baseline performance of 500 GB gp2 (1,500 IOPS). Migrating to gp3 (option B) eliminates the credit-bucket model entirely, providing a baseline of 3,000 IOPS and 125 MiB/s throughput regardless of volume size, with the ability to provision higher IOPS and throughput independently without relying on burst credits.

Exam trap

The trap here is that candidates assume increasing gp2 volume size (Option A) is the only way to gain more I/O credits, overlooking that gp3 eliminates the credit model entirely and provides a cost-effective, predictable performance baseline without throttling.

How to eliminate wrong answers

Option A is wrong because increasing gp2 volume size to 1,000 GB would raise the baseline IOPS to 3,000 and increase the credit-earning rate, but it does not eliminate the burst-bucket model; if the workload consistently exceeds baseline, credits will still be depleted and throttling will recur, plus it incurs unnecessary storage cost. Option C is wrong because EBS optimization is a feature that dedicates network bandwidth for EBS traffic between the EC2 instance and EBS volumes; it does not affect the I/O credit balance or burst behavior of a gp2 volume, and the instance likely already has it enabled if it supports the volume size. Option D is wrong because Amazon RDS for Sybase ASE does not exist as a managed service; Sybase ASE is not supported by Amazon RDS, so this option is technically infeasible and would require a different database migration strategy.

Practice this question →

99

MCQeasy

A company is migrating its SAP ERP system to AWS and needs to ensure that the SAP application can communicate with the corporate LDAP server for authentication. The LDAP server is on-premises. Which AWS service should be used to establish a secure connection?

A.AWS Direct Connect

B.VPC Peering

C.AWS Site-to-Site VPN

D.AWS Transit Gateway

AnswerC

Site-to-Site VPN provides a secure IPsec tunnel over the internet.

Why this answer

AWS Site-to-Site VPN creates an encrypted tunnel over the public internet using IPsec, enabling secure communication between the SAP application in the VPC and the on-premises LDAP server. This is the most straightforward and cost-effective option for establishing a secure connection when a dedicated physical link is not required.

Exam trap

The trap here is that candidates often confuse VPC Peering with on-premises connectivity, not realizing that VPC Peering only works between VPCs within AWS and cannot extend to an on-premises network.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect provides a dedicated private physical connection, which is overkill and more expensive for simply securing LDAP traffic; it is typically used for high-bandwidth or low-latency needs. Option B is wrong because VPC Peering connects two VPCs within AWS, not an on-premises network, and does not support VPN or encryption for on-premises connectivity. Option D is wrong because AWS Transit Gateway is a network transit hub that can connect VPCs and on-premises networks, but it requires a VPN or Direct Connect attachment to reach on-premises; it is not a direct replacement for the secure tunnel itself.

Practice this question →

100

MCQmedium

A company runs SAP S/4HANA on AWS and needs to set up a disaster recovery (DR) site in another AWS Region. The RPO is 15 minutes and RTO is 4 hours. The database is SAP HANA. Which approach meets these requirements?

A.Take nightly backups to S3 and restore in the DR region.

B.Use AWS Database Migration Service (DMS) for continuous replication.

C.Enable SAP HANA System Replication across regions.

D.Use AWS Backup for cross-region EBS snapshots.

AnswerC

Supports low RPO and moderate RTO.

Why this answer

SAP HANA System Replication (HSR) is the native SAP mechanism for replicating HANA databases to a secondary site with low RPO (typically seconds to minutes) and supports cross-region asynchronous replication. With an RPO of 15 minutes and RTO of 4 hours, HSR can meet these requirements by continuously shipping log entries to the DR region, enabling a controlled takeover within the RTO window.

Exam trap

The trap here is that candidates often confuse AWS-native replication services (DMS, AWS Backup) with SAP-specific replication mechanisms, assuming any continuous replication tool can handle SAP HANA, when in fact only HSR provides the required log-level consistency and takeover capabilities for a 15-minute RPO.

How to eliminate wrong answers

Option A is wrong because nightly backups to S3 cannot achieve a 15-minute RPO; they only provide point-in-time recovery from the previous night, and restoring a multi-terabyte HANA database from S3 would far exceed the 4-hour RTO. Option B is wrong because AWS DMS does not support SAP HANA as a source for continuous replication; it is designed for heterogeneous database migrations, not native HANA log replication, and cannot maintain HANA-specific transactional consistency. Option D is wrong because AWS Backup cross-region EBS snapshots capture entire volumes at a block level, but they are not application-consistent for SAP HANA (they would require crash recovery) and the snapshot frequency (typically every 1–24 hours) cannot meet a 15-minute RPO.

Practice this question →

101

MCQmedium

A company is planning to migrate its SAP ERP system to AWS. The system uses Oracle Database as its backend. The company wants to minimize licensing costs and administrative overhead. Which AWS database service is most suitable for this migration?

A.Amazon Redshift

B.Amazon DynamoDB

C.Amazon RDS for Oracle

D.Amazon Aurora

AnswerC

RDS for Oracle provides managed Oracle database service.

Why this answer

Amazon RDS for Oracle is the most suitable choice because it directly supports Oracle Database, allowing the company to migrate its existing SAP ERP system with minimal re-architecture. It reduces administrative overhead through automated backups, patching, and replication, while still using the company's existing Oracle licenses (if they choose to bring their own license) to minimize licensing costs.

Exam trap

The trap here is that candidates often assume Amazon Aurora is a drop-in replacement for Oracle due to its high performance and compatibility claims, but Aurora does not support Oracle's proprietary SQL dialect, PL/SQL, or Oracle-specific database features required by SAP ERP.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a columnar data warehouse optimized for analytical queries, not a transactional database for SAP ERP workloads, and it does not support Oracle compatibility or SAP-certified database features. Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database that lacks the relational database capabilities, stored procedures, and ACID transaction support required by SAP ERP with Oracle Database. Option D is wrong because Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database, not Oracle-compatible, and SAP ERP requires Oracle-specific features such as Oracle PL/SQL, Oracle RAC, and Oracle-specific data types that Aurora does not support.

Practice this question →

102

MCQmedium

A company is running SAP S/4HANA on AWS with a high-availability setup using SAP HANA System Replication and a Pacemaker cluster. The cluster consists of two EC2 instances in different Availability Zones, each with an EBS volume for HANA data. The cluster uses a virtual IP address (VIP) managed by the AWS Route 53 health check and failover mechanism. During a recent failover test, the secondary node took over as primary, but the application was unable to connect to the database for several minutes. The investigation reveals that the VIP did not update correctly. The company wants to ensure fast and reliable VIP failover. What should the team do to improve the failover time?

A.Increase the DNS TTL to 300 seconds to reduce lookups and rely on the Pacemaker VIP update.

B.Assign an Elastic IP address to the active node and use a script to reassign it during failover.

C.Reduce the Route 53 health check interval to 10 seconds and lower the DNS TTL to 60 seconds.

D.Place the SAP HANA database behind an internal Network Load Balancer (NLB) and use the NLB's TCP health checks to route traffic to the active instance.

AnswerD

NLB provides fast health checks (every 10 seconds) and immediate traffic rerouting without DNS delays, enabling sub-second failover.

Why this answer

Using an internal Network Load Balancer (NLB) as a database endpoint provides a static IP that can be redirected to the active HANA node. The NLB performs TCP health checks at layer 4 and can detect failure within seconds, rerouting traffic to the healthy secondary instance almost immediately. Option A is incorrect because increasing DNS TTL makes failover slower, not faster.

Option B is incorrect because reassigning an Elastic IP requires API calls that can take tens of seconds. Option C is incorrect because even with a reduced health check interval and low TTL, DNS propagation still introduces delays, and Route 53 health checks are not as fast as NLB health checks.

Practice this question →

103

MCQhard

An SAP system on AWS is using a shared /usr/sap/trans directory mounted on an NFS file server. The file server is an EC2 instance with a standard gp2 EBS volume. During SAP transports, users experience slow response times and occasional timeouts. The system administrator suspects the file server is the bottleneck. Which solution would provide a fully managed, highly available, and performant file share for SAP transport files?

A.Configure multiple EC2 file servers with a load balancer.

B.Replace the EC2 file server with Amazon EFS.

C.Migrate /usr/sap/trans to Amazon FSx for NetApp ONTAP with Multi-AZ deployment.

D.Increase the EBS volume size of the file server to improve throughput.

AnswerC

FSx for NetApp ONTAP provides a fully managed, scalable, and highly available NFS file system ideal for SAP transport files.

Why this answer

Amazon FSx for NetApp ONTAP is a fully managed, high-performance NFS file system that supports Multi-AZ deployment and is SAP-certified for /usr/sap/trans. Option A (multiple EC2 file servers with a load balancer) adds complexity and is not fully managed. Option B (Amazon EFS) can be used but may not provide the same level of performance and features as FSx ONTAP for this use case.

Option D (increasing the EBS volume size) does not address the single point of failure and may not significantly improve throughput.

Practice this question →

104

Multi-Selectmedium

An SAP administrator is troubleshooting a performance issue on an SAP HANA database running on AWS. The HANA data volume is an EBS io1 volume with 10,000 provisioned IOPS. The administrator notices that the average queue length is consistently above 10, and the average latency is 20 ms. Which TWO actions will most likely improve performance?

Select 2 answers

A.Migrate the volume to an instance with NVMe instance store.

B.Increase the provisioned IOPS on the io1 volume to 20,000.

C.Move the database to a larger EC2 instance type that supports higher EBS bandwidth.

D.Configure multiple EBS volumes in a RAID 0 stripe to increase IOPS.

E.Change the volume type to gp3 with 10,000 IOPS.

AnswersB, C

More IOPS reduces queue depth and latency.

Why this answer

Options B and C are correct. Increasing provisioned IOPS on the io1 volume (Option B) directly addresses the high queue length and latency by providing more I/O capacity. Moving the database to a larger EC2 instance type (Option C) increases the dedicated EBS bandwidth, removing a potential throughput bottleneck at the instance level.

Option A (NVMe instance store) is not suitable for persistent SAP HANA data. Option D (RAID 0) can increase IOPS but adds complexity and does not fix insufficient provisioned IOPS or instance bandwidth. Option E (gp3 with 10,000 IOPS) does not increase IOPS compared to the current io1 volume.

Practice this question →

105

MCQeasy

A small business runs its SAP Business One on a single EC2 instance in AWS. The database is SAP HANA, and the application is also on the same instance. The company wants to ensure that in the event of an instance failure, they can quickly restore the system from backups. They take daily EBS snapshots of the root volume and the data volume. One day, the instance fails and becomes unreachable. The IT administrator attempts to launch a new instance from the most recent AMI, but the new instance does not have the same private IP address, causing connectivity issues for the company's on-premises systems that use VPN to connect to the SAP server. The company uses a Site-to-Site VPN connection to the VPC. What should the administrator do to ensure that the private IP address is preserved after recovery?

A.Modify the VPC subnet to use a smaller CIDR range to ensure the IP is available.

B.Create a new AMI from the failed instance and use that AMI to launch a new instance, specifying the same private IP in the subnet.

C.Assign an Elastic IP to the instance and update the VPN configuration to use the Elastic IP.

D.Create an Elastic Network Interface (ENI) with the desired private IP, attach it to the instance, and after failure, detach it from the old instance and attach to the new instance.

AnswerD

ENI retains the private IP and can be moved to another instance.

Why this answer

An Elastic Network Interface (ENI) can retain a fixed private IP address. By creating an ENI with the desired private IP and attaching it to the original instance, after a failure you can detach the ENI from the failed instance (or simply launch a new instance and attach the ENI) to preserve the same private IP. This ensures that the on-premises VPN connection, which relies on that IP, continues to work.

Option A is incorrect because modifying the subnet's CIDR does not guarantee that the specific IP address remains available; it might still be used by another resource or cause routing issues. Option B is incorrect because creating a new AMI from the failed instance does not preserve the private IP; the new instance launched from that AMI will receive a dynamically assigned IP from the subnet unless you specify a static IP, but that is not part of the AMI process. Option C is incorrect because Elastic IP addresses are public IPs; the VPN connection between on-premises and the VPC uses private IP addresses, so using an Elastic IP would not resolve the private IP connectivity issue.

Practice this question →

106

MCQeasy

An administrator receives this error when trying to register an SAP system in AWS Systems Manager. What is the likely cause?

A.The SAP Host Agent is not installed on the EC2 instance.

B.The IAM role assigned to the instance does not have the required permissions.

C.The AWS Systems Manager Agent (SSM Agent) is not running.

D.The SAP system is not installed correctly.

AnswerA

The error message explicitly states that the SAP Host Agent is not installed.

Why this answer

The error occurs because AWS Systems Manager requires the SAP Host Agent to be installed and running on the EC2 instance to register an SAP system. Without the SAP Host Agent, Systems Manager cannot discover or manage the SAP instance, even if the SSM Agent and IAM permissions are correctly configured.

Exam trap

The trap here is that candidates confuse the AWS SSM Agent (required for instance management) with the SAP Host Agent (required for SAP system registration), leading them to incorrectly select the SSM Agent not running as the cause.

How to eliminate wrong answers

Option B is wrong because an IAM role with insufficient permissions would cause a different error, such as 'AccessDenied' or 'UnauthorizedOperation', not a registration failure specific to SAP system discovery. Option C is wrong because if the SSM Agent were not running, the instance itself would not appear in Systems Manager at all, and the error would be about instance connectivity, not SAP registration. Option D is wrong because an incorrectly installed SAP system would produce SAP-specific startup or runtime errors, not a registration failure in Systems Manager, which relies on the SAP Host Agent for discovery.

Practice this question →

107

MCQmedium

Refer to the exhibit. An administrator runs the AWS CLI command shown and receives the output. The instance is running, but the SAP application on the instance is not accessible. Which additional AWS CLI command should the administrator run to troubleshoot the network connectivity?

A.aws ec2 describe-subnets

B.aws ec2 describe-network-interfaces

C.aws ec2 describe-security-groups

D.aws ec2 describe-instances --instance-ids i-0abcd1234efgh5678 --query 'Reservations[0].Instances[0].NetworkInterfaces'

AnswerD

This query returns network interface details including public IP, security groups, etc.

Why this answer

The correct command, `describe-instances` with a filter on `NetworkInterfaces`, retrieves the detailed network interface configuration attached to the specific instance, including the subnet ID, security group IDs, and public/private IP addresses. This allows the administrator to verify whether the instance is attached to the correct subnet and security groups, which are the most common causes of network connectivity issues for an SAP application. The other commands either do not filter to the specific instance or do not provide the necessary network interface details to diagnose the problem.

Exam trap

The trap here is that candidates often choose `describe-security-groups` (Option C) thinking it directly shows the rules, but they forget that without linking the security group to the specific instance's network interface, they cannot confirm which rules are actually applied to that instance, especially when multiple security groups are involved.

How to eliminate wrong answers

Option A is wrong because `describe-subnets` lists all subnets in the VPC but does not show which subnet the specific instance is attached to, so it cannot directly troubleshoot connectivity for that instance. Option B is wrong because `describe-network-interfaces` lists all network interfaces in the account without filtering to the specific instance, making it impractical to isolate the interface associated with the problematic instance. Option C is wrong because `describe-security-groups` lists all security groups but does not show which security groups are attached to the instance's network interface, so it cannot verify the instance-level firewall rules affecting the SAP application.

Practice this question →

108

MCQhard

Refer to the exhibit. An IAM policy is created for an automated script that starts and stops EC2 instances. The script is failing to stop an instance with the tag 'Environment: non-production'. What is the most likely cause?

A.The EC2 instance does not have the tag 'Environment' with value 'non-production'.

B.The policy does not include ec2:StopInstances action.

C.The policy does not allow ec2:Describe* actions for instances.

D.The condition is applied to the ec2:StartInstances action but not ec2:StopInstances.

AnswerA

The condition requires the instance to have that exact tag; otherwise, the action is denied.

Why this answer

The IAM policy is configured with a condition that requires the EC2 instance to have the tag 'Environment' with value 'non-production' for both StartInstances and StopInstances actions. If the instance does not have this exact tag, the action is denied. Option B is incorrect because the policy likely includes the ec2:StopInstances action, but the condition is not met.

Option C is incorrect because the policy does not require ec2:Describe* actions for the stop operation to work. Option D is incorrect because the condition is applied equally to both StartInstances and StopInstances.

Exam trap

The trap is that candidates may assume a lack of ec2:StopInstances action is the cause, but the policy actually includes it; the issue is the tag condition not being satisfied.

Practice this question →

109

MCQmedium

An SAP administrator attaches the above IAM policy to a user. What actions can the user perform?

A.Describe, start, and stop EC2 instances, but not terminate them.

B.Perform all EC2 actions including terminate.

C.Only describe EC2 instances.

D.Only start and stop instances.

AnswerA

Allow actions include describe, start, stop; deny overrides for terminate.

Why this answer

The IAM policy explicitly allows ec2:Describe*, ec2:StartInstances, and ec2:StopInstances actions, but does not include ec2:TerminateInstances. Therefore, the user can describe, start, and stop EC2 instances, but cannot terminate them. The Deny effect on ec2:TerminateInstances is not present, but the absence of an Allow means the action is implicitly denied.

Exam trap

The trap here is that candidates may assume the wildcard ec2:Describe* also covers start/stop/terminate actions, but it only grants read-only Describe permissions, not lifecycle management actions.

How to eliminate wrong answers

Option B is wrong because the policy does not grant ec2:TerminateInstances, so the user cannot perform all EC2 actions including terminate. Option C is wrong because the policy also allows StartInstances and StopInstances, not just Describe actions. Option D is wrong because the policy includes Describe actions in addition to Start and Stop, so the user can also describe instances.

Practice this question →

110

MCQeasy

A company is deploying SAP NetWeaver on AWS and needs to configure the SAP application server instances for high availability. Which AWS feature is used to distribute traffic across multiple application server instances in different Availability Zones?

A.Auto Scaling group

B.Amazon Route 53 weighted routing

C.Application Load Balancer

D.NAT Gateway

AnswerC

ALB distributes traffic across instances in multiple AZs.

Why this answer

The Application Load Balancer (ALB) is the correct AWS service for distributing traffic across multiple SAP application server instances in different Availability Zones. ALB operates at Layer 7, supports health checks, and can route HTTP/HTTPS traffic to target groups spanning multiple AZs, which is essential for SAP NetWeaver's stateless application layer high availability.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) with application-layer load balancing, not realizing that Route 53 weighted routing lacks health-check-aware traffic distribution and session persistence, which are required for SAP high availability.

How to eliminate wrong answers

Option A is wrong because Auto Scaling groups manage instance scaling and replacement, not traffic distribution; they can be used with a load balancer but do not route traffic themselves. Option B is wrong because Amazon Route 53 weighted routing distributes DNS traffic across endpoints but does not perform health-check-aware load balancing at the application layer; it can cause uneven traffic distribution due to DNS caching and does not handle session persistence required for SAP. Option D is wrong because a NAT Gateway provides outbound internet access for instances in private subnets and has no role in distributing inbound application traffic.

Practice this question →

111

Multi-Selecthard

A company is migrating its SAP ECC system to SAP S/4HANA on AWS. The current database is running on Oracle. They want to minimize downtime during the migration. Which TWO services or features should they consider to achieve a near-zero downtime migration? (Select TWO.)

Select 2 answers

A.Use AWS Snowball to transfer the initial Oracle data dump to AWS.

B.Use SAP HANA System Replication (HSR) for the final synchronization.

C.Use EC2 Hibernate to pause the source instance during cutover.

D.Use AWS Database Migration Service (DMS) for ongoing replication from Oracle to HANA.

E.Use Amazon EBS Snapshots for point-in-time recovery and replication.

AnswersA, D

Snowball is for offline data transfer, not for near-zero downtime.

Why this answer

To achieve near-zero downtime migration from Oracle to SAP HANA on AWS, two key services are recommended: AWS Snowball for the initial bulk data transfer to AWS, and AWS Database Migration Service (DMS) for ongoing replication of changes from Oracle to HANA. SAP HANA System Replication (HSR) is used for replication between two HANA systems, not for heterogeneous migration from Oracle. EC2 Hibernate and EBS Snapshots are not designed for live database migration across different engines.

Exam trap

A common mistake is thinking that SAP HANA System Replication can be used for migrating from Oracle to HANA. HSR only works between HANA databases, not for cross-platform replication. Also, EC2 Hibernate cannot facilitate database migration.

Practice this question →

112

MCQeasy

A company is running SAP on AWS and needs to encrypt all data at rest for the SAP HANA database. Which AWS service should be used to manage the encryption keys?

A.AWS CloudHSM

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.AWS Certificate Manager (ACM)

AnswerB

KMS is used to manage encryption keys for data at rest.

Why this answer

AWS Key Management Service (KMS) is the correct service for managing encryption keys for SAP HANA on AWS because it provides a centralized, highly available key management system that integrates directly with AWS services and supports envelope encryption. For SAP HANA, KMS can be used to encrypt the EBS volumes, S3 buckets, or other storage where HANA data resides, and it allows you to control key rotation, access policies, and auditing via AWS CloudTrail, meeting the requirement to encrypt data at rest.

Exam trap

The trap here is that candidates confuse AWS CloudHSM with KMS, thinking that because CloudHSM provides dedicated HSMs it must be the correct choice for key management, but the question specifically asks for a service to 'manage' encryption keys, which is KMS's core function, while CloudHSM is a raw HSM service that requires manual key management and lacks native integration with AWS storage services for transparent encryption.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for generating and storing keys, but it is not a key management service; it requires you to manage the HSM cluster and client software yourself, and it does not natively integrate with SAP HANA or AWS services for automatic encryption of data at rest without custom development. Option C is wrong because AWS Secrets Manager is designed to manage and rotate secrets such as database credentials, API keys, and passwords, not to manage encryption keys for data-at-rest encryption; it stores secrets but does not perform encryption operations or integrate with storage services for transparent encryption. Option D is wrong because AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates for securing network communications, not for managing encryption keys for data at rest; it does not provide key management for storage encryption.

Practice this question →

113

Multi-Selectmedium

Which THREE factors should be considered when selecting an EC2 instance type for an SAP HANA production system? (Choose three.)

Select 3 answers

A.The instance type must have sufficient memory capacity for the HANA database.

B.The instance type must provide adequate network bandwidth for replication and backups.

C.The instance type must have GPU acceleration for HANA analytics.

D.The instance type must be certified by SAP for SAP HANA.

E.The instance type must have a high number of vCPUs regardless of memory.

AnswersA, B, D

HANA is memory-intensive.

Why this answer

SAP HANA is an in-memory database that loads all data into RAM for processing, so the EC2 instance must have sufficient memory capacity to accommodate the HANA database size, including overhead for operations and growth. AWS provides specific EC2 instance types (e.g., x1e, x1, r5, u-6tb1) with large memory configurations tailored for SAP HANA workloads.

Exam trap

The trap here is that candidates may assume GPU acceleration (option C) is needed for HANA analytics due to the term 'analytics,' but SAP HANA does not leverage GPUs; instead, it uses CPU SIMD instructions and memory bandwidth for high-performance query processing.

Practice this question →

114

MCQhard

An SAP administrator uses an IAM role attached to an EC2 instance to perform backups. The backup script fails when trying to write to an S3 bucket and create EBS snapshots. What is the most likely cause?

A.The S3 bucket policy denies all writes from this role.

B.The trust policy does not include the EC2 service principal.

C.The role does not have permission to create snapshots due to an explicit deny.

D.The policy lacks 's3:ListBucket' and 'ec2:CreateSnapshot' requires volume ARN.

AnswerB

Correct. Without the EC2 service principal in the trust policy, the instance cannot assume the role, causing all API calls to fail.

Why this answer

The most likely cause is that the trust policy of the IAM role does not include the EC2 service principal (ec2.amazonaws.com). Without this, the EC2 instance cannot assume the role, causing all AWS API calls from the backup script to fail, including writing to S3 and creating EBS snapshots. Options A and C only affect specific actions, and D incorrectly includes s3:ListBucket as a requirement.

Exam trap

Candidates often focus on missing S3 or EC2 permissions but overlook the prerequisite trust policy. If the instance cannot assume the role, no permissions are applied.

How to eliminate wrong answers

Option A is wrong because a bucket policy that denies all writes from this role would explicitly block writes, but the question states the script fails when trying to write and create snapshots, implying a broader permission issue rather than a targeted deny. Option B is wrong because the trust policy already allows the EC2 service principal to assume the role (the role is attached to the EC2 instance), so the trust policy is not the cause. Option C is wrong because an explicit deny for snapshot creation would cause a failure, but the question's scenario points to missing permissions (not an explicit deny) as the root cause, and the error is more likely due to missing resource ARN requirements.

Practice this question →

115

MCQhard

An SAP system is experiencing high CPU utilization on the application server. CloudWatch metrics show that the CPU credit balance for the T3 instance is frequently depleted. What is the most cost-effective solution to resolve this issue while maintaining performance?

A.Add more vCPUs by changing to a C5 instance.

B.Enable T3 unlimited on the instance.

C.Change the instance type to M5.large.

D.Increase the size of the EBS volumes.

AnswerB

T3 unlimited allows the instance to burst beyond the baseline, paying extra only when credits are exhausted, which is cost-effective for intermittent spikes.

Why this answer

Enabling T3 unlimited allows the instance to burst beyond its baseline CPU utilization by spending credits, and when credits are exhausted, it can still burst by incurring a small additional charge per vCPU-hour. This is the most cost-effective solution as it avoids the need to migrate to a larger or different instance type, while maintaining performance for the SAP system's variable workloads.

Exam trap

The trap here is that candidates often assume the only way to fix CPU credit exhaustion is to move to a larger or non-burstable instance, overlooking the cost-effective T3 unlimited feature that allows continued bursting with minimal additional cost.

How to eliminate wrong answers

Option A is wrong because changing to a C5 instance adds more vCPUs and increases cost unnecessarily; the issue is not a lack of vCPUs but the T3 instance's credit exhaustion, which is a burstable performance limitation. Option C is wrong because changing to an M5.large instance is a larger, non-burstable instance type that would increase cost without addressing the root cause of credit depletion; it may also provide more baseline CPU than needed, leading to wasted resources. Option D is wrong because increasing EBS volume size does not affect CPU credit balance or CPU utilization; it addresses storage performance, not compute performance.

Practice this question →

116

Multi-Selectmedium

Which AWS service can be used to monitor the performance of SAP HANA databases running on EC2 instances?

Select 1 answer

A.Amazon CloudWatch

B.Amazon Inspector

C.Amazon RDS Performance Insights

D.AWS X-Ray

E.AWS Config

AnswersA

Correct – Amazon CloudWatch can monitor EC2-hosted SAP HANA via custom metrics.

Why this answer

Amazon CloudWatch is the primary AWS service for monitoring the performance of SAP HANA databases on EC2. It can collect custom metrics such as CPU utilization, memory usage, disk I/O, and SAP HANA-specific metrics (e.g., row store memory, column store memory) via the CloudWatch agent or monitoring scripts. The other listed services (Inspector, RDS Performance Insights, X-Ray, Config) are not designed for or capable of directly monitoring self-managed SAP HANA database performance on EC2.

Exam trap

The original question implied two services, but only one AWS service in the list (CloudWatch) is suitable for SAP HANA performance monitoring. Avoid forcing a second answer where none exists; RDS Performance Insights, for example, is exclusive to Amazon RDS and cannot monitor self-managed databases on EC2.

Practice this question →

117

MCQeasy

An SAP system on AWS needs to be highly available across two Availability Zones. The application tier runs on EC2 instances behind an Application Load Balancer. The database tier uses an RDS Multi-AZ deployment. What additional step is REQUIRED to ensure complete high availability for the application tier?

A.Use a larger EC2 instance type.

B.Launch EC2 instances in at least two different Availability Zones.

C.Enable EBS Multi-Attach for the root volumes.

D.Configure an Auto Scaling group with a dynamic scaling policy.

AnswerB

Ensures application survives AZ failure.

Why this answer

For the application tier to be highly available across two Availability Zones, EC2 instances must be distributed across at least two AZs so that if one AZ fails, the Application Load Balancer can route traffic to instances in the other AZ. Option B directly addresses this requirement. Without instances in multiple AZs, the application tier remains a single point of failure, even if the ALB and RDS Multi-AZ are configured correctly.

Exam trap

The trap here is that candidates often assume an Auto Scaling group (Option D) automatically provides high availability across AZs, but without explicitly configuring subnets in multiple AZs and a multi-AZ distribution strategy, the Auto Scaling group could launch all instances in a single AZ, leaving the application tier vulnerable.

How to eliminate wrong answers

Option A is wrong because using a larger EC2 instance type improves performance and capacity but does not provide fault tolerance across AZs; a single large instance in one AZ still fails if that AZ goes down. Option C is wrong because EBS Multi-Attach is not supported for root volumes of EC2 instances (it is only available for specific EBS volume types like io1/io2 and is intended for clustered workloads, not for boot volumes), and it does not address cross-AZ high availability. Option D is wrong because an Auto Scaling group with a dynamic scaling policy helps with elasticity and capacity management but does not inherently ensure instances are launched in multiple AZs unless the Auto Scaling group is explicitly configured with subnets in at least two AZs; the question asks for a required step to ensure complete high availability, and simply configuring an Auto Scaling group without specifying multi-AZ subnets would not guarantee cross-AZ distribution.

Practice this question →

118

MCQmedium

An SAP HANA system is deployed on AWS with a cluster of EC2 instances. The system requires high network throughput between the nodes for HANA scale-out. Which EC2 networking feature should be used?

A.Use multiple Elastic Network Interfaces (ENIs) per instance.

B.Enable Elastic Network Adapter (ENA) support on the instances.

C.Use the Intel 82599 VF (ixgbevf) driver for enhanced networking.

D.Place all nodes in a cluster placement group.

AnswerB

ENA provides high throughput and low latency, essential for HANA scale-out.

Why this answer

For SAP HANA scale-out clusters requiring high network throughput between EC2 instances, the correct feature is Elastic Network Adapter (ENA) support. ENA is a custom network interface optimized for high-throughput and low-latency packet processing, providing up to 100 Gbps of network bandwidth on supported instance types. This directly meets the performance demands of HANA's inter-node communication.

Exam trap

The trap here is that candidates often confuse 'enhanced networking' with the older ixgbevf driver or think that multiple ENIs or placement groups alone can solve throughput bottlenecks, but only ENA provides the high-bandwidth, low-latency performance required for modern HANA scale-out workloads.

How to eliminate wrong answers

Option A is wrong because using multiple Elastic Network Interfaces (ENIs) per instance does not inherently increase network throughput; it only provides additional IP addresses and separate network paths, but the aggregate bandwidth is still limited by the instance's underlying hardware and ENA support. Option C is wrong because the Intel 82599 VF (ixgbevf) driver is an older enhanced networking driver for instances using the Intel 82599 Virtual Function, which supports only up to 10 Gbps and is not available on modern instance types; it lacks the performance and features of ENA. Option D is wrong because placing all nodes in a cluster placement group reduces network latency and provides up to 10 Gbps of single-flow bandwidth, but it does not increase the maximum network throughput beyond the instance's capabilities; ENA is required to achieve the higher throughput needed for HANA scale-out.

Practice this question →

119

MCQeasy

A company is deploying an SAP BusinessObjects (BOBJ) platform on AWS. The platform consists of multiple web application servers, a CMS database, and an audit database. The company wants to ensure high availability for the CMS database using native SAP tools. Which AWS service should be used to host the CMS database to facilitate the use of SAP's native replication?

A.Amazon RDS

B.Amazon DynamoDB

C.Amazon ElastiCache

D.Amazon S3

AnswerA

RDS supports the databases used by BOBJ CMS and provides Multi-AZ for high availability.

Why this answer

Amazon RDS is the correct choice because it provides managed relational database instances that support database engines like SQL Server and Oracle, which are compatible with SAP BusinessObjects CMS. RDS offers Multi-AZ deployments for high availability and can be used with SAP's native database replication methods such as log shipping or Always On availability groups, meeting the high availability requirement without managing the underlying infrastructure. DynamoDB, ElastiCache, and S3 are not relational databases and do not support the native replication tools needed for the CMS database.

Exam trap

The AWS SAP on AWS Specialty exam often tests the misconception that any AWS database service can host SAP workloads, but the trap here is that candidates might choose DynamoDB or ElastiCache because they are 'highly available' by default, ignoring that SAP BusinessObjects CMS requires a relational database with native replication support.

How to eliminate wrong answers

Option B (Amazon DynamoDB) is wrong because it is a NoSQL key-value and document database that does not support the relational database features required by SAP BusinessObjects CMS, such as stored procedures, triggers, or native SAP replication tools. Option C (Amazon ElastiCache) is wrong because it is an in-memory caching service (Redis or Memcached) that cannot persist the CMS database schema or support SAP's native replication for high availability. Option D (Amazon S3) is wrong because it is an object storage service, not a relational database, and cannot host a CMS database or provide the transactional consistency and replication capabilities needed for SAP BusinessObjects.

Practice this question →

120

MCQeasy

An SAP system is running on EC2 with a single Availability Zone. The company needs to increase availability for the SAP application layer. Which is the most cost-effective and reliable approach?

A.Deploy a second EC2 instance in the same AZ and configure a Route 53 weighted routing policy.

B.Use an Auto Scaling group with EC2 instances in two Availability Zones behind an Application Load Balancer.

C.Use a multi-AZ RDS database and keep the application on a single EC2 instance.

D.Use an EC2 instance in a different region and use Route 53 latency-based routing.

AnswerB

Auto Scaling with multiple AZs provides cost-effective high availability and load distribution.

Why this answer

It distributes the SAP application layer across multiple EC2 instances in two Availability Zones behind an Application Load Balancer, providing both high availability and fault tolerance. The Auto Scaling group ensures that the desired number of instances are maintained even if an instance or an entire AZ fails, while the ALB performs health checks and routes traffic only to healthy instances. This approach is cost-effective as it avoids over-provisioning and only scales based on demand, and it is reliable because it eliminates a single point of failure at the application tier.

Exam trap

The trap here is that candidates may assume that simply adding a second instance in the same AZ (Option A) or using a multi-AZ database (Option C) is sufficient for application-layer high availability, but they overlook that the application tier itself must be distributed across multiple AZs to survive an AZ outage.

How to eliminate wrong answers

Option A is wrong because deploying a second EC2 instance in the same Availability Zone does not protect against an AZ failure; if the AZ goes down, both instances become unavailable, and Route 53 weighted routing alone cannot provide automatic failover or health-based routing. Option C is wrong because it only addresses database high availability via multi-AZ RDS, but the application layer remains on a single EC2 instance, which is a single point of failure; the question specifically asks about increasing availability for the SAP application layer, not the database. Option D is wrong because using a different region introduces significant latency for an SAP system, which is latency-sensitive, and Route 53 latency-based routing does not provide automatic failover or health checks; additionally, cross-region replication for SAP is complex and not cost-effective for the application layer alone.

Practice this question →

121

Multi-Selecthard

A company is running an SAP S/4HANA system on AWS. The system uses an SAP HANA database with a current size of 1.5 TB. The company wants to implement a backup strategy that allows point-in-time recovery (PITR) with an RPO of 5 minutes and an RTO of 4 hours. The backup must be stored in Amazon S3. Which combination of steps should the company take? (Choose TWO.)

Select 2 answers

A.Schedule full backups every 12 hours and log backups every 2 hours.

B.Configure log backup to run every 5 minutes using Backint.

C.Install and configure the SAP HANA Backint agent to stream full and log backups to Amazon S3.

D.Use Amazon EBS snapshots of the HANA data volume as the primary backup mechanism.

E.Set up SAP HANA System Replication to a second instance in another Availability Zone.

AnswersB, C

5-minute log backups meet the RPO.

Why this answer

The correct options are B and C. Option B configures log backups every 5 minutes using Backint, achieving the required RPO of 5 minutes. Option C installs the Backint agent to stream both full and log backups to Amazon S3, meeting the storage requirement.

Option A is incorrect because a 2-hour log backup interval exceeds the 5-minute RPO. Option D is incorrect because EBS snapshots provide volume-level recovery, not point-in-time database recovery. Option E is incorrect because SAP HANA System Replication is for high availability, not backup.

Practice this question →

122

MCQhard

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

A.Use AWS Config rules to detect noncompliant buckets and send notifications.

B.Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.

C.Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.

D.Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.

AnswerC

SCPs apply to all accounts in the OU and can prevent noncompliant bucket creation, including by the root user.

Why this answer

Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Exam trap

The trap here is that candidates often choose detective controls like AWS Config (Option A) or account-level IAM policies (Option B) because they are familiar with them, failing to recognize that only SCPs provide preventive, organization-wide enforcement that cannot be bypassed by account administrators.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can only detect noncompliant buckets after they are created and send notifications, but they do not prevent the violation from occurring. Option B is wrong because IAM policies are account-specific and can be overridden by account administrators with full administrative privileges, making them unreliable for organization-wide enforcement. Option D is wrong because CloudFormation StackSets can deploy templates that create buckets with encryption, but they do not prevent users from creating buckets outside of CloudFormation or modifying existing buckets to remove encryption.

Practice this question →

123

MCQeasy

An SAP administrator needs to back up SAP HANA database to Amazon S3. Which AWS service or feature should be used to automate this backup?

A.Amazon EBS snapshots

B.SAP HANA Backup and Recovery with Backint

C.AWS Backup

D.S3 Lifecycle policies

AnswerB

Backint enables HANA to backup directly to S3.

Why this answer

The SAP HANA Backup and Recovery feature can back up directly to S3 via the Backint agent. Option A is incorrect because EBS snapshots capture the entire volume, not just the HANA database, and are not SAP HANA-aware. Option C is incorrect because AWS Backup supports some databases but not SAP HANA directly.

Option D is incorrect because S3 Lifecycle policies manage object retention, not backup initiation.

Practice this question →

124

Multi-Selecteasy

A company is planning to run SAP NetWeaver on AWS and needs to ensure that the system is highly available. Which TWO AWS services should be combined to achieve HA for the SAP central services (ASCS/SCS) and the database? (Choose TWO.)

Select 2 answers

A.Elastic Load Balancing (ELB) to distribute traffic across multiple application server instances.

B.Amazon CloudFront to cache static content.

C.Amazon EC2 Auto Recovery to automatically recover the instance hosting ASCS/SCS if it becomes impaired.

D.Amazon S3 to store the SAP system configuration files.

E.Amazon Route 53 health checks with failover routing.

AnswersA, C

ELB provides load balancing and failover for application servers.

Why this answer

Elastic Load Balancing (ELB) is correct because it distributes incoming traffic across multiple SAP application server (AS) instances, ensuring that if one AS fails, the ELB redirects traffic to healthy instances. This provides high availability for the SAP application tier, which is essential for the overall system's resilience.

Exam trap

The trap here is that candidates often confuse DNS-level failover (Route 53) with instance-level recovery (Auto Recovery), or they think CloudFront or S3 can provide HA for SAP services, when in fact only Auto Recovery directly addresses the recovery of a single impaired instance hosting ASCS/SCS.

Practice this question →

125

MCQhard

An SAP administrator runs the command `aws ec2 describe-volumes --volume-id vol-0abc1234` and sees the following output: ``` { "Volumes": [ { "VolumeId": "vol-0abc1234", "Size": 100, "VolumeType": "io2", "Iops": 10000, "State": "available", "MultiAttachEnabled": false, "Attachments": [] } ] } ``` The EC2 instance i-0a1b2c3d4e5f6g7h8 is stopped. What will happen if the administrator attempts to start the instance?

A.The instance will fail to start because the volume type is not supported.

B.The instance will start successfully and the volume will be attached.

C.The instance will start but the volume will not attach because multi-attach is disabled.

D.The instance will start but the volume will be read-only.

AnswerC

Correct. The instance will start, but the volume will not be attached because it is currently detached and must be attached explicitly.

Why this answer

The volume is in 'available' state, meaning it is not attached to any instance. Starting a stopped instance does not automatically attach a detached volume; the volume must be manually attached. Therefore, the instance will start successfully but the volume will not be attached, making option C correct.

Exam trap

The trap here is that candidates may assume a stopped instance with a detached volume will fail to start or that the volume type (io2 with 10,000 IOPS) imposes restrictions, when in fact io2 volumes with up to 32,000 IOPS are universally supported and the instance will start normally regardless of the volume's attachment state.

How to eliminate wrong answers

Option A is wrong because gp3 is a fully supported EBS volume type for all EC2 instance families, and there is no restriction that would cause a start failure due to volume type. Option C is wrong because multi-attach is only relevant for io1/io2 volumes and is not required for a single attachment; a gp3 volume can be attached to one instance without multi-attach enabled. Option D is wrong because EBS volumes attached to an EC2 instance are not read-only by default; they are read-write unless explicitly mounted as read-only in the OS, which is not determined by the volume type or attachment method.

Practice this question →

126

MCQmedium

An SAP Basis administrator needs to migrate an on-premises SAP ERP system running on Oracle to AWS. The system has a 2 TB database and requires minimal downtime (less than 1 hour). The current on-premises network bandwidth to AWS is 1 Gbps. Which migration strategy is MOST appropriate?

A.Export the database using SAP HANA System Replication (HSR) to an Amazon EC2 instance with HANA.

B.Perform a manual export/import using Oracle Data Pump and transfer the dump file via AWS Direct Connect.

C.Use AWS Application Migration Service (MGN) to replicate the entire server to AWS, then cut over.

D.Use AWS Database Migration Service (DMS) with ongoing replication from Oracle to Amazon RDS for Oracle, then perform a final cutover.

AnswerD

DMS supports ongoing replication, enabling minimal downtime cutover.

Why this answer

AWS DMS with ongoing replication from Oracle to Amazon RDS for Oracle is the most appropriate strategy because it supports minimal downtime (less than 1 hour) by continuously replicating changes from the source Oracle database to the target RDS instance, allowing a short final cutover window. The 1 Gbps bandwidth is sufficient for the initial full load of a 2 TB database when using DMS's optimized data transfer, and the target RDS for Oracle provides a fully managed Oracle-compatible environment suitable for SAP ERP workloads.

Exam trap

The trap here is that candidates often assume a manual export/import (Option B) is the simplest approach, but they overlook the time constraint of a 2 TB database over 1 Gbps, which makes it impossible to achieve less than 1 hour downtime, while DMS's CDC capability is the key to meeting that requirement.

How to eliminate wrong answers

Option A is wrong because SAP HANA System Replication (HSR) is designed for SAP HANA databases, not for Oracle databases, and the source system runs on Oracle, making this option technically incompatible. Option B is wrong because a manual export/import using Oracle Data Pump with a 2 TB dump file over 1 Gbps bandwidth would take significantly longer than 1 hour (approximately 4.5 hours at theoretical max), failing the minimal downtime requirement. Option C is wrong because AWS Application Migration Service (MGN) replicates the entire server at the block level, which would require a full server conversion and does not natively handle Oracle-to-Oracle database replication with minimal downtime for an SAP ERP system; it also lacks the fine-grained database-level change capture needed for a sub-hour cutover.

Practice this question →

127

Multi-Selectmedium

A company is running an SAP NetWeaver system on AWS. The system includes a primary application server (PAS) and a dialog instance. The administrator wants to monitor the SAP system health using Amazon CloudWatch. Which THREE metrics should be monitored to proactively detect performance issues? (Choose THREE.)

Select 3 answers

A.EBS Volume Queue Length

B.EC2 SwapUsage (as custom metric)

C.EC2 CPU Utilization

D.EC2 NetworkIn

E.SAP work process usage (via SAP monitoring)

AnswersA, C, E

High queue length indicates I/O requests waiting, often a sign of storage bottleneck.

Why this answer

EBS Volume Queue Length is a critical metric for SAP workloads because it directly indicates I/O latency. A high queue length means the storage subsystem cannot keep up with the SAP database or application server I/O requests, which can cause transaction delays and system hangs. Monitoring this metric allows proactive detection of storage bottlenecks before they impact SAP performance.

Exam trap

The trap here is that candidates often focus on CPU and memory metrics (like SwapUsage) because they are common in general server monitoring, but for SAP on AWS, storage I/O performance (EBS Queue Length) and SAP-specific work process utilization are more directly tied to application responsiveness and must be included alongside CPU Utilization.

Practice this question →

128

Multi-Selectmedium

Which THREE factors should be considered when choosing an EC2 instance type for an SAP HANA production system? (Choose three.)

Select 3 answers

A.GPU capabilities for parallel processing.

B.Amount of memory (RAM) required.

C.Network throughput and latency.

D.Support for EBS optimization.

E.Processor architecture (Intel/AMD vs ARM).

AnswersB, C, E

HANA is memory-intensive.

Why this answer

SAP HANA is an in-memory database that loads all data into RAM for processing, making memory the primary determinant of instance sizing. The amount of RAM required directly dictates the EC2 instance family and size, as SAP HANA certified instances are specifically validated for memory-to-vCPU ratios and total memory capacity.

Exam trap

The trap here is that candidates may mistakenly choose GPU capabilities (Option A) due to confusion with machine learning or HPC workloads, or select EBS optimization (Option D) as a primary factor, when in reality SAP HANA's memory-centric design and certification requirements make RAM, network performance, and processor architecture the decisive criteria.

Practice this question →

129

MCQmedium

A company is running SAP ERP on AWS and wants to reduce costs by right-sizing the EC2 instances. The administrator has identified that the current instances are over-provisioned for CPU and memory. Which AWS service can provide recommendations for instance type changes based on historical usage?

A.AWS Trusted Advisor

B.AWS Compute Optimizer

C.Amazon CloudWatch

D.AWS Cost Explorer

AnswerB

Compute Optimizer uses machine learning to recommend optimal AWS resources.

Why this answer

AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, I/O, network) from Amazon CloudWatch and provides actionable recommendations for right-sizing EC2 instances, including instance type changes. For SAP ERP workloads, it can identify over-provisioned instances by comparing actual usage patterns against the performance characteristics of different instance families, directly addressing the goal of reducing costs without compromising performance.

Exam trap

The trap here is that candidates confuse AWS Trusted Advisor's general cost optimization checks (which include idle instance detection) with Compute Optimizer's specific right-sizing recommendations based on historical utilization, leading them to select Trusted Advisor instead of the service designed for this exact purpose.

How to eliminate wrong answers

Option A (AWS Trusted Advisor) is wrong because it provides general cost optimization checks (e.g., idle instances, reserved instance coverage) but does not analyze historical CPU/memory utilization to recommend specific instance type changes; its recommendations are based on static rules, not machine learning on usage patterns. Option C (Amazon CloudWatch) is wrong because it is a monitoring and observability service that collects and stores metrics and logs, but it does not generate instance type recommendations; it provides the raw data that Compute Optimizer uses, but lacks the analysis engine to produce right-sizing suggestions. Option D (AWS Cost Explorer) is wrong because it focuses on visualizing and analyzing historical cost and usage data (e.g., spend trends, reserved instance recommendations), not on analyzing EC2 instance performance metrics to recommend instance type changes for right-sizing.

Practice this question →

130

Multi-Selecteasy

A company is running SAP HANA on an EC2 instance. The administrator needs to ensure that the instance is resilient to an Availability Zone failure. Which actions should the administrator take? (Choose TWO.)

Select 2 answers

A.Configure Auto Scaling to automatically launch a new instance in another AZ.

B.Use Amazon CloudWatch to monitor instance health and trigger a recovery.

C.Set up SAP HANA System Replication between instances in two Availability Zones.

D.Deploy a second HANA instance in a different AZ and configure replication.

E.Take daily EBS snapshots of the HANA data volume.

AnswersC, D

HSR provides data replication across AZs.

Why this answer

SAP HANA System Replication (HSR) provides synchronous or asynchronous replication of the HANA database to a secondary instance in a different Availability Zone (AZ). This ensures that if the primary AZ fails, the secondary instance can be promoted to primary with minimal data loss, meeting the resilience requirement. HSR is the native SAP mechanism for disaster recovery across AZs and is fully supported on AWS.

Exam trap

The trap here is that candidates often confuse instance-level recovery (e.g., CloudWatch recovery or Auto Scaling) with database-level replication, failing to recognize that SAP HANA requires a dedicated replication mechanism like HSR to maintain data consistency across AZs.

Practice this question →

131

MCQeasy

Refer to the exhibit. A CloudFormation template is used to launch an EC2 instance for SAP. The instance launches but the root volume is only 50 GB. The SAP installation requires at least 100 GB for the root volume. How should the template be modified?

A.Change VolumeSize from 50 to 100 in the BlockDeviceMapping.

B.Change the InstanceType to a larger instance.

C.Modify the running instance's root volume size using the AWS Management Console.

D.Change the ImageId to an AMI with a larger root volume.

AnswerA

Increasing the VolumeSize value will allocate a larger root volume.

Why this answer

The CloudFormation template explicitly defines the root volume size in the BlockDeviceMapping property. By changing VolumeSize from 50 to 100, the template will provision a new EC2 instance with a 100 GB root volume, meeting the SAP installation requirement. The BlockDeviceMapping overrides the default root volume size from the AMI, so this is the precise way to control volume size at launch.

Exam trap

This question tests the misconception that changing the instance type or AMI alone can adjust root volume size, when in fact the BlockDeviceMapping is the explicit mechanism to control root volume size at launch.

How to eliminate wrong answers

Option B is wrong because changing the InstanceType to a larger instance does not affect the root volume size; instance types control CPU, memory, and network performance, not storage capacity. Option C is wrong because modifying the running instance's root volume size using the AWS Management Console requires stopping the instance and detaching the volume, which is not a template modification and does not address the root cause in the CloudFormation code. Option D is wrong because changing the ImageId to an AMI with a larger root volume is unreliable and unnecessary; AMIs have a default root volume size that can be overridden by BlockDeviceMapping, and the correct approach is to adjust the template parameter rather than depend on a different AMI.

Practice this question →

132

MCQmedium

A company uses SAP BusinessObjects (BO) on AWS. The BO servers run on EC2 instances in a private subnet. Users access the BI Launch Pad through an Application Load Balancer (ALB) in a public subnet. The company recently received a security audit finding that the ALB is accessible from the internet on port 443, but the security group allows inbound traffic from 0.0.0.0/0. The audit requires that only the company's corporate IP range (203.0.113.0/24) should be allowed. Additionally, the company wants to reduce the attack surface by blocking traffic from other IPs. What should the company do to meet the security requirement?

A.Deploy AWS WAF on the ALB and create a rule to allow only the corporate IP range.

B.Modify the security group attached to the ALB to allow only inbound traffic from 203.0.113.0/24 on port 443.

C.Replace the security group with a network ACL on the ALB subnet to allow only the corporate IP range.

D.Move the ALB to a private subnet and use a VPN for user access.

AnswerB

Security groups can restrict traffic by source IP.

Why this answer

The correct answer because modifying the security group attached to the ALB to restrict inbound traffic on port 443 to only the corporate IP range (203.0.113.0/24) is the most direct and effective way to meet the requirement. Security groups are stateful and can enforce IP-based restrictions. Option A is not the best choice because AWS WAF is not necessary for simple IP allowlisting; it's more suited for complex rules like rate limiting or SQL injection prevention.

Option C is incorrect because while a network ACL can also restrict traffic, it is stateless and requires separate inbound and outbound rules, and it applies to the subnet rather than the ALB directly, which is less granular. Option D is unnecessary because moving the ALB to a private subnet would block all internet traffic, preventing even corporate users from accessing BI Launch Pad without additional VPN setup, which is more complex than needed.

Practice this question →

133

MCQmedium

A company is running SAP on AWS and needs to back up the SAP HANA database daily. The database is 1 TB in size and the backup must be completed within 2 hours. The backup will be stored in Amazon S3. Which approach provides the fastest backup time while minimizing cost?

A.Copy the backup files to an EC2 instance store, then upload to S3

B.Take EBS snapshots of the volume

C.Use the SAP HANA Backint agent to stream backups directly to S3

D.Mount an Amazon EFS file system and write backups to it

AnswerC

Backint is optimized for HANA backup to S3, fast and cost-effective.

Why this answer

The SAP HANA Backint agent is the native, certified integration for SAP HANA backups to Amazon S3. It streams backup data directly to S3 via the Backint API, eliminating intermediate storage and minimizing data transfer overhead. This approach achieves the fastest backup time because it avoids the latency of writing to instance store, EBS, or EFS before reaching S3, and it incurs only S3 storage costs without additional compute or storage fees.

Exam trap

The trap here is that candidates often assume EBS snapshots are the fastest because they are block-level and incremental, but they fail to recognize that SAP HANA requires application-consistent backups and that Backint is the only option that integrates directly with SAP HANA's backup framework for fast, certified backups to S3.

How to eliminate wrong answers

Option A is wrong because copying backup files to EC2 instance store (ephemeral storage) first adds an unnecessary intermediate write step, and instance store data is lost on instance stop/termination, requiring additional upload time to S3. Option B is wrong because EBS snapshots capture the entire volume, not just the HANA database changes, and restoring from snapshots requires additional steps to make the data usable for SAP HANA; they also do not integrate with SAP HANA's backup catalog. Option D is wrong because mounting an Amazon EFS file system and writing backups to it introduces network file system latency and throughput limitations, and EFS is not optimized for high-throughput sequential writes of large database backups, making it slower than direct S3 streaming.

Practice this question →

134

MCQhard

A company runs SAP on AWS and uses a shared file system for SAP transport files. The system must support concurrent access from multiple SAP application servers and provide strong consistency. The transport files are typically small (less than 1 MB) and are frequently read and written. Which file storage solution should be used?

A.Amazon FSx for Windows File Server

B.Amazon S3

C.Amazon EFS

D.Amazon EC2 instance store

AnswerC

EFS provides NFS shared storage with strong consistency, ideal for SAP transport directories.

Why this answer

Amazon EFS (Elastic File System) provides a fully managed, POSIX-compliant, shared file system that supports concurrent access from multiple EC2 instances (SAP application servers) with strong consistency. It uses the NFSv4.1 protocol, which ensures that read-after-write consistency is maintained across all clients, making it ideal for SAP transport files that are frequently read and written.

Exam trap

The trap here is that candidates confuse object storage (S3) with file storage, or assume that any shared storage (like FSx for Windows) works for Linux-based SAP workloads, overlooking the specific POSIX and consistency requirements of SAP transport files.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server uses the SMB protocol and is designed for Windows-based workloads, not for SAP on Linux, and its consistency model is not as strong as NFS for concurrent POSIX operations. Option B is wrong because Amazon S3 is an object storage service, not a file system; it does not support POSIX file locking or concurrent read/write semantics required for SAP transport files, and its eventual consistency model (though strong for new PUTs) can lead to stale reads in some scenarios. Option D is wrong because Amazon EC2 instance store provides ephemeral block storage that is local to a single instance, cannot be shared across multiple SAP application servers, and data is lost on instance stop or termination.

Practice this question →

135

MCQeasy

A solutions architect is designing a disaster recovery plan for a critical application that runs on Amazon RDS for PostgreSQL. The application requires a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which RDS deployment option meets these requirements?

A.A single-AZ deployment with cross-Region automated backups.

B.A single-AZ deployment with a standby instance manually promoted.

C.A Multi-AZ deployment with synchronous replication.

D.A Multi-AZ deployment with a Read Replica in a different Region.

AnswerC

Multi-AZ provides synchronous replication and automatic failover.

Why this answer

Amazon RDS Multi-AZ deployments with synchronous replication provide automatic failover to a standby instance in a different Availability Zone, ensuring data is committed to both primary and standby before acknowledging a write. This achieves an RPO of effectively zero (less than 5 seconds) and an RTO typically under 1 minute, meeting the stated requirements.

Exam trap

The trap here is confusing Multi-AZ synchronous replication (which provides automatic failover and near-zero RPO) with cross-Region Read Replicas (which use asynchronous replication and require manual promotion, thus failing both RPO and RTO requirements).

How to eliminate wrong answers

Option A is wrong because cross-Region automated backups have an RPO of up to 5 minutes or more due to the asynchronous nature of backup uploads, and RTO involves restoring from a snapshot which takes significantly longer than 1 minute. Option B is wrong because a single-AZ deployment with manual promotion requires you to detect the failure and manually promote a standby (if any), resulting in RTO far exceeding 1 minute and no synchronous replication to guarantee RPO under 5 seconds. Option D is wrong because a Read Replica in a different Region uses asynchronous replication, which can have replication lag exceeding 5 seconds, and promoting it requires manual intervention, failing the RTO requirement.

Practice this question →

136

MCQhard

A company runs SAP on AWS and is experiencing high latency for database queries after moving the SAP HANA database to a larger instance type. CloudWatch metrics show that the EBS volume queue length is consistently high. What is the most likely cause of the latency?

A.The instance's network bandwidth is saturated.

B.The instance's CPU is under-provisioned.

C.The EBS volume does not have enough provisioned IOPS.

D.The EBS volume is not encrypted.

AnswerC

Insufficient IOPS leads to requests queuing.

Why this answer

A consistently high EBS volume queue length indicates that the volume is receiving more I/O requests than it can process, causing requests to queue up. Since the SAP HANA database was moved to a larger instance type, the workload likely demands more IOPS than the EBS volume is provisioned for, leading to throttling and increased latency. Option C correctly identifies that insufficient provisioned IOPS is the most likely cause.

Exam trap

The trap here is that candidates may confuse a high EBS queue length with network or CPU bottlenecks, but the queue length is a direct indicator of I/O throttling due to insufficient provisioned IOPS, not resource saturation elsewhere.

How to eliminate wrong answers

Option A is wrong because network bandwidth saturation would manifest as network-related metrics (e.g., network throughput, packet drops) and would not directly cause a high EBS volume queue length; the queue length is a storage-level metric. Option B is wrong because CPU under-provisioning would show high CPU utilization or CPU credit exhaustion in CloudWatch, not a consistently high EBS queue length; the queue length is specific to I/O operations. Option D is wrong because EBS volume encryption does not affect I/O performance or queue depth; encryption is a security feature that adds minimal overhead on modern instance types with hardware acceleration.

Practice this question →

137

MCQmedium

An SAP administrator runs the commands above to inspect the volumes attached to an EC2 instance that hosts an SAP HANA database. The database log files are stored on /dev/sdf. What is a potential issue with this configuration?

A.The log volume uses gp3, which may not provide enough IOPS for HANA log writes.

B.The log volume is attached as /dev/sdf, which is not a standard device name for HANA.

C.The root volume will be deleted on termination, causing data loss.

D.The log volume is not encrypted.

AnswerA

HANA log volumes require high IOPS; io1 or io2 are recommended.

Why this answer

Gp3 volumes may not provide sufficient IOPS for HANA log writes, which require high IOPS and low latency. Options B, C, and D are incorrect: /dev/sdf is a standard device name, DeleteOnTermination=false is fine for persistence, and encryption is not shown to be an issue.

Practice this question →

138

MCQmedium

A company is running a business-critical SAP HANA database on an m5.24xlarge EC2 instance. The database stores 3 TB of data on EBS gp3 volumes. The system experiences high latency during peak hours. Which configuration change would most effectively reduce latency without increasing costs significantly?

A.Increase the Provisioned IOPS of the gp3 volumes to the maximum supported.

B.Move the database to a larger instance type like x1e.32xlarge with more memory.

C.Migrate the EBS volumes to io2 Block Express volumes with the same capacity.

D.Increase the gp3 volume size to 4 TB to gain more baseline IOPS.

AnswerC

io2 Block Express provides consistent single-digit millisecond latency and higher IOPS, ideal for SAP HANA.

Why this answer

Migrating to io2 Block Express volumes provides consistent, sub-millisecond latency and higher IOPS performance than gp3, which is essential for reducing high latency in a business-critical SAP HANA database during peak hours. This change addresses the latency issue without significantly increasing costs, as io2 Block Express offers a cost-effective balance of performance and durability for mission-critical workloads.

Exam trap

The trap here is that candidates assume increasing gp3 IOPS or volume size is sufficient to fix latency, but they overlook that gp3's architecture introduces variable latency under sustained load, while io2 Block Express is specifically designed for consistent, low-latency performance required by critical databases like SAP HANA.

How to eliminate wrong answers

Option A is wrong because increasing the Provisioned IOPS of gp3 volumes to the maximum supported (16,000 IOPS) would not eliminate the inherent latency variability of gp3 under sustained high throughput, and the cost increase for maximum IOPS could be significant without guaranteeing the consistent low latency required for SAP HANA. Option B is wrong because moving to a larger instance type like x1e.32xlarge would increase costs substantially due to higher instance pricing and does not directly address the EBS volume latency; the bottleneck is storage performance, not compute or memory capacity. Option D is wrong because increasing the gp3 volume size to 4 TB only raises the baseline IOPS from 3,000 to 4,000 (at 0.5 IOPS per GB), which is insufficient to resolve high latency during peak hours and does not provide the consistent low latency that io2 Block Express offers.

Practice this question →

139

MCQmedium

A company is running SAP BusinessObjects on AWS. The application server is on an EC2 instance, and the database is on Amazon RDS for SQL Server. Users report that reports are taking longer to generate than expected. Which AWS service can be used to analyze the performance bottleneck?

A.AWS Trusted Advisor

B.AWS CloudTrail

C.AWS X-Ray

D.Amazon CloudWatch with enhanced monitoring for RDS

AnswerD

CloudWatch provides metrics like CPU, memory, and disk I/O, and RDS Enhanced Monitoring offers OS-level metrics.

Why this answer

Amazon CloudWatch with enhanced monitoring provides detailed OS-level metrics for RDS (CPU, memory, disk I/O, and network), along with EC2 metrics, enabling analysis of performance bottlenecks in SAP BusinessObjects. Option A (AWS Trusted Advisor) offers best-practice recommendations, not performance analysis. Option B (AWS CloudTrail) audits API calls, which is unrelated to performance.

Option C (AWS X-Ray) is designed for tracing requests in distributed applications, not for database-level performance monitoring.

Practice this question →

140

MCQmedium

A company is running an SAP HANA database on an r5.8xlarge EC2 instance. The database experiences high memory pressure, and they want to add more memory without downtime. What should they do?

A.Use AWS License Manager to add more memory to the instance.

B.Modify the instance type to r5.12xlarge while the instance is running.

C.Use Amazon RDS for SAP HANA to automatically scale memory.

D.Stop the instance and change the instance type to u-6tb1.112xlarge.

AnswerB

EC2 instances with ENA support can change instance type without stopping if the new type is in the same family.

Why this answer

You can modify the instance type of a running EC2 instance without stopping it, provided the new type is compatible with the current configuration. In this case, changing from r5.8xlarge to r5.12xlarge increases memory from 256 GiB to 384 GiB, and both are in the same instance family, supporting live resizing. This allows the SAP HANA database to add memory without downtime, addressing high memory pressure.

Exam trap

The trap here is that candidates may think stopping the instance is always required for instance type changes, but AWS supports live resizing for certain instance families like r5, and they might incorrectly choose Option D due to familiarity with the u-6tb1.112xlarge instance type for SAP HANA, ignoring the downtime constraint.

How to eliminate wrong answers

Option A is wrong because AWS License Manager is used to manage software licenses, not to add memory to an EC2 instance; it cannot modify instance resources. Option C is wrong because Amazon RDS does not support SAP HANA as a database engine; SAP HANA must run on EC2 or bare metal, not on RDS. Option D is wrong because stopping the instance to change the instance type would cause downtime, which the question explicitly requires to avoid; additionally, u-6tb1.112xlarge is a bare metal instance type that requires stopping the instance and may not be compatible with a running r5.8xlarge without reconfiguration.

Practice this question →

141

Multi-Selecteasy

Which TWO of the following are best practices for securing an SAP system on AWS? (Choose two.)

Select 2 answers

A.Store database credentials in plaintext in application configuration files

B.Disable AWS CloudTrail to reduce logs

C.Use security groups to restrict inbound traffic to SAP application ports

D.Allow all inbound traffic from 0.0.0.0/0 for easy access

E.Encrypt data in transit using TLS/SSL certificates

AnswersC, E

Security groups act as virtual firewalls.

Why this answer

Security groups act as a virtual firewall for EC2 instances, allowing you to control inbound and outbound traffic. Restricting inbound traffic to only the necessary SAP application ports (e.g., 3200 for SAP GUI, 443 for SAP Web Dispatcher) minimizes the attack surface and is a fundamental security best practice.

Exam trap

The trap here is that candidates may confuse security groups with network ACLs, or mistakenly think that allowing all traffic (0.0.0.0/0) is acceptable for 'easy access' during testing, but AWS explicitly tests that least-privilege access is a core security principle for production SAP workloads.

Practice this question →

142

MCQmedium

A company is deploying SAP NetWeaver on AWS and wants to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). They plan to use a cluster manager (Pacemaker) with a shared filesystem. The cluster will span two Availability Zones. The storage for the shared filesystem must be highly available and provide consistent performance. What storage solution should be used?

A.Use an Amazon S3 bucket as the shared filesystem.

B.Use instance store volumes (Local SSDs) on each node.

C.Use an Amazon EBS volume with Multi-Attach enabled.

D.Use Amazon EFS for the shared filesystem.

AnswerD

Correct because Amazon EFS provides a fully managed NFS filesystem that can be accessed from multiple EC2 instances across AZs, ensuring high availability and consistent performance for SAP shared files.

Why this answer

Amazon EFS provides a fully managed NFS filesystem that can be mounted from multiple EC2 instances across different Availability Zones, offering high availability and consistent performance for SAP Central Services (ASCS) and Enqueue Replication Server (ERS) shared filesystem. Option A is incorrect because Amazon S3 is object storage, not a POSIX-compliant filesystem, and cannot be used as a shared filesystem for SAP. Option B is incorrect because instance store volumes are ephemeral and local to each instance; they cannot be shared between nodes.

Option C is incorrect because EBS Multi-Attach only supports attachment to multiple instances within the same Availability Zone, not across AZs, and has additional limitations for shared filesystem use.

Practice this question →

143

MCQhard

A company runs its SAP ERP system on AWS with an SAP HANA database on an EC2 instance. The database is configured with multiple EBS io1 volumes striped in a RAID 0. Recently, the company implemented a new backup process using AWS Backup with the Backint agent. However, during the backup window, the database performance degrades significantly, causing application timeouts. The database administrator checks CloudWatch metrics and sees that the EBS write latency spikes to over 50 ms during backups. The backup target is an S3 bucket in the same region. The EC2 instance type is r5.4xlarge with EBS-optimized enabled. What is the MOST likely cause of the performance degradation?

A.The Backint agent is consuming CPU and I/O resources, causing contention.

B.The EBS volumes have reached the provisioned IOPS limit of 20,000 IOPS.

C.The S3 bucket is in a different region, causing network latency.

D.The EC2 instance type does not match the requirements for Backint.

AnswerA

Backint runs on the HANA host and uses resources, impacting performance.

Why this answer

The Backint agent runs on the same EC2 instance as SAP HANA, consuming CPU and I/O resources during backup, causing contention and performance degradation. Option B is unlikely because with RAID 0 the aggregate IOPS is higher than the provisioned per volume limit. Option C is incorrect because the S3 bucket is in the same region as stated.

Option D is incorrect because the r5.4xlarge instance supports EBS optimization and is suitable for Backint.

Practice this question →

144

MCQeasy

An SAP administrator needs to provide temporary, time-limited access to an S3 bucket containing SAP backup files for an external auditor. The auditor should be able to download files from the bucket. Which method provides the most secure way to grant access?

A.Create an IAM user with read-only access to the bucket and share the credentials with the auditor.

B.Provide the auditor with the root user credentials of the AWS account.

C.Make the bucket publicly readable and share the bucket URL.

D.Generate a presigned URL for each file the auditor needs to download.

AnswerD

Presigned URLs are time-limited and scoped to specific objects.

Why this answer

Presigned URLs grant temporary, time-limited access to specific S3 objects without requiring the auditor to have AWS credentials or any permanent permissions. The SAP administrator can generate a presigned URL for each backup file, set an expiration time, and share the URL with the auditor, who can then download the file using standard HTTP GET requests. This approach follows the principle of least privilege and ensures access is revoked automatically after the URL expires.

Exam trap

The trap here is that candidates may choose Option A (IAM user) because it seems like a standard access control method, but they overlook the requirement for temporary, time-limited access and the security risks of sharing long-term credentials with an external party.

How to eliminate wrong answers

Option A is wrong because creating an IAM user with read-only access and sharing credentials violates security best practices by introducing long-term credentials that could be reused or compromised, and it requires managing a separate IAM user for a temporary task. Option B is wrong because providing root user credentials grants unrestricted, permanent access to the entire AWS account, including the ability to delete resources, modify billing, and access all services, which is a severe security risk. Option C is wrong because making the bucket publicly readable exposes all objects in the bucket to anyone on the internet, not just the auditor, and violates data confidentiality and compliance requirements.

Practice this question →

145

MCQhard

An organization uses AWS Systems Manager to run automation documents on their SAP EC2 instances. Recently, some automation runbooks have failed because the EC2 instances did not have the required SSM Agent version. The operations team wants to ensure all existing and future instances automatically have the latest SSM Agent. Which solution meets this requirement?

A.Use an automation document to update the SSM Agent and schedule it via a cron job on each instance.

B.Enable the 'Auto-update SSM Agent' option in the EC2 launch settings for all instances.

C.Configure AWS Systems Manager Patch Manager to update the SSM Agent.

D.Create an AWS Systems Manager State Manager association that runs the AWS-UpdateSSMAgent document on the instances.

AnswerD

State Manager ensures compliance and automatic updates.

Why this answer

AWS Systems Manager State Manager can enforce a desired state configuration on EC2 instances. By creating an association that runs the `AWS-UpdateSSMAgent` document on a schedule, State Manager ensures that both existing and future instances (when configured with the appropriate instance profile and tags) automatically update to the latest SSM Agent version, regardless of the instance's lifecycle.

Exam trap

The trap here is that candidates may confuse Patch Manager's OS patching capabilities with SSM Agent updates, or assume a non-existent EC2 launch setting exists, leading them to choose options that sound plausible but are technically incorrect.

How to eliminate wrong answers

Option A is wrong because scheduling a cron job on each instance to run an automation document is not a scalable or managed solution; it requires manual setup per instance and does not leverage AWS Systems Manager's native automation capabilities. Option B is wrong because there is no 'Auto-update SSM Agent' option in EC2 launch settings; this feature does not exist in the AWS Management Console or API. Option C is wrong because AWS Systems Manager Patch Manager is designed to patch the OS and applications, not to update the SSM Agent itself; it does not have a built-in mechanism to update the SSM Agent.

Practice this question →

146

Multi-Selecthard

A company runs its SAP HANA database on an EC2 instance with EBS volumes. The database requires consistent high IOPS and low latency. The system is currently using EBS gp2 volumes, but performance is inconsistent during peak loads. Which TWO steps should the administrator take to improve storage performance? (Choose 2)

Select 2 answers

A.Increase the size of the existing gp2 volumes to increase baseline IOPS.

B.Take regular EBS snapshots to improve performance.

C.Configure multiple EBS volumes in a RAID 0 stripe set.

D.Migrate to EBS io2 Block Express volumes with provisioned IOPS.

E.Enable EBS-optimized on the EC2 instance.

AnswersC, D

Correct. Configuring multiple EBS volumes in a RAID 0 stripe set combines I/O across volumes, thereby increasing throughput and IOPS to handle peak loads.

Why this answer

Options C and D are correct. C: Configuring multiple EBS volumes in a RAID 0 stripe set increases throughput by combining I/O across volumes, which helps with peak loads. D: Migrating to EBS io2 Block Express volumes with provisioned IOPS ensures consistent high IOPS and low latency.

A is incorrect because increasing gp2 volume size only raises baseline IOPS but does not guarantee consistent high IOPS during peak loads. B is incorrect because regular EBS snapshots do not improve performance and can degrade it during snapshot creation. E is incorrect because EBS-optimized instances are enabled by default for current generation instances and are not a storage performance improvement step.

Practice this question →

147

MCQhard

A company runs its SAP Business Suite on AWS with an Oracle database on an EC2 instance. The database is stored on multiple EBS volumes configured as a RAID 0 array. The company wants to migrate the database to SAP HANA on a new EC2 instance. The SAP HANA instance will use EBS volumes for data and log storage. The current Oracle database size is 500 GB. The company needs to minimize downtime during the migration. Which migration strategy should they use?

A.Use AWS Application Migration Service to migrate the entire EC2 instance.

B.Use SAP HANA System Replication to replicate data from the source Oracle database to the target HANA database.

C.Export the Oracle database to a flat file and import into SAP HANA.

D.Use AWS Database Migration Service (DMS) to migrate from Oracle to SAP HANA.

AnswerD

AWS DMS can migrate from Oracle to SAP HANA with ongoing replication, allowing minimal downtime by keeping the source online during migration.

Why this answer

AWS DMS supports heterogeneous migration from Oracle to SAP HANA, enabling minimal downtime through continuous replication. SAP HANA System Replication (HSR) cannot be used because it only works between HANA systems, not from Oracle. Export/import causes extended downtime, and Application Migration Service is for server-level migration, not database-level.

Practice this question →

148

Multi-Selecthard

A company is migrating a legacy three-tier web application to AWS. The application uses a MySQL database and stores session data in the database. The company wants to minimize database load and improve scalability. Which TWO actions should the company take to achieve these goals?

Select 2 answers

A.Configure Amazon RDS Multi-AZ for high availability.

B.Use Auto Scaling for the web server tier to handle variable traffic.

C.Use Amazon ElastiCache to store session data instead of the database.

D.Use Amazon RDS read replicas to offload read traffic from the primary database.

E.Use Amazon ElastiCache to cache frequently accessed database queries.

AnswersC, E

Storing session data in ElastiCache reduces database write load and improves performance.

Why this answer

Storing session data in the database creates unnecessary write load and latency. Amazon ElastiCache (Memcached or Redis) provides an in-memory key-value store that is ideal for transient session data, reducing database load and improving application scalability by offloading session management from the persistent MySQL layer.

Exam trap

The trap here is that candidates often confuse high-availability features (Multi-AZ) or read-scaling (read replicas) with load reduction, failing to recognize that session data is write-heavy and requires a dedicated in-memory store like ElastiCache to truly minimize database load.

Practice this question →

149

Multi-Selecthard

An SAP application on AWS needs to be migrated to a new virtual private cloud (VPC). The SAP system uses SAProuter to connect to SAP support. Which THREE components must be updated or re-configured during the migration to ensure uninterrupted connectivity?

Select 3 answers

A.Adjust the S3 bucket policy to allow access from the new VPC.

B.Update the Amazon Route 53 DNS records for the SAP application and database servers.

C.Modify the SAProuter configuration (e.g., saprouttab) to use the new IP address or hostname of the SAProuter instance.

D.Recreate IAM roles for the SAP application servers.

E.Update security group rules and network ACLs to allow SAP traffic in the new VPC.

AnswersB, C, E

When instances are migrated to a new VPC, their private IP addresses may change; DNS records must be updated to maintain name resolution.

Why this answer

Updating Amazon Route 53 DNS records ensures that the SAP application and database servers can be reached using their new private or public IP addresses in the new VPC. Without this update, clients and SAP support connections via SAProuter would fail due to DNS resolution pointing to the old VPC's IPs, causing connectivity interruptions.

Exam trap

The trap here is that candidates may overlook DNS updates (Option B) as a critical step, assuming IP addresses are static, or mistakenly think IAM roles (Option D) or S3 policies (Option A) are relevant to network-level connectivity during a VPC migration.

Practice this question →

150

Multi-Selectmedium

Which TWO of the following are valid strategies to improve the availability of an SAP HANA database on AWS?

Select 2 answers

A.Implement automatic failover using SAP HANA System Replication.

B.Use Amazon RDS for HANA with Multi-AZ deployment.

C.Take daily snapshots of the HANA data volume.

D.Configure SAP HANA System Replication across two Availability Zones.

E.Use a larger EC2 instance type for the HANA server.

AnswersA, D

Automatic failover is a key HA feature.

Why this answer

SAP HANA System Replication (HSR) provides synchronous or asynchronous replication of the HANA database to a secondary system. Automatic failover can be configured using HSR with tools like Pacemaker or AWS-specific scripts, ensuring high availability by switching to the standby instance if the primary fails. This is a native SAP HANA feature that does not rely on external services.

Exam trap

The trap here is that candidates may confuse backup strategies (snapshots) or performance scaling (larger instances) with high availability, or incorrectly assume Amazon RDS supports SAP HANA, when in fact HANA requires manual EC2 deployment and native replication features.

Practice this question →

← PreviousPage 2 of 6 · 389 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Technology questions.

Start 20-question session