Knowledge + Practice

CCNA Design of SAP Workloads on AWS Questions

75 of 462 questions · Page 3/7 · Design of SAP Workloads on AWS · Answers revealed

Practice these questions Domain overview All questions

151

MCQhard

A company is migrating an SAP BusinessObjects system to AWS. The system includes a Central Management Server (CMS) and several processing servers. The CMS uses a SQL Server database. The company wants to use a managed database service on AWS to reduce operational overhead. The database size is 100 GB and is expected to grow 10% annually. The company requires automatic failover to a secondary Availability Zone with minimal downtime. Which AWS database service should the company use for the CMS database?

A.Amazon RDS for SQL Server with Multi-AZ deployment

B.Amazon EC2 with SQL Server installed

C.Amazon Aurora SQL Server

D.Amazon DynamoDB

AnswerA

RDS for SQL Server with Multi-AZ provides automatic failover and reduces operational overhead.

Why this answer

Option C is correct because Amazon RDS for SQL Server with Multi-AZ provides automatic failover to a standby in another AZ. Option A is wrong because Amazon Aurora is not compatible with SQL Server. Option B is wrong because SQL Server on EC2 is not managed.

Option D is wrong because Amazon DynamoDB is NoSQL and not compatible with SQL Server.

Practice this question →

152

MCQmedium

A company is running SAP ERP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS service should be used to achieve this?

A.EC2 Auto Scaling

B.Elastic Load Balancer (NLB)

C.Amazon Route 53

D.AWS Global Accelerator

AnswerB

Network Load Balancer can distribute traffic to multiple ASCS instances for HA.

Why this answer

The correct answer is C because AWS Elastic Load Balancer (specifically Network Load Balancer) can be used to distribute traffic between ASCS instances for high availability. Option A is incorrect because AWS Global Accelerator improves performance but not high availability for ASCS. Option B is incorrect because Route 53 is for DNS and can be used for health checks but not as the primary HA mechanism for ASCS.

Option D is incorrect because EC2 Auto Scaling is for scaling compute capacity, not for managing ASCS failover.

Practice this question →

153

MCQeasy

An SAP administrator is troubleshooting connectivity between SAP application servers and the SAP HANA database. The database security group has an inbound rule as shown in the exhibit. The application servers are in security group sg-12345. However, the application servers cannot connect to the database. What is the most likely reason?

A.The source should be the IP address range of the application servers.

B.The rule uses the wrong protocol; it should be UDP.

C.The outbound rule on the application server security group is missing.

D.The port number is incorrect for SAP HANA.

AnswerD

SAP HANA uses port 3<instance_number>15, not 3300.

Why this answer

Option D is correct because the rule allows traffic from sg-12345 but only on port 3300. SAP HANA default port is 3<instance_number>15, not 3300. Option A is wrong because the rule is for TCP.

Option B is wrong because source is a security group, not IP. Option C is wrong because the rule is inbound, not outbound.

Practice this question →

154

MCQmedium

A company is migrating its SAP ERP system to AWS. The system requires high availability for the SAP Central Services (ASCS) instance. Which AWS architecture should be used to meet this requirement?

A.Use a multi-AZ deployment with Amazon FSx for NetApp ONTAP as a shared file system and place ASCS on two EC2 instances in different Availability Zones with an Elastic IP address.

B.Use Amazon S3 to store the ASCS configuration and launch a single EC2 instance with an Auto Scaling group.

C.Deploy ASCS on a single EC2 instance in one Availability Zone with an EBS volume snapshot for recovery.

D.Use Amazon RDS for SAP Central Services running in a Multi-AZ configuration.

AnswerA

This provides high availability with failover across AZs.

Why this answer

Option A is correct because SAP ASCS requires a highly available shared file system and a floating IP address for failover. Amazon FSx for NetApp ONTAP provides a highly available, NFS-based shared file system that supports the SAP transport and profile directories across Availability Zones. Placing two EC2 instances in different AZs with an Elastic IP address allows the ASCS instance to be failed over manually or via a cluster manager, meeting the high availability requirement.

Exam trap

The trap here is that candidates confuse SAP Central Services (ASCS) with a database service and incorrectly select Amazon RDS, or assume that a single-instance recovery solution like EBS snapshots meets high availability requirements, when in fact SAP ASCS requires a clustered architecture with shared storage and a floating IP.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object store and does not support the POSIX file system semantics required by SAP ASCS for shared directories like /usr/sap/trans and profile files; Auto Scaling groups are designed for stateless scaling, not for stateful SAP ASCS failover. Option C is wrong because a single EC2 instance with an EBS snapshot provides only backup and recovery, not high availability; it cannot achieve the sub-minute failover required for SAP ASCS. Option D is wrong because Amazon RDS is a managed database service for relational databases, not for SAP Central Services, which is an application service that requires a shared file system and cluster management, not a database.

Practice this question →

155

MCQmedium

A company is designing a backup strategy for SAP HANA on AWS. The HANA database is 2 TB in size. The company requires daily full backups and hourly incremental backups. Which AWS service should be used to store the backups cost-effectively with high durability?

A.Amazon S3 with lifecycle policies to transition to Glacier.

B.Amazon EBS Snapshots stored in Amazon S3.

C.AWS Storage Gateway with volume gateway.

D.Amazon EFS for shared backup storage.

AnswerA

S3 offers durability and cost-effectiveness for backups.

Why this answer

Option A is correct because Amazon S3 provides 99.999999999% durability and is cost-effective for storing backups. S3 lifecycle policies can move older backups to Glacier for further cost savings. Option B is incorrect because Amazon EBS Snapshots are stored in S3 but are more expensive for long-term retention.

Option C is incorrect because Amazon EFS is a file system, not optimized for backup storage. Option D is incorrect because AWS Storage Gateway is for on-premises integration.

Practice this question →

156

MCQhard

Refer to the exhibit. An SAP administrator created this IAM policy for an SAP application user that performs database backups to Amazon S3. The user reports that backup jobs fail with an access denied error. What is the most likely cause?

A.The policy has a syntax error and is invalid.

B.The policy does not allow s3:PutObject for the bucket.

C.The policy is missing s3:ListBucket permission on the bucket.

D.The Deny statement blocks all DeleteObject requests.

AnswerC

ListBucket is required to access objects in the bucket.

Why this answer

Option B is correct because the Deny statement denies s3:DeleteObject when SecureTransport is false, but the user may be using HTTPS (SecureTransport true), which is fine. However, the error is likely due to missing s3:ListBucket permission to list objects in the bucket. Option A is wrong because the policy allows PutObject.

Option C is wrong because the Deny condition only applies when SecureTransport is false. Option D is wrong because the Allow statement exists.

Practice this question →

157

MCQhard

A company has an SAP HANA database running on a r5.8xlarge EC2 instance with 3.5 TB of data. They want to back up the database to Amazon S3 using Backint. What is the most cost-effective and performant backup strategy?

A.Use EBS snapshots and copy them to S3.

B.Use multiple parallel Backint streams to a single S3 bucket with S3 Standard storage.

C.Use multiple parallel Backint streams to multiple S3 buckets with S3 Glacier storage.

D.Use a single Backint stream to one S3 bucket with S3 Standard storage.

AnswerB

Parallel streams improve throughput; single bucket is simpler and cost-effective.

Why this answer

Backint is the native SAP HANA backup integration that sends backup data directly to Amazon S3. Using multiple parallel Backint streams maximizes throughput by leveraging S3's high request rate limits, and S3 Standard storage provides the low-latency access needed for frequent backups and restores without incurring retrieval costs. This combination is both cost-effective and performant for a 3.5 TB database.

Exam trap

The trap here is that candidates often choose S3 Glacier for cost savings, overlooking the retrieval latency and costs for frequent backups, or they choose a single stream assuming simplicity, missing the performance benefits of parallelism for large datasets.

How to eliminate wrong answers

Option A is wrong because EBS snapshots capture the entire volume, including unused blocks, and require copying to S3, which adds latency and cost without leveraging Backint's native SAP integration for HANA. Option C is wrong because S3 Glacier storage incurs retrieval fees and delays (minutes to hours) that are unsuitable for frequent backups and rapid restores required by SAP HANA. Option D is wrong because a single Backint stream creates a bottleneck, limiting throughput to a single connection and failing to utilize S3's parallel processing capabilities, resulting in slower backup times for a 3.5 TB dataset.

Practice this question →

158

MCQhard

A company is designing a multi-zone SAP system on AWS. They want to minimize network latency between SAP application servers and the SAP HANA database. What is the best practice for deploying these components?

A.Deploy in different VPCs and use VPC peering.

B.Deploy in different AWS Regions.

C.Deploy application servers and HANA in the same AZ and same VPC.

D.Deploy application servers in one AZ and HANA in another AZ.

AnswerC

Same AZ and VPC minimizes latency.

Why this answer

The correct answer is D because placing the SAP application servers and HANA database in the same Availability Zone minimizes network latency. Option A is incorrect because spreading across AZs increases latency. Option B is incorrect because using different VPCs adds unnecessary latency.

Option C is incorrect because different Regions have much higher latency.

Practice this question →

159

MCQmedium

A company runs SAP ERP on AWS. The system needs to be highly available with automatic failover in case of an Availability Zone failure. Which architecture should be used?

A.Route 53 failover routing policy

B.Auto Scaling group with multiple EC2 instances in different AZs

C.SAP HANA System Replication across two Availability Zones with automatic failover

D.AWS RDS Multi-AZ deployment

AnswerC

HANA SR across AZs provides automatic failover for HA.

Why this answer

SAP HANA System Replication (HSR) across two Availability Zones with automatic failover is the correct architecture because it provides synchronous or asynchronous replication of the SAP HANA database at the storage or log level, enabling automatic failover to a standby instance in a different AZ when the primary fails. This meets the requirement for high availability and automatic failover during an AZ failure, as HSR is the native SAP mechanism for database-level HA on AWS, unlike generic AWS services that do not handle SAP-specific application state or replication requirements.

Exam trap

The trap here is that candidates confuse generic AWS high-availability services (like Auto Scaling or RDS Multi-AZ) with SAP-specific requirements, failing to recognize that SAP HANA requires its own replication mechanism (HSR) and that RDS does not support SAP HANA at all.

How to eliminate wrong answers

Option A is wrong because Route 53 failover routing policy only handles DNS-level traffic routing to healthy endpoints, not automatic failover of the SAP ERP application or database; it cannot initiate database failover or maintain session state, and it requires health checks that do not replace SAP HANA's replication and takeover logic. Option B is wrong because an Auto Scaling group with multiple EC2 instances in different AZs provides compute-level redundancy but does not manage SAP HANA database replication or automatic failover; it lacks the database synchronization and takeover mechanisms needed for SAP ERP, and scaling out instances does not address database state consistency. Option D is wrong because AWS RDS Multi-AZ deployment is designed for relational databases like MySQL, PostgreSQL, or Oracle, not for SAP HANA; SAP HANA is an in-memory database that requires its own replication technology (HSR) and is not supported by RDS Multi-AZ, which also does not provide SAP-specific application-aware failover.

Practice this question →

160

MCQmedium

An administrator is reviewing a CloudFormation template to deploy an SAP ASCS instance. The template snippet is shown in the exhibit. What is a potential issue with this configuration for a production deployment?

A.The AMI ID is not specified correctly.

B.The instance type m5.large is not certified for SAP ASCS.

C.The security group is not defined in the template.

D.The tags are not sufficient for SAP discovery.

AnswerB

SAP ASCS requires certified instance types; m5.large is not certified.

Why this answer

Option B is correct because the m5.large instance type is not certified for SAP ASCS on AWS. SAP requires specific instance types that have passed SAP's certification tests for high-availability and performance requirements of the ASCS (ABAP Central Services) role. Using an uncertified instance type can lead to unsupported configurations, potential performance issues, and lack of SAP support.

Exam trap

The trap here is that candidates often assume any instance type in a family (e.g., m5) is automatically certified for SAP, but SAP certification is granular per specific size and role, and m5.large is explicitly excluded for ASCS in production.

How to eliminate wrong answers

Option A is wrong because the AMI ID is not specified in the template snippet shown, but this is not inherently an issue—the AMI can be provided as a parameter or mapped later, and the question focuses on the ASCS deployment configuration, not the AMI. Option C is wrong because security groups can be referenced by name or ID without being defined inline in the same template; they may exist externally or be imported, and this does not directly affect ASCS certification. Option D is wrong because tags are not a certification requirement for SAP ASCS; while tags help with resource identification and automation, insufficient tags do not prevent a production deployment or violate SAP certification.

Practice this question →

161

MCQeasy

An SAP administrator is planning a Disaster Recovery (DR) strategy for SAP HANA on AWS. The DR site is in a different AWS Region. Which AWS service can replicate SAP HANA data to the DR region with low Recovery Point Objective (RPO)?

A.Amazon EBS snapshots copied to the DR region

B.SAP HANA System Replication with log shipping

C.AWS Database Migration Service (DMS) with ongoing replication

D.Amazon S3 cross-region replication

AnswerB

HANA System Replication provides continuous synchronization with low RPO.

Why this answer

Option A is correct. SAP HANA System Replication with log shipping can provide a low RPO by continuously replicating data to another region. Option B is wrong because EBS snapshots are periodic and may not achieve low RPO.

Option C is wrong because S3 cross-region replication is object-level, not database-level. Option D is wrong because AWS Database Migration Service is for migrations, not ongoing replication for DR.

Practice this question →

162

Multi-Selectmedium

An SAP system on AWS uses an Oracle database. The administrator wants to automate the creation of daily backups and retain them for 30 days. Which THREE AWS services can be used together to achieve this? (Choose three.)

Select 3 answers

A.Amazon S3 lifecycle policies

B.AWS Lambda

C.Amazon EBS snapshots

D.AWS Backup

E.Amazon CloudWatch Events

AnswersA, C, D

To expire old backups.

Why this answer

Option A, Option C, and Option D are correct: AWS Backup (A) schedules backups, Amazon EBS snapshots (C) capture data, and Amazon S3 lifecycle policies (D) manage retention. Option B is wrong because AWS Lambda is not necessary for scheduling. Option E is wrong because CloudWatch is for monitoring.

Practice this question →

163

MCQeasy

A company wants to automate the installation of SAP software on AWS. Which AWS service is most appropriate for orchestrating the deployment of SAP systems?

A.AWS CloudFormation

B.AWS OpsWorks

C.AWS CodeDeploy

D.AWS Lambda

AnswerA

CloudFormation allows infrastructure as code to provision all AWS resources for SAP.

Why this answer

AWS CloudFormation is the most appropriate service for orchestrating the deployment of SAP systems because it allows you to define the entire infrastructure as code using templates, enabling automated, repeatable, and consistent provisioning of SAP landscapes. It supports custom resources and nested stacks, which are essential for managing the complex dependencies and multi-tier architecture typical of SAP deployments on AWS.

Exam trap

The trap here is that candidates often confuse AWS OpsWorks or CodeDeploy with infrastructure orchestration, but the PAS-C01 exam specifically tests the understanding that CloudFormation is the primary service for automating the provisioning of SAP systems on AWS, while OpsWorks and CodeDeploy serve different purposes in configuration management and application deployment, respectively.

How to eliminate wrong answers

Option B (AWS OpsWorks) is wrong because it is designed for configuration management using Chef or Puppet, not for orchestrating the deployment of complex SAP systems; it lacks native support for SAP-specific resources and templates. Option C (AWS CodeDeploy) is wrong because it is intended for deploying application code to EC2 instances or on-premises servers, not for provisioning the underlying infrastructure or orchestrating multi-tier SAP landscapes. Option D (AWS Lambda) is wrong because it is a serverless compute service for running event-driven code, not a deployment orchestration tool; it cannot manage the lifecycle of infrastructure resources like EC2 instances, storage, and networking required for SAP.

Practice this question →

164

MCQmedium

A company is running SAP ERP on AWS and needs to encrypt data at rest for all SAP-related storage. Which combination of AWS services can be used to achieve this? (Select TWO.)

A.AWS Identity and Access Management (IAM)

B.Amazon S3 server-side encryption

C.AWS WAF

D.Amazon EBS encryption

E.Amazon CloudWatch Logs

AnswerB, D

Encrypts objects stored in S3, such as backups.

Why this answer

Amazon EBS encryption (Option D) provides at-rest encryption for the block storage volumes used by SAP EC2 instances, ensuring data on the underlying disks is encrypted. Amazon S3 server-side encryption (Option B) encrypts data at rest in S3 buckets, which can be used for SAP backups, log archives, or other SAP-related object storage. Together, they cover the primary storage types for SAP on AWS.

Exam trap

The trap here is that candidates may confuse access control services (IAM) or security monitoring (WAF, CloudWatch) with encryption services, failing to recognize that only storage-level services like EBS and S3 provide native at-rest encryption for SAP data.

How to eliminate wrong answers

Option A is wrong because AWS Identity and Access Management (IAM) is an access control service that manages permissions and authentication, not data encryption at rest. Option C is wrong because AWS WAF is a web application firewall that protects against web exploits, not a data encryption service. Option E is wrong because Amazon CloudWatch Logs is a monitoring and logging service that stores log data but does not provide native encryption at rest for SAP storage; it relies on underlying service encryption, but it is not a direct encryption mechanism for SAP-related storage.

Practice this question →

165

Multi-Selecthard

Which THREE of the following are valid options for high availability of SAP HANA on AWS? (Choose THREE.)

Select 3 answers

A.Storage replication using NetApp Cloud Volumes ONTAP.

B.HANA System Replication with automatic failover using AWS Elastic IP or Route53.

C.SAP HANA replication to a secondary region with asynchronous replication.

D.Amazon RDS Multi-AZ for HANA.

E.HANA System Replication with manual failover.

AnswersA, B, E

Third-party storage replication can provide HA.

Why this answer

Option A is correct because NetApp Cloud Volumes ONTAP provides storage-level replication that can be used for SAP HANA high availability. This solution replicates storage volumes between availability zones or regions, enabling failover at the storage layer independently of the database, which is a valid HA architecture for SAP HANA on AWS.

Exam trap

The trap here is confusing disaster recovery (asynchronous replication to a secondary region) with high availability (synchronous replication within the same region), and assuming that managed services like RDS Multi-AZ support SAP HANA when they do not.

Practice this question →

166

MCQmedium

An SAP system on AWS is using Amazon EBS volumes for the database. The company wants to take crash-consistent snapshots of the entire database volume set. Which approach is recommended?

A.Stop the instance, take snapshots, then restart

B.Use EBS Multi-Attach to attach volumes to a backup instance

C.Take snapshots of each volume individually at the same time

D.Use AWS Backup with pre- and post-scripts for volume groups

AnswerD

AWS Backup can create crash-consistent snapshots across volumes.

Why this answer

Option D is correct because the AWS Backup service can orchestrate snapshots across multiple EBS volumes with application-consistent or crash-consistent behavior. Option A is wrong because individual snapshots without coordination may not be crash-consistent. Option B is wrong because stopping the instance causes downtime.

Option C is wrong because EBS Multi-Attach is for shared volumes, not for snapshot consistency.

Practice this question →

167

MCQeasy

A company is running SAP HANA on AWS and needs to ensure high availability for the database. Which AWS service should be used to automatically recover the HANA primary instance in case of an instance failure?

A.Amazon CloudWatch alarms

B.AWS CloudFormation custom resources

C.AWS Lambda functions

D.Amazon Route 53 health checks and failover routing

AnswerD

Route 53 health checks can trigger failover to a standby database.

Why this answer

Option A is correct because Amazon Route 53 can be used with health checks to automatically redirect traffic to a standby HANA instance. Option B is wrong because AWS CloudFormation is for infrastructure provisioning, not automatic recovery. Option C is wrong because AWS Lambda can be used for custom automation but is not the primary service for this.

Option D is wrong because Amazon CloudWatch monitors but does not automatically recover the instance.

Practice this question →

168

Multi-Selecthard

Which TWO are required considerations when sizing an SAP HANA instance on AWS for a production environment? (Choose two.)

Select 2 answers

A.Provision instance store volumes for HANA data and log areas.

B.Purchase Reserved Instances for the HANA server to reduce costs.

C.Ensure the instance has enough memory to hold the HANA data in memory (RAM:data ratio).

D.Provision EBS volumes with sufficient IOPS for the HANA workload.

E.Select an RDS instance type that supports SAP HANA.

AnswersC, D

HANA is in-memory; data must fit in RAM for performance.

Why this answer

Option C is correct because SAP HANA is an in-memory database that requires all active data to reside in RAM. The RAM:data ratio must be carefully sized to ensure the instance has enough memory to hold the HANA data and log volumes in memory, typically with a 1:4 or 1:8 ratio depending on compression and workload. AWS provides specific instance types (e.g., x1e, u-6tb1) certified for SAP HANA that meet these memory requirements.

Exam trap

The trap here is that candidates confuse storage persistence requirements with instance store vs. EBS, or mistakenly think RDS can host SAP HANA, when in fact SAP HANA requires certified EC2 instances and specific EBS configurations for production workloads.

Practice this question →

169

MCQmedium

A company is running SAP on AWS and needs to design a disaster recovery (DR) solution with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. The primary region is us-east-1 and the DR region is us-west-2. The SAP application uses an SAP HANA database with a size of 2 TB. Which combination of AWS services should be used to meet the DR requirements most cost-effectively?

A.Use AWS Database Migration Service (DMS) with continuous replication from the primary HANA database to a target in us-west-2.

B.Use AWS Backup with continuous backups and cross-region copy to achieve RPO of 15 minutes.

C.Use AWS Backup to take hourly backups of the HANA database and restore in us-west-2 during a disaster.

D.Configure HANA System Replication (HSR) across regions and use a standby HANA instance in us-west-2 with a smaller instance size.

AnswerD

HSR provides near-synchronous replication with RPO of seconds; a smaller standby reduces cost and can be scaled up during failover within RTO.

Why this answer

Option D is correct because HANA System Replication (HSR) is the native SAP HANA replication technology that can achieve an RPO of 15 minutes or less by asynchronously replicating data across regions. By using a smaller standby instance in us-west-2, the solution meets the RTO of 4 hours (since the standby can be scaled up or promoted quickly) while minimizing ongoing DR costs. This approach is purpose-built for SAP HANA and avoids the overhead of third-party tools or backup-based restores.

Exam trap

The trap here is that candidates assume AWS Backup or DMS can handle SAP HANA replication, but neither supports the required continuous, low-RPO replication for HANA, and the native HSR is the only service that meets both the RPO and RTO cost-effectively.

How to eliminate wrong answers

Option A is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a continuous replication source for ongoing changes; DMS is designed for homogeneous/heterogeneous migrations, not for real-time HANA replication with sub-15-minute RPO. Option B is wrong because AWS Backup does not support continuous backups for SAP HANA; it can only take snapshot-based backups at scheduled intervals, and achieving a 15-minute RPO with hourly backups is impossible. Option C is wrong because hourly backups cannot guarantee a 15-minute RPO (the maximum data loss could be up to 1 hour), and restoring from backups in a DR region would likely exceed the 4-hour RTO due to the time required to restore a 2 TB HANA database.

Practice this question →

170

MCQmedium

An SAP administrator is creating an IAM policy for an EC2 instance that performs SAP database backups to S3 and creates EBS snapshots. The policy as shown fails to allow the EC2 instance to perform backup operations. What is the most likely reason?

A.The S3 resource ARN is incorrect; it should be 'arn:aws:s3:::sap-backup-bucket' without the '/*'.

B.The S3 actions are too permissive; they should be restricted to specific prefixes.

C.The ec2:CreateSnapshot action must be restricted to specific volume ARNs.

D.The policy does not include the 's3:ListBucket' action for the bucket itself.

AnswerD

Without 's3:ListBucket' on the bucket resource, the instance cannot list objects or verify bucket existence, causing failures.

Why this answer

Option D is correct because the policy lacks the `s3:ListBucket` action for the bucket itself (ARN without `/*`). When an EC2 instance performs SAP database backups to S3, the AWS SDK or CLI first issues a `ListBucket` request to verify the bucket exists and to list objects before uploading. Without this permission, the backup operation fails at the initial listing step, even if `s3:PutObject` is allowed on the object ARN.

Exam trap

The trap here is that candidates focus on the EC2 snapshot permissions or S3 object ARN syntax, overlooking the prerequisite `s3:ListBucket` action required for any S3 upload workflow.

How to eliminate wrong answers

Option A is wrong because the S3 resource ARN `arn:aws:s3:::sap-backup-bucket/*` is correct for object-level actions like `s3:PutObject`; removing the `/*` would restrict access to the bucket itself, which is needed for `s3:ListBucket` but not for `s3:PutObject`. Option B is wrong because the S3 actions being too permissive is not the cause of failure; the issue is a missing action, not excessive permissions. Option C is wrong because `ec2:CreateSnapshot` does not require restriction to specific volume ARNs for the policy to work; the failure is due to missing S3 permissions, not EC2 snapshot permissions.

Practice this question →

171

MCQeasy

Which AWS service is used to automate the installation and configuration of SAP applications on AWS according to best practices?

A.AWS OpsWorks

B.AWS Launch Wizard for SAP

C.AWS CloudFormation

D.AWS Quick Starts

AnswerB

Launch Wizard provides guided, best-practice deployment for SAP.

Why this answer

AWS Launch Wizard for SAP is the correct service because it provides a guided, best-practice-based deployment experience specifically for SAP applications. It automatically provisions the necessary AWS infrastructure (EC2, EBS, VPC, etc.) and configures the SAP software according to AWS and SAP validated architectures, reducing manual effort and errors.

Exam trap

The trap here is that candidates confuse AWS Launch Wizard for SAP with AWS CloudFormation or Quick Starts, assuming any automation tool can handle SAP installation, but only Launch Wizard integrates the SAP-specific software installation and best-practice validation directly into the provisioning workflow.

How to eliminate wrong answers

Option A is wrong because AWS OpsWorks is a configuration management service that uses Chef and Puppet, but it is not purpose-built for SAP deployment and does not include SAP-specific best practices or automated SAP installation workflows. Option C is wrong because AWS CloudFormation is a general-purpose Infrastructure as Code (IaC) service that requires users to manually define all resources and SAP-specific configurations; it lacks the guided, automated SAP installation and validation logic that Launch Wizard provides. Option D is wrong because AWS Quick Starts are reference deployments that use CloudFormation templates, but they are not dynamically interactive or tailored to individual SAP system requirements (like SID, sizing, or HA) and do not automate the actual SAP software installation step.

Practice this question →

172

MCQhard

An SAP administrator notices that the SAP HANA database is running out of disk space on the /hana/data volume. The volume is an EBS gp3 volume with 2000 GB size. The administrator wants to increase the size without downtime. Which action should be taken?

A.Detach the volume, create a snapshot, create a larger volume from the snapshot, and attach it

B.Create a new larger volume and copy data using rsync

C.Increase the IOPS of the volume to improve performance

D.Use the modify-volume API to increase the size of the existing volume

AnswerD

EBS supports online modification of volume size.

Why this answer

EBS gp3 volumes can be modified (size increased) while attached and in use, without downtime. Option A is wrong because detaching the volume would cause downtime. Option B is wrong because a new volume would require data migration and downtime.

Option D is wrong because increasing IOPS alone does not increase capacity.

Practice this question →

173

MCQmedium

A company runs SAP on AWS and wants to implement a high-availability (HA) solution for SAP Central Services (ASCS/ERS) using Amazon EC2 instances. Which AWS service is essential for managing the virtual IP address (VIP) required for the HA cluster?

A.AWS Global Accelerator

B.Amazon Route 53

C.AWS WAF

D.Application Load Balancer

AnswerB

Route 53 can provide failover routing with health checks to redirect traffic to the standby ASCS instance.

Why this answer

Amazon Route 53 is essential for managing the virtual IP address (VIP) required for the SAP Central Services (ASCS/ERS) HA cluster because it provides DNS-based failover. When the active ASCS instance fails, the HA cluster updates a Route 53 DNS record to point to the standby instance's IP address, effectively migrating the VIP. This allows clients to reconnect using the same DNS name without needing an elastic IP or a network-level VIP, which is not natively supported in AWS for this use case.

Exam trap

The trap here is that candidates often assume a traditional on-premises VIP (e.g., using a floating IP with ARP) is required, but AWS does not support that, so the correct answer is a DNS-based solution like Route 53, not a load balancer or accelerator.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator provides static anycast IP addresses and traffic acceleration, but it does not support the dynamic, application-level VIP failover required for SAP ASCS/ERS HA clusters; it is designed for global traffic distribution, not for managing a single VIP that follows a cluster resource. Option C is wrong because AWS WAF is a web application firewall that protects against common web exploits, and it has no capability to manage or failover a virtual IP address for SAP Central Services. Option D is wrong because an Application Load Balancer distributes traffic across multiple targets at Layer 7, but it cannot be used to assign a single, floating VIP to an active-passive SAP ASCS/ERS cluster; the HA cluster requires a VIP that moves with the active node, which ALB does not support.

Practice this question →

174

MCQmedium

A company is experiencing performance issues with their SAP ERP system on AWS. The system is running on an r5.4xlarge EC2 instance with gp2 EBS volumes. The database is SAP HANA. CloudWatch metrics show high write latency on the data volume. Which change would most likely improve performance?

A.Increase the size of the gp2 volume to get more baseline IOPS

B.Move the database to a t3.large instance

C.Enable EBS optimization on the instance

D.Change the volume type to io2 Block Express

AnswerD

io2 Block Express offers consistent low latency and high IOPS for SAP HANA.

Why this answer

io2 Block Express volumes provide higher IOPS and lower latency compared to gp2, suitable for SAP HANA.

Practice this question →

175

MCQmedium

An SAP administrator is creating an IAM policy to allow SAP basis users to manage their own SAP EC2 instances. The policy above is intended to allow users to start, stop, and reboot instances tagged with their username. However, users report that they cannot start instances. What is the MOST likely reason?

A.The condition references ${aws:username} which is not available in the context.

B.The condition key ec2:ResourceTag/SAPSystem is not valid.

C.The actions are not correct for managing instances.

D.The ec2:StartInstances action does not support resource-level permissions; it requires a separate condition or a wildcard resource.

AnswerD

StartInstances does not support resource-level permissions, so the condition doesn't apply.

Why this answer

The ec2:StartInstances action does not support resource-level permissions in IAM policies. This means that even if the policy specifies a condition based on tags, the condition is ignored for StartInstances, and the action will be denied unless the resource element is set to a wildcard ('*'). AWS documentation explicitly states that StartInstances, StopInstances, and RebootInstances require a wildcard resource or a separate condition to allow the action, making option D the correct answer.

Exam trap

The trap here is that candidates assume all EC2 actions support resource-level permissions and conditions, but AWS explicitly excludes certain actions like StartInstances, StopInstances, and RebootInstances from this support, requiring a wildcard resource or a separate condition to function correctly.

How to eliminate wrong answers

Option A is wrong because ${aws:username} is a valid IAM policy variable that resolves to the IAM user's username, and it is available in the request context for most AWS services, including EC2. Option B is wrong because ec2:ResourceTag/SAPSystem is a valid condition key that can be used to filter EC2 instances based on their tags, and there is no inherent issue with its syntax. Option C is wrong because the actions ec2:StartInstances, ec2:StopInstances, and ec2:RebootInstances are indeed the correct actions for starting, stopping, and rebooting EC2 instances, so the actions themselves are not the problem.

Practice this question →

176

MCQhard

An SAP administrator notices that the SAP application server is experiencing high latency when reading from the shared /sapmnt directory mounted from an Amazon EFS file system. The EFS file system is in General Purpose performance mode and uses Bursting throughput mode. The administrator checks CloudWatch metrics and sees that BurstCreditBalance is near zero. What is the most cost-effective solution to address the latency?

A.Increase the size of the EFS file system to increase the burst credit balance

B.Enable Provisioned Throughput mode on the EFS file system

C.Mount the /sapmnt directory from an Amazon EBS gp3 volume instead

D.Change the EFS performance mode to Max I/O

AnswerB

Provides consistent throughput without burst credits.

Why this answer

Option D is correct because switching to Provisioned Throughput mode ensures consistent throughput without relying on burst credits. Option A is wrong because switching to Max I/O performance mode does not increase throughput. Option B is wrong because EBS gp3 volumes are not shared across instances.

Option C is wrong because increasing burst credit balance is not possible; burst credits are earned based on storage size.

Practice this question →

177

MCQmedium

An SAP administrator needs to configure high availability for SAP NetWeaver AS ABAP. They plan to use AWS services. Which combination of services is required?

A.Amazon EFS and Pacemaker on EC2

B.AWS Global Accelerator and Auto Scaling

C.Elastic Load Balancing and Amazon Route 53

D.Amazon EBS Multi-Attach volumes

AnswerA

EFS provides shared storage; Pacemaker manages clustering.

Why this answer

Option A is correct because SAP NetWeaver AS ABAP high availability on AWS requires shared storage for the /sapmnt and /usr/sap/trans directories, which Amazon EFS provides via NFSv4, and a cluster manager like Pacemaker on EC2 to orchestrate failover between the primary and secondary application servers. This combination ensures that the SAP central services (ASCS and ERS) can fail over seamlessly in the event of an instance or availability zone failure.

Exam trap

The trap here is that candidates often confuse general AWS HA services (like ELB or Auto Scaling) with the specific shared-storage and cluster-manager requirements of SAP NetWeaver AS ABAP, leading them to overlook the necessity of a cluster filesystem (EFS) and a cluster resource manager (Pacemaker).

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator and Auto Scaling are designed for improving network performance and scaling web/application tiers, not for orchestrating SAP application-level failover or providing the shared file system required by SAP NetWeaver AS ABAP. Option C is wrong because Elastic Load Balancing and Amazon Route 53 handle traffic distribution and DNS routing, but they do not provide the shared storage (e.g., /sapmnt) or the cluster fencing and resource management needed for SAP ASCS/ERS high availability. Option D is wrong because Amazon EBS Multi-Attach volumes support concurrent attachment to multiple EC2 instances only within a single Availability Zone, which violates the cross-AZ high availability requirement for SAP; additionally, SAP NetWeaver AS ABAP requires a distributed file system like NFS, not block-level shared storage.

Practice this question →

178

MCQeasy

An SAP administrator wants to monitor the CPU utilization of SAP application servers using Amazon CloudWatch. What is the minimum configuration required?

A.Install and configure the AWS CloudWatch Agent on each SAP application server.

B.Set up an AWS Lambda function to query EC2 metrics from the CloudWatch API.

C.Configure SAP Solution Manager to export metrics to CloudWatch.

D.Enable EC2 detailed monitoring from the AWS Management Console.

AnswerA

Agent collects OS-level metrics and sends to CloudWatch.

Why this answer

The AWS CloudWatch Agent must be installed and configured on each SAP application server to collect custom metrics like CPU utilization at the granularity and frequency required for SAP monitoring. CloudWatch by default only provides basic EC2 metrics (every 5 minutes) and cannot capture OS-level or application-level CPU utilization without the agent. The agent sends metrics via the CloudWatch PutMetricData API, enabling detailed monitoring of SAP-specific performance counters.

Exam trap

The trap here is that candidates often confuse enabling EC2 detailed monitoring (Option D) with collecting OS-level metrics, not realizing that detailed monitoring only increases the frequency of hypervisor-level metrics and does not provide the application-specific CPU data required for SAP monitoring.

How to eliminate wrong answers

Option B is wrong because AWS Lambda querying EC2 metrics from the CloudWatch API would only retrieve existing EC2-level metrics (e.g., CPUUtilization at 5-minute intervals) and cannot provide the OS-level or SAP-process-level CPU utilization needed; it adds no new data collection capability. Option C is wrong because SAP Solution Manager does not natively export metrics to CloudWatch; it uses its own monitoring infrastructure (e.g., CCMS, Wily Introscope) and would require a custom integration or adapter to forward data to CloudWatch. Option D is wrong because enabling EC2 detailed monitoring (1-minute intervals) only increases the frequency of hypervisor-level CPU metrics, not OS-level or application-specific CPU utilization, and still cannot capture SAP application server process metrics.

Practice this question →

179

Multi-Selecthard

An SAP system on AWS is using an SAP HANA database. The database administrator wants to monitor memory usage and receive alerts when memory consumption exceeds 90%. Which THREE services can be used together to achieve this?

Select 3 answers

A.Amazon Simple Notification Service (SNS)

B.Amazon CloudWatch custom metrics for SAP HANA

C.AWS Config

D.Amazon CloudWatch Alarms

E.Amazon Inspector

AnswersA, B, D

SNS can send notifications when alarms are triggered.

Why this answer

Options A, B, and D are correct. A: CloudWatch can collect custom metrics. B: CloudWatch Alarms can trigger notifications.

D: SNS sends email or SMS. Option C is wrong because Amazon Inspector is for security assessment. Option E is wrong because AWS Config is for compliance and configuration tracking.

Practice this question →

180

MCQmedium

A company is running SAP NetWeaver on AWS. The system uses an SAP HANA database. The operations team needs to monitor the database performance and receive alerts when specific metrics exceed thresholds. Which AWS service should be used to collect and analyze SAP HANA metrics?

A.Amazon CloudWatch

B.Amazon Inspector

C.AWS CloudTrail

D.AWS Config

AnswerA

CloudWatch can collect and alarm on custom metrics from HANA.

Why this answer

Amazon CloudWatch is the correct service because it can collect, monitor, and analyze SAP HANA database metrics using the AWS CloudWatch Agent or the SAP HANA CloudWatch integration. By configuring custom metrics or using the SAP HANA monitoring views, operations teams can set CloudWatch Alarms to trigger notifications when specific thresholds are exceeded, enabling proactive performance management.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) or AWS Config (configuration compliance) with monitoring services, but only CloudWatch provides the metric collection, alarm, and notification capabilities required for real-time SAP HANA performance monitoring.

How to eliminate wrong answers

Option B is wrong because Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not for collecting or analyzing database performance metrics. Option C is wrong because AWS CloudTrail records API activity and governance events for auditing, not real-time database performance monitoring or metric collection. Option D is wrong because AWS Config evaluates and records resource configuration changes for compliance and auditing, not for monitoring runtime database performance metrics like memory or CPU usage.

Practice this question →

181

MCQhard

An SAP workload on AWS uses an Auto Scaling group for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS) instances. The instances are launched with a custom AMI that includes the SAP software. During a recent failover test, the ASCS instance failed to start after being terminated and re-launched by the Auto Scaling group. The error log indicates that the ASCS instance cannot find the quorum device. What is the most likely cause of this issue?

A.The quorum device (EBS volume) was not re-attached or was not available in the same Availability Zone as the new ASCS instance.

B.The instance type of the new ASCS instance is different from the original, causing incompatibility with the SAP kernel.

C.The ASCS instance does not have a public IP address, preventing communication with the quorum device.

D.The Security Group associated with the ASCS instance does not allow inbound traffic on the quorum port.

AnswerA

In a multi-AZ setup, the quorum device must be accessible to the new instance; if it's an EBS volume, it is tied to a specific AZ.

Why this answer

In an SAP on AWS high-availability setup, the ASCS and ERS instances rely on a shared quorum device (typically an EBS volume or an Amazon EFS file system) to maintain cluster state and prevent split-brain scenarios. When the Auto Scaling group terminates and re-launches the ASCS instance, the new instance must have the quorum device attached and be in the same Availability Zone as the EBS volume (since EBS volumes are AZ-specific). If the quorum device is not re-attached or is in a different AZ, the SAP cluster cannot find it, causing the ASCS instance to fail to start.

Exam trap

The trap here is that candidates may think the issue is related to network connectivity or security groups, but the real problem is the AZ-specific nature of EBS volumes and the requirement to re-attach the quorum device to the new instance.

How to eliminate wrong answers

Option B is wrong because the SAP kernel is not tied to a specific instance type; it runs on any supported instance type as long as the architecture (x86_64) and operating system match. Option C is wrong because the quorum device is accessed via block storage (EBS) or shared file system (EFS), not over the network using a public IP address; communication with the quorum device does not require a public IP. Option D is wrong because the quorum device is not accessed via a network port; it is a storage resource, so security group rules for inbound traffic are irrelevant to quorum device discovery.

Practice this question →

182

MCQeasy

A company is deploying SAP S/4HANA on AWS. They need to choose the appropriate storage for the database volume to meet high IOPS and low latency requirements. Which AWS storage service should they use?

A.Amazon EFS

B.Amazon S3

C.Amazon EBS io2 Block Express volumes

D.Amazon EBS gp3 volumes

AnswerC

io2 Block Express provides high IOPS and low latency for SAP HANA.

Why this answer

Amazon EBS io2 Block Express volumes provide high IOPS and low latency, suitable for SAP HANA database workloads. Option A is wrong because EBS gp3 is for general-purpose, not optimized for high IOPS. Option B is wrong because EFS is file storage, not block.

Option D is wrong because S3 is object storage.

Practice this question →

183

MCQmedium

A company is migrating an SAP S/4HANA system to AWS. The system requires high availability across two Availability Zones. Which AWS service should be used to attach a block-level storage volume that can be concurrently accessed by two EC2 instances in active/passive mode?

A.Use Amazon FSx for NetApp ONTAP to provide a shared block storage volume accessible from both AZs.

B.Use Amazon FSx for Windows File Server with a multi-AZ file system.

C.Use Amazon S3 as a shared block storage device.

D.Use Amazon EBS Multi-Attach to attach a single EBS volume to both EC2 instances across AZs.

AnswerA

FSx for NetApp ONTAP supports shared block storage across AZs.

Why this answer

Option B is correct because Amazon EBS Multi-Attach allows a single EBS volume to be attached to multiple EC2 instances in the same Availability Zone, but for active/passive across AZs, shared EBS is not supported; the correct service is Amazon EFS, but EFS is file-level. For block-level concurrent access across AZs, Amazon FSx for NetApp ONTAP provides shared block storage. Option A is wrong because EBS Multi-Attach only works within a single AZ.

Option C is wrong because FSx for Windows File Server is file-level. Option D is wrong because S3 is object storage.

Practice this question →

184

MCQeasy

A company is running SAP ERP on AWS and wants to ensure that their SAP system is backed up according to SAP best practices. Which backup method should they use for the SAP HANA database?

A.AWS Backup service

B.EBS snapshots of the data volumes

C.SAP HANA Backint to Amazon S3

D.Amazon S3 replication

AnswerC

Backint provides integrated, consistent backups.

Why this answer

SAP HANA Backint to Amazon S3 is the correct backup method because it integrates directly with SAP HANA's native backup interface (Backint), allowing SAP to manage backup and restore operations natively. This approach supports SAP best practices for HANA database backups, including full, incremental, and differential backups, and leverages Amazon S3 for durable, scalable storage without requiring external scripting or manual snapshot coordination.

Exam trap

The trap here is that candidates often assume EBS snapshots are sufficient for database backups because they work for other databases, but SAP HANA requires application-consistent backups via Backint to maintain transactional integrity and support SAP's certified recovery procedures.

How to eliminate wrong answers

Option A is wrong because AWS Backup service does not natively support SAP HANA database backups via the Backint API; it can only back up EBS volumes or EC2 instances, which are not crash-consistent for HANA without application-level coordination. Option B is wrong because EBS snapshots of data volumes are not application-consistent for SAP HANA unless the database is frozen or stopped, which violates SAP best practices for online backups and can lead to data corruption or recovery failures. Option D is wrong because Amazon S3 replication is a storage-level feature for copying objects between S3 buckets, not a backup method for SAP HANA databases; it does not interact with HANA's backup interface or ensure transactional consistency.

Practice this question →

185

MCQmedium

A company is designing an SAP HANA disaster recovery (DR) solution on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The RPO is 15 minutes, and the RTO is 2 hours. Which AWS service should be used for replicating the SAP HANA database to the DR site?

A.SAP HANA System Replication with log shipping using Amazon S3 or direct VPN connection.

B.Amazon S3 Cross-Region Replication for database backup files.

C.Amazon EBS snapshots replicated to us-west-2 via Amazon Data Lifecycle Manager.

D.AWS Database Migration Service (DMS) with ongoing replication.

AnswerA

SAP HANA System Replication provides synchronous or asynchronous replication with low RPO.

Why this answer

SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for real-time database replication, capable of achieving sub-minute RPOs by continuously shipping log entries to a secondary system. When combined with a direct VPN connection or Amazon S3 as a log shipping target, it meets the 15-minute RPO and 2-hour RTO requirements for disaster recovery across AWS regions. This is the only option that provides synchronous or near-synchronous replication of the HANA database itself, not just backups or snapshots.

Exam trap

The trap here is that candidates often confuse backup replication (S3 CRR or EBS snapshots) with live database replication, failing to recognize that SAP HANA System Replication is the only AWS-supported method that provides the required RPO by replicating transactional logs in near real-time.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Cross-Region Replication replicates only static backup files (e.g., data or log backups) stored in S3, not the live database transactions, so it cannot achieve a 15-minute RPO for ongoing changes. Option C is wrong because Amazon EBS snapshots replicated via Data Lifecycle Manager capture point-in-time disk states, but they are not application-consistent for SAP HANA without additional scripting, and the snapshot frequency (typically every 1-24 hours) cannot meet a 15-minute RPO. Option D is wrong because AWS Database Migration Service (DMS) with ongoing replication is designed for heterogeneous database migrations and does not support SAP HANA as a source for continuous change data capture (CDC) replication.

Practice this question →

186

MCQmedium

A company is designing an SAP S/4HANA workload on AWS. The system must be highly available within a single AWS Region. Which architecture ensures automatic failover for the SAP Central Services (ASCS) instance?

A.Place an Application Load Balancer (ALB) in front of two ASCS instances in different Availability Zones.

B.Deploy ASCS on a single EC2 instance with multiple Elastic Network Interfaces (ENIs).

C.Use Amazon CloudFront to distribute traffic to multiple ASCS instances in different Availability Zones.

D.Configure Amazon Route 53 with health checks to failover to a secondary ASCS instance in a different Availability Zone.

AnswerD

Route 53 health checks can monitor the primary ASCS and automatically route traffic to a standby instance in another AZ.

Why this answer

Option D is correct because Amazon Route 53 with health checks can monitor the primary ASCS instance and automatically fail over DNS resolution to a secondary ASCS instance in a different Availability Zone. This provides the necessary automatic failover for SAP Central Services (ASCS) without requiring a shared filesystem or cluster manager, as Route 53 health checks detect instance or service failure and update DNS records accordingly.

Exam trap

The trap here is that candidates often assume a load balancer (ALB) is required for high availability, but SAP ASCS uses proprietary protocols that ALB cannot inspect or health-check, making DNS-based failover with Route 53 the correct AWS-native approach.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) operates at Layer 7 and cannot properly handle the proprietary SAP-specific protocols (e.g., Message Server and Enqueue Server) used by ASCS; ALB does not support the required health checks or session persistence for SAP Central Services. Option B is wrong because deploying ASCS on a single EC2 instance with multiple Elastic Network Interfaces (ENIs) does not provide any failover capability; it only adds network redundancy within the same instance, which is a single point of failure. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) designed for static and dynamic web content distribution, not for routing SAP proprietary traffic to ASCS instances; it cannot perform health checks or failover for SAP services.

Practice this question →

187

MCQeasy

A company is running SAP Business Suite on AWS using an Oracle database. They need to migrate the Oracle database to SAP HANA as part of an SAP S/4HANA conversion. The current Oracle database size is 5 TB and runs on an r5.8xlarge instance. The target HANA database will run on an r5.24xlarge instance. The company wants to minimize downtime. What is the best approach to migrate the data?

A.Use AWS Database Migration Service (DMS) to continuously replicate data from Oracle to HANA, then switch over.

B.Use SAP Landscape Transformation (SLT) to replicate data in real-time from Oracle to HANA.

C.Use Oracle Data Pump to export the database and import into HANA using SAP HANA studio.

D.Use SAP Software Update Manager (SUM) with the Database Migration Option (DMO) to migrate and upgrade in one step.

AnswerD

SUM with DMO performs the migration and upgrade in a single process, minimizing downtime.

Why this answer

SAP provides the Software Update Manager (SUM) with DMO (Database Migration Option) to perform the migration and upgrade in one step, minimizing downtime. Option A (native Oracle export/import) is time-consuming. Option B (AWS DMS) is not fully supported for SAP HANA as target.

Option C (SAP Landscape Transformation) is for data replication but not for a one-step migration with upgrade. Option D is correct.

Practice this question →

188

MCQhard

An SAP administrator notices that the SAP HANA database is running out of memory frequently. The system is deployed on an EC2 instance with 512 GB of RAM. The HANA memory usage is peaking at 480 GB. What should the administrator do to resolve this issue?

A.Configure a swap file on the instance's root EBS volume

B.Enable HANA memory overcommit and set the memory limit to 90%

C.Migrate to an instance with more memory, such as x1e.32xlarge

D.Reduce the number of HANA table partitions

AnswerB

Overcommit allows HANA to use more memory than allocated, useful for temporary spikes.

Why this answer

Option D is correct because enabling HANA's memory overcommit can handle spikes beyond assigned memory. Option A is risky as it could cause swap thrashing. Option B would provide more headroom but is costly.

Option C is not a viable solution.

Practice this question →

189

MCQeasy

An SAP Basis administrator is migrating an SAP NetWeaver system from on-premises to AWS. They want to minimize downtime during the migration of the database. Which AWS service is best suited for this?

A.AWS Server Migration Service (SMS)

B.AWS CloudEndure Migration

C.AWS Database Migration Service (DMS)

D.AWS Snowball Edge

AnswerC

DMS supports ongoing replication for minimal downtime.

Why this answer

AWS DMS can perform live migration with minimal downtime by continuously replicating changes from the source database to the target RDS instance.

Practice this question →

190

MCQhard

An SAP HANA administrator is troubleshooting a performance issue on an EC2 instance (r5.8xlarge) running SAP HANA. The instance has two EBS volumes attached. Based on the exhibit, which additional information is needed to determine if the instance is optimized for SAP HANA?

A.Whether the instance is EBS-optimized or has dedicated EBS bandwidth.

B.Whether the instance is in a placement group.

C.The volume type and IOPS of the attached EBS volumes.

D.Whether the AMI used is SAP-certified.

AnswerA

SAP HANA requires EBS optimization; the exhibit does not show this attribute (shown in describe-instances as 'EbsOptimized').

Why this answer

Option A is correct because SAP HANA requires high and consistent network throughput for data replication and client access, and the instance must be EBS-optimized or have dedicated EBS bandwidth to ensure that EBS I/O does not contend with network I/O. Without this confirmation, the administrator cannot guarantee that the instance meets SAP's performance requirements for HANA workloads, as non-optimized instances share the same network interface for both EBS and data traffic, leading to potential bottlenecks.

Exam trap

The trap here is that candidates often focus on storage parameters like volume type and IOPS (Option C) because they are directly tied to SAP HANA's performance, but the question specifically asks about the instance's optimization, which is a network-level attribute that controls how EBS traffic is handled, not the storage configuration itself.

How to eliminate wrong answers

Option B is wrong because a placement group affects network latency and throughput between instances, but it does not directly impact the instance's ability to handle EBS I/O or its optimization for SAP HANA. Option C is wrong because while volume type and IOPS are important for storage performance, the question specifically asks about the instance's optimization for SAP HANA, which is determined by EBS-optimization or dedicated bandwidth, not the volume specifications themselves. Option D is wrong because the AMI certification ensures the operating system and SAP HANA software are compatible, but it does not address the underlying instance's network and EBS I/O architecture required for optimized performance.

Practice this question →

191

MCQmedium

A company is planning to migrate their SAP ECC system to AWS. They want to minimize downtime and use an automated approach. Which AWS service should be used for the migration?

A.AWS Application Discovery Service

B.AWS CloudFormation

C.AWS Launch Wizard

D.AWS Server Migration Service

AnswerC

Launch Wizard automates SAP deployment and migration with best practices.

Why this answer

Option B is correct because AWS Launch Wizard automates the deployment of SAP systems. Option A is wrong because AWS CloudFormation is for infrastructure as code, not a migration service. Option C is wrong because AWS Server Migration Service is for server-level migration, not SAP-specific.

Option D is wrong because AWS Application Discovery Service is for discovery, not migration.

Practice this question →

192

MCQmedium

A company is deploying SAP Business Suite on AWS. They need to ensure that the SAP system can handle a sudden increase in user load without manual intervention. Which AWS service should be used to automatically scale the SAP application servers?

A.AWS Lambda

B.Amazon Elastic Container Service

C.Elastic Load Balancing

D.AWS Auto Scaling

AnswerD

Auto Scaling adjusts the number of EC2 instances automatically.

Why this answer

AWS Auto Scaling is the correct service because it automatically adjusts the number of SAP application server instances based on demand, using scaling policies tied to metrics like CPU utilization or memory. This ensures the SAP system can handle sudden user load spikes without manual intervention, which is a core requirement for elastic SAP deployments on AWS.

Exam trap

The trap here is that candidates often confuse Elastic Load Balancing with auto-scaling, thinking that load balancing alone provides elasticity, but ELB only distributes traffic and does not manage instance count.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for event-driven code, not designed to run or scale SAP application servers, which require persistent, stateful operating system environments. Option B is wrong because Amazon Elastic Container Service (ECS) manages Docker containers, but SAP Business Suite is traditionally deployed on EC2 instances with specific OS and kernel requirements, not containerized. Option C is wrong because Elastic Load Balancing distributes incoming traffic across existing instances but does not automatically add or remove instances; it requires an external scaling mechanism like Auto Scaling to adjust capacity.

Practice this question →

193

Multi-Selectmedium

Which TWO Amazon CloudWatch metrics are most useful for monitoring SAP HANA database performance on EC2?

Select 2 answers

A.CPUCreditBalance

B.NetworkIn

C.DiskWriteOps

D.VolumeQueueLength

E.StatusCheckFailed

AnswersA, D

Important for T2/T3 instances to avoid throttling.

Why this answer

CPUCreditBalance (A) is critical for monitoring SAP HANA on EC2 because HANA is a memory- and CPU-intensive in-memory database that can burst CPU usage. If the instance runs on a T-series burstable instance, a low CPUCreditBalance indicates the instance may soon be throttled, causing severe performance degradation for HANA queries. VolumeQueueLength (D) is essential because SAP HANA relies on fast, low-latency storage (e.g., io1/io2 EBS volumes) for data persistence; a high queue length signals that I/O requests are backing up, directly impacting HANA's savepoint and log write performance.

Exam trap

The trap here is that candidates often confuse general EC2 health metrics (like StatusCheckFailed) or high-level throughput metrics (NetworkIn, DiskWriteOps) with the specific performance indicators that directly impact SAP HANA's in-memory and I/O-sensitive workload, leading them to overlook the burst credit and queue depth metrics that AWS explicitly documents for HANA monitoring.

Practice this question →

194

Multi-Selectmedium

A company is designing a disaster recovery (DR) strategy for its SAP landscape on AWS. The DR site must be in a different AWS Region. Which TWO options can be used to replicate the SAP HANA database to the DR Region? (Choose TWO.)

Select 2 answers

A.Amazon RDS Multi-Region replica

B.Amazon S3 Cross-Region Replication for HANA backup files

C.AWS Database Migration Service (DMS) with ongoing replication

D.SAP HANA System Replication across Regions

E.Amazon EBS snapshot copy to the DR Region

AnswersC, D

DMS can replicate HANA data to another region.

Why this answer

Option A and Option D are correct. SAP HANA System Replication can replicate to a different region using log shipping. AWS DMS can also replicate data to a target in another region.

Option B is wrong because EBS snapshots are per-region and cannot be directly copied across regions without manual steps. Option C is wrong because S3 Cross-Region Replication replicates objects, not database transactions. Option E is wrong because RDS is not used for SAP HANA.

Practice this question →

195

MCQmedium

A company runs SAP S/4HANA on AWS using a distributed architecture with separate instances for the database (DB) and application (ASCS, PAS, AAS). The application servers are in an Auto Scaling group. After a recent scaling event, users report that they cannot log in to the system. The SAP dispatcher logs show that the application servers cannot connect to the message server. What is the most likely cause?

A.The database connection string in the new application servers points to the wrong endpoint.

B.The new application servers are not registered in the SAP message server's configuration.

C.The SAP licenses are exhausted and need to be updated.

D.The security group of the application servers is not allowing outbound traffic to the DB server.

AnswerB

Auto Scaling instances must be registered in the SAP profile to communicate with the message server.

Why this answer

Auto Scaling instances need to be integrated with SAP's application server architecture. If the new instances are not registered in the SAP profile or the message server's configuration, they won't be recognized. Option A (security group) would block all traffic, not just after scaling.

Option B (licensing) is possible but less immediate. Option D (database connection) is not related to message server. Option C is the most typical cause.

Practice this question →

196

MCQmedium

A company runs SAP on AWS and needs to implement a disaster recovery strategy for their SAP NetWeaver system. The primary site is in us-east-1, and the DR site is in us-west-2. They want to minimize data loss and recovery time. Which approach meets these requirements?

A.Use SAP HANA System Replication in asynchronous mode across regions.

B.Use SAP HANA System Replication in synchronous mode across regions.

C.Use AWS Backup to back up the SAP HANA database and restore in us-west-2.

D.Use Amazon S3 cross-region replication for SAP HANA data files.

AnswerA

Async replication provides low RPO and RTO for cross-region DR.

Why this answer

SAP HANA System Replication in asynchronous mode across regions is the correct approach because it provides near-zero recovery point objective (RPO) with minimal impact on primary system performance, while enabling rapid failover to the DR region in us-west-2. Asynchronous replication is suitable for cross-region scenarios where network latency would make synchronous mode impractical, and it meets the requirement to minimize both data loss and recovery time for SAP NetWeaver.

Exam trap

The trap here is that candidates often confuse synchronous mode as always better for data protection, but fail to recognize that cross-region latency makes synchronous replication impractical, leading to transaction timeouts or severe performance degradation, while asynchronous mode is the standard for multi-region DR in SAP on AWS.

How to eliminate wrong answers

Option B is wrong because synchronous mode across regions would introduce high latency and potential transaction blocking due to network round-trip times, making it unsuitable for cross-region DR and potentially causing application performance degradation. Option C is wrong because AWS Backup for SAP HANA provides point-in-time recovery but has a higher recovery time objective (RTO) due to the need to restore full database backups, and it does not support continuous replication for minimal data loss. Option D is wrong because Amazon S3 cross-region replication only replicates object-level data files and does not provide the transaction-consistent, log-based replication required for SAP HANA database recovery, nor does it support automated failover.

Practice this question →

197

MCQmedium

A company is migrating its SAP ERP system to AWS. The system has strict high availability requirements with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. The SAP application and database (SAP HANA) must be in the same AWS Region but can be in different Availability Zones. Which architecture should the company use to meet these requirements?

A.Deploy SAP HANA in a single Availability Zone with asynchronous replication to a secondary instance in another AZ, and use manual failover.

B.Deploy SAP HANA in a Multi-AZ cluster using synchronous replication across two Availability Zones, with the SAP application servers in an Auto Scaling group across the same AZs.

C.Deploy SAP HANA on a single EC2 instance with EBS snapshots every 5 minutes, and use a secondary instance in another AZ with snapshots restored.

D.Deploy SAP HANA on a single EC2 instance with hourly backups to Amazon S3 and a script to restore the backup on a new instance in a different AZ.

AnswerB

Multi-AZ synchronous replication provides automatic failover and meets RPO and RTO.

Why this answer

Option B is correct because it uses synchronous replication for SAP HANA across two Availability Zones, which ensures zero data loss and meets the RPO of 15 minutes. The Multi-AZ cluster with automatic failover achieves the RTO of 2 hours, while the SAP application servers in an Auto Scaling group across the same AZs provide high availability and load balancing. This architecture aligns with AWS best practices for SAP HANA HA, leveraging HANA System Replication (HSR) in sync mode.

Exam trap

The trap here is that candidates confuse asynchronous replication (which risks data loss) with synchronous replication (which ensures zero RPO), or they underestimate the recovery time of snapshot-based or backup-based approaches, assuming they can meet strict RTO/RPO targets.

How to eliminate wrong answers

Option A is wrong because asynchronous replication can result in data loss exceeding the 15-minute RPO, and manual failover increases RTO beyond 2 hours. Option C is wrong because EBS snapshots every 5 minutes cannot guarantee an RPO of 15 minutes due to snapshot consistency delays and restore times that exceed the 2-hour RTO. Option D is wrong because hourly backups to S3 provide an RPO of up to 60 minutes, failing the 15-minute requirement, and restoring from S3 takes longer than 2 hours, violating the RTO.

Practice this question →

198

MCQmedium

A company runs SAP S/4HANA on AWS and needs to back up the SAP HANA database to Amazon S3. They want to automate backups and ensure they are encrypted at rest. Which solution should they use?

A.Use AWS Backup to schedule backups to S3

B.Use an S3 lifecycle policy to transition backups to S3

C.Configure SAP HANA Backint agent to back up directly to S3 with SSE-S3 encryption

D.Use AWS KMS to encrypt backups and store them manually

AnswerC

Backint agent integrates with SAP HANA and supports encryption.

Why this answer

SAP HANA backup to S3 can be done using the hdbbackint interface with the SAP HANA Backint agent for S3, which supports encryption. Option A is wrong because AWS Backup does not directly integrate with hdbbackint. Option B is wrong because S3 lifecycle does not handle backups.

Option D is wrong because AWS KMS alone does not perform backups.

Practice this question →

199

MCQeasy

A company wants to automate the deployment of SAP environments on AWS. Which AWS service should the company use to define the infrastructure as code?

A.AWS OpsWorks

B.AWS CodeDeploy

C.AWS Elastic Beanstalk

D.AWS CloudFormation

AnswerD

CloudFormation enables infrastructure as code.

Why this answer

Option A is correct because AWS CloudFormation allows defining infrastructure as code. Option B is wrong because AWS Elastic Beanstalk is for web applications, not SAP. Option C is wrong because OpsWorks is for Chef/Puppet.

Option D is wrong because CodeDeploy is for application deployment, not infrastructure.

Practice this question →

200

MCQmedium

A company is running SAP S/4HANA on AWS. They are experiencing high read latency on their EBS volumes used for /usr/sap. Which of the following is the MOST effective way to improve read performance?

A.Use io2 Block Express volumes with provisioned IOPS.

B.Change the volume type to gp3 with higher throughput.

C.Move to a larger instance type with more network bandwidth.

D.Configure RAID 0 across multiple volumes.

AnswerA

io2 Block Express provides consistent low latency.

Why this answer

The io2 Block Express volume type provides the highest durability and consistent low-latency performance for SAP workloads, with up to 256,000 provisioned IOPS per volume. For /usr/sap, which is sensitive to read latency due to frequent binary and configuration file access, io2 Block Express ensures predictable sub-millisecond latency even under high I/O demand, directly addressing the high read latency issue.

Exam trap

The trap here is that candidates often confuse throughput improvements (gp3 or RAID 0) with latency reduction, but the question specifically targets read latency, which requires a volume type designed for consistent low-latency performance like io2 Block Express.

How to eliminate wrong answers

Option B is wrong because gp3 volumes, while offering baseline performance and burst capability, cannot match the ultra-low latency and consistent IOPS of io2 Block Express for latency-sensitive SAP /usr/sap directories. Option C is wrong because moving to a larger instance type with more network bandwidth improves network throughput, not EBS volume read latency, which is a storage-level performance characteristic. Option D is wrong because RAID 0 across multiple volumes increases throughput and IOPS but does not inherently reduce read latency per I/O operation, and it introduces complexity and risk of data loss without addressing the underlying volume performance.

Practice this question →

201

MCQeasy

A company is planning to migrate its SAP ERP system to AWS. The database is SAP HANA with a size of 3 TB. The company wants to minimize downtime during the migration. Which migration strategy should the company use?

A.Use HANA System Replication to replicate the database to an EC2 instance running HANA in the target AWS environment, then perform a takeover.

B.Export the HANA database to flat files using SAP HANA Studio, upload the files to Amazon S3, and import them into an EC2 HANA instance.

C.Use AWS Database Migration Service (DMS) with ongoing replication to migrate the database to Amazon RDS for SAP HANA.

D.Use AWS Backup to take a full backup of the on-premises HANA database and restore it to an EC2 instance in AWS.

AnswerA

HSR provides continuous replication with minimal downtime during the final switchover.

Why this answer

HANA System Replication (HSR) is the optimal strategy for minimizing downtime because it continuously replicates data from the on-premises HANA database to an EC2 instance running HANA in AWS. When the migration window opens, a simple takeover (failover) occurs, typically completing in minutes, which meets the requirement for minimal downtime. This approach avoids the lengthy export/import or backup/restore processes that would take hours for a 3 TB database.

Exam trap

The trap here is that candidates may assume AWS DMS or backup/restore services are suitable for SAP HANA migrations, but DMS does not support HANA as a target, and backup/restore methods cause significant downtime, whereas HANA System Replication is the only AWS-recommended approach for near-zero downtime migrations.

How to eliminate wrong answers

Option B is wrong because exporting a 3 TB HANA database to flat files via SAP HANA Studio and then importing from S3 would take many hours or days, causing significant downtime, and does not support ongoing replication to minimize the cutover window. Option C is wrong because AWS DMS does not support SAP HANA as a target for ongoing replication; Amazon RDS for SAP HANA is not a valid service (RDS supports only certain database engines like MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB, not SAP HANA). Option D is wrong because using AWS Backup to take a full backup and restore it would require the database to be offline during the backup and restore process, leading to extended downtime, and AWS Backup does not natively support SAP HANA for ongoing replication or near-zero downtime migrations.

Practice this question →

202

Multi-Selectmedium

An SAP administrator is designing a backup strategy for an SAP HANA database on AWS. They want to use the Backint interface with Amazon S3. Which THREE components are required? (Choose three.)

Select 3 answers

A.EBS volumes for the backup catalog

B.IAM role with permissions to write to the S3 bucket

C.AWS Backint Agent for SAP HANA

D.S3 Transfer Acceleration enabled

E.An S3 bucket to store the backups

AnswersB, C, E

The EC2 instance needs an IAM role to access S3.

Why this answer

Option B is correct because the Backint interface for SAP HANA on AWS requires an IAM role that grants the AWS Backint Agent permissions to write backup data to the designated S3 bucket. Without this IAM role, the agent cannot authenticate or perform PutObject operations against S3, making the backup fail.

Exam trap

The trap here is that candidates may assume EBS volumes are required for the backup catalog or that S3 Transfer Acceleration is mandatory for performance, but the Backint interface only needs the agent, an S3 bucket, and an IAM role with write permissions.

Practice this question →

203

MCQhard

An SAP administrator notices that the SAP HANA database backups to Amazon S3 are failing intermittently with timeout errors. The backup script uses the AWS CLI to copy files to an S3 bucket. What is the most likely cause and solution?

A.The S3 bucket policy is too restrictive, modify the policy

B.The S3 bucket has a lifecycle policy that deletes objects too quickly

C.The backup files are large and the CLI command does not use multipart upload; use multipart upload and increase timeout values

D.S3 Transfer Acceleration is not enabled, enable it

AnswerC

Large files need multipart upload and appropriate timeouts.

Why this answer

Intermittent timeouts may be due to network connectivity issues or insufficient retries. Using multipart upload for large files and enabling retries can resolve this. Option A is wrong because S3 bucket policies do not cause timeouts.

Option B is wrong because S3 Transfer Acceleration is for speed, not timeouts. Option D is wrong because S3 lifecycle policies do not affect uploads.

Practice this question →

204

MCQhard

An SAP Basis administrator notices that the SAP HANA database performance has degraded significantly after migrating to AWS. The database is running on an r5.8xlarge instance with 3.6 TB of Amazon EBS gp3 storage. The administrator checks Amazon CloudWatch metrics and finds that the Read/Write latency is consistently above 10 ms and the queue depth is averaging 32. What is the MOST likely cause of the performance degradation?

A.The EC2 instance type does not support enough EBS bandwidth for the workload.

B.The EC2 instance's EBS bandwidth is fully utilized, causing I/O queueing.

C.The gp3 volume burst credit balance is exhausted, causing throughput to drop to baseline.

D.The EBS gp3 volume size is too small, causing IOPS throttling.

AnswerB

High queue depth indicates I/O requests are waiting due to bandwidth saturation.

Why this answer

The r5.8xlarge instance provides a maximum EBS bandwidth of 4,750 Mbps and a maximum EBS IOPS of 60,000. With a queue depth averaging 32 and latency above 10 ms, the instance's EBS bandwidth is saturated, causing I/O requests to queue and wait. This is the classic symptom of hitting the instance-level EBS bandwidth limit, not a volume-level issue.

Exam trap

The trap here is that candidates confuse volume-level limits (gp3 baseline IOPS or gp2 burst credits) with instance-level EBS bandwidth limits, leading them to incorrectly select options C or D when the real bottleneck is the EC2 instance's aggregate EBS throughput capacity.

How to eliminate wrong answers

Option A is wrong because the r5.8xlarge instance type supports up to 4,750 Mbps of EBS bandwidth and 60,000 IOPS, which is more than sufficient for typical SAP HANA workloads; the problem is that this bandwidth is fully utilized, not that the instance type is insufficient. Option C is wrong because gp3 volumes do not use burst credits; they have a baseline performance of 3,000 IOPS and 125 MB/s throughput regardless of size, and burst credits are a feature of gp2, not gp3. Option D is wrong because gp3 volume IOPS are independent of volume size; you can provision up to 16,000 IOPS on any gp3 volume, and the 3.6 TB size is more than adequate to support the required IOPS without throttling.

Practice this question →

205

MCQhard

A company is running SAP ERP on AWS and notices performance degradation during peak hours. The application servers are in an Auto Scaling group behind an Application Load Balancer. Which configuration change would best handle the increased load?

A.Increase the minimum and maximum instance count in the Auto Scaling group

B.Configure a step scaling policy based on memory utilization

C.Replace the Application Load Balancer with a Network Load Balancer

D.Change the Auto Scaling policy to use a target tracking policy based on CPU utilization

AnswerD

CPU utilization is a more relevant metric for SAP application server load.

Why this answer

Option A is correct because scaling policies based on memory utilization are not standard; CPU utilization is a better metric for SAP application servers. Option B is wrong because increasing instance size may be costly and not as dynamic. Option C is wrong because changing to Network Load Balancer does not solve performance.

Option D is wrong because a step scaling policy based on CPU utilization is appropriate, but the question asks for a change; option A directly addresses the issue of using memory-based scaling.

Practice this question →

206

MCQhard

A company is running SAP NetWeaver on AWS with a multi-ABAP application server setup. They want to implement a load balancing solution for HTTP traffic to the SAP Web Dispatcher. The solution must be highly available and support SSL termination. Which AWS service should be used?

A.Application Load Balancer (ALB)

B.Amazon CloudFront

C.Classic Load Balancer (CLB)

D.Network Load Balancer (NLB)

AnswerA

ALB supports HTTP/HTTPS, SSL termination, and health checks.

Why this answer

Option B is correct because Application Load Balancer supports HTTP/HTTPS traffic, SSL termination, and is highly available across AZs. Option A is wrong because NLB is for TCP/UDP, not HTTP-specific features. Option C is wrong because CloudFront is a CDN.

Option D is wrong because Classic Load Balancer is legacy and less feature-rich.

Practice this question →

207

MCQhard

A company is deploying SAP NetWeaver on AWS and needs to ensure that the SAP application servers can communicate with the SAP HANA database using the hostname. The environment uses a Windows Domain Controller for Active Directory. Which DNS resolution strategy should be used?

A.Use AWS Directory Service for Microsoft Active Directory with DNS

B.Configure DHCP option sets to use custom DNS

C.Install a DNS server on an Amazon Linux instance

D.Use Amazon Route 53 Resolver outbound endpoint

AnswerA

Provides DNS integrated with AD for hostname resolution.

Why this answer

Option A is correct because AWS Directory Service for Microsoft Active Directory provides a managed DNS service that integrates with Active Directory. This allows SAP application servers to resolve the SAP HANA database hostname via DNS, which is essential for SAP NetWeaver's hostname-based communication. The managed service ensures automatic DNS record updates and supports Windows-native DNS resolution without requiring custom infrastructure.

Exam trap

The trap here is that candidates often assume any DNS solution (like Route 53 Resolver or a Linux DNS server) can handle Windows Active Directory hostname resolution, overlooking the need for native Windows DNS integration with dynamic updates and Kerberos authentication.

How to eliminate wrong answers

Option B is wrong because DHCP option sets can specify custom DNS servers, but they do not provide the Active Directory-integrated DNS resolution required for Windows Domain Controller environments; they only point to existing DNS servers. Option C is wrong because installing a DNS server on an Amazon Linux instance does not natively integrate with Active Directory for dynamic DNS updates and Windows authentication, leading to potential resolution failures for SAP hostnames. Option D is wrong because Amazon Route 53 Resolver outbound endpoints are used for hybrid DNS resolution between on-premises and AWS, not for providing Active Directory-integrated DNS within a VPC; they lack the Windows-specific features needed for SAP hostname resolution.

Practice this question →

208

MCQmedium

A company wants to implement a disaster recovery (DR) strategy for its SAP landscape on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. They need to replicate SAP HANA database asynchronously with a Recovery Point Objective (RPO) of 15 minutes. Which AWS service should they use?

A.AWS Elastic Disaster Recovery (DRS)

B.SAP HANA System Replication

C.Amazon S3 cross-region replication for HANA backup files

D.AWS Database Migration Service (DMS) with ongoing replication

AnswerB

SAP HANA System Replication is the correct method for asynchronous replication.

Why this answer

SAP HANA System Replication is the native mechanism for asynchronous replication of HANA databases. AWS does not provide a managed replication service for HANA.

Practice this question →

209

Multi-Selecthard

Which TWO of the following are required to enable SAP HANA System Replication across two AWS Availability Zones?

Select 2 answers

A.The primary and secondary instances must be in the same AWS region

B.A Virtual Private Gateway must be attached to the VPC

C.The EBS volumes must be configured for multi-attach or use a shared file system

D.A cluster placement group must be used

E.An Application Load Balancer must be configured for the replication traffic

AnswersA, C

Cross-region replication is possible but not within the same region requirement; however, for low latency, same region is essential.

Why this answer

SAP HANA System Replication requires both primary and secondary instances to be in the same AWS region because the replication protocol (based on TCP/IP) relies on low-latency, synchronous or asynchronous data transfer that is only feasible within a region's Availability Zones. Cross-region replication would introduce latency exceeding SAP's recommended thresholds (typically <1 ms RTT for synchronous replication), risking data consistency and failover reliability.

Exam trap

The trap here is that candidates confuse SAP HANA System Replication (which requires same-region AZs) with SAP HANA scale-out or backup scenarios that might use shared storage or cross-region replication, leading them to select EBS multi-attach or cross-region options incorrectly.

Practice this question →

210

Multi-Selectmedium

A company is designing a disaster recovery (DR) strategy for its SAP environment on AWS. The primary site is in us-east-1, and the DR site must be in us-west-2. The Recovery Point Objective (RPO) is 15 minutes, and the Recovery Time Objective (RTO) is 4 hours. Which TWO AWS services should be used to meet these objectives?

Select 2 answers

A.Amazon Route 53 health checks to fail over DNS to the DR site.

B.Amazon EC2 Auto Scaling groups to launch instances in us-west-2 on failover.

C.SAP HANA System Replication configured with asynchronous replication to a HANA instance in us-west-2.

D.AWS Elastic Disaster Recovery (AWS DRS) to continuously replicate SAP servers to us-west-2.

E.AWS Backup to copy EBS snapshots to us-west-2 every 15 minutes.

AnswersC, D

Asynchronous replication can achieve RPO of seconds to minutes.

Why this answer

SAP HANA System Replication with asynchronous mode can achieve an RPO of 15 minutes or less by continuously replicating log buffers from the primary HANA database in us-east-1 to a secondary HANA instance in us-west-2. This is the native SAP replication mechanism and is the only option that directly meets the database-level RPO requirement without additional overhead.

Exam trap

The trap here is that candidates often choose AWS Backup (Option E) thinking frequent snapshots can meet a 15-minute RPO, but they overlook that snapshot creation is not instantaneous and cannot provide the sub-15-minute consistency required for SAP HANA, whereas native HANA replication and AWS DRS are designed for continuous replication.

Practice this question →

211

Multi-Selectmedium

Which TWO of the following are best practices for running SAP HANA on AWS? (Select TWO.)

Select 2 answers

A.Use Amazon EFS as the storage layer for HANA data files.

B.Use T3 instances for production to save costs.

C.Use Amazon RDS Multi-AZ for HANA database replication.

D.Use EBS Snapshots for backup of HANA data volumes.

E.Use EC2 instances from the SAP HANA certified instance list.

AnswersD, E

EBS Snapshots provide crash-consistent backups.

Why this answer

Option D is correct because EBS Snapshots provide a consistent, crash-consistent backup mechanism for HANA data volumes when used with application-consistent procedures (e.g., pre-freeze/post-thaw scripts via AWS Backup or custom automation). Snapshots are block-level, incremental, and can be automated for point-in-time recovery, aligning with SAP HANA backup best practices on AWS.

Exam trap

The trap here is that candidates confuse general-purpose backup services (like EFS or RDS) with the specific storage and replication requirements of SAP HANA, leading them to select options that sound reasonable but are technically incompatible or uncertified.

Practice this question →

212

MCQeasy

A company wants to automate the deployment of SAP systems on AWS. Which AWS service is most appropriate for infrastructure as code (IaC) for SAP?

A.AWS OpsWorks

B.AWS Elastic Beanstalk

C.AWS CodeDeploy

D.AWS CloudFormation

AnswerD

CloudFormation is the standard IaC service on AWS.

Why this answer

AWS CloudFormation is the most appropriate service for infrastructure as code (IaC) for SAP because it allows you to define and provision AWS infrastructure declaratively using templates. This enables repeatable, version-controlled deployments of complex SAP landscapes, including EC2 instances, networking, storage, and security groups, which is critical for SAP's strict architectural requirements.

Exam trap

The trap here is that candidates often confuse AWS CodeDeploy or Elastic Beanstalk with IaC because they involve 'deployment,' but they are designed for application code or PaaS, not for provisioning the underlying SAP infrastructure, which requires full control over compute, storage, and networking.

How to eliminate wrong answers

Option A is wrong because AWS OpsWorks is a configuration management service based on Chef and Puppet, not a declarative IaC tool; it is designed for application configuration and lifecycle management, not for provisioning the underlying SAP infrastructure. Option B is wrong because AWS Elastic Beanstalk is a PaaS service that abstracts infrastructure management for web applications, but it does not support the custom, granular control required for SAP systems (e.g., specific instance types, HANA-specific storage, or high-availability setups). Option C is wrong because AWS CodeDeploy is a deployment automation service for application code updates, not for provisioning infrastructure; it cannot define or manage the underlying AWS resources needed for an SAP environment.

Practice this question →

213

MCQhard

An SAP administrator notices that the SAP HANA database on an EC2 instance is experiencing high I/O latency. The instance is using EBS gp2 volumes. Which change would most effectively reduce I/O latency for the SAP HANA data volume?

A.Use instance store SSDs for the SAP HANA data volume.

B.Switch to io2 Block Express EBS volumes for the data volume.

C.Increase the size of the EBS gp2 volume to increase baseline IOPS.

D.Configure RAID 0 across multiple gp2 volumes.

AnswerB

io2 Block Express provides sub-millisecond latency and high IOPS.

Why this answer

Option B is correct because io2 Block Express volumes provide consistent, high-performance IOPS with sub-millisecond latency, which is critical for SAP HANA data volumes. Unlike gp2, which relies on burst credits and has variable performance, io2 Block Express delivers predictable low latency and up to 256,000 IOPS per volume, directly addressing the high I/O latency issue.

Exam trap

The trap here is that candidates may assume increasing gp2 volume size or using RAID 0 will solve latency issues, but these approaches do not address the fundamental lack of consistent low-latency performance that io2 Block Express provides.

How to eliminate wrong answers

Option A is wrong because instance store SSDs are ephemeral and do not persist data across instance stops or terminations, making them unsuitable for SAP HANA data volumes that require durability and high availability. Option C is wrong because increasing the size of a gp2 volume only raises the baseline IOPS (at a rate of 3 IOPS per GB), but gp2 still suffers from burst bucket limitations and does not guarantee the sub-millisecond latency required for SAP HANA. Option D is wrong because RAID 0 across multiple gp2 volumes increases throughput and IOPS but does not reduce latency per I/O operation; it also introduces a single point of failure if any volume fails, which is unacceptable for SAP HANA data persistence.

Practice this question →

214

MCQeasy

A company is planning to run SAP S/4HANA on AWS. The architect needs to ensure that the EC2 instances are SAP certified for the specific SAP HANA version. Where should the architect verify the instance certification?

A.SAP Support Portal

B.AWS Management Console under EC2 instance types

C.SAP Certified and Supported SAP HANA Hardware Directory

D.AWS documentation for SAP on AWS

AnswerC

This directory is the official source for SAP HANA hardware certification.

Why this answer

The SAP Certified and Supported SAP HANA Hardware Directory lists all certified hardware, including AWS instance types. Option A is wrong because the AWS documentation may not list all certifications. Option C is wrong because the AWS Management Console does not show SAP certification status.

Option D is wrong because the SAP Support Portal is for incidents, not hardware certification.

Practice this question →

215

MCQmedium

A company is running SAP HANA on AWS and needs to back up the database to Amazon S3. Which approach provides the most efficient and cost-effective backup strategy?

A.Use AWS Storage Gateway with tapes.

B.Use SAP HANA Backint agent to back up directly to S3.

C.Take EBS snapshots of the HANA data volumes.

D.Copy HANA data files to EC2 instance store.

AnswerB

Backint integrates with SAP HANA for efficient backups.

Why this answer

The correct answer is C because using SAP HANA's native backup to S3 via the Backint agent is the most efficient and cost-effective method. Option A is incorrect because EBS snapshots are for entire volumes and may include unused space. Option B is incorrect because copying to EC2 instance store is not durable.

Option D is incorrect because AWS Storage Gateway is more suited for on-premises integration.

Practice this question →

216

MCQmedium

A company runs its SAP ERP system on AWS. The database is SAP HANA on an EC2 instance. The system is critical and requires a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 2 hours. Which solution meets these requirements with the LEAST operational overhead?

A.Use AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) to perform continuous backups to S3.

B.Use EBS snapshots of the root and data volumes taken every 5 minutes.

C.Set up HANA system replication across two EC2 instances in different Availability Zones with manual failover.

D.Schedule manual HANA backups to S3 using cron scripts and hdbsql commands.

AnswerA

Continuous backups provide low RPO; automated restore meets RTO with low overhead.

Why this answer

AWS Backup with the SAP HANA Backup and Restore feature (Backint integration) provides continuous, incremental backups to Amazon S3, achieving an RPO of less than 5 minutes with automated, policy-driven backups. This solution minimizes operational overhead by eliminating manual scripting and infrastructure management, while supporting point-in-time recovery within the required RTO of under 2 hours.

Exam trap

The trap here is that candidates often overestimate the simplicity of EBS snapshots (Option B) for database workloads, not realizing that SAP HANA requires application-consistent backups and that frequent snapshots alone cannot achieve sub-5-minute RPO without significant custom orchestration.

How to eliminate wrong answers

Option B is wrong because EBS snapshots taken every 5 minutes cannot guarantee an RPO of less than 5 minutes due to snapshot initiation delays and the need to quiesce the HANA database, and they require manual or custom automation for consistency, increasing operational overhead. Option C is wrong because HANA system replication across Availability Zones with manual failover introduces significant operational overhead (manual intervention) and cannot meet the RTO of less than 2 hours reliably, as failover requires human action and coordination. Option D is wrong because scheduling manual HANA backups to S3 using cron scripts and hdbsql commands is error-prone, lacks automated monitoring, and requires custom scripting and maintenance, resulting in higher operational overhead and potential RPO/RTO gaps.

Practice this question →

217

MCQeasy

A company is designing a disaster recovery (DR) strategy for its SAP system on AWS. The primary site is in us-east-1 and the DR site in us-west-2. The RTO is 4 hours and RPO is 1 hour. Which AWS service should be used for cross-region replication of the SAP HANA database backups stored in Amazon S3?

A.AWS Backup with a cross-region backup plan.

B.Use AWS Storage Gateway to replicate backups.

C.Amazon S3 Cross-Region Replication (CRR).

D.Enable S3 Versioning on the source bucket.

AnswerC

S3 CRR automatically replicates new objects to another region, meeting RPO.

Why this answer

Amazon S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects (including SAP HANA database backups) from a source S3 bucket in us-east-1 to a destination bucket in us-west-2, meeting the 1-hour RPO by ensuring backups are available in the DR region within minutes of upload. CRR operates asynchronously at the object level, requires no additional infrastructure, and directly supports the stated requirement for cross-region replication of S3-stored backups without introducing extra latency or complexity.

Exam trap

The trap here is that candidates often confuse AWS Backup (which manages backup schedules and retention) with S3 CRR (which handles object-level replication), leading them to select AWS Backup despite it not being designed for cross-region replication of existing S3 objects.

How to eliminate wrong answers

Option A is wrong because AWS Backup with a cross-region backup plan is designed for scheduling and managing backups of AWS resources (e.g., EBS, RDS, DynamoDB) but does not natively replicate existing S3 objects; it would require creating separate backup copies, adding overhead and potentially missing the 1-hour RPO. Option B is wrong because AWS Storage Gateway is a hybrid storage service for on-premises to AWS connectivity (e.g., file, volume, or tape gateways) and is not designed for cross-region replication of S3 objects; it would introduce unnecessary complexity and latency. Option D is wrong because enabling S3 Versioning on the source bucket only preserves multiple versions of objects within the same bucket and region, providing protection against accidental deletion or overwrite, but does not replicate data to a different region, thus failing to meet the DR requirement for cross-region availability.

Practice this question →

218

MCQhard

An SAP system on AWS is experiencing performance degradation. The CloudWatch metrics show that the EBS volumes used for the HANA data files have an average queue length of 10 and average latency of 50 ms. What is the most likely cause?

A.EBS encryption is causing additional overhead.

B.EBS snapshots are being taken too frequently.

C.The EBS volume's provisioned IOPS are insufficient for the workload.

D.EBS optimization is not enabled on the instance.

AnswerC

Insufficient IOPS cause queuing and increased latency.

Why this answer

An average EBS queue length of 10 and average latency of 50 ms indicate that the volume is saturated with I/O requests. The queue length persistently exceeds the recommended threshold (typically <1 for optimal performance), and latency spikes above the 1–10 ms range for gp3 or io2 volumes. This directly points to insufficient provisioned IOPS for the SAP HANA workload, causing requests to queue up and wait for service.

Exam trap

The trap here is that candidates confuse high queue length with a snapshot or encryption issue, but AWS explicitly documents that queue length and latency are the primary indicators of IOPS exhaustion, not of background operations like snapshots or encryption.

How to eliminate wrong answers

Option A is wrong because EBS encryption uses AES-256 and is handled by the Nitro chip or instance hardware with negligible performance overhead; it does not cause queue buildup or latency spikes. Option B is wrong because EBS snapshots are incremental and taken from the control plane; they do not directly impact data-plane I/O latency or queue depth unless the volume is heavily utilized during a snapshot (which would still manifest as insufficient IOPS). Option D is wrong because EBS optimization is enabled by default on all current-generation instance types (e.g., m5, r5, x1e) and cannot be disabled; if it were missing on an older instance, it would cause a fixed bandwidth cap, not a queue-length symptom.

Practice this question →

219

MCQeasy

A company wants to use AWS Systems Manager to automate patching of SAP application servers. What is a prerequisite for Systems Manager to manage these EC2 instances?

A.Enable SSH access to the instances.

B.Assign a separate IAM role to each instance.

C.Install the SSM Agent on the EC2 instances.

D.Ensure the instances have public IP addresses.

AnswerC

SSM Agent is required for Systems Manager to communicate with instances.

Why this answer

AWS Systems Manager requires the SSM Agent to be installed and running on EC2 instances to enable communication with the Systems Manager service for patching and other management tasks. Without the agent, Systems Manager cannot send commands, initiate patching workflows, or gather inventory data from the instances. The SSM Agent is pre-installed on many Amazon Linux and Windows AMIs but must be manually installed on custom or imported images.

Exam trap

The trap here is that candidates often assume SSH or public IP addresses are required for remote management, but Systems Manager is designed to work without them, relying solely on the SSM Agent and IAM permissions over HTTPS.

How to eliminate wrong answers

Option A is wrong because SSH access is not required for Systems Manager; the service uses the SSM Agent over HTTPS (port 443) to communicate, not SSH. Option B is wrong because while an IAM role is necessary, a single IAM role can be shared across multiple instances; assigning a separate role to each instance is not a prerequisite. Option D is wrong because Systems Manager can manage instances in private subnets without public IP addresses, using VPC endpoints or Systems Manager managed instances with a NAT gateway.

Practice this question →

220

MCQhard

An SAP Basis administrator notices that the SAP application server on an EC2 instance is experiencing intermittent high latency when writing to the SAP HANA database. The HANA database is on a separate EC2 instance in the same VPC and Availability Zone. Which configuration change is most likely to resolve the issue?

A.Launch the instances in a cluster placement group

B.Enable EBS optimization on both instances

C.Change the Elastic Network Adapter (ENA) to SR-IOV

D.Enable Jumbo Frames on the network interfaces

AnswerD

Jumbo Frames reduce overhead for large packets, improving network throughput and reducing latency for HANA communication.

Why this answer

The intermittent high latency when writing to SAP HANA is likely caused by network packet fragmentation. Enabling Jumbo Frames (MTU 9001) on the network interfaces of both the SAP application server and the HANA database EC2 instances reduces the number of packets required for large data transfers, lowers CPU overhead for packet processing, and improves throughput. This is a standard recommendation for SAP on AWS to optimize network performance between application and database layers.

Exam trap

The trap here is that candidates often confuse network performance issues with compute or storage optimizations, leading them to choose EBS optimization or placement groups, when the real fix is a simple MTU adjustment to eliminate packet fragmentation overhead.

How to eliminate wrong answers

Option A is wrong because a cluster placement group is designed for low-latency, high-bandwidth communication between instances, but it does not address the underlying packet fragmentation issue; it would only help if the instances were in different AZs or needed enhanced network performance, which is not the case here. Option B is wrong because EBS optimization is a feature that dedicates bandwidth between the EC2 instance and EBS volumes, not between two EC2 instances; it would not resolve network latency between the SAP app server and HANA database. Option C is wrong because the Elastic Network Adapter (ENA) is already the default modern network interface for current-generation instances, and SR-IOV (Single Root I/O Virtualization) is an older technology (e.g., Intel 82599 VF) that is not applicable to ENA; changing to SR-IOV would not improve performance and could cause compatibility issues.

Practice this question →

221

Multi-Selectmedium

A company is running SAP HANA on AWS and needs to ensure high availability for the SAP Central Services (ASCS/ERS) instance. Which TWO actions should be taken to achieve this? (Choose two.)

Select 2 answers

A.Configure ASCS and ERS on separate EC2 instances in different Availability Zones.

B.Use an Application Load Balancer to distribute traffic between ASCS and ERS instances.

C.Use a Network Load Balancer with a floating IP address for the SAP virtual hostname.

D.Deploy both ASCS and ERS on the same EC2 instance to reduce latency.

E.Place both ASCS and ERS in the same Availability Zone to minimize network latency.

AnswersA, C

Separate instances in different AZs provide high availability.

Why this answer

For SAP HANA high availability, the ASCS and ERS instances must run on separate EC2 instances (or separate Availability Zones) to avoid a single point of failure. Using a Network Load Balancer with a floating IP addresses for the virtual hostname ensures seamless failover. Option B (single instance) would not provide HA.

Option E (using a Classic Load Balancer) is not recommended for SAP ASCS/ERS; AWS recommends NLB. Option C (single AZ) defeats HA. Option D (application-based routing) is not needed; NLB uses IP/host-based routing.

Practice this question →

222

MCQeasy

A company runs SAP on AWS and wants to back up its SAP HANA database to Amazon S3. The database is 2 TB in size. The backup must be encrypted at rest in S3 and must be cost-effective. Which approach should the company use?

A.Use AWS Backup to directly back up the SAP HANA database to S3 with SSE-S3

B.Configure a cron job to copy the SAP HANA backup files from EBS to S3 using AWS CLI

C.Install the SAP HANA Backint agent for Amazon S3 and configure it to use SSE-S3 encryption

D.Use SAP HANA Studio to export the database to a file on EBS and then manually upload to S3

AnswerC

Backint is the recommended method for backing up SAP HANA to S3 with encryption.

Why this answer

Option C is correct because Backint agent for SAP HANA integrates with AWS Backup and uses S3, enabling server-side encryption with SSE-S3 at no extra cost. Option A is wrong because AWS Backup does not support direct backup of SAP HANA to S3 without Backint. Option B is wrong because the SAP HANA file-level backup would require backup to EBS and then to S3, adding complexity.

Option D is wrong because manual copy to S3 is not automated.

Practice this question →

223

MCQhard

A company runs SAP S/4HANA on AWS with a multi-tier landscape (DEV, QAS, PRD). The PRD system uses a clustered setup with two application servers behind an Application Load Balancer. The database is a single-node HANA on an r5.24xlarge instance. The administrator receives an alert that the PRD application is slow. CloudWatch metrics show high CPU utilization on the two application servers (average 95%) and high DB connection count. The ALB shows increased request latency. The database CPU is at 60%. The administrator suspects a SQL query performance issue. What should be the first step to identify the root cause?

A.Configure CloudWatch Logs to capture HANA trace logs and analyze them.

B.Enable detailed SQL trace in HANA to identify high-resource queries.

C.Add two more application servers to distribute the load.

D.Increase the size of the HANA database instance to reduce CPU pressure.

AnswerB

SQL trace identifies specific queries causing performance issues.

Why this answer

The symptoms (high CPU on app servers, high DB connections, increased ALB latency, DB CPU at 60%) strongly suggest a SQL query performance bottleneck, not a capacity issue. Enabling detailed SQL trace in HANA (option B) is the most direct first step to identify the specific high-resource queries causing the slowdown, as it captures execution plans, wait times, and resource consumption per query. This aligns with SAP's recommended troubleshooting methodology for HANA performance issues.

Exam trap

The trap here is that candidates may confuse high application server CPU with a scaling issue (option C) or assume high DB connections mean the database is underpowered (option D), rather than recognizing that a SQL performance problem can manifest as app-side symptoms while the DB CPU remains moderate.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs can capture HANA trace logs, but the first step should be to enable a targeted SQL trace to pinpoint problematic queries, not to passively collect general logs. Option C is wrong because adding application servers would not resolve a SQL query performance issue; it would only mask the symptom by distributing load, and the root cause (poor query) would remain. Option D is wrong because increasing the HANA database instance size would not fix a SQL query performance issue; the DB CPU is only at 60%, indicating the bottleneck is likely inefficient queries, not insufficient compute capacity.

Practice this question →

224

MCQhard

A company is running SAP HANA on AWS and needs to ensure that the system can be restored to a specific point in time within the last 24 hours with minimal data loss. The database is 2 TB in size. Which backup strategy meets these requirements with the lowest cost?

A.Configure S3 Transfer Acceleration for faster backup uploads.

B.Use a script to copy HANA backup files to S3 every 15 minutes.

C.Use AWS Backup with a daily backup and a 24-hour retention policy, enabling point-in-time recovery.

D.Take hourly EBS snapshots of all HANA volumes and retain them for 24 hours.

AnswerC

AWS Backup supports PITR for HANA and is cost-effective with daily backups.

Why this answer

Option C is correct because AWS Backup for SAP HANA supports continuous backups and point-in-time recovery (PITR) with a 24-hour retention, meeting the requirement for minimal data loss. This managed service automates log backups every 5 minutes, enabling restore to any second within the retention window, and is more cost-effective than custom scripting or frequent EBS snapshots due to its incremental, deduplicated backup storage and no need for additional compute resources.

Exam trap

The trap here is that candidates often choose hourly EBS snapshots (Option D) thinking they are cheaper and simpler, but they overlook the high cost of frequent snapshots for a 2 TB database and the lack of application-consistent, point-in-time recovery, which is critical for SAP HANA.

How to eliminate wrong answers

Option A is wrong because S3 Transfer Acceleration only speeds up uploads to S3 but does not provide any backup or point-in-time recovery capability; it addresses network latency, not backup strategy. Option B is wrong because copying HANA backup files to S3 every 15 minutes requires custom scripting, manual orchestration, and does not guarantee consistent point-in-time recovery across all data files; it also incurs higher storage costs for full backups and lacks native integration with HANA's log backup chain. Option D is wrong because hourly EBS snapshots of all HANA volumes (2 TB) would be extremely costly due to the high frequency and large volume size, and EBS snapshots are crash-consistent, not application-consistent, risking data corruption for SAP HANA; they also do not support granular point-in-time recovery to a specific second within the last 24 hours.

Practice this question →

225

MCQhard

An SAP administrator created the IAM policy above for an EC2 instance role used by SAP HANA Backint agent. The backup to S3 fails with access denied. What is the likely cause?

A.The policy grants permissions on objects but not on the bucket itself. For s3:PutObject and s3:GetObject, a bucket-level permission is also required for some operations.

B.The policy does not allow s3:PutObject.

C.The policy does not allow ec2:CreateSnapshot.

D.The policy does not allow s3:ListBucket.

AnswerA

The resource ARN for S3 actions should include the bucket ARN for bucket-level operations.

Why this answer

The policy grants s3:PutObject and s3:GetObject on objects within the bucket (using the "arn:aws:s3:::bucket-name/*" resource), but does not include a bucket-level permission such as s3:PutObject or s3:GetObject on the bucket itself ("arn:aws:s3:::bucket-name"). For certain S3 operations, including multipart uploads and object writes that require bucket-level authorization checks, the IAM policy must explicitly allow the action on both the bucket and the object ARN. Without this, the SAP HANA Backint agent fails with access denied.

Exam trap

The trap here is that candidates assume s3:PutObject on the object ARN is sufficient, overlooking the requirement for bucket-level permissions on the same action for operations like multipart uploads or bucket-level condition checks.

How to eliminate wrong answers

Option B is wrong because the policy explicitly includes s3:PutObject on the object ARN, so the failure is not due to a missing s3:PutObject action. Option C is wrong because the question is about S3 backup failure, not EC2 snapshots; ec2:CreateSnapshot is irrelevant to the Backint agent's S3 access. Option D is wrong because s3:ListBucket is not required for the PutObject and GetObject operations used by the Backint agent; the error is caused by missing bucket-level permissions, not the ListBucket action.

Practice this question →

← PreviousPage 3 of 7 · 462 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Design of SAP Workloads on AWS questions.

Start 20-question session