Knowledge + Practice

CCNA Technology Questions

75 of 389 questions · Page 3/6 · Technology · Answers revealed

Practice these questions Domain overview All questions

151

MCQhard

An SAP HANA database on AWS requires a backup strategy that includes incremental backups to minimize storage costs. The database is large (2 TB) and the backup window is short. Which AWS service or feature is most suitable for performing incremental backups of SAP HANA?

A.Amazon S3 Lifecycle policies

B.AWS Backup

C.SAP HANA backup to Amazon S3

D.Amazon EBS Snapshots

AnswerD

EBS Snapshots are incremental and capture only changed blocks, ideal for large databases.

Why this answer

D is correct because Amazon EBS Snapshots provide native incremental backup capability at the block level, which is ideal for large SAP HANA databases (2 TB) with short backup windows. Snapshots capture only changed blocks since the last snapshot, minimizing storage costs and backup time, and can be automated via AWS Backup or custom scripts.

Exam trap

The trap here is that candidates may choose AWS Backup (Option B) because it is a managed backup service, but it does not natively provide the block-level incremental efficiency of EBS Snapshots for large databases like SAP HANA, and the question specifically asks for the most suitable service for incremental backups with minimal storage costs.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Lifecycle policies manage object lifecycle transitions (e.g., moving to Glacier) but do not perform backups or incremental snapshots of SAP HANA data. Option B is wrong because AWS Backup supports EBS snapshots but does not natively perform SAP HANA application-consistent backups without additional scripting or integration; it is a management service, not the most suitable for direct incremental backup of SAP HANA. Option C is wrong because SAP HANA backup to Amazon S3 uses file-based backups (e.g., via SAP HANA Backint), which are not inherently incremental at the block level and require full backups or log backups, leading to higher storage costs and longer backup windows compared to EBS Snapshots.

Practice this question →

152

Multi-Selecteasy

A company wants to monitor the performance of its SAP HANA database on AWS. Which THREE Amazon CloudWatch metrics should be monitored to ensure optimal database performance?

Select 3 answers

A.NetworkIn

B.CPUCreditBalance

C.EBSIOBalance%

D.DiskReadOps

E.MemoryUtilization

AnswersA, B, C

Monitors incoming network traffic to the instance.

Why this answer

CPUCreditBalance indicates if the instance is using burstable CPU. EBSIOBalance% shows I/O credit balance for EBS volumes. NetworkIn/Out monitor network traffic.

These are key for HANA performance. MemoryUtilization is not a standard CloudWatch metric (needs custom agent). DiskReadOps is also not standard.

Practice this question →

153

MCQeasy

A company is running SAP HANA on an EC2 instance with an EBS volume for data storage. The company wants to take daily snapshots of the EBS volume for backup. However, they are concerned about data consistency because the database is running. What should they do to ensure consistent snapshots?

A.Freeze the filesystem using fsfreeze before taking the snapshot.

B.Stop the EC2 instance before taking the snapshot.

C.Use AWS Backup with pre-scripts and post-scripts to quiesce SAP HANA.

D.Take the snapshot while the database is running without any preparation.

AnswerC

AWS Backup can run scripts to ensure application consistency.

Why this answer

Using AWS Backup with pre-scripts and post-scripts to quiesce SAP HANA ensures application-consistent snapshots by pausing I/O and flushing buffers before the snapshot. Option A is wrong because simply freezing the filesystem with fsfreeze does not guarantee database consistency without application-level quiescing. Option B is wrong because stopping the instance causes downtime and is unnecessary with proper quiescing.

Option D is wrong because taking a snapshot while the database is running without preparation may result in an inconsistent state.

Practice this question →

154

MCQeasy

A company wants to automate the creation of an SAP application server in AWS. Which AWS service is best suited for this task?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS CodeDeploy

D.AWS OpsWorks

AnswerB

Infrastructure as code to automate resource creation.

Why this answer

AWS CloudFormation is best suited for automating the creation of an SAP application server because it allows you to define the entire infrastructure as code (IaC) using a template (JSON or YAML). This enables consistent, repeatable provisioning of EC2 instances, security groups, storage, and networking configurations required for SAP, and supports integration with AWS Systems Manager for post-deployment configuration.

Exam trap

The trap here is that candidates often confuse AWS OpsWorks (which is for configuration management) with infrastructure provisioning, or they mistakenly think Elastic Beanstalk can handle SAP workloads because it automates EC2 creation, but it lacks the granular control over OS and SAP-specific settings required for certified SAP environments.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Beanstalk is a PaaS service designed for web applications and does not support the custom OS-level configurations, kernel parameters, and SAP-specific file systems (e.g., /usr/sap, /sapmnt) required for an SAP application server. Option C is wrong because AWS CodeDeploy is a deployment automation service for updating applications on existing compute resources, not for provisioning new infrastructure like EC2 instances for SAP. Option D is wrong because AWS OpsWorks is a configuration management service based on Chef/Puppet, but it lacks native support for the complex, multi-tier SAP architecture and does not provide the same level of infrastructure orchestration as CloudFormation for SAP landscapes.

Practice this question →

155

MCQmedium

A company is running SAP HANA on AWS and wants to encrypt the EBS volumes at rest. The company requires key rotation and audit logging of key usage. Which solution should be used?

A.Use AWS Certificate Manager

B.Use AWS CloudHSM to manage keys

C.Use S3 server-side encryption

D.Use EBS encryption with AWS KMS

AnswerD

KMS provides key rotation and CloudTrail logging for key usage.

Why this answer

Amazon EBS encryption with AWS KMS provides key management, rotation, and audit logging. S3 server-side encryption does not apply to EBS. AWS CloudHSM is for hardware-based key management but does not provide automatic key rotation.

AWS Certificate Manager is for SSL/TLS certificates.

Practice this question →

156

MCQhard

An SAP system on AWS uses a shared file system (e.g., /sapmnt) that must be accessible from multiple EC2 instances. Which storage solution provides the highest availability and scalability?

A.Amazon EFS

B.Amazon S3 with S3 File Gateway

C.AWS Storage Gateway file gateway

D.Amazon EBS with multi-attach enabled

AnswerA

EFS provides a scalable NFS file system with automatic replication across AZs, ideal for /sapmnt.

Why this answer

Amazon EFS provides a fully managed, NFS-based shared file system that is accessible from multiple EC2 instances across Availability Zones, offering high availability and automatic scalability. For SAP /sapmnt, EFS supports the required POSIX permissions and concurrent access patterns without single points of failure, unlike block storage or gateway solutions.

Exam trap

The trap here is that candidates often choose EBS with multi-attach because it seems to allow shared access, but they overlook its single-AZ limitation and the 16-instance cap, which fails the high-availability and scalability requirements for SAP.

How to eliminate wrong answers

Option B is wrong because Amazon S3 with S3 File Gateway presents an S3 bucket as a file share via NFS or SMB, but it introduces a gateway appliance that can become a single point of failure and adds latency, making it unsuitable for the low-latency, high-throughput requirements of SAP /sapmnt. Option C is wrong because AWS Storage Gateway file gateway also relies on a local cache and a gateway endpoint, which does not provide the native multi-AZ resilience and automatic scaling of EFS, and it is not designed for concurrent POSIX-compliant access from many EC2 instances. Option D is wrong because Amazon EBS with multi-attach enabled is limited to a maximum of 16 Nitro-based EC2 instances in a single Availability Zone, and it does not provide cross-AZ access or automatic scalability, making it inadequate for a highly available SAP shared file system.

Practice this question →

157

Multi-Selectmedium

A company runs an SAP HANA database on an EC2 instance with a 2 TB EBS gp3 volume. The instance type is r5.8xlarge. To improve disk performance for high-throughput write operations, the SAP administrator wants to increase IOPS. Which TWO actions should the administrator take to achieve the required IOPS? (Choose two.)

Select 2 answers

A.Configure the instance to use T2 unlimited credits.

B.Change the volume type to st1 (throughput optimized HDD).

C.Modify the volume to provision additional IOPS up to 16,000.

D.Enable EBS optimization on the EC2 instance.

E.Increase the EBS volume size to increase baseline IOPS.

AnswersC, E

gp3 allows independent IOPS provisioning.

Why this answer

Gp3 volumes allow independent provisioning of IOPS up to 16,000, which directly increases performance for high-throughput write operations. Option E is correct because increasing the volume size also increases the baseline IOPS for gp3 (baseline is 3 IOPS/GiB). Option A is wrong because T2 unlimited credits apply to burstable instances, not EBS performance.

Option B is wrong because st1 is a throughput-optimized HDD volume, not suitable for high IOPS. Option D is wrong because EBS optimization is enabled by default on r5 instances and is not a configurable action.

Practice this question →

158

MCQeasy

A company wants to migrate its SAP ERP system from on-premises to AWS using the SAP Application Performance Standard (SAPS) sizing approach. The current on-premises system has a SAPS rating of 15,000. The company needs to select an EC2 instance type that can provide sufficient compute capacity. Which EC2 instance family is most suitable for SAP HANA workloads?

A.c5

B.p3

C.x1e

D.m5

AnswerC

The x1e instance family is designed for high-memory SAP HANA workloads, offering up to 3,904 GiB of RAM per instance, which directly satisfies the SAPS rating of 15,000 by providing the memory-to-CPU ratio required for in-memory database processing. This constraint—memory capacity for SAPS—differentiates x1e from general-purpose families that lack sufficient RAM for HANA’s columnar storage.

Why this answer

(x1e) is correct because SAP HANA is an in-memory database that requires high memory capacity, and the x1e instance family is memory-optimized and certified for SAP HANA workloads. Option A (c5) is wrong because it is compute-optimized and does not offer the memory required for HANA. Option B (p3) is wrong because it is GPU-optimized for machine learning, not memory-intensive databases.

Option D (m5) is wrong because it is general-purpose and may not provide the dedicated memory or certification for HANA.

Practice this question →

159

MCQmedium

Refer to the exhibit. An SAP HANA administrator runs the command to check the attached volume. The volume is attached to an instance but the database is reporting low IOPS. What should the administrator check next?

A.Check if the volume size is sufficient; increase to 1 TB.

B.Check if the EC2 instance is EBS-optimized and has sufficient network bandwidth.

C.Check if the volume type should be changed to gp2 for better burst performance.

D.Check if the instance is using the NVMe driver for the EBS volume.

AnswerB

Check if the EC2 instance is EBS-optimized and has sufficient network bandwidth. [CORRECT]

Why this answer

The volume is provisioned with 10,000 IOPS (io1), but the database still reports low IOPS. The most likely cause is that the EC2 instance is not EBS-optimized, which limits the dedicated bandwidth for EBS traffic and can throttle performance. Checking EBS optimization and network bandwidth is the proper next step.

Option A is wrong because volume size does not directly determine IOPS; provisioning size does not increase IOPS. Option C is wrong because changing to gp2 would reduce maximum IOPS (gp2 burst credits would not sustain 10,000 IOPS). Option D is wrong because NVMe drivers are required for EBS volumes on Nitro-based instances; if the instance uses Nitro, the NVMe driver must be installed and configured properly.

However, low IOPS is more likely due to EBS optimization than driver issues.

Practice this question →

160

Multi-Selecthard

A company runs SAP HANA in a multi-node scale-out configuration on AWS. The system is experiencing network bottlenecks that impact performance. Which AWS services or features can be used to monitor and analyze network performance between the HANA nodes? (Choose THREE.)

Select 3 answers

A.VPC Flow Logs

B.AWS Trusted Advisor

C.Amazon Inspector

D.AWS X-Ray [CORRECT]

E.Amazon CloudWatch (Network metrics)

AnswersA, D, E

VPC Flow Logs capture IP traffic metadata, allowing analysis of network connections and identification of bottlenecks between HANA nodes.

Why this answer

VPC Flow Logs capture IP traffic metadata to analyze network connections between HANA nodes. Amazon CloudWatch provides network metrics such as throughput and errors. AWS X-Ray helps trace application requests across nodes, which can identify performance bottlenecks including network latency.

AWS Trusted Advisor offers best practice recommendations but not detailed network analysis. Amazon Inspector is for security assessment. Therefore, the three services that can be used to monitor and analyze network performance are VPC Flow Logs, CloudWatch, and X-Ray.

Practice this question →

161

MCQmedium

An SAP system administrator is troubleshooting an issue where the SAP HANA database is using more memory than expected on an Amazon EC2 instance. The instance type is an x1e.32xlarge with 3,904 GB of RAM. The HANA global.ini file includes the parameter 'memorymanager = global'. The administrator suspects that the HANA memory limit is not set correctly. What should the administrator check to confirm the memory limit?

A.Review Amazon CloudWatch metrics for HANA memory usage.

B.Run the SQL statement 'SELECT * FROM M_SERVICE_MEMORY' and compare with 'SELECT VALUE FROM M_INIFILE WHERE KEY='global_allocation_limit'.'

C.Check the output of 'free -g' command on the EC2 instance.

D.Check the 'global_allocation_limit' parameter in the global.ini file.

AnswerB

This shows effective allocation limit and actual usage.

Why this answer

When `memorymanager = global` is set in HANA, the effective memory limit is determined by the `global_allocation_limit` parameter in the `global.ini` file, not by the OS-level memory. Running `SELECT * FROM M_SERVICE_MEMORY` shows actual per-service memory usage, while `SELECT VALUE FROM M_INIFILE WHERE KEY='global_allocation_limit'` retrieves the configured limit. Comparing these two values directly confirms whether the memory limit is set correctly and if HANA is respecting it.

Exam trap

The trap here is that candidates assume checking the `global.ini` file directly (Option D) is sufficient, but the exam tests whether you know that the active in-memory configuration must be queried via system views like `M_INIFILE` to confirm the actual enforced limit, especially when `memorymanager = global` is used.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch metrics for HANA memory usage show actual consumption, not the configured memory limit; they cannot confirm whether the `global_allocation_limit` is set correctly. Option C is wrong because `free -g` shows total OS memory and usage, but when `memorymanager = global` is active, HANA manages its own memory pool independently of OS-level free memory, so this command does not reveal the HANA-specific limit. Option D is wrong because checking the `global_allocation_limit` parameter in the `global.ini` file only shows the configured value, but does not confirm whether HANA is actually enforcing that limit or if the value is being overridden by other settings (e.g., `memorymanager = global` requires the limit to be read from the in-memory configuration, not just the file).

Practice this question →

162

MCQmedium

A company is running an SAP HANA database on an EC2 instance with Amazon EBS volumes. The database is experiencing high write latency. The storage is configured as two gp2 volumes in a RAID 0 stripe. Which change is most likely to improve write performance?

A.Migrate to a RAID 0+1 configuration with four volumes.

B.Replace gp2 volumes with io1 volumes provisioned with sufficient IOPS for the workload.

C.Increase the volume size of each gp2 volume to 1 TB to increase baseline IOPS.

D.Move the data to instance store volumes attached to the EC2 instance.

AnswerB

io1 volumes provide provisioned IOPS, ensuring consistent low latency for write-intensive workloads.

Why this answer

SAP HANA is an I/O-intensive application that requires predictable, low-latency storage performance. gp2 volumes use a burst-bucket model that can lead to performance degradation under sustained high write loads, whereas io1 volumes allow you to provision a specific number of IOPS independently of volume size, ensuring consistent throughput. By provisioning sufficient IOPS for the workload, you eliminate the write latency caused by gp2's burst credit exhaustion.

Exam trap

The trap here is that candidates assume increasing gp2 volume size (Option C) will linearly improve IOPS, but they overlook that gp2's baseline IOPS scales slowly (3 IOPS per GiB) and that the burst model is insufficient for sustained high-write workloads, making io1 the only option that guarantees consistent, provisioned performance.

How to eliminate wrong answers

Option A is wrong because RAID 0+1 (mirroring of stripes) improves redundancy but does not inherently increase write IOPS or reduce latency; in fact, mirroring adds a write penalty since each write must be duplicated. Option C is wrong because increasing gp2 volume size to 1 TB raises the baseline IOPS from 100 to 300 (since gp2 baseline is 3 IOPS per GiB), which may still be insufficient for a high-write SAP HANA workload, and it does not address the fundamental limitation of gp2's burst model. Option D is wrong because instance store volumes are ephemeral and provide non-persistent storage; they are not suitable for a production SAP HANA database that requires data durability and the ability to survive instance stops or failures.

Practice this question →

163

MCQhard

A company is migrating its SAP landscape to AWS. They have a mix of production and non-production systems. The SAP systems use a shared storage architecture for transport directories. Which AWS storage solution should be used for the SAP transport directory to provide low-latency access across multiple EC2 instances in the same region?

A.Amazon EFS

B.Amazon EBS with multi-attach

C.Amazon S3 with S3FS

D.Amazon FSx for Windows File Server

AnswerA

Amazon EFS provides a scalable, shared file system accessible from multiple EC2 instances with low latency, ideal for SAP transport directories.

Why this answer

Amazon EFS provides a scalable, shared file system accessible from multiple EC2 instances with low latency, ideal for SAP transport directories. Amazon S3 is object storage, not a file system. Amazon FSx for Windows File Server is for Windows workloads.

Amazon EBS volumes can only be attached to one instance at a time (except for multi-attach, which has limitations).

Practice this question →

164

MCQeasy

A company is migrating an SAP ERP system to AWS and needs to connect on-premises users to the SAP application securely. The SAP application is deployed in a VPC private subnet. Which service should be used to provide secure access for remote users?

A.AWS Site-to-Site VPN

B.AWS Transit Gateway

C.AWS Direct Connect

D.AWS Client VPN

AnswerD

Client VPN allows remote users to securely connect to the VPC.

Why this answer

AWS Client VPN is a managed service that allows remote users to securely connect to AWS resources using OpenVPN-based VPN clients. Since the SAP application is in a private subnet, remote users need individual encrypted tunnels to access it, which Client VPN provides by authenticating users and routing traffic through a VPC endpoint.

Exam trap

The trap here is confusing network-to-network connectivity solutions (Site-to-Site VPN, Direct Connect) with user-to-network remote access (Client VPN), leading candidates to choose a site-to-site option when the requirement is for individual remote users.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN is designed to connect entire on-premises networks to a VPC, not individual remote users; it requires a customer gateway device and does not provide per-user authentication. Option B is wrong because AWS Transit Gateway is a network transit hub for interconnecting VPCs and on-premises networks, not a remote access VPN solution for individual users. Option C is wrong because AWS Direct Connect provides a dedicated private network connection between an on-premises data center and AWS, but it is not designed for remote user access and requires physical infrastructure and carrier agreements.

Practice this question →

165

MCQmedium

A company is running a critical SAP HANA database on AWS. The database administrator wants to ensure that the SAP HANA backup files are stored in a secure, durable, and cost-effective manner. They need to retain backups for 7 years to meet compliance requirements. Which AWS service should be used for long-term backup storage?

A.AWS Backup

B.Amazon S3 Glacier Deep Archive

C.Amazon EBS Snapshots

D.Amazon S3 Standard

AnswerB

Amazon S3 Glacier Deep Archive is the lowest-cost storage class for long-term retention of data that is accessed rarely.

Why this answer

Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage for long-term retention of data that is accessed infrequently, with retrieval times of 12-48 hours. For a 7-year compliance retention requirement, this service offers secure, durable (99.999999999% durability), and cost-effective storage for SAP HANA backup files, which do not need immediate access.

Exam trap

The trap here is that candidates often confuse AWS Backup as a storage service rather than a backup orchestration service, leading them to select it for long-term storage instead of recognizing that S3 Glacier Deep Archive is the actual cost-effective storage tier for archival compliance.

How to eliminate wrong answers

Option A is wrong because AWS Backup is a centralized backup service that can manage backups across AWS services, but it does not provide the specific long-term, low-cost storage tier needed for 7-year retention; it would still require a storage destination like S3 Glacier Deep Archive for cost efficiency. Option C is wrong because Amazon EBS Snapshots are designed for point-in-time backups of EBS volumes, but they are not cost-effective for 7-year retention due to incremental storage costs and lack of a deep archive tier; they are better suited for short-term disaster recovery. Option D is wrong because Amazon S3 Standard is optimized for frequently accessed data with low latency and high throughput, making it too expensive for long-term archival of backups that are rarely accessed over 7 years.

Practice this question →

166

MCQmedium

A company is running a critical SAP HANA database on an EC2 instance with a single EBS volume for /hana/data. They need to ensure high durability and recoverability of the data. Which storage configuration meets SAP best practices?

A.Mount an Amazon EFS filesystem for /hana/data.

B.Configure RAID 0 over multiple EBS volumes for the /hana/data filesystem.

C.Use a single gp3 EBS volume with provisioned IOPS.

D.Use EBS Multi-Attach to attach the same volume to multiple instances.

AnswerC

Correct. gp3 volumes can be provisioned with up to 16,000 IOPS and 1,000 MB/s throughput, meeting HANA requirements. A single volume simplifies management and is cost-effective.

Why this answer

For SAP HANA on AWS, a single gp3 EBS volume can be configured with up to 16,000 IOPS and speeds of up to 1,000 MB/s. This meets the performance requirements for many production HANA systems. RAID 0 striping adds complexity and does not improve durability; durability is achieved through backup and snapshots.

Using a single gp3 volume with sufficient provisioned IOPS is more cost-effective and simpler to manage. Therefore, option C is the best configuration for high durability and recoverability.

Practice this question →

167

MCQmedium

An SAP system administrator needs to automate the creation of an SAP HANA database backup and copy it to another AWS Region for disaster recovery. The backup is stored in an Amazon S3 bucket. Which AWS service should be used to replicate the backup to another Region?

A.S3 Cross-Region Replication (CRR)

B.S3 Lifecycle Policies

C.S3 Batch Operations

D.S3 Transfer Acceleration

AnswerA

CRR automatically replicates objects across regions.

Why this answer

S3 Cross-Region Replication (CRR) is the correct service because it automatically replicates objects from a source S3 bucket in one AWS Region to a destination bucket in another Region, meeting the requirement to copy the SAP HANA database backup to a different Region for disaster recovery. CRR operates asynchronously and can be configured with the appropriate IAM role to replicate existing and new objects, ensuring the backup is continuously available in the DR Region.

Exam trap

The trap here is that candidates confuse S3 Lifecycle Policies with replication, mistakenly thinking they can move data between Regions, when lifecycle policies only change storage class within the same Region.

How to eliminate wrong answers

Option B (S3 Lifecycle Policies) is wrong because lifecycle policies manage object transitions between storage classes (e.g., from S3 Standard to S3 Glacier) or expiration, not cross-Region replication. Option C (S3 Batch Operations) is wrong because batch operations perform bulk actions (e.g., copying objects, tagging) on a one-time basis, not continuous automated replication. Option D (S3 Transfer Acceleration) is wrong because it only speeds up uploads over long distances using AWS edge locations, but does not replicate data to another Region.

Practice this question →

168

MCQhard

An SAP system running on AWS experienced a database failure. The recovery plan uses cross-Region Amazon RDS snapshots. The RPO is 15 minutes and the RTO is 2 hours. Which AWS service should be used to automate snapshot replication across Regions?

A.AWS CloudFormation

B.AWS Backup

C.Amazon RDS automated backups

D.Amazon S3 Cross-Region Replication

AnswerB

AWS Backup can automate cross-Region snapshot copying with scheduled policies.

Why this answer

AWS Backup can automate cross-Region snapshot copying with scheduling. Option A is incorrect because AWS CloudFormation is used for infrastructure as code, not for automating snapshot replication. Option C is incorrect because Amazon RDS automated backups are region-specific and cannot be cross-Region.

Option D is incorrect because Amazon S3 Cross-Region Replication is for objects, not RDS snapshots.

Practice this question →

169

MCQeasy

Refer to the exhibit. An SAP administrator is reviewing the block device mappings of an EC2 instance. What is the impact of the DeleteOnTermination setting on /dev/sdf?

A.The volume will persist after the instance is terminated

B.The volume will be automatically deleted after 30 days

C.The volume will be deleted when the instance is terminated

D.The volume is a snapshot of the root volume

AnswerA

The volume will remain and can be attached to another instance.

Why this answer

The DeleteOnTermination attribute controls whether an Amazon EBS volume is automatically deleted when the associated EC2 instance is terminated. For the volume at /dev/sdf, the setting is 'false', meaning the volume will persist after the instance is terminated. This is a common configuration for data volumes that need to be retained for backup, migration, or reuse purposes.

Exam trap

The trap here is that candidates assume all non-root volumes have DeleteOnTermination set to 'false' by default, but the exam often presents a scenario where the setting is explicitly changed, requiring careful reading of the exhibit to determine the actual value.

How to eliminate wrong answers

Option B is wrong because there is no AWS default or feature that automatically deletes EBS volumes after 30 days; deletion is tied to the instance lifecycle or manual action. Option C is wrong because it describes the behavior when DeleteOnTermination is set to 'true', but the exhibit shows it is 'false', so the volume will not be deleted upon termination. Option D is wrong because the volume at /dev/sdf is a separate EBS block device, not a snapshot of the root volume; snapshots are point-in-time backups stored in Amazon S3, not block device mappings.

Practice this question →

170

Multi-Selectmedium

A company is running SAP HANA on AWS and wants to implement a disaster recovery strategy using a standby system in another AWS Region. Which THREE components are essential for this setup?

Select 3 answers

A.Amazon Route53

B.A secondary EC2 instance in the DR Region

C.AWS CloudEndure Migration

D.Cross-Region VPC Peering or Transit Gateway

E.SAP HANA System Replication

AnswersB, D, E

The DR system runs on an EC2 instance.

Why this answer

A secondary EC2 instance in the DR Region is required to host the standby SAP HANA system. This instance must be sized and configured to match the primary, and it will receive replicated data via SAP HANA System Replication to enable failover.

Exam trap

The trap here is that candidates often confuse AWS CloudEndure Migration (a migration tool) with a disaster recovery solution, but SAP HANA has its own native replication mechanism that must be used for database-level DR, making CloudEndure irrelevant for this specific scenario.

Practice this question →

171

MCQhard

An SAP system running on AWS is configured with a Multi-AZ RDS for SAP HANA database. The primary database fails, but the automatic failover does not occur. What is the most likely reason?

A.The Multi-AZ configuration was not paid for

B.The standby instance was not configured with EBS snapshots

C.Multi-AZ is not supported for RDS for SAP HANA

D.The primary instance does not have an Elastic IP attached

AnswerC

RDS for SAP HANA does not support Multi-AZ; use native HANA replication.

Why this answer

Multi-AZ for RDS for SAP HANA is not supported; RDS for SAP HANA does not have Multi-AZ capability. Option A is incorrect because Multi-AZ is not a paid option; it incurs costs but is not disabled by billing. Option B is incorrect because RDS for HANA does not use EBS snapshots for replication.

Option D is incorrect because RDS does not use Elastic IPs.

Practice this question →

172

Multi-Selectmedium

Which TWO AWS services can be used to create a private, low-latency network connection between an on-premises data center and an SAP environment on AWS? (Choose two.)

Select 2 answers

A.VPC peering

B.AWS Site-to-Site VPN

C.AWS Direct Connect

D.AWS Transit Gateway

E.AWS PrivateLink

AnswersB, C

Creates a secure connection over the internet between on-premises and AWS.

Why this answer

AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet to deliver consistent low latency and high bandwidth, which is critical for SAP workloads. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, offering a private connection that can supplement Direct Connect as a backup or for lower-cost scenarios, though it introduces internet variability. Both services establish private connectivity between on-premises and AWS, meeting the requirements for low-latency SAP environments.

Exam trap

The trap here is that candidates may confuse AWS Transit Gateway as a direct connection service, but it is a central hub that requires an underlying connection (Direct Connect or VPN) to reach on-premises, not a standalone private connection method.

Practice this question →

173

MCQhard

An SAP system on AWS is configured with an Application Load Balancer (ALB) for health checks. The ALB marks all targets as unhealthy. The health check path is /sap/public/health.html, and the SAP Web Dispatcher is configured to serve this file. What is the most likely cause of the health check failure?

A.The health check path is incorrect.

B.The security group for the Web Dispatcher does not allow traffic from the ALB.

C.The health check port is wrong.

D.The ALB is in a different VPC.

AnswerB

Security groups must allow inbound traffic from the ALB.

Why this answer

ALB health checks originate from private IP addresses within the VPC. If the SAP Web Dispatcher's security group does not allow inbound traffic from the ALB's security group, the health check requests will be blocked. Path or port issues would also cause failures, but the most common cause is security group misconfiguration.

Practice this question →

174

MCQhard

An SAP system uses AWS Direct Connect to connect to on-premises networks. The SAP application servers are in a private subnet with a NAT gateway for outbound internet. The SAProuter instance is behind an Internet-facing Network Load Balancer (NLB). Connections from SAP support to the SAProuter timeout. What is the likely cause?

A.The NLB target group is configured with the wrong protocol or port for SAProuter.

B.The security group for the SAProuter instance does not allow inbound traffic from the NLB.

C.The Direct Connect virtual interface is not advertising the SAProuter's IP address.

D.The NAT gateway does not allow inbound traffic from the internet.

AnswerB

This is a possible cause, but the question asks for the most specific cause given the symptom.

Why this answer

The issue is that connections from SAP support to the SAProuter timeout. The SAProuter instance is behind an Internet-facing NLB, which distributes traffic to targets. For the NLB to forward traffic to the SAProuter instance, the instance's security group must allow inbound traffic from the NLB's source IP or security group.

Without this rule, the NLB health checks fail and traffic is not forwarded, causing timeouts. Option A (wrong protocol/port) is possible but less likely since the NLB is configured for SAProuter. Option C (Direct Connect advertising) is irrelevant because the connection is from the internet, not on-premises.

Option D (NAT gateway) is for outbound traffic only and does not affect inbound connections from the internet.

Practice this question →

175

MCQhard

A company runs SAP HANA on AWS using a scale-up configuration. The system is experiencing high CPU utilization on the HANA server during peak load. The SAP administrator wants to add more CPU resources without disruption. Which action should be taken?

A.Add an additional HANA node to create a scale-out configuration and distribute the load.

B.Enable Multi-AZ deployment for high availability.

C.Change the EC2 instance type to a larger size using the AWS Management Console.

D.Increase the provisioned IOPS on the EBS volumes.

AnswerA

Scale-out can be added online if using HANA system replication, but involves new instances. However, among options, this is the only one that adds CPU without stopping existing instance (though new instances needed).

Why this answer

Adding an additional HANA node to create a scale-out configuration allows the system to distribute the workload across multiple nodes, providing additional CPU resources without downtime. SAP HANA supports scale-out configurations where new nodes can be added online using the 'ALTER SYSTEM ADD WORKER' command, enabling CPU scaling without restarting the existing system.

Exam trap

The trap here is that candidates often confuse scaling up (changing instance type) with scaling out (adding nodes), and assume that changing the instance type can be done without disruption, but AWS requires stopping the instance for a type change, which causes downtime.

How to eliminate wrong answers

Option B is wrong because enabling Multi-AZ deployment for high availability does not add CPU resources; it only provides a standby instance in another Availability Zone for failover, which does not help with high CPU utilization during peak load. Option C is wrong because changing the EC2 instance type to a larger size requires stopping the instance, which causes disruption and downtime, contradicting the requirement for no disruption. Option D is wrong because increasing provisioned IOPS on EBS volumes improves storage performance, not CPU resources, and does not address high CPU utilization.

Practice this question →

176

MCQeasy

A company needs to set up a disaster recovery solution for SAP on AWS with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which strategy is most appropriate?

A.Deploy all SAP components in a single AWS Region.

B.Use cross-region backup and restore with AWS Backup.

C.Use Multi-AZ deployment for the database.

D.Set up a pilot light environment with database replication.

AnswerB

Backups to S3 can be restored in another region within RPO/RTO.

Why this answer

Cross-region backup and restore with AWS Backup is the most appropriate strategy because it meets both the RPO of 15 minutes and RTO of 2 hours for SAP on AWS. AWS Backup supports continuous backups for SAP HANA databases with a 15-minute RPO via Backint integration, and restoring from a cross-region backup can complete within 2 hours for typical SAP workloads. This approach provides the required recovery point and time objectives while maintaining data durability across AWS Regions.

Exam trap

The trap here is that candidates often confuse Multi-AZ (Option C) as a disaster recovery solution, but it only protects against AZ failures, not regional disasters, and the question's RPO/RTO targets imply a cross-region requirement, making cross-region backup and restore the correct choice despite its higher RTO compared to pilot light.

How to eliminate wrong answers

Option A is wrong because deploying all SAP components in a single AWS Region provides no disaster recovery capability; a regional failure would result in complete data loss and downtime, failing both the RPO and RTO requirements. Option C is wrong because Multi-AZ deployment for the database only protects against an Availability Zone failure within the same Region, not a full regional disaster, and thus cannot meet the cross-region DR requirement implicit in the RPO/RTO targets. Option D is wrong because a pilot light environment with database replication typically achieves a lower RTO (minutes) but requires ongoing replication and failover orchestration; however, for SAP on AWS, pilot light often implies a warm standby with database replication that can achieve sub-15-minute RPO but may not guarantee the 2-hour RTO due to the complexity of SAP application stack startup and validation, and it is not the most appropriate strategy when cross-region backup and restore can meet the stated objectives with less operational overhead.

Practice this question →

177

MCQhard

A company runs SAP on EC2 instances in a private subnet. The instances need to download patches from the internet but must not be directly accessible from the internet. Which configuration meets these requirements?

A.Place a proxy server on a bastion host in a public subnet

B.Attach an Internet Gateway to the VPC and add a route to the private subnet

C.Use a VPN connection to the on-premises network and route internet traffic through it

D.Deploy a NAT Gateway in a public subnet and route traffic from the private subnet to it

AnswerD

NAT Gateway enables outbound internet traffic while blocking inbound.

Why this answer

A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download patches) while preventing any unsolicited inbound connections from the internet. The private subnet's route table directs 0.0.0.0/0 traffic to the NAT Gateway, which performs source network address translation (SNAT) on the outbound traffic and drops unsolicited inbound packets.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, mistakenly thinking that an Internet Gateway can be used for outbound-only access from a private subnet, when in fact an Internet Gateway enables bidirectional traffic and requires instances to have public IPs to be reachable from the internet.

How to eliminate wrong answers

Option A is wrong because a proxy server on a bastion host in a public subnet would require the EC2 instances to be explicitly configured to use the proxy, and the bastion host itself would be directly accessible from the internet, creating a management and security overhead that does not meet the requirement of the instances not being directly accessible. Option B is wrong because attaching an Internet Gateway directly to the VPC and adding a route to the private subnet would make the instances directly accessible from the internet (since the Internet Gateway enables bidirectional traffic), violating the requirement that instances must not be directly accessible. Option C is wrong because using a VPN connection to the on-premises network and routing internet traffic through it would force all internet-bound traffic to traverse the on-premises network, which is an overly complex and indirect solution that does not leverage AWS-native services; it also does not inherently prevent direct internet access to the instances unless additional firewall rules are applied.

Practice this question →

178

Multi-Selecthard

An SAP system is deployed on EC2 instances in a VPC. The security team requires that all traffic between the SAP application and database tiers must be encrypted in transit. Which action should be taken to meet this requirement?

Select 1 answer

A.Attach an Internet Gateway to the VPC

B.Configure SSL/TLS certificates on the database and application servers

C.Restrict security group rules to only allow traffic from the application tier

D.Create a VPC Peering connection between the subnets

E.Use network ACLs to allow only database traffic

AnswersB

Configuring SSL/TLS certificates on both servers encrypts the traffic between them in transit.

Why this answer

To encrypt traffic in transit between SAP application and database tiers, SSL/TLS certificates must be configured on both servers (B). This ensures that all data exchanged is encrypted. Security group rules (C) control access but do not provide encryption themselves; they only limit which traffic reaches the database, not whether that traffic is encrypted.

No other option offers encryption. Therefore, only option B correctly fulfills the requirement of encrypting traffic in transit.

Practice this question →

179

Multi-Selectmedium

A company is deploying SAP S/4HANA on AWS and needs to choose a storage solution for the HANA data volume that provides high IOPS and low latency. Which TWO storage options are suitable? (Choose TWO.)

Select 2 answers

A.Amazon EBS gp2 volumes

B.Amazon EC2 instance store (NVMe SSD)

C.Amazon EBS io2 Block Express volumes

D.Amazon Elastic File System (EFS)

E.Amazon S3

AnswersB, C

Instance store provides very low latency and high IOPS, but data is ephemeral; often used for /hana/log.

Why this answer

Amazon EC2 instance store (NVMe SSD) provides very high IOPS and ultra-low latency because it is physically attached to the host server, making it ideal for SAP HANA data volumes that require consistent, sub-millisecond performance. Amazon EBS io2 Block Express volumes deliver up to 256,000 IOPS per volume with single-digit millisecond latency and 99.999% durability, meeting SAP HANA's demanding storage performance requirements.

Exam trap

The trap here is that candidates often choose gp2 volumes because they are SSD-based and cheaper, failing to recognize that gp2's burst model cannot sustain the consistent high IOPS and low latency that SAP HANA demands, and that only io2 Block Express or instance store are SAP-certified for HANA data volumes.

Practice this question →

180

MCQhard

An SAP system administrator is troubleshooting a high CPU usage issue on an SAP application server (AS) running on an EC2 instance. The administrator suspects that a specific ABAP report is consuming excessive resources. Which AWS service can provide detailed CPU utilization metrics at the process level to confirm the suspicion?

A.AWS CloudTrail

B.Amazon CloudWatch agent with the 'procstat' plugin

C.AWS Systems Manager Inventory

D.AWS Compute Optimizer

AnswerB

The CloudWatch agent can collect per-process CPU, memory, and disk metrics and publish them as custom CloudWatch metrics.

Why this answer

The Amazon CloudWatch agent with the 'procstat' plugin can collect CPU and memory utilization metrics at the individual process level, including specific ABAP processes or reports by name or PID. This allows the administrator to confirm which ABAP report is causing high CPU usage on the EC2 instance running the SAP application server.

Exam trap

The trap here is that candidates may confuse CloudTrail (audit logging) with monitoring, or assume that Systems Manager Inventory provides real-time performance data, when in fact only the CloudWatch agent with the procstat plugin can deliver per-process CPU metrics.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events, not system-level CPU metrics. Option C is wrong because AWS Systems Manager Inventory collects software inventory and OS configuration data, not real-time CPU utilization per process. Option D is wrong because AWS Compute Optimizer provides rightsizing recommendations based on historical utilization patterns, not granular process-level metrics.

Practice this question →

181

Multi-Selecteasy

A company is planning to migrate its SAP environment to AWS. The SAP landscape includes development, test, and production systems. The company wants to ensure data security and compliance. Which THREE AWS services should the company use to achieve this?

Select 3 answers

A.AWS Key Management Service (KMS) for encryption of EBS volumes and S3 buckets.

B.AWS Identity and Access Management (IAM) for user and role management.

C.AWS Direct Connect for dedicated network connection.

D.AWS CloudTrail for auditing API calls.

E.Elastic Load Balancing for distributing traffic.

AnswersA, B, D

KMS provides encryption key management.

Why this answer

AWS KMS enables encryption of EBS volumes and S3 buckets, ensuring data at rest is secure. Option B is correct because IAM provides user and role management to enforce least privilege access. Option D is correct because CloudTrail records API activity for auditing and compliance.

Option C is wrong because Direct Connect is a network connectivity service, not a security service. Option E is wrong because Elastic Load Balancing is for traffic distribution, not security.

Practice this question →

182

MCQeasy

A company is implementing SAP HANA on AWS and needs to ensure that the storage configuration meets the required IOPS and throughput. The SAP HANA system uses a scale-out architecture with multiple worker nodes. Which type of Amazon EBS volume is recommended for the /hana/data and /hana/log volumes in a production environment?

A.Throughput Optimized HDD (st1)

B.General Purpose SSD (gp2 or gp3)

C.Provisioned IOPS SSD (io1 or io2)

D.Cold HDD (sc1)

AnswerC

Provides consistent low-latency performance required for HANA.

Why this answer

For SAP HANA production workloads on AWS, the /hana/data and /hana/log volumes require consistent, high IOPS and low latency. Provisioned IOPS SSD (io1 or io2) volumes are recommended because they allow you to specify a guaranteed IOPS rate independent of volume size, meeting SAP's strict performance requirements for scale-out architectures. General Purpose SSD volumes (gp2/gp3) cannot provide the sustained, predictable IOPS needed for critical SAP HANA operations, especially under burst conditions.

Exam trap

The trap here is that candidates often choose General Purpose SSD (gp2/gp3) thinking it is sufficient for production, but AWS and SAP documentation explicitly mandate Provisioned IOPS SSD for SAP HANA production workloads to guarantee consistent performance and meet SAP's certification requirements.

How to eliminate wrong answers

Option A is wrong because Throughput Optimized HDD (st1) is a throughput-oriented, not IOPS-oriented, volume type with high latency and inconsistent performance, making it unsuitable for SAP HANA's low-latency data and log writes. Option B is wrong because General Purpose SSD (gp2 or gp3) volumes rely on burst credits (gp2) or baseline performance that may not guarantee the sustained high IOPS required by SAP HANA in production, and they lack the ability to provision dedicated IOPS. Option D is wrong because Cold HDD (sc1) is designed for infrequently accessed, cold data with very low IOPS and high latency, which cannot support the real-time transactional demands of SAP HANA.

Practice this question →

183

MCQhard

An SAP administrator created the IAM policy shown in the exhibit for a team managing SAP HANA instances. What is the effective permission for the team regarding an EC2 instance with the tag 'Environment=Production'?

A.The team can start, stop, and terminate the instance.

B.The team cannot start, stop, or terminate the instance.

C.The team can only describe the instance.

D.The team can start and stop the instance, but cannot terminate it.

AnswerD

The Deny for TerminateInstances blocks termination.

Why this answer

The IAM policy explicitly denies the 'ec2:TerminateInstances' action for instances with the tag 'Environment=Production', while allowing 'ec2:StartInstances' and 'ec2:StopInstances' via a separate Allow statement. Since an explicit Deny overrides any Allow, the team can start and stop the instance but cannot terminate it.

Exam trap

The trap here is that candidates may overlook the explicit Deny statement and assume the Allow for start/stop/terminate applies universally, or they may forget that an explicit Deny overrides any Allow, leading them to incorrectly choose Option A or B.

How to eliminate wrong answers

Option A is wrong because the policy includes an explicit Deny for 'ec2:TerminateInstances' on Production-tagged instances, which overrides the Allow for start and stop, so termination is not permitted. Option B is wrong because the policy does allow 'ec2:StartInstances' and 'ec2:StopInstances' for Production-tagged instances, so the team can perform those actions. Option C is wrong because the policy does not restrict describing the instance; the effective permissions include start and stop, not just describe.

Practice this question →

184

Multi-Selecteasy

An SAP administrator needs to set up disaster recovery for an SAP system on AWS. Which TWO AWS services can be used to replicate data across regions?

Select 2 answers

A.Amazon CloudFront

B.Amazon EFS replication

C.Amazon EBS snapshots copied to another region

D.Amazon S3 Cross-Region Replication

E.Amazon RDS read replicas in another region

AnswersC, D

Snapshots can be copied cross-region for volume replication.

Why this answer

Amazon EBS snapshots can be copied to another AWS region, providing a reliable mechanism for disaster recovery of SAP systems by creating point-in-time backups of critical volumes. This allows the SAP administrator to restore the system in a different region if the primary region fails, ensuring data durability and recoverability.

Exam trap

The trap here is that candidates may confuse Amazon RDS read replicas with cross-region disaster recovery replication, but read replicas are designed for read scaling and do not support write operations or failover for SAP systems.

Practice this question →

185

MCQeasy

An SAP system administrator needs to grant an external auditor read-only access to view EC2 instance configurations and CloudWatch logs. Which IAM policy should they use?

A.AWS managed policy: SecurityAudit

B.AWS managed policy: ReadOnlyAccess

C.AWS managed policy: AdministratorAccess

D.AWS managed policy: PowerUserAccess

AnswerB

ReadOnlyAccess provides read-only access to all services, suitable for auditors.

Why this answer

The ReadOnlyAccess AWS managed policy grants read-only access to all AWS services and resources, including EC2 instance configurations and CloudWatch logs, without allowing any write or modify actions. This policy is the most appropriate for an external auditor who needs to view but not change any resources, as it provides the necessary read permissions across services while preventing any modifications.

Exam trap

The trap here is that candidates often choose SecurityAudit because it sounds security-focused, but it lacks the broad read-only access to EC2 and CloudWatch logs required for this specific auditor scenario.

How to eliminate wrong answers

Option A is wrong because SecurityAudit is designed for security auditing and includes read-only access to security-related services like IAM, CloudTrail, and Config, but it does not grant read access to EC2 instance configurations or CloudWatch logs, which are required for this use case. Option C is wrong because AdministratorAccess grants full administrative permissions, including write and delete actions, which violates the principle of least privilege and is excessive for a read-only auditor. Option D is wrong because PowerUserAccess allows full access to AWS services and resources but does not allow management of users and groups; however, it still permits write and modify actions on EC2 and CloudWatch, which is not appropriate for read-only access.

Practice this question →

186

MCQeasy

An administrator is setting up an SAP system on AWS and needs to assign a static private IP address to the SAP application server. Which AWS resource should be used to ensure the private IP address remains the same even after an instance stop/start?

A.VPC endpoint

B.Elastic Network Interface (ENI) with a primary private IP

C.Secondary private IP address on the primary network interface

D.Elastic IP address

AnswerB

An ENI retains its private IP address even when detached or attached to a different instance.

Why this answer

An Elastic Network Interface (ENI) with a primary private IP address retains its private IP address across instance stop/start cycles because the ENI is a separate resource that persists independently of the instance lifecycle. When you attach an ENI to an SAP application server, the primary private IP (assigned from the VPC subnet) remains fixed even after the instance is stopped and started, ensuring consistent network addressing for SAP communication.

Exam trap

The trap here is that candidates confuse the persistence of an Elastic IP (which is a public IP) with the need for a static private IP, or they mistakenly think that secondary private IPs on the primary ENI survive instance stop/start, when in fact only an ENI as a standalone resource guarantees private IP persistence.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint is used to privately connect a VPC to supported AWS services (e.g., S3, DynamoDB) via the AWS network, not to assign or preserve a static private IP address for an EC2 instance. Option C is wrong because a secondary private IP address on the primary network interface is attached to the instance's default ENI, which is ephemeral and can change if the instance is stopped and started (the primary ENI is deleted and recreated). Option D is wrong because an Elastic IP address is a public IPv4 address that can be associated with an instance or ENI, but it does not provide a static private IP address; it is used for public-facing connectivity and incurs charges when not associated with a running instance.

Practice this question →

187

MCQmedium

A company runs SAP on AWS and uses AWS KMS for encryption of EBS volumes. The security team requires that the EBS volumes used for SAP HANA data and log files be encrypted with a customer-managed key. They also want to ensure that the key cannot be deleted. What should the security team do to protect the KMS key?

A.Set a key policy that prevents the kms:ScheduleKeyDeletion action.

B.Use an AWS managed key instead of a customer-managed key.

C.Store the key in AWS Secrets Manager.

D.Enable automatic key rotation.

AnswerA

A key policy can explicitly deny the deletion action.

Why this answer

Setting a key policy that denies the kms:ScheduleKeyDeletion action prevents the key from being deleted. This ensures that the customer-managed key used for EBS volume encryption cannot be scheduled for deletion, meeting the security requirement. Option B is incorrect because AWS managed keys cannot have custom key policies and are managed by AWS, which does not meet the requirement for a customer-managed key.

Option C is incorrect because storing the key in Secrets Manager is not for deletion prevention; Secrets Manager is for secure storage of secrets, not for KMS key deletion protection. Option D is incorrect because automatic key rotation creates new cryptographic material but does not prevent key deletion; it is a security best practice for key freshness, not for deletion prevention.

Practice this question →

188

MCQhard

A company is migrating an SAP ERP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). The solution must use a shared file system for the SAP transport directory. Which combination of AWS services should be used?

A.Amazon FSx for Windows File Server for the transport directory

B.Amazon S3 as the transport directory with two application servers

C.Amazon EFS for the transport directory and two EC2 instances with a floating IP

D.Amazon EBS volumes attached to both ASCS and ERS instances

AnswerC

EFS provides shared NFS; floating IP enables failover for ASCS/ERS.

Why this answer

SAP ASCS and ERS require a highly available shared file system for the SAP transport directory, and Amazon EFS provides a fully managed NFS file system that can be mounted by multiple EC2 instances across Availability Zones. The floating IP (using AWS Elastic IP or a secondary private IP) allows the ASCS and ERS services to fail over transparently between the two EC2 instances, meeting the high availability requirements without relying on a single point of failure.

Exam trap

The trap here is that candidates often assume a shared file system must be block storage (like EBS) or Windows-based (like FSx), but they overlook that SAP on Linux requires NFS-based shared storage, and Amazon EFS is the native AWS NFS solution that supports multi-AZ access and high availability.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server uses SMB protocol, which is not natively supported by SAP on Linux (SAP ASCS/ERS typically run on Linux or Windows, but the question does not specify Windows; for Linux-based SAP, NFS is required). Option B is wrong because Amazon S3 is an object storage service and cannot be used as a POSIX-compliant shared file system for the SAP transport directory; it lacks the necessary file locking and low-latency access required by SAP. Option D is wrong because Amazon EBS volumes can only be attached to a single EC2 instance at a time (unless using multi-attach EBS, which is limited to specific volume types and instance families and is not designed for SAP shared file systems); attaching separate EBS volumes to ASCS and ERS would not provide a shared file system.

Practice this question →

189

Multi-Selecteasy

Which TWO AWS services are commonly used to monitor the performance of SAP applications and infrastructure?

Select 2 answers

A.AWS X-Ray

B.AWS CloudTrail

C.Amazon CloudWatch

D.AWS Config

E.AWS Trusted Advisor

AnswersA, C

X-Ray helps trace and debug application performance.

Why this answer

AWS X-Ray is correct because it helps trace and analyze user requests as they travel through SAP applications, identifying performance bottlenecks and errors in distributed transactions. Amazon CloudWatch is correct because it collects and monitors metrics, logs, and alarms for SAP infrastructure resources such as EC2 instances, RDS databases, and Application Load Balancers, enabling proactive performance management.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with CloudWatch (monitoring), or assume AWS Config can monitor performance when it only tracks configuration changes.

Practice this question →

190

Multi-Selectmedium

A company is planning to migrate a large SAP HANA database to AWS using AWS Snowball Edge devices. The database size is 50 TB and the migration must be completed within a week. Which TWO actions should the company take to ensure a successful migration?

Select 2 answers

A.Use AWS Direct Connect to accelerate data transfer from Snowball Edge to AWS.

B.Order multiple Snowball Edge devices to transfer data in parallel.

C.Split the data into smaller chunks because each Snowball Edge can only hold 10 TB.

D.Copy the data directly to an Amazon S3 bucket using the Snowball Edge client.

E.Compress the HANA data files before loading them onto the Snowball Edge devices.

AnswersB, E

Parallel transfers reduce overall time.

Why this answer

Snowball Edge devices have a usable storage capacity of up to 80 TB per device, but to transfer 50 TB within a one-week window, using multiple devices in parallel significantly reduces the total transfer time. Parallel data transfer allows the company to split the workload across devices, maximizing throughput and meeting the tight migration deadline.

Exam trap

The trap here is that candidates may assume Snowball Edge devices have a 10 TB limit (confusing them with older Snowball models) or believe that Direct Connect can accelerate the physical shipping process, leading them to select incorrect options A or C.

Practice this question →

191

MCQhard

A company has deployed SAP BusinessObjects (BO) on AWS using a multi-tier architecture with a Windows-based application server and a SQL Server database hosted on Amazon RDS. The application server is behind an Application Load Balancer (ALB) that handles HTTPS traffic. Users report that sometimes they receive a '502 Bad Gateway' error when accessing the BO web interface. The error occurs intermittently and is not reproducible on demand. The operations team checks the ALB logs and sees that the target response time occasionally exceeds 120 seconds. The BO application has a default timeout of 60 seconds. The team also notices that the ALB idle timeout is set to 60 seconds. What is the most likely cause of the 502 errors?

A.Place an Amazon CloudFront distribution in front of the ALB to cache responses and reduce load.

B.Increase the max_connections parameter in the RDS SQL Server instance.

C.Increase the idle timeout of the Application Load Balancer to 180 seconds.

D.Increase the deregistration delay on the ALB target group to 300 seconds.

AnswerC

The ALB request timeout (idle timeout) can be increased to accommodate longer application processing times, preventing premature connection closure.

Why this answer

The 502 errors occur because the ALB idle timeout (60 seconds) matches the BO application's default timeout (60 seconds), but the ALB logs show target response times occasionally exceed 120 seconds. When the ALB idle timeout expires before the backend completes its response, the ALB closes the connection and returns a 502 error. Increasing the ALB idle timeout to 180 seconds allows sufficient time for the backend to respond, preventing premature connection termination.

Exam trap

The trap here is confusing the ALB idle timeout with the deregistration delay or database connection limits, leading candidates to choose options that address unrelated bottlenecks instead of the direct cause of the 502 error.

How to eliminate wrong answers

Option A is wrong because placing a CloudFront distribution in front of the ALB would not resolve the underlying timeout issue; caching is ineffective for dynamic SAP BO sessions and does not extend the ALB's idle timeout. Option B is wrong because increasing max_connections on RDS SQL Server addresses database connection limits, not the HTTP-level timeout causing the 502 error. Option D is wrong because the deregistration delay controls how long the ALB waits for in-flight requests before removing a target from service; it does not affect the idle timeout that triggers the 502 error.

Practice this question →

192

MCQeasy

An organization wants to ensure that its SAP HANA database backups are stored in a separate AWS Region for disaster recovery. The backups are currently stored in Amazon S3 in the primary Region. Which AWS service should be used to replicate the backups to another Region automatically?

A.Amazon S3 Cross-Region Replication (CRR).

B.AWS Storage Gateway with volume gateway.

C.AWS Backup with a cross-region backup plan.

D.Amazon S3 Transfer Acceleration.

AnswerA

S3 CRR automatically replicates objects to another Region.

Why this answer

Amazon S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects from an S3 bucket in one AWS Region to a bucket in another Region, meeting the requirement for storing SAP HANA database backups in a separate Region for disaster recovery. CRR operates asynchronously at the object level, ensuring that backups are continuously copied without manual intervention, and it supports the same storage classes and encryption mechanisms as the source bucket.

Exam trap

The trap here is that candidates may confuse AWS Backup's cross-region copy capability with S3 CRR, but AWS Backup is a managed backup service that does not automatically replicate existing S3 objects without a backup plan, whereas CRR is a native S3 feature designed specifically for continuous, automatic object replication across Regions.

How to eliminate wrong answers

Option B (AWS Storage Gateway with volume gateway) is wrong because volume gateway provides on-premises access to cloud-backed iSCSI volumes and does not automatically replicate data across Regions; it is designed for hybrid storage, not cross-region backup replication. Option C (AWS Backup with a cross-region backup plan) is wrong because while AWS Backup can copy backups across Regions, it is a backup orchestration service that requires creating backup plans and policies, and it does not directly replicate existing S3 objects; it is more suited for managing backups of AWS services like EBS, RDS, and DynamoDB, not for continuous replication of S3-stored SAP HANA backups. Option D (Amazon S3 Transfer Acceleration) is wrong because it only speeds up uploads to S3 over long distances using AWS edge locations; it does not provide any replication or copying of data between Regions.

Practice this question →

193

MCQmedium

A company runs SAP S/4HANA on AWS and needs to ensure that the system can automatically recover from an Availability Zone failure. The solution must use synchronous replication for zero data loss. Which AWS architecture meets these requirements?

A.EBS snapshots taken every 5 minutes

B.Multi-AZ RDS for SAP HANA

C.Cluster placement group spanning two AZs

D.SAP HANA System Replication with synchronous replication

AnswerD

Synchronous HSR provides zero RPO and automatic failover across AZs.

Why this answer

SAP HANA System Replication with synchronous replication across Availability Zones ensures zero data loss and automatic failover. Option A is incorrect because EBS snapshots are asynchronous and do not provide zero data loss. Option B is incorrect because Multi-AZ RDS is not supported for HANA.

Option C is incorrect because cluster placement groups are within a single AZ and do not provide cross-AZ failover.

Practice this question →

194

MCQmedium

Refer to the exhibit. An Application Load Balancer is configured to route traffic to an Auto Scaling group of web servers. The health check for the target group is failing. The web servers are healthy and running, but the health check endpoint is returning a 503 status code because the application cannot connect to the database. The database is an Amazon RDS instance in the same VPC. Which action should the solutions architect take to resolve the health check failure?

A.Restart the web server instances to reset the database connection.

B.Change the health check endpoint to a static page that does not require database connectivity.

C.Modify the application's health check endpoint to return a 200 OK status even when the database is unavailable.

D.Increase the health check interval to allow more time for the database to respond.

AnswerB

A static health check page will return 200 even if the database is down, allowing the instance to pass the health check.

Why this answer

The health check endpoint should validate the web server's ability to serve traffic, not the database's availability. By changing the health check to a static page (e.g., /health.html) that does not depend on database connectivity, the load balancer will correctly assess the web server's health independently. This decouples the health check from the database, preventing cascading failures where a database outage causes all web servers to be marked unhealthy and removed from the target group.

Exam trap

The trap here is that candidates may think the health check must reflect the full application stack (including database connectivity), but AWS best practice is to keep health checks lightweight and independent of external dependencies to prevent cascading failures.

How to eliminate wrong answers

Option A is wrong because restarting the web server instances does not resolve the underlying database connectivity issue; the application will still fail to connect to the database after restart, and the health check will continue to return 503. Option C is wrong because modifying the application to return a 200 OK status even when the database is unavailable would mask a real application failure, causing the load balancer to route traffic to unhealthy servers that cannot serve complete requests, leading to user-facing errors. Option D is wrong because increasing the health check interval does not fix the database connectivity problem; it only delays the detection of the failure, and the health check will still fail when it eventually runs.

Practice this question →

195

MCQeasy

Refer to the exhibit. An SAP system administrator checks disk usage on an SAP HANA instance. The /hana/log volume is at 80% usage. What is the recommended course of action to prevent issues?

A.Take a snapshot of the instance and terminate it.

B.Increase the size of the EBS volume for /hana/log and extend the filesystem.

C.Delete old backup files from /hana/log.

D.Move some data from /hana/log to /hana/data.

AnswerB

Increasing volume size provides more space for log files.

Why this answer

SAP HANA requires that the log volume have sufficient free space to avoid transaction log overflow. The best practice is to increase the size of the log volume. Deleting logs manually is risky, and moving data volumes is not appropriate.

The recommended action is to increase the EBS volume size and extend the filesystem.

Practice this question →

196

MCQmedium

An administrator needs to retrieve the private IP address of an ASCS instance that was deployed via AWS CloudFormation. What is the most efficient way to get this IP address?

A.Check the CloudFormation stack events for the private IP.

B.Use the AWS CLI to describe the EC2 instance using the instance ID.

C.Use AWS Systems Manager to find the IP from the instance ID.

D.Modify the CloudFormation template to add the private IP as an output.

AnswerD

Adding the private IP as an output in the template is the most direct way to expose it via CloudFormation.

Why this answer

CloudFormation stack outputs are the intended mechanism for exposing resource attributes, such as private IP addresses, after stack creation. By modifying the template to include the private IP as an output, the administrator can retrieve it directly via the AWS CLI `describe-stacks` command without additional API calls or manual lookups, making it the most efficient and automated approach.

Exam trap

The trap here is that candidates may assume retrieving the private IP from the EC2 instance directly (via describe-instances or Systems Manager) is simpler, but they overlook that CloudFormation outputs are specifically designed to expose such values efficiently and are the recommended practice for infrastructure-as-code workflows.

How to eliminate wrong answers

Option A is wrong because CloudFormation stack events track lifecycle operations (e.g., resource creation, updates, deletions) and do not contain resource-specific data like private IP addresses. Option B is wrong because while describing the EC2 instance using the instance ID can retrieve the private IP, it requires an extra step to first obtain the instance ID from the stack, which is less efficient than using a direct stack output. Option C is wrong because AWS Systems Manager can retrieve instance metadata, but it requires the instance to have the SSM Agent installed and configured, and it introduces unnecessary complexity compared to using a native CloudFormation output.

Practice this question →

197

MCQhard

An SAP administrator created the IAM policy shown above to control access to an S3 bucket used for SAP HANA backups. The policy is attached to an IAM role used by an EC2 instance. The instance fails to upload backups. What is the cause?

A.The policy does not allow encryption (SSE-S3) which is required for backups.

B.The 'aws:SecureTransport' condition in the Deny statement is incorrectly using 'BoolIfExists' instead of 'Bool'.

C.The VPC endpoint ID in the policy does not match the actual endpoint.

D.The Deny statement overrides the Allow statement for all actions.

AnswerB

Using 'BoolIfExists' will deny requests even if the key is absent, which may deny legitimate HTTPS requests if the condition is mis-evaluated. 'Bool' should be used to explicitly check for false.

Why this answer

The policy uses 'BoolIfExists' for the 'aws:SecureTransport' condition in the Deny statement. 'BoolIfExists' evaluates the condition as true if the condition key exists and matches the specified value, OR if the key does not exist at all. This can cause unintended denials when the 'aws:SecureTransport' key is absent from the request context (e.g., certain internal AWS service calls). Using 'Bool' instead ensures the condition is evaluated only when the key is present, preventing false denials.

This mismatch between the intended behavior (deny only when explicitly false) and the actual behavior (deny also when key is missing) is the root cause of the backup upload failure.

Practice this question →

198

MCQeasy

An SAP customer has deployed SAP HANA on AWS using an r5.12xlarge instance with 16 EBS io1 volumes for data and log. The system is running in production. The operations team receives an alert that one of the EBS volumes has failed (status check failed). The volume is part of the RAID 0 stripe for the data volume. What should they do to recover the system with minimal data loss?

A.Detach the failed volume, attach a new identical volume, and rebuild the RAID array.

B.Contact AWS Support to recover the data from the failed EBS volume.

C.Increase the size of the remaining volumes to compensate for the lost capacity.

D.Restore the HANA database from the latest backup to a new set of EBS volumes.

AnswerD

Restoring from backup ensures data consistency and recovery with minimal loss.

Why this answer

Since the failed volume is part of a RAID 0 stripe, the entire stripe is compromised. Restoring from the most recent backup is the safest way to recover with minimal data loss. Option A (replace volume and rebuild RAID) may not work because RAID 0 has no redundancy.

Option B (AWS Support) may help but not recover data directly. Option C (increase volume size) does not fix the failed volume.

Practice this question →

199

MCQhard

A company is migrating an SAP ERP system to AWS and needs to minimize downtime during the cutover. The database is SAP ASE. Which migration strategy is most appropriate?

A.Use SAP ASE replication to replicate data to an EC2 instance running ASE, then cut over.

B.Create a nightly backup of the on-premises database, copy to AWS, and restore.

C.Perform a full database export from on-premises and import into Amazon RDS for ASE.

D.Use AWS Database Migration Service (DMS) with ongoing replication.

AnswerA

Correct. Native ASE replication provides continuous, real-time synchronization, allowing a very short cutover window by applying only final transactions.

Why this answer

SAP ASE native replication (via Sybase Replication Server) allows continuous, real-time data synchronization from the on-premises ASE database to an EC2 instance running ASE in AWS. While AWS DMS supports SAP ASE as a source, it typically performs a full load followed by ongoing replication, which can introduce higher latency and longer cutover windows. In contrast, native replication minimizes downtime by keeping the target closely synchronized, requiring only a brief pause to apply final transactions and redirect clients.

Exam trap

The trap is assuming AWS DMS is the best choice for minimizing downtime because it supports SAP ASE. However, native ASE replication provides even lower latency and a faster cutover, as it avoids the initial full data load required by DMS. The key is understanding that native replication is purpose-built for ASE-to-ASE synchronization and offers the shortest possible downtime.

How to eliminate wrong answers

Option B is wrong because nightly backups and restores require a full data transfer and restore process, which can take hours or days for large SAP ASE databases, causing unacceptable downtime during cutover. Option C is wrong because Amazon RDS for ASE is not a supported service; AWS does not offer a managed RDS engine for SAP ASE, so a full export/import to RDS is not feasible. Option D is wrong because AWS DMS does not support SAP ASE as a source for ongoing replication with transactional consistency; DMS is designed for heterogeneous migrations and lacks native SAP ASE log-based replication capabilities, making it unsuitable for minimizing downtime in this scenario.

Practice this question →

200

MCQeasy

A company has deployed SAP S/4HANA on AWS using a single EC2 instance for the HANA database. The database volume is an EBS io1 volume with 5,000 provisioned IOPS. The company wants to implement a high availability (HA) solution for the database using SAP HANA System Replication (HSR) with automatic failover. They plan to use a second EC2 instance in a different Availability Zone. The database administrator is concerned about data consistency during replication. Which additional AWS service should be used to ensure data consistency and minimize data loss during failover?

A.AWS Backup to schedule backups of the HANA database.

B.AWS Database Migration Service (DMS) to continuously replicate data.

C.Amazon EBS snapshots to capture point-in-time copies of the data volume.

D.Amazon Route53 with health checks to automatically redirect traffic to the standby instance.

AnswerD

Route53 can provide DNS failover with health checks.

Why this answer

Amazon Route53 with health checks can monitor the primary HANA instance and automatically update DNS to redirect traffic to the standby instance in a different Availability Zone during a failover. This ensures minimal disruption and data consistency with HSR. Option A (AWS Backup) is for scheduled backups, not real-time replication.

Option B (DMS) is designed for database migration, not for HANA HSR. Option C (EBS snapshots) provide point-in-time backups, not continuous replication to minimize data loss.

Practice this question →

201

MCQmedium

During an SAP system migration to AWS, the team needs to ensure that the SAP application can automatically restart if the EC2 instance fails. Which combination of AWS services should they use?

A.AWS Elastic Beanstalk and Amazon RDS

B.Amazon EC2 Auto Scaling and Amazon CloudWatch

C.AWS Lambda and Amazon SQS

D.Amazon Route 53 and Elastic Load Balancing

AnswerB

Auto Scaling replaces unhealthy instances, and CloudWatch alarms can initiate recovery actions.

Why this answer

Amazon EC2 Auto Scaling can automatically replace a failed EC2 instance by launching a new one, while Amazon CloudWatch can monitor instance health and trigger the Auto Scaling recovery process. Together, they ensure the SAP application restarts on a healthy instance without manual intervention, meeting the high-availability requirement for SAP workloads.

Exam trap

The trap here is that candidates often confuse Elastic Load Balancing or Route 53 for instance recovery, but they only handle traffic distribution and DNS, not automatic instance replacement or restart.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Beanstalk is a PaaS service for web applications, not designed for SAP migrations, and Amazon RDS does not manage EC2 instance recovery for SAP applications. Option C is wrong because AWS Lambda is for serverless compute and Amazon SQS is a message queue; neither provides automatic EC2 instance restart or health monitoring for SAP. Option D is wrong because Amazon Route 53 is a DNS service and Elastic Load Balancing distributes traffic; they do not automatically restart failed EC2 instances or replace them.

Practice this question →

202

MCQmedium

Refer to the exhibit. An SAP administrator is creating an IAM policy for launching EC2 instances. Which instance type will the policy allow?

A.r5.16xlarge

B.r5.xlarge

C.r5.2xlarge

D.r5.4xlarge and r5.8xlarge

AnswerD

These are the only instance types allowed by the condition.

Why this answer

The IAM policy allows ec2:RunInstances with a condition that restricts instance types to those matching 'r5.4xlarge' or 'r5.8xlarge' via a ForAllValues:StringEquals condition on ec2:InstanceType. Since the condition uses a wildcard-free list, only the explicitly listed instance types are permitted. Options A, B, and C are not in the list, so they are denied.

Exam trap

The trap here is that candidates may think the condition allows a range of instance sizes (e.g., all r5 variants) due to the 'ForAllValues' wording, but it actually performs an exact match against the listed types, so only r5.4xlarge and r5.8xlarge are permitted.

How to eliminate wrong answers

Option A is wrong because r5.16xlarge is not listed in the ec2:InstanceType condition values, so the policy denies it. Option B is wrong because r5.xlarge is not included in the allowed list, and the condition explicitly requires a match to 'r5.4xlarge' or 'r5.8xlarge'. Option C is wrong because r5.2xlarge is not among the permitted instance types, and the ForAllValues:StringEquals condition ensures only the specified types are allowed.

Practice this question →

203

MCQeasy

An SAP administrator is reviewing a CloudFormation template snippet shown in the exhibit. The template creates an EC2 instance for SAP. What is missing from the template to ensure the instance is placed in a specific subnet?

A.The SubnetId property is not specified in the NetworkInterface

B.The InstanceType is not suitable for SAP

C.The ImageId is invalid

D.The SecurityGroup reference is missing

AnswerA

SubnetId is required to place the instance in a subnet.

Why this answer

The CloudFormation template snippet shows a NetworkInterface property being used to attach the EC2 instance to a VPC network. When you specify a NetworkInterface, you must include the SubnetId within that interface definition to place the instance in a specific subnet. Without SubnetId, the instance will be launched into the default subnet of the default VPC, which may not be the intended subnet for SAP workloads requiring specific network segmentation or latency constraints.

Exam trap

The trap here is that candidates often assume the SubnetId can be specified at the instance level even when using NetworkInterface, but AWS CloudFormation requires SubnetId to be defined inside the NetworkInterface when that property is present, and omitting it causes the instance to launch in the default subnet rather than failing with a clear error.

How to eliminate wrong answers

Option B is wrong because the InstanceType being suitable for SAP is a separate concern from subnet placement; the template snippet does not show the InstanceType value, and the question specifically asks about ensuring placement in a specific subnet, not instance sizing. Option C is wrong because the ImageId validity is unrelated to subnet placement; an invalid ImageId would cause a launch failure, but the question focuses on the missing subnet specification. Option D is wrong because the SecurityGroup reference is not required for subnet placement; security groups can be associated at the network interface level or instance level, but their presence or absence does not determine which subnet the instance is placed in.

Practice this question →

204

MCQeasy

An SAP HANA database is running on an EC2 instance with EBS volumes. The operations team needs to take nightly backups of the database. Which AWS service provides the most cost-effective backup solution for long-term retention?

A.Amazon S3 Glacier Deep Archive

B.Amazon EBS Snapshots

C.Amazon S3 Standard

D.AWS Backup

AnswerA

Glacier Deep Archive is the lowest cost storage for long-term backups.

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for long-term retention of backups that are accessed infrequently. Amazon EBS Snapshots are stored in S3 but cost more for long-term retention. AWS Backup is a service but does not change storage class.

Amazon S3 Standard is expensive for long-term.

Practice this question →

205

Multi-Selectmedium

A company is designing a disaster recovery plan for SAP S/4HANA on AWS. The plan must have a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. Which solutions can meet these requirements? (Choose TWO.)

Select 2 answers

A.Multi-AZ deployment of SAP HANA within the same region

B.SAP HANA log shipping to Amazon S3 every 15 minutes and restore in another region

C.Cross-Region Amazon S3 backup and restore using AWS Backup

D.Synchronous storage-level replication using EBS snapshots every 15 minutes and automated restore

E.SAP HANA system replication to a secondary region with automatic failover

AnswersB, E

Correct. SAP HANA log shipping to Amazon S3 every 15 minutes can achieve the RPO of 15 minutes. With automated restore and pre-provisioned infrastructure, RTO of 2 hours is feasible.

Why this answer

SAP HANA log shipping to Amazon S3 every 15 minutes can achieve an RPO of 15 minutes by shipping transaction logs at that interval. RTO of 2 hours is achievable if the restore process is automated and tested. Option E: SAP HANA system replication to a secondary region with automatic failover provides near-zero RPO (seconds) and RTO in minutes, clearly meeting the requirements.

Option D is incorrect because EBS snapshots are asynchronous and not a replication mechanism; they may not guarantee an RPO of 15 minutes due to snapshot scheduling delays, and restore times can exceed 2 hours, especially for large databases.

Practice this question →

206

MCQhard

A company is using SAP HANA on AWS and needs to back up the database to Amazon S3. The backup must be encrypted at rest in S3. The company already uses AWS KMS for encryption. What is the MOST secure way to configure the backup?

A.Use SSE-KMS with a customer managed key and restrict key usage with key policies.

B.Use client-side encryption before uploading to S3.

C.Enable default S3 encryption with SSE-S3.

D.Use SSE-KMS with the AWS managed key for S3.

AnswerA

Provides control and integration with existing KMS.

Why this answer

Using SSE-KMS with a customer managed key allows you to enforce granular key policies, including restricting key usage to specific IAM roles or conditions, and enables audit trails via AWS CloudTrail. This provides the highest level of control and security for encrypting SAP HANA backups at rest in S3, meeting the requirement for the most secure configuration.

Exam trap

The trap here is that candidates often assume the AWS managed key for S3 (aws/s3) is sufficient for encryption, but the question explicitly asks for the 'most secure' way, which requires customer managed keys with restrictive key policies to meet compliance and audit requirements.

How to eliminate wrong answers

Option B is wrong because client-side encryption would require the SAP HANA backup process to handle encryption before upload, adding complexity and potential key management overhead, and it does not leverage the existing AWS KMS infrastructure the company already uses. Option C is wrong because SSE-S3 uses AWS-managed keys with no ability to control key policies, rotation, or access restrictions, offering less security and auditability compared to customer managed keys. Option D is wrong because the AWS managed key for S3 (aws/s3) does not allow you to restrict key usage with custom key policies; it is shared across accounts and lacks the granular control needed for the most secure configuration.

Practice this question →

207

MCQhard

A company runs SAP BusinessObjects on AWS using multiple EC2 instances. The system uses a shared file system (EFS) for the repository and output files. Recently, users have reported that generating large reports takes much longer than usual. The SAP administrator checks the EFS metrics in CloudWatch and sees that the BurstCreditBalance is consistently near zero. The EFS file system is in General Purpose mode with default throughput settings. The current size of the file system is 500 GB. What should the administrator do to improve performance?

A.Migrate the EFS file system to EFS One Zone for better performance.

B.Enable Max I/O throughput mode on the EFS file system.

C.Switch to Provisioned Throughput mode and set a higher value.

D.Increase the size of the EFS file system by adding more data to it.

AnswerC

Correct. Provisioned Throughput mode allows setting a specific throughput value, ensuring consistent performance without relying on burst credits.

Why this answer

With BurstCreditBalance consistently near zero, the EFS file system has exhausted its burst credits. For SAP workloads that require consistent throughput and have high I/O demands, AWS recommends using Provisioned Throughput mode to ensure predictable performance. This allows the administrator to specify a higher throughput value independent of the file system size, which resolves the performance issue for large report generation.

Option B is incorrect because enabling Max I/O mode changes the performance mode, not the throughput mode. Max I/O is designed for workloads with high concurrency and does not guarantee consistent throughput; it may not provide the stable performance needed for SAP. Option A is incorrect because EFS One Zone is for cost savings in a single AZ and does not improve throughput.

Option D is incorrect because while adding data increases baseline throughput slightly, it is not an efficient or practical solution and may not provide sufficient throughput.

Exam trap

A common mistake is to assume that Max I/O mode (option B) solves burst credit exhaustion because it provides higher burst throughput. However, Max I/O is a performance mode that optimizes for high concurrency, not sustained throughput. For SAP workloads, Provisioned Throughput (option C) is the recommended solution to ensure consistent performance.

Practice this question →

208

MCQmedium

A company runs SAP BusinessObjects on AWS and needs to scale the application tier based on CPU utilization. Which AWS service should be used to automatically add or remove EC2 instances?

A.AWS Elastic Load Balancing

B.AWS Lambda

C.AWS Auto Scaling

D.AWS CloudFormation

AnswerC

Auto Scaling can adjust instance count based on CPU metrics.

Why this answer

AWS Auto Scaling can automatically adjust the number of EC2 instances based on CloudWatch alarms for CPU utilization. AWS Elastic Load Balancing distributes traffic but does not scale instances. AWS Lambda is for serverless, not EC2 scaling.

AWS CloudFormation is for infrastructure provisioning, not auto-scaling.

Practice this question →

209

MCQhard

A company runs its SAP S/4HANA system on AWS using a multi-node HANA scale-out configuration. After a recent OS update, the application layer cannot connect to the HANA database. The HANA database processes are running, but the SAP application servers report 'communication failure' errors. Initial checks show that the security group rules allow traffic on the required ports. What is the MOST likely cause of the issue?

A.The DNS resolution is misconfigured after the OS update, causing hostname lookup failures.

B.The NTP synchronization is off, causing time drift and authentication errors.

C.The OS update has reset the iptables firewall rules, blocking internal HANA ports.

D.The SAP system is not correctly licensed for the new OS version.

AnswerC

OS updates can clear iptables rules, blocking required ports even if security groups allow traffic.

Why this answer

OS updates on Linux systems often reset or flush iptables firewall rules to their default state, which typically blocks all inbound traffic on non-essential ports. In a multi-node HANA scale-out configuration, internal HANA communication relies on specific TCP ports (e.g., 3xx01–3xx10 for internal network traffic). When iptables rules are reset, these ports become blocked, preventing the SAP application layer from connecting to the HANA database even though the database processes are running and security group rules at the AWS level are correctly configured.

Exam trap

The trap here is that candidates often focus on AWS-level security groups or DNS issues, overlooking the fact that OS-level firewalls (iptables) are reset during updates and can block internal HANA ports even when security groups are correctly configured.

How to eliminate wrong answers

Option A is wrong because DNS misconfiguration would cause hostname lookup failures, but the SAP application servers report 'communication failure' errors, not 'hostname resolution' errors; moreover, the HANA database processes are running and the issue appeared immediately after an OS update, not a DNS change. Option B is wrong because NTP synchronization issues causing time drift would lead to Kerberos or SSL/TLS authentication errors, not generic 'communication failure' errors, and HANA does not rely on NTP for internal node communication in a scale-out configuration. Option D is wrong because SAP licensing is not enforced at the OS level; licensing issues would prevent the SAP system from starting or cause license expiration warnings, not block network connectivity between the application layer and the database.

Practice this question →

210

MCQmedium

A company is running SAP HANA on AWS and needs to perform a backup to S3 using the SAP HANA BACKUP command. The backup fails with an error indicating that the S3 bucket cannot be accessed. The EC2 instance has an IAM role assigned with the necessary S3 permissions. What is the most likely cause of the failure?

A.The S3 bucket is in a different region.

B.The instance does not have internet access.

C.The IAM role does not have the correct trust policy.

D.The S3 bucket policy denies access from the instance's VPC.

AnswerD

A bucket policy can explicitly deny access even if IAM allows.

Why this answer

SAP HANA backup to S3 requires a properly configured S3 bucket and the backup tool must be able to write to it. The error is likely due to the bucket policy blocking the request. IAM role permissions are correct, but bucket policies can override them.

Practice this question →

211

MCQmedium

An SAP administrator has created the IAM policy shown in the exhibit and attached it to an IAM role used by an EC2 instance running SAP HANA. The instance needs to download backup files from the S3 bucket 'sap-backup-bucket' and then stop itself after the backup is complete. However, the backup script fails with an access denied error when trying to list the bucket. What is the most likely cause? (Note: This question is reused from above but with correct exhibit now. I need to change the exhibit to have a mistake. Let me fix: remove the bucket ARN from the Resource list for S3 actions, so only the object ARN is present. That will cause the list operation to fail.)

A.The S3 bucket is encrypted and the policy does not allow kms:Decrypt

B.The instance does not have an internet gateway to reach S3

C.The policy does not include the ec2:StopInstances permission

D.The policy does not allow the s3:ListBucket action on the bucket ARN

AnswerD

The policy allows s3:ListBucket but the Resource array only includes the object ARN (sap-backup-bucket/*), not the bucket ARN. The ListBucket action requires the bucket ARN as resource.

Practice this question →

212

MCQeasy

An administrator needs to back up an SAP HANA database running on an EC2 instance. The backup must be stored in a durable, cost-effective storage solution. Which AWS service is best suited for storing the backup files?

A.Amazon S3

B.Amazon S3 Glacier

C.Amazon EFS

D.Amazon EBS snapshots

AnswerA

S3 is durable, scalable, and cost-effective for backup files.

Why this answer

Amazon S3 is the best choice for storing SAP HANA backup files because it offers 99.999999999% durability, is cost-effective for long-term backup storage, and integrates natively with SAP HANA via the Backint agent for direct backup to S3. S3 provides scalable object storage that can handle the large volume of SAP HANA data without requiring manual provisioning or lifecycle management.

Exam trap

The trap here is that candidates confuse Amazon S3 Glacier as a primary backup target due to its low cost, overlooking that SAP HANA backups require immediate accessibility for restoration, which S3 Glacier's retrieval delays cannot satisfy.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Glacier is designed for archival storage with retrieval times ranging from minutes to hours, making it unsuitable for regular SAP HANA backups that may need quick restoration. Option C is wrong because Amazon EFS is a file-level storage service that is more expensive than S3 for backup use cases and does not support the Backint integration that SAP HANA requires for direct backup. Option D is wrong because Amazon EBS snapshots are block-level backups tied to a specific EC2 instance and Availability Zone, lacking the durability, cost-efficiency, and cross-region capabilities of S3 for long-term backup storage.

Practice this question →

213

MCQhard

A company is using AWS Systems Manager to manage their SAP environment. They want to ensure that only specific users can run automation documents on production SAP instances. Which IAM policy action should be used to control access to executing automation documents?

A.ssm:SendCommand

B.ssm:GetParameter

C.ssm:StartAutomationExecution

D.ssm:ListDocuments

AnswerC

This action permits starting automation documents.

Why this answer

The correct action is ssm:StartAutomationExecution because AWS Systems Manager Automation requires this specific permission to initiate an automation workflow. The question asks about controlling access to executing automation documents, and StartAutomationExecution is the IAM action that governs the ability to start an automation execution on a target resource, such as a production SAP instance.

Exam trap

The trap here is that candidates confuse the Run Command capability (ssm:SendCommand) with Automation execution, because both involve running commands on instances, but they use different IAM actions and APIs.

How to eliminate wrong answers

Option A is wrong because ssm:SendCommand is used to send a Run Command (a different Systems Manager capability) to managed instances, not to start an automation document execution. Option B is wrong because ssm:GetParameter controls read access to a parameter in AWS Systems Manager Parameter Store, which is unrelated to executing automation documents. Option D is wrong because ssm:ListDocuments allows listing available documents but does not grant permission to execute them.

Practice this question →

214

MCQeasy

A company is running an SAP HANA database on an EC2 instance with a large amount of memory. The system is experiencing performance issues during peak loads. Which AWS service should be used to capture detailed performance metrics for analysis?

A.AWS Config

B.AWS CloudTrail

C.AWS X-Ray

D.Amazon CloudWatch

AnswerD

CloudWatch with agent can capture detailed performance metrics including memory.

Why this answer

Amazon CloudWatch is the correct service because it provides detailed, customizable performance metrics for EC2 instances, including memory utilization, CPU, disk I/O, and network throughput. For SAP HANA, which is memory-intensive, CloudWatch can capture custom metrics (e.g., via the CloudWatch Agent) to monitor memory pressure and identify bottlenecks during peak loads, enabling performance analysis and scaling decisions.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (auditing) or AWS Config (compliance) with performance monitoring, but the exam specifically tests whether you know that CloudWatch is the only service that captures OS-level and custom performance metrics for EC2 instances.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration management service that tracks resource inventory and changes, not real-time performance metrics; it cannot capture memory or CPU utilization data. Option B is wrong because AWS CloudTrail records API activity and user actions for auditing, not system-level performance metrics like memory usage or I/O. Option C is wrong because AWS X-Ray is designed for tracing and debugging distributed applications (e.g., microservices), not for monitoring OS-level or database performance metrics on a single EC2 instance.

Practice this question →

215

MCQmedium

A company is running SAP Business Suite on AWS. The system includes a central services (ASCS) instance, a primary application server (PAS), and a database server running SAP HANA. The company recently experienced an outage when the EC2 instance hosting the ASCS instance failed due to a hardware issue. The system was down for 4 hours while the IT team manually recovered the ASCS instance from an AMI. The company wants to implement a highly available ASCS instance with automatic failover and a Recovery Time Objective (RTO) of less than 15 minutes. The system is currently running in a single Availability Zone. What should the company do to meet these requirements?

A.Place the ASCS instance behind an Application Load Balancer and configure health checks.

B.Configure an Auto Scaling group for the ASCS instance with a minimum of 1 and maximum of 2, and use a lifecycle hook to attach an Elastic IP.

C.Deploy a second ASCS instance in a different Availability Zone, set up SAP enqueue replication, and use a virtual IP address with Route 53 health checks for failover.

D.Enable CloudWatch EC2 Auto Recovery on the ASCS instance and configure it to start a new instance in a different AZ.

AnswerC

This is the correct approach: deploy a second ASCS in another AZ, use SAP enqueue replication, and use Route 53 health checks with a virtual IP to achieve automatic failover with RTO <15 minutes.

Why this answer

Deploying a second ASCS instance in a different Availability Zone with SAP enqueue replication and a virtual IP address managed by Route 53 health checks provides automatic failover with an RTO under 15 minutes. This setup ensures that if the primary ASCS instance fails, the standby instance takes over quickly, maintaining enqueue state and minimizing downtime. Option A is wrong because an Application Load Balancer is not designed for SAP ASCS failover; it would not handle enqueue replication or virtual hostname.

Option B is wrong because an Auto Scaling group with lifecycle hooks does not provide application-level clustering or enqueue state replication. Option D is wrong because CloudWatch EC2 Auto Recovery only restarts the instance in the same Availability Zone and does not address enqueue replication or cross-AZ failover, resulting in an RTO longer than 15 minutes.

Practice this question →

216

Multi-Selecteasy

Which TWO AWS services can be used to store SAP backup data? (Choose two.)

Select 2 answers

A.Amazon S3

B.Amazon S3 Glacier

C.Amazon RDS

D.Amazon DynamoDB

E.Amazon EBS

AnswersA, B

S3 is a common backup target.

Why this answer

Amazon S3 is correct because it provides a highly durable, scalable, and cost-effective object storage service that can be used to store SAP backup data, such as database backups from SAP HANA or SAP ASE, via native integration or third-party backup tools. SAP-certified backup solutions, including the SAP HANA Backup & Recovery tool, can directly write backups to S3 buckets using the S3 API, supporting standard storage classes for frequent access.

Exam trap

The trap here is that candidates may confuse Amazon EBS as a backup storage service because it is commonly used for EC2 instance storage, but EBS volumes are not designed for long-term, cost-effective backup archiving, whereas S3 and S3 Glacier are the correct services for storing SAP backup data.

Practice this question →

217

MCQhard

An SAP application on EC2 is experiencing high CPU utilization. The instance is part of an Auto Scaling group. The CPU metric shows spikes every hour. Which scaling policy should be used to preemptively scale out before the spike?

A.Simple scaling policy based on CPU > 80%

B.Step scaling policy with multiple thresholds

C.Target tracking scaling policy with CPU target 75%

D.Scheduled scaling policy to add capacity just before the spike

AnswerD

Scheduled scaling can anticipate predictable patterns.

Why this answer

The CPU spikes are predictable (every hour), making a scheduled scaling policy the ideal choice to preemptively add capacity just before the spike occurs. Scheduled scaling allows you to define a specific time to increase the desired capacity of the Auto Scaling group, ensuring resources are available before the load increases, rather than reacting after the spike has started.

Exam trap

The trap here is that candidates often choose reactive policies (like target tracking or step scaling) because they focus on CPU thresholds, missing the key requirement for preemptive scaling based on a predictable, time-based pattern.

How to eliminate wrong answers

Option A is wrong because a simple scaling policy based on CPU > 80% is reactive, not preemptive; it only triggers after the threshold is breached, which would not prevent the spike from causing high utilization. Option B is wrong because a step scaling policy also reacts to real-time metric alarms (e.g., CPU crossing thresholds) and cannot anticipate future spikes; it adjusts capacity based on current demand, not scheduled events. Option C is wrong because a target tracking scaling policy maintains a target CPU utilization (e.g., 75%) by continuously adjusting capacity based on current load, but it cannot preemptively scale before a known periodic spike; it would only react after the metric deviates from the target.

Practice this question →

218

MCQhard

Refer to the exhibit. An IAM policy is attached to an EC2 instance role used by SAP HANA backup scripts. The backup script attempts to upload a file to the S3 bucket without specifying server-side encryption. What will happen?

A.The upload fails because there is no Allow statement without condition.

B.The upload succeeds because there is an Allow statement.

C.The upload fails because of the Deny statement.

D.The upload succeeds because the Deny condition does not match.

AnswerC

The Deny statement explicitly denies PutObject when encryption is not AES256.

Why this answer

The first statement allows PutObject only if encryption is AES256. The second statement denies PutObject if encryption is not AES256. Since the request does not specify encryption, it does not match the condition in the Allow statement (so not allowed) and it matches the Deny statement because encryption is not AES256 (StringNotEquals).

Therefore, the request is denied.

Practice this question →

219

Multi-Selecthard

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet high availability and low latency requirements. The company expects traffic to spike unpredictably. Which THREE strategies should the company implement to ensure the application can handle the load? (Choose THREE.)

Select 3 answers

A.Enable API Gateway caching with a suitable TTL

B.Set the Lambda function timeout to the maximum value of 15 minutes

C.Configure provisioned concurrency for the Lambda functions

D.Configure DynamoDB auto scaling with a minimum capacity of 10 read and 10 write capacity units

E.Use DynamoDB on-demand capacity mode for the tables

AnswersA, C, E

Caching reduces backend load and improves response times for repeated requests, helping handle spikes.

Why this answer

API Gateway caching stores responses from your endpoints, reducing the number of calls made to the backend Lambda function and DynamoDB. By setting a suitable TTL, you ensure that frequently accessed data is served from the cache, which lowers latency and offloads the backend during unpredictable traffic spikes. This directly supports high availability by preventing backend overload.

Exam trap

The trap here is that candidates often confuse auto scaling (Option D) with on-demand capacity mode, not realizing that auto scaling has a lag time and requires manual capacity planning, whereas on-demand mode is designed for unpredictable traffic with instant scaling.

Practice this question →

220

MCQeasy

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for PostgreSQL database. The operations team reports that the application becomes unresponsive for about 30 seconds every hour at the same time. The team checks the ALB access logs and notices that during the outage, the ALB returns HTTP 504 errors. The RDS monitoring shows a spike in CPU usage and active connections during the same period. The application team confirms there are no scheduled jobs during that time. What should the team do to diagnose the root cause?

A.Review the security group rules for the database to ensure the application can connect.

B.Review the ALB target group health checks and ensure the EC2 instances are passing the health check.

C.Increase the EC2 instance size to handle more concurrent connections.

D.Check the RDS Enhanced Monitoring metrics for the database instance to identify resource bottlenecks such as high memory pressure or disk I/O.

AnswerD

Enhanced Monitoring provides detailed OS-level metrics to pinpoint the root cause of the database spike.

Why this answer

The symptoms—hourly 30-second unresponsiveness, HTTP 504 errors from the ALB, and a correlated spike in RDS CPU and active connections—point to a database-side bottleneck. RDS Enhanced Monitoring provides OS-level metrics (memory, disk I/O, CPU) that can reveal resource contention or throttling events (e.g., swap usage, IOPS exhaustion) not visible in standard CloudWatch metrics, enabling precise root cause identification.

Exam trap

The trap here is that candidates confuse HTTP 504 errors with ALB or EC2 health check failures, but 504 specifically indicates the ALB received no response from the target (often due to database timeout), not that the target is unhealthy.

How to eliminate wrong answers

Option A is wrong because security group rules are static and would cause persistent connectivity failures, not a predictable hourly 30-second outage. Option B is wrong because ALB target group health checks failing would cause 503 errors (not 504) and would not explain the correlated RDS CPU/connection spike. Option C is wrong because increasing EC2 instance size addresses compute capacity on the application tier, but the bottleneck is on the database tier (RDS CPU/connections spike), so it would not resolve the root cause.

Practice this question →

221

MCQhard

A company is migrating its SAP ERP system running on Oracle to SAP HANA on AWS. The system has a database size of 2 TB. During migration planning, the team needs to minimize downtime. Which strategy should be used?

A.Take a full backup of Oracle, restore to SAP HANA, and then apply incremental logs.

B.Use SAP HANA System Replication to initially load data from the source SAP HANA (or migrate using SAP DMO with SUM) and then switch over.

C.Use the AWS Database Migration Service (DMS) to perform an online migration from Oracle to SAP HANA.

D.Perform an export/import using SAP tools while the source database is online.

AnswerB

SAP HANA System Replication allows near-zero downtime migration by replicating data while source is online.

Why this answer

SAP DMO (Database Migration Option) with SUM (Software Update Manager) is the recommended approach for migrating SAP systems to SAP HANA with minimal downtime. It performs a heterogeneous migration directly from Oracle to SAP HANA, using a combination of initial data load and subsequent delta replication to reduce the final cutover window. This method is specifically designed for SAP landscapes and supports near-zero downtime migration scenarios.

Exam trap

The trap here is that candidates often assume AWS DMS can handle any database migration, but it lacks support for SAP HANA as a target and cannot manage SAP-specific metadata and dependencies required for a successful migration.

How to eliminate wrong answers

Option A is wrong because restoring an Oracle full backup directly to SAP HANA is not possible; SAP HANA uses a completely different storage engine and data format, requiring a logical migration via SAP tools. Option C is wrong because AWS DMS does not support SAP HANA as a target for heterogeneous migrations from Oracle; DMS is designed for standard relational databases, not SAP-specific systems. Option D is wrong because performing an export/import while the source is online can cause data inconsistency and does not provide a mechanism for incremental replication, leading to longer downtime during the final cutover.

Practice this question →

222

Multi-Selecthard

An SAP system is running on AWS with a Multi-AZ deployment. The system uses an Amazon RDS for SAP HANA database. Which TWO actions should be taken to ensure high availability?

Select 2 answers

A.Create a read replica in a different region

B.Configure automated backups with a retention period

C.Enable Multi-AZ on the RDS instance

D.Deploy the RDS instance in a single Availability Zone

E.Take manual snapshots every hour

AnswersB, C

Automated backups enable point-in-time recovery, which is essential for HA.

Why this answer

Enabling Multi-AZ on RDS automatically provisions a standby in a different AZ and handles failover. Configuring automated backups allows point-in-time recovery. Read replicas are for read scaling, not HA.

Manual snapshots are not automatic. Using a single AZ does not provide HA.

Practice this question →

223

MCQmedium

A company is running SAP HANA on an EC2 instance. The storage is configured with multiple EBS volumes striped using LVM. The SAP administrator notices that disk I/O latency spikes during peak hours. Which change would MOST effectively reduce latency without incurring additional cost?

A.Increase the size of the EBS volumes

B.Provision additional IOPS on the EBS volumes

C.Switch from LVM to RAID 0 striping

D.Use an EBS-optimized EC2 instance type

AnswerD

EBS-optimized instances provide dedicated bandwidth to EBS, reducing latency.

Why this answer

Using an EBS-optimized EC2 instance provides dedicated network bandwidth for EBS I/O, which reduces contention and latency without additional cost if the instance type already supports it. Option A is incorrect because increasing the size of EBS volumes does not directly reduce latency. Option B is incorrect because provisioning additional IOPS incurs extra cost, contradicting the requirement.

Option C is incorrect because switching to RAID 0 striping improves throughput but does not lower latency.

Practice this question →

224

MCQmedium

A company is migrating an SAP system to AWS and needs to ensure high availability for the SAP Central Services (ASCS) instance. Which architecture should be used to meet this requirement?

A.Use a cluster of EC2 instances across two Availability Zones with shared storage and a cluster manager.

B.Deploy the ASCS on a single large EC2 instance with a Multi-Attach EBS volume.

C.Use an Auto Scaling group with a launch configuration for ASCS.

D.Deploy two EC2 instances in the same Availability Zone with a replicated file system.

AnswerA

This provides HA across AZs with failover.

Why this answer

SAP Central Services (ASCS) requires a high-availability cluster that can fail over between physical hosts while maintaining shared storage and a quorum mechanism. Deploying a cluster of EC2 instances across two Availability Zones with shared storage (e.g., Amazon EFS or FSx for NetApp ONTAP) and a cluster manager (e.g., Pacemaker) meets this requirement by providing automatic failover and data consistency. This architecture aligns with SAP's official high-availability guidelines for AWS, which mandate multi-AZ deployment to tolerate an entire AZ failure.

Exam trap

The trap here is that candidates often confuse high availability with fault tolerance or scalability, leading them to choose Auto Scaling (Option C) or a single-instance Multi-Attach EBS (Option B), which do not provide the automatic failover and AZ-level resilience required for SAP ASCS.

How to eliminate wrong answers

Option B is wrong because a single large EC2 instance with a Multi-Attach EBS volume provides no high availability; if the instance or AZ fails, ASCS becomes unavailable. Option C is wrong because Auto Scaling groups are designed for stateless, horizontally scalable workloads, not for stateful SAP ASCS instances that require a fixed cluster quorum and shared storage. Option D is wrong because deploying two EC2 instances in the same Availability Zone does not protect against an AZ failure, which is a key requirement for high availability; a replicated file system alone cannot ensure automatic failover without a cluster manager.

Practice this question →

225

Multi-Selectmedium

A company is designing a disaster recovery (DR) strategy for a critical application that runs on EC2 instances in a single AWS Region. The application uses an Amazon RDS MySQL Multi-AZ DB instance. The company wants to achieve a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 15 minutes for both compute and database tiers. Which TWO options should the company implement? (Choose TWO.)

Select 2 answers

A.Configure a cross-Region read replica for the RDS MySQL DB instance in the secondary Region

B.Create Amazon Machine Images (AMIs) of the EC2 instances and copy them to the secondary Region

C.Use Amazon EBS snapshots of the EC2 instances and copy them to the secondary Region every minute

D.Migrate the database to Amazon Aurora MySQL and configure an Aurora Global Database

E.Enable cross-Region automated backups for the RDS Multi-AZ DB instance

AnswersA, B

A cross-Region read replica can be promoted to a primary in seconds, meeting the RPO of 1 minute.

Why this answer

A cross-Region read replica for RDS MySQL can be promoted to a standalone primary in the secondary Region within minutes, meeting the 15-minute RTO. The asynchronous replication lag is typically under 1 minute, satisfying the 1-minute RPO. This provides a managed, low-latency DR database tier without needing to restore from backups.

Exam trap

The trap here is that candidates may confuse cross-Region automated backups (Option E) with cross-Region read replicas, not realizing that backups have a higher RPO and longer restore times, while read replicas provide near-real-time replication and faster promotion.

Practice this question →

← PreviousPage 3 of 6 · 389 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Technology questions.

Start 20-question session