CCNA Technology Questions — Page 6 of 6

376

MCQhard

An IAM policy is attached to a user who manages SAP HANA volumes. The policy is shown in the exhibit. What is the effect of this policy?

A.The user can attach and detach any volume regardless of tags.

B.The user can delete any volume.

C.The user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume.

D.The user can attach and detach any volume in the production environment.

AnswerC

Correct: The first statement allows AttachVolume and DetachVolume only when the volume has the tag Environment=production. The second statement denies DeleteVolume for all volumes. Thus, the user can attach/detach volumes with that tag but cannot delete any volume.

Why this answer

The first statement allows ec2:AttachVolume and ec2:DetachVolume only if the volume has tag Environment=production. The second statement denies ec2:DeleteVolume for all volumes. Therefore, the user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume.

Option A is incorrect because attach/detach are allowed only with the condition. Option B is incorrect because delete is denied for all volumes. Option D is incorrect because the allow statement is conditional on the specific tag value, not just the production environment.

Practice this question →

377

MCQeasy

An SAP system uses an NFS share from an EFS file system for transport files. Recently, the transport directory performance has degraded. Which change would most likely improve performance?

A.Increase the burst credit balance by creating more files.

B.Enable Provisioned Throughput on the EFS file system.

C.Migrate the transport directory to Amazon FSx for Lustre.

D.Use Amazon S3 with an NFS mount via AWS Storage Gateway.

AnswerB

Provisioned Throughput ensures consistent IOPS for NFS workloads.

Why this answer

Using Provisioned Throughput on EFS ensures consistent performance regardless of file system size. Option A is wrong because increasing burst credits only helps temporarily. Option C is wrong because FSx for Lustre is for high-performance computing, not general purpose NFS.

Option D is wrong because moving to S3 would require application changes.

Practice this question →

378

MCQmedium

An SAP system administrator needs to monitor the CPU utilization of an EC2 instance running SAP NetWeaver and set an alarm when it exceeds 90% for 5 minutes. Which AWS service should they use?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Trusted Advisor

D.AWS Config

AnswerB

CloudWatch monitors EC2 metrics and can trigger SNS notifications when thresholds are breached.

Why this answer

Amazon CloudWatch is the correct service because it provides detailed monitoring of EC2 instances, including CPU utilization metrics, and allows you to set CloudWatch Alarms that trigger when a metric exceeds a specified threshold (e.g., 90%) for a given number of consecutive evaluation periods (e.g., 5 minutes). This is the native AWS service designed for performance monitoring and alerting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (auditing) or AWS Config (compliance) with monitoring services, but only CloudWatch provides the metric collection and alarm functionality needed for real-time performance thresholds.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events, not system-level performance metrics like CPU utilization. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations for cost, performance, security, and fault tolerance, but it does not offer real-time metric monitoring or alarm configuration. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not operational metrics or threshold-based alarms.

Practice this question →

379

MCQhard

An SAP administrator runs the AWS CLI command shown in the exhibit to check the status of a production HANA instance. The output shows the instance is running in us-east-1a. However, the SAP application team reports that the HANA database is not responding. What should the administrator check next to diagnose the issue?

A.The EBS volumes are detached from the instance

B.The instance state is 'running' so no issue with the instance

C.The HANA database service is not running on the instance

D.The security group does not allow inbound traffic to the database port

AnswerC

The administrator should verify the HANA process is running.

Why this answer

The AWS CLI command only checks the EC2 instance state (e.g., 'running'), not the status of the HANA database service itself. Even if the instance is running, the HANA database service (hdbnameserver, hdbindexserver, etc.) may have crashed, failed to start, or been stopped. The administrator should SSH into the instance and run commands like 'systemctl status hdbindexserver' or 'sapcontrol -nr <instance_number> -function GetProcessList' to verify the HANA service status.

Exam trap

The trap here is that candidates assume an EC2 instance state of 'running' guarantees all applications on it are functional, but AWS separates infrastructure health from guest OS/application health, and the exam tests this distinction by requiring you to check the database service separately.

How to eliminate wrong answers

Option A is wrong because if EBS volumes were detached, the instance would likely show a different state (e.g., 'stopped' or 'terminated') or the root volume would be missing, causing immediate boot failure; the CLI output shows the instance is running, so volumes are attached. Option B is wrong because an instance state of 'running' only indicates the OS is up, not that application-level services like HANA are operational; the database can be down while the instance is healthy. Option D is wrong because a security group blocking inbound traffic would prevent new connections but would not cause the database to be 'not responding' from the instance's perspective; the database service itself would still be running and could be checked locally via loopback; the issue is the service not running, not network access.

Practice this question →

380

MCQhard

An SAP Basis administrator is migrating an SAP ERP system from an on-premises environment to AWS. The system uses an SAP HANA database. The migration must have minimal downtime. The administrator plans to use SAP HANA System Replication (HSR) to synchronize data to an AWS HANA instance. However, the network latency between on-premises and AWS is consistently around 50 ms. What should the administrator do to ensure that HSR can maintain synchronization without impacting source system performance?

A.Use synchronous replication with a lower sync timeout setting to avoid blocking.

B.Configure HSR in asynchronous mode with full sync disabled to avoid affecting source transaction performance.

C.Keep synchronous replication but increase the replication timeout value in the HANA global.ini file.

D.Enable HANA delta merge operations during replication to reduce the amount of data transferred.

AnswerB

Asynchronous replication does not wait for acknowledgment, so source performance is unaffected; suitable for high-latency links.

Why this answer

With 50 ms network latency, synchronous replication would block source transactions while waiting for acknowledgment from the target, severely impacting performance. Asynchronous mode with full sync disabled allows HSR to send log buffers without waiting for the target to confirm, ensuring source system performance is unaffected while still maintaining eventual consistency for migration.

Exam trap

The trap here is that candidates confuse synchronous replication with 'safer' replication, not realizing that high latency makes synchronous mode impractical for performance-sensitive source systems, and that 'full sync' is a separate HSR parameter controlling whether the secondary must be fully in sync before the primary commits.

How to eliminate wrong answers

Option A is wrong because synchronous replication with a lower sync timeout would cause frequent timeouts and transaction failures, not avoid blocking. Option C is wrong because increasing the replication timeout in synchronous mode still blocks source transactions during the wait period, only delaying the timeout event. Option D is wrong because delta merge operations are a HANA internal memory optimization unrelated to replication data transfer; they do not reduce the amount of data sent via HSR.

Practice this question →

381

MCQhard

A company is migrating its SAP environment to AWS and wants to use SAP HANA as a Service on AWS (HANA database on AWS). The SAP application tier will run on EC2 instances behind an Application Load Balancer. The company requires high availability for the database with automatic failover in case of an AZ failure. Which architecture should the company implement?

A.Configure HANA replication to Amazon S3 for point-in-time recovery.

B.Set up HANA System Replication between two EC2 instances in different AZs with automatic failover.

C.Use HANA System Replication with a synchronous secondary in the same AZ.

D.Deploy a single HANA database on a large EC2 instance in one AZ with regular backups to S3.

AnswerB

HANA System Replication across AZs provides high availability and automatic failover.

Why this answer

HANA System Replication configured between two EC2 instances in different Availability Zones (AZs) with automatic failover ensures high availability and resilience against an AZ failure. Option A is incorrect because replicating HANA to Amazon S3 is meant for backups and point-in-time recovery, not for real-time automatic failover. Option C is incorrect because synchronous replication within the same AZ does not protect against an AZ failure; it only provides protection against instance or host failure.

Option D is incorrect because a single HANA database instance in one AZ, even with regular backups to S3, cannot provide automatic failover if the AZ fails; it would require manual recovery.

Practice this question →

382

Multi-Selectmedium

Which TWO of the following are required components for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared? (Choose two.)

Select 2 answers

A.Amazon EFS file system

B.EC2 instance store

C.Amazon S3 bucket

D.Amazon FSx for NetApp ONTAP

E.Amazon EBS volume

AnswersA, D

EFS provides NFS shared storage.

Why this answer

Amazon EFS is required for an SAP HANA scale-out deployment on AWS that uses shared storage for /hana/shared because it provides a fully managed, POSIX-compliant NFS file system that can be mounted concurrently across multiple EC2 instances. SAP HANA scale-out nodes require a shared file system for /hana/shared to exchange configuration and log data, and EFS supports the necessary NFSv4 protocol with the required throughput and latency characteristics for this workload.

Exam trap

The trap here is that candidates often assume Amazon EBS with multi-attach is a valid shared storage option for SAP HANA, but multi-attach is not supported for SAP HANA scale-out, and they may overlook that both EFS and FSx for ONTAP are the only AWS-managed NFS solutions that meet SAP's certification requirements for /hana/shared.

Practice this question →

383

MCQeasy

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance. The EC2 instance has an Elastic IP address of 203.0.113.5 and is running in a VPC with CIDR 10.0.0.0/16. When the application on the instance tries to upload an object to the S3 bucket 'my-bucket', it receives an Access Denied error. What is the MOST likely cause?

A.The policy does not allow the s3:PutObject action.

B.The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket without the asterisk.

C.The policy is missing a Deny statement for other IP addresses.

D.The condition checks the source IP address, but the EC2 instance uses a private IP address within the VPC when communicating with S3 via a VPC endpoint.

AnswerD

When using a VPC endpoint, the source IP is the private IP of the instance, which is within the allowed range, but the condition is evaluated against the public IP? Actually, the condition is on the source IP, which for traffic through a VPC endpoint is the private IP. The private IP (10.x.x.x) matches the condition. However, if the instance is communicating via the internet, the source IP would be the Elastic IP, which is not in the allowed range. But the error suggests the condition is blocking. The most likely cause is that the condition is checking the public IP, but the instance is using a VPC endpoint? Actually, the correct answer is D: the condition checks the source IP, but if using a VPC endpoint, the source IP is the private IP, which is within range, so it would work. The error occurs if the instance is communicating via the internet and the Elastic IP is not in the allowed range. Since the condition specifies 10.0.0.0/16, which is the VPC CIDR, it expects the private IP. If the instance uses a VPC endpoint, it works. If not, it fails. The exhibit does not specify a VPC endpoint, so likely the instance is using the internet, and the source IP is the Elastic IP, which is not in the allowed range. So answer D is correct because the condition is checking the source IP, but the instance's public IP is not in the allowed range. The explanation in the JSON is slightly off but the key idea is correct.

Why this answer

The IAM policy condition likely includes an `aws:SourceIp` condition that allows only the Elastic IP address (203.0.113.5). However, when the EC2 instance communicates with S3 via a VPC endpoint, traffic uses a private IP from the VPC CIDR (10.0.0.0/16) as the source IP, not the Elastic IP. This mismatch causes the condition to evaluate to False, resulting in Access Denied.

Exam trap

Candidates may think the Elastic IP is always used as the source IP, but with a VPC endpoint, the source IP becomes a private IP from the VPC, which may not match the `aws:SourceIp` condition expecting the Elastic IP.

How to eliminate wrong answers

Option A is wrong because the policy explicitly allows `s3:PutObject` under the `Action` element, so the action is permitted. Option B is wrong because the resource ARN `arn:aws:s3:::my-bucket/*` is correct for granting access to objects within the bucket; omitting the asterisk would restrict access to the bucket itself, not its objects. Option C is wrong because the policy does not need a Deny statement for other IP addresses; the existing Allow with a condition already restricts access to only the specified IP, and adding a Deny would be redundant and could cause unintended conflicts.

Practice this question →

384

MCQeasy

A company wants to migrate its on-premises SAP system to AWS. The system consists of an SAP NetWeaver application server and an SAP HANA database. The database requires ultra-low latency storage. Which AWS storage solution is most suitable for the SAP HANA data volume?

A.Amazon EBS io2 Block Express volumes

B.EC2 Instance Store

C.Amazon S3

D.Amazon EFS file system

AnswerA

Provides consistent low latency and high IOPS for SAP HANA.

Why this answer

Amazon EBS io2 Block Express volumes are the most suitable storage solution for SAP HANA data volumes because they provide ultra-low latency, high durability, and up to 256,000 IOPS per volume with sub-millisecond latency. This meets the stringent performance requirements of SAP HANA, which demands consistent, low-latency storage for its in-memory database operations. io2 Block Express is certified by SAP for production HANA workloads on AWS.

Exam trap

The trap here is that candidates often confuse EC2 Instance Store's low latency with durability, overlooking that SAP HANA requires persistent, non-ephemeral storage for production data.

How to eliminate wrong answers

Option B is wrong because EC2 Instance Store provides ephemeral, non-persistent storage that does not survive instance stops or terminations, making it unsuitable for critical SAP HANA data that requires durability and persistence. Option C is wrong because Amazon S3 is an object storage service with higher latency and does not support block-level access or the low-latency IOPS required for SAP HANA database volumes. Option D is wrong because Amazon EFS is a file-level NFS storage system with higher latency and lower IOPS compared to EBS io2 Block Express, and it is not certified for SAP HANA data volumes.

Practice this question →

385

MCQmedium

An SAP application is experiencing high latency when writing to an Amazon EBS volume. The volume is a gp2 type attached to an m5.4xlarge instance. Which change would improve write performance?

A.Increase the size of the gp2 volume to 1 TB.

B.Change the volume type to st1.

C.Enable EBS optimization on the EC2 instance.

D.Change the volume type to io2 and provision sufficient IOPS.

AnswerD

io2 volumes provide consistent low-latency performance.

Why this answer

The gp2 volume's baseline performance of 3 IOPS per GiB (max 16,000 IOPS) is insufficient for the SAP application's write-intensive workload, causing high latency. Changing to io2 with provisioned IOPS ensures consistent, high-performance writes by decoupling IOPS from volume size, directly addressing the latency issue.

Exam trap

The trap here is that candidates assume increasing gp2 volume size (Option A) will linearly improve performance, but they overlook that gp2's IOPS scaling is capped at 16,000 IOPS and burst credits are finite, whereas io2 provides predictable, provisioned performance.

How to eliminate wrong answers

Option A is wrong because increasing the gp2 volume size to 1 TB only raises the baseline IOPS to 3,000 (3 IOPS/GiB), which may still be inadequate for high-write SAP workloads and does not guarantee low latency. Option B is wrong because st1 is a throughput-optimized HDD volume designed for large, sequential workloads, not for low-latency random writes required by SAP applications. Option C is wrong because EBS optimization is already enabled by default on all current-generation instances like m5.4xlarge, so enabling it again provides no benefit.

Practice this question →

386

Multi-Selecthard

An SAP administrator is configuring high availability for SAP HANA using HANA system replication (HSR) across multiple Availability Zones. The administrator must ensure that the replication traffic is encrypted and uses the most efficient network path. Which TWO configurations meet these requirements? (Choose TWO.)

Select 2 answers

A.Enable SAP HANA system replication with TLS/SSL encryption.

B.Store replication data in Amazon S3 and have the secondary instance pull it.

C.Use AWS Direct Connect to connect the Availability Zones.

D.Use VPC peering between the subnets in different Availability Zones.

E.Configure a VPN connection between the Availability Zones.

AnswersA, D

HSR supports TLS encryption for secure replication traffic.

Why this answer

SAP HANA system replication (HSR) supports TLS/SSL encryption natively, which encrypts the replication traffic between the primary and secondary HANA instances. This ensures data confidentiality and integrity without requiring additional network infrastructure, and it uses the most efficient network path because the replication occurs directly over the existing network between the Availability Zones.

Exam trap

The trap here is that candidates may assume AWS Direct Connect or VPN are required for encryption and efficient routing between Availability Zones, but SAP HANA's native TLS/SSL encryption and VPC peering (which uses the AWS backbone) already satisfy both requirements without additional services.

Practice this question →

387

MCQmedium

The following IAM trust policy is attached to a role named CrossAccountBackupRole in account 123456789012: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111111111111:role/SAPAdminRole" }, "Action": "sts:AssumeRole", "Condition": {} } ] } What does this policy enable?

A.The SAPAdminRole directly receives permissions to access S3.

B.The SAPAdminRole can assume the CrossAccountBackupRole.

C.The CrossAccountBackupRole can be assumed by any IAM user.

D.The SAPAdminRole can list S3 buckets in account 123456789012.

AnswerB

Correct. The policy explicitly allows SAPAdminRole to assume CrossAccountBackupRole via sts:AssumeRole.

Why this answer

The trust policy explicitly allows the IAM role SAPAdminRole (in account 111111111111) to perform sts:AssumeRole on the CrossAccountBackupRole. This enables SAPAdminRole to assume CrossAccountBackupRole and inherit its permissions. The policy does not grant direct S3 access; that would require a separate permissions policy attached to CrossAccountBackupRole.

Exam trap

A common trap is to assume that the trust policy alone grants resource permissions (like S3 access). In reality, the trust policy only allows assumption of the role; the permissions policy attached to the role defines what actions the assumed role can perform.

How to eliminate wrong answers

Option A is wrong because the policy does not directly grant permissions to the SAPAdminRole; it only allows the SAPAdminRole to assume the CrossAccountBackupRole, which then may have S3 permissions. Option C is wrong because the policy specifically restricts the principal to the SAPAdminRole (arn:aws:iam::111111111111:role/SAPAdminRole), not any IAM user or role. Option D is wrong because the policy only allows the sts:AssumeRole action, not any S3 actions like listing buckets; S3 permissions would require separate IAM policies attached to the CrossAccountBackupRole.

Practice this question →

388

MCQhard

An SAP ERP system on AWS is experiencing performance degradation. A review shows that the Amazon EBS volumes used for SAP transport directories are gp2 with high throughput but high latency. The SAP team needs improved I/O performance without changing the total storage capacity. Which action should be taken?

A.Change the volume type to gp3 and increase baseline IOPS.

B.Move the transport directories to instance store volumes.

C.Enable EBS throughput optimization on the EC2 instance.

D.Change the volume type to io2 Block Express with provisioned IOPS.

AnswerD

io2 provides consistent low latency and high IOPS, ideal for SAP transport directories.

Why this answer

Io2 Block Express volumes provide consistent, high-performance IOPS with sub-millisecond latency, which directly addresses the high-latency issue with gp2 volumes. This option improves I/O performance without changing storage capacity, as required by the SAP team. gp2 volumes suffer from burst bucket limitations, leading to high latency under sustained throughput, while io2 Block Express offers provisioned IOPS for predictable performance.

Exam trap

The trap here is that candidates may choose gp3 (Option A) thinking it always improves latency, but gp3 still shares resources and cannot match the consistent low latency of io2 Block Express for demanding SAP workloads.

How to eliminate wrong answers

Option A is wrong because changing to gp3 increases baseline IOPS but does not guarantee the ultra-low latency required for SAP transport directories, as gp3 still uses a shared performance model that can introduce variability. Option B is wrong because instance store volumes are ephemeral and data is lost on instance stop or termination, making them unsuitable for persistent SAP transport directories. Option C is wrong because EBS throughput optimization is not a feature; EC2 instances have EBS-optimized by default on current generations, and enabling it does not resolve latency issues caused by volume type limitations.

Practice this question →

389

MCQhard

A company is running SAP Business Suite on AWS and wants to improve the disaster recovery posture by replicating data to another AWS Region. The solution must have a recovery time objective (RTO) of less than 15 minutes and a recovery point objective (RPO) of less than 5 minutes. Which approach should they take?

A.Configure SAP HANA system replication with synchronous mode.

B.Use AWS Database Migration Service for continuous replication.

C.Use Amazon S3 cross-Region replication for transaction logs.

D.Use AWS Backup to create cross-Region EBS snapshots every 5 minutes.

AnswerA

Synchronous HANA replication ensures data is copied to the secondary before commit, achieving low RPO and RTO.

Why this answer

SAP HANA system replication in synchronous mode ensures that every committed transaction is replicated to the secondary region before acknowledging the commit, achieving an RPO of effectively zero (less than 5 minutes) and enabling rapid failover within seconds, meeting the RTO of under 15 minutes. This is the only native SAP solution that provides the required low-latency, consistent replication for SAP Business Suite on AWS.

Exam trap

The trap here is that candidates often confuse AWS-native replication services (like DMS, S3 CRR, or AWS Backup) with SAP-specific replication mechanisms, assuming any continuous replication can meet the strict RPO/RTO, but only SAP HANA system replication is designed for sub-minute failover and near-zero data loss for SAP workloads.

How to eliminate wrong answers

Option B is wrong because AWS Database Migration Service (DMS) is designed for heterogeneous database migrations and continuous replication of changes, but it does not support SAP HANA as a source for ongoing replication with the required RPO/RTO; it introduces latency and potential data inconsistency that cannot guarantee sub-5-minute RPO. Option C is wrong because Amazon S3 cross-Region replication for transaction logs is asynchronous and can have replication delays of minutes to hours, failing the RPO of less than 5 minutes; additionally, it requires manual log replay and does not provide automated failover for the SAP application. Option D is wrong because AWS Backup creating cross-Region EBS snapshots every 5 minutes cannot achieve an RPO of less than 5 minutes (snapshots are point-in-time and the interval itself is 5 minutes, plus snapshot creation and transfer time), and restoring from snapshots takes significantly longer than 15 minutes, failing the RTO requirement.

Practice this question →