CCNA Design of SAP Workloads on AWS Questions — Page 4 of 6

226

MCQeasy

A company runs SAP HANA on AWS and needs to ensure that the database can be restored to any point in time within the last 48 hours with minimal data loss. Which backup strategy should be used?

A.Use Amazon EBS snapshots every 6 hours.

B.Schedule daily full backups and hourly incremental log backups to Amazon S3 using Backint.

C.Use AWS Backup with a daily backup plan.

D.Take weekly full backups and daily differential backups to Amazon S3.

AnswerB

This combination allows point-in-time recovery with minimal data loss.

Why this answer

SAP HANA supports Backint integration with Amazon S3 for log backups, enabling point-in-time recovery (PITR) with minimal data loss. Daily full backups combined with hourly incremental log backups ensure that any transaction committed within the last 48 hours can be restored, meeting the RPO requirement of minimal data loss.

Exam trap

The trap here is that candidates often confuse EBS snapshots or AWS Backup with SAP HANA's specific requirement for Backint-based log backups, assuming general-purpose backup tools can achieve the same PITR granularity without understanding SAP HANA's dependency on transaction log continuity.

How to eliminate wrong answers

Option A is wrong because Amazon EBS snapshots every 6 hours cannot achieve point-in-time recovery to any moment within 48 hours; they only provide recovery points every 6 hours, leading to potential data loss of up to 6 hours. Option C is wrong because AWS Backup with a daily backup plan does not support the granular log backups needed for SAP HANA PITR; it lacks the Backint integration for transaction log backups. Option D is wrong because weekly full backups with daily differential backups do not provide the hourly log backup granularity required for minimal data loss; differential backups capture changes since the last full backup, not transaction-level logs, so PITR within 48 hours is not possible.

Practice this question →

227

MCQmedium

A company runs SAP on AWS and uses a shared Amazon EFS file system for /sapmnt and /usr/sap/trans. The administrator wants to control access to specific directories based on the source IP address of the SAP application servers. Which method should be used to achieve this?

A.Configure security group rules to allow only specific IP addresses

B.Use Amazon S3 bucket policies with IP conditions

C.Use Amazon EFS access points with IAM policies

D.Use network ACLs to restrict access by IP

AnswerC

Access points enforce directory access, IAM policies can restrict by IP.

Why this answer

Amazon EFS access points can be combined with IAM policies to enforce a specific POSIX user and directory path per application, and IAM conditions can restrict access based on the source IP address of the SAP application servers. This allows fine-grained control over which EC2 instances (by IP) can access specific subdirectories like /sapmnt or /usr/sap/trans without modifying the NFS client configuration.

Exam trap

The trap here is that candidates often confuse network-level controls (security groups, NACLs) with file-system-level controls, assuming IP-based restrictions can be applied directly to directories within a shared EFS volume, when in fact EFS access points with IAM policies are the correct AWS-native mechanism for this granularity.

How to eliminate wrong answers

Option A is wrong because security group rules operate at the network interface level and cannot control access to specific directories within a shared EFS file system; they only allow or deny traffic to the entire EFS mount target. Option B is wrong because Amazon S3 bucket policies are not applicable to EFS; EFS is a file system, not an object store, and does not use S3 bucket policies. Option D is wrong because network ACLs are stateless and apply at the subnet level, not at the file system or directory level, and they cannot enforce directory-specific access controls.

Practice this question →

228

MCQmedium

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP application servers. The ALB is configured with a TCP listener. Users report that some sessions are terminated unexpectedly. What is the MOST likely cause?

A.The ALB is not configured with SSL termination.

B.The target group health check interval is set too low.

C.The ALB idle timeout setting is shorter than the SAP session timeout.

D.The ALB is configured with cross-zone load balancing disabled.

AnswerC

If idle timeout is lower than SAP session timeout, connections are dropped.

Why this answer

The ALB's idle timeout setting controls how long the load balancer keeps a connection open without data transfer. If this timeout is shorter than the SAP session timeout, the ALB will close the connection prematurely, causing the user's session to be terminated unexpectedly. This is a common mismatch when long-running SAP transactions or background jobs do not send data within the ALB's idle timeout window.

Exam trap

The trap here is that candidates often confuse the ALB's idle timeout with the target group health check interval, assuming that frequent health checks cause session drops, when in fact health checks do not affect established connections.

How to eliminate wrong answers

Option A is wrong because SSL termination is not required for TCP listeners; TCP listeners pass traffic through without decryption, and the lack of SSL termination does not cause session termination. Option B is wrong because setting the health check interval too low would cause the target group to mark instances as unhealthy more frequently, potentially dropping connections, but the described symptom is unexpected session termination, not health check failures; a low interval actually increases health check frequency, which does not directly terminate established sessions. Option D is wrong because disabling cross-zone load balancing affects traffic distribution across Availability Zones, not the persistence of individual TCP sessions; it may cause uneven load but does not terminate active sessions.

Practice this question →

229

MCQeasy

An SAP application server on an EC2 instance is unable to connect to the SAP HANA database on another EC2 instance. Both instances are in the same VPC and security groups allow traffic. What is the most likely cause?

A.The VPC does not have an Internet Gateway

B.The security group for the database instance does not allow inbound traffic on the HANA port

C.Network ACLs are blocking traffic

D.The route table does not have a local route

AnswerB

HANA uses port 3XX13; must be allowed.

Why this answer

The most likely cause is that the security group attached to the SAP HANA database instance does not have an inbound rule allowing traffic on the SAP HANA database port (typically 3<span>00</span>15 for HANA system DB or 3<span>NN</span>13 for tenant DBs). Even if the security group for the application server allows outbound traffic, the database security group must explicitly permit inbound TCP traffic from the application server's security group or IP address on the correct HANA port. Without this rule, the database will reject the connection at the instance level.

Exam trap

The trap here is that candidates often confuse security groups (stateful, instance-level) with Network ACLs (stateless, subnet-level) and assume that if the security group allows outbound traffic from the app server, the connection should work, forgetting that the database's security group must also allow inbound traffic on the specific HANA port.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway is only required for instances to communicate with the internet or with other VPCs via public IPs; it is not needed for communication between two EC2 instances within the same VPC. Option C is wrong because Network ACLs are stateless and, by default, allow all inbound and outbound traffic in a default VPC; even if custom NACLs were used, they would need to explicitly block traffic on the HANA port, which is less common than a missing security group rule. Option D is wrong because the route table in a VPC always includes a local route for the VPC CIDR by default, which enables direct communication between instances in the same VPC without any additional configuration.

Practice this question →

230

MCQmedium

An SAP system is experiencing performance issues during peak hours. The SAP application servers are running on EC2 instances behind a Network Load Balancer (NLB). The NLB is configured to use cross-zone load balancing. The issue is that one application server receives significantly more traffic than others. What is the most likely cause?

A.The application servers have different instance sizes, causing the NLB to send more traffic to larger instances

B.The NLB is using round-robin algorithm and one server is slower

C.The flow hash algorithm is causing an uneven distribution of client traffic

D.The health check is failing on the other servers

AnswerC

NLB uses a flow hash based on source IP, port, and protocol; with few clients, distribution can be uneven.

Why this answer

The Network Load Balancer (NLB) uses a flow hash algorithm based on the 5-tuple (source IP, source port, destination IP, destination port, and protocol) to route traffic. This algorithm is designed to maintain session stickiness, but it can cause uneven distribution if a small number of clients generate a disproportionate amount of traffic, as each client's flows are consistently sent to the same target. Cross-zone load balancing distributes traffic across all targets in all enabled Availability Zones, but it does not alter the flow hash algorithm's per-flow routing, so one server can still receive more flows if its hash bucket is overloaded.

Exam trap

The trap here is that candidates often assume cross-zone load balancing alone ensures even distribution, but they overlook that the NLB's flow hash algorithm inherently causes per-flow stickiness, which can lead to imbalance when a small number of clients generate many flows.

How to eliminate wrong answers

Option A is wrong because the NLB does not consider instance size when routing traffic; it uses the flow hash algorithm and distributes flows independently of target capacity. Option B is wrong because the NLB does not use a round-robin algorithm; it uses a flow hash algorithm for connection routing, and a slower server would not cause the NLB to send more traffic to it—the NLB does not adjust distribution based on server performance. Option D is wrong because if health checks were failing on other servers, those servers would be removed from the target group and would not receive any traffic, which would not cause one server to receive significantly more traffic than others; instead, traffic would be distributed only among healthy targets.

Practice this question →

231

MCQmedium

A company runs SAP HANA on EC2 with EBS io1 volumes. The administrator notices that the disk queue depth is consistently high during peak hours, causing increased latency. The volume is 2 TB with 5000 provisioned IOPS. The instance is an r5.4xlarge with EBS bandwidth of 4750 Mbps. The database workload is write-intensive. The administrator wants to reduce latency without increasing costs significantly. Which action should the administrator take?

A.Increase the provisioned IOPS to 10,000

B.Enable EBS Multi-Attach and use multiple instances to share the volume

C.Change the volume type to gp3 with 5000 IOPS

D.Upgrade the EC2 instance to an r5.8xlarge

AnswerA

Higher IOPS reduces queue depth and latency.

Why this answer

Increasing the provisioned IOPS to 10,000 directly addresses the high disk queue depth by allowing more I/O operations to be processed concurrently, thereby reducing latency. Option B is incorrect because EBS Multi-Attach is used to attach a volume to multiple EC2 instances simultaneously, but it does not improve queue depth or latency for a single instance write-intensive workload. Option C is incorrect because changing to gp3 with the same 5000 IOPS does not provide any performance improvement; gp3 has a baseline of 3000 IOPS and relies on burst credits, which is not suitable for sustained high write demands.

Option D is incorrect because upgrading to an r5.8xlarge increases network and EBS bandwidth but does not increase the provisioned IOPS, so it does not resolve the queue depth issue and adds unnecessary cost.

Practice this question →

232

MCQhard

An SAP on AWS environment is experiencing intermittent connectivity issues between the SAP application servers and the SAP HANA database. Both are in the same VPC but in different Availability Zones. The network team has confirmed that the security groups allow traffic on the required ports. What is a likely cause of the issue?

A.AWS Shield Advanced is blocking legitimate traffic.

B.Network ACLs are misconfigured, blocking return traffic.

C.VPC Flow Logs are enabled and dropping packets.

D.The VPC is using AWS Direct Connect, which adds latency.

AnswerB

Network ACLs are stateless, so even when security groups permit outbound traffic from application servers to the HANA database, a misconfigured inbound rule on the ACL for the database subnet can block ephemeral return traffic, causing intermittent connectivity. This satisfies the constraint that both instances reside in different Availability Zones, where ACLs operate at the subnet boundary.

Why this answer

Network ACLs are stateless, meaning they evaluate inbound and outbound traffic separately. Even if inbound rules allow traffic from the SAP application servers to the HANA database, the outbound rules on the database subnet's NACL must explicitly allow the return traffic (ephemeral ports) back to the application servers. Misconfigured outbound rules in the NACL can drop the response packets, causing intermittent connectivity issues between the application and database tiers across Availability Zones.

Exam trap

The trap here is that candidates often assume security groups (which are stateful) are the only firewall layer, forgetting that Network ACLs are stateless and require explicit outbound rules for return traffic, especially when traffic crosses Availability Zones.

How to eliminate wrong answers

Option A is wrong because AWS Shield Advanced is a DDoS protection service that does not block legitimate traffic based on application-layer rules; it only mitigates volumetric attacks and requires explicit configuration to filter traffic. Option C is wrong because VPC Flow Logs are a monitoring feature that captures metadata about IP traffic; they do not drop or block packets. Option D is wrong because AWS Direct Connect provides a dedicated network connection that reduces latency compared to the public internet; it does not add latency and is not the cause of intermittent connectivity within the same VPC.

Practice this question →

233

MCQmedium

An SAP system on AWS uses an Application Load Balancer (ALB) to distribute traffic to multiple SAP Web Dispatchers. The system is experiencing intermittent session drops. What is the most likely cause?

A.The ALB is not configured for sticky sessions.

B.The ALB deletion protection is enabled.

C.The ALB health check interval is too short.

D.Cross-zone load balancing is not enabled on the ALB.

AnswerA

Without sticky sessions, subsequent requests may go to different Web Dispatchers, breaking session state.

Why this answer

The ALB operates at Layer 7 and, by default, distributes each request independently across healthy targets. SAP Web Dispatchers maintain user session state (e.g., logon tickets, application context) locally. Without sticky sessions (session affinity) enabled on the ALB, subsequent requests from the same user can be routed to a different Web Dispatcher, causing the new dispatcher to lack the session context and dropping the user's session.

Enabling stickiness based on the ALB-generated cookie ensures all requests from a session are sent to the same Web Dispatcher, preventing these intermittent drops.

Exam trap

The trap here is that candidates often confuse health check intervals or cross-zone load balancing with session persistence, assuming that any routing issue must be caused by target availability or distribution, rather than recognizing that the ALB's default stateless behavior is the root cause of session drops in stateful SAP Web Dispatcher deployments.

How to eliminate wrong answers

Option B is wrong because deletion protection only prevents accidental deletion of the ALB itself; it has no effect on traffic routing or session persistence. Option C is wrong because a health check interval that is too short would cause the ALB to mark targets as unhealthy more aggressively, potentially removing them from rotation, but it would not cause intermittent session drops for requests that reach a healthy target; the described symptom is session affinity loss, not target availability. Option D is wrong because cross-zone load balancing distributes traffic evenly across targets in all Availability Zones, which improves utilization but does not affect session stickiness; without sticky sessions, requests can still be routed to different targets regardless of cross-zone settings.

Practice this question →

234

MCQmedium

An SAP administrator notices that the SAP application server on AWS is experiencing high latency when connecting to the SAP HANA database. The database is on a separate EC2 instance in the same VPC. What is the MOST likely cause?

A.Enhanced Networking is not enabled on the EC2 instances.

B.EBS optimization is not enabled on the application server.

C.The HANA database is using a public IP address.

D.The instances are not in a placement group.

AnswerA

Enhanced Networking reduces latency and packet drops.

Why this answer

High latency between an SAP application server and a SAP HANA database in the same VPC is most likely caused by Enhanced Networking not being enabled on the EC2 instances. Enhanced Networking uses the Elastic Network Adapter (ENA) to provide higher bandwidth, higher packet-per-second performance, and consistently lower inter-instance latencies. Without it, network traffic is handled by the Xen or Nitro hypervisor's default driver, which introduces additional overhead and latency, especially under the high-throughput, low-latency requirements of SAP HANA communication.

Exam trap

The trap here is that candidates often confuse EBS optimization (storage I/O) with network performance, or assume that being in the same VPC automatically guarantees low latency, overlooking that Enhanced Networking is a required feature for high-performance workloads like SAP HANA.

How to eliminate wrong answers

Option B is wrong because EBS optimization affects storage I/O performance between the EC2 instance and its attached EBS volumes, not network latency between two EC2 instances. Option C is wrong because using a public IP address would introduce additional routing through the internet gateway and potential NAT overhead, but the question states both instances are in the same VPC, so traffic would still use the local VPC routing unless explicitly configured otherwise; the most likely cause is a missing network performance feature, not a public IP. Option D is wrong because placement groups reduce network latency by ensuring instances are in close physical proximity, but they are not required for low-latency communication; Enhanced Networking is a prerequisite for achieving the lowest latency even within a placement group.

Practice this question →

235

Multi-Selecteasy

A company is migrating its SAP ERP system from an on-premises environment to AWS. The database is SAP HANA. The migration must minimize downtime. Which TWO approaches should the company consider?

Select 2 answers

A.Use AWS Database Migration Service (DMS) with full load only.

B.Use VM Import/Export to migrate the entire on-premises virtual machine to AWS.

C.Use the SAP Software Provisioning Manager (SWPM) to perform a homogeneous system copy over the network.

D.Use AWS DMS with full load and ongoing change data capture (CDC).

E.Set up SAP HANA System Replication from the on-premises HANA database to AWS HANA.

AnswersD, E

CDC keeps the target updated with minimal downtime.

Why this answer

AWS DMS with full load and ongoing change data capture (CDC) enables a near-zero-downtime migration by continuously replicating changes from the source SAP HANA database to the target on AWS after the initial full load, allowing the cutover to occur with minimal disruption. Option E is correct because SAP HANA System Replication provides a native, asynchronous or synchronous replication mechanism that can be configured between the on-premises HANA database and an AWS-hosted HANA instance, supporting a controlled switchover with very low downtime.

Exam trap

The trap here is that candidates often overlook the native SAP HANA System Replication option (E) because they assume only AWS-native services like DMS are valid, or they mistakenly believe that VM Import/Export (B) can achieve minimal downtime without understanding the need for ongoing replication.

Practice this question →

236

MCQeasy

A company is planning to run SAP S/4HANA on AWS. They need to ensure that the SAP system can be accessed from the corporate network via a secure VPN connection. Which AWS service should be used to establish this connectivity?

A.AWS Client VPN

B.AWS Transit Gateway

C.AWS Site-to-Site VPN

D.AWS Direct Connect

AnswerC

Provides secure IPsec VPN between corporate network and AWS VPC.

Why this answer

AWS Site-to-Site VPN creates a secure IPsec tunnel between the corporate network's on-premises VPN device and a Virtual Private Gateway (VGW) attached to the VPC hosting the SAP S/4HANA system. This enables encrypted communication over the public internet, meeting the requirement for secure VPN connectivity from the corporate network to the SAP workload.

Exam trap

The trap here is that candidates confuse AWS Client VPN (remote access for individual users) with Site-to-Site VPN (network-to-network connectivity), or assume Transit Gateway alone provides VPN connectivity without understanding it requires a VPN attachment.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is a managed remote-access VPN service that connects individual clients (e.g., laptops) to AWS, not a site-to-site connection between a corporate network and AWS. Option B is wrong because AWS Transit Gateway is a network transit hub that interconnects VPCs and on-premises networks, but it does not itself establish a VPN connection; it requires a VPN attachment (e.g., Site-to-Site VPN) to connect to the corporate network. Option D is wrong because AWS Direct Connect provides a dedicated private physical connection, not a VPN over the internet, and does not use IPsec encryption by default; it is a separate service for dedicated bandwidth and lower latency, not a VPN solution.

Practice this question →

237

MCQmedium

A company is deploying a new SAP HANA database on AWS and needs to ensure the EBS volumes are optimized for throughput. Which EBS volume type should be used for the HANA data and log volumes?

A.sc1

B.io2 Block Express

C.gp3

D.st1

AnswerB

io2 Block Express offers high performance and is certified for SAP HANA.

Why this answer

For SAP HANA data and log volumes, io2 Block Express (option B) is the correct choice because it provides the highest throughput and IOPS consistency required for SAP HANA's demanding workload. io2 Block Express supports up to 256,000 IOPS and 4,000 MB/s throughput per volume, with 99.999% durability, making it ideal for mission-critical SAP HANA databases on AWS.

Exam trap

The trap here is that candidates may choose gp3 (option C) because it is a general-purpose SSD that can be provisioned with higher IOPS, but they overlook that SAP HANA specifically requires the ultra-low latency and high throughput consistency of io2 Block Express for log volumes, and that gp3's maximum IOPS and throughput are insufficient for large-scale SAP HANA deployments.

How to eliminate wrong answers

Option A (sc1) is wrong because sc1 is a cold HDD volume type designed for infrequently accessed, throughput-oriented workloads with low cost, but it cannot meet the high IOPS and low latency requirements of SAP HANA. Option C (gp3) is wrong because while gp3 offers balanced performance and can be used for some SAP workloads, it does not provide the consistent sub-millisecond latency and high throughput needed for SAP HANA log volumes, and its maximum IOPS (16,000) is significantly lower than io2 Block Express. Option D (st1) is wrong because st1 is a throughput-optimized HDD volume type intended for big data and log processing, but it has burstable performance and cannot sustain the high IOPS and low latency required for SAP HANA data and log volumes.

Practice this question →

238

Multi-Selectmedium

Which TWO of the following are required for SAP HANA high availability on AWS using HANA System Replication (HSR) with automatic failover? (Select TWO.)

Select 2 answers

A.Application Auto Scaling to automatically scale HANA instances.

B.An Amazon Route 53 health check that monitors the primary instance and updates a DNS record to the secondary IP on failure.

C.An Elastic Load Balancer (ELB) in front of the HANA instances to distribute traffic.

D.Placement of primary and secondary HANA instances in different Availability Zones.

E.An Amazon Route 53 alias record pointing to the primary instance's private IP.

AnswersB, D

Route 53 health checks can be used to update DNS for automatic failover.

Why this answer

Amazon Route 53 health checks can monitor the primary HANA instance's availability. On failure, a Route 53 failover routing policy automatically updates the DNS record to point to the secondary instance's private IP, enabling clients to reconnect without manual intervention. This is a key component of HANA System Replication (HSR) with automatic failover on AWS.

Exam trap

The trap here is that candidates often confuse load balancers (ELB) with DNS-based failover, but ELBs are stateless and cannot handle HANA's direct client connections or replication state, making Route 53 health checks with failover routing the correct choice for HSR automatic failover.

Practice this question →

239

MCQmedium

A company is running SAP on AWS and wants to ensure high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which architecture meets this requirement?

A.Deploy ASCS and ERS on the same EC2 instance with S3 replication.

B.Configure Route 53 health checks to switch between two instances in the same AZ.

C.Deploy ASCS and ERS on separate EC2 instances in different Availability Zones, with a Network Load Balancer.

D.Use a single EC2 instance with an S3 bucket for shared storage and Lambda for failover.

AnswerC

Multi-AZ with separate instances and NLB ensures HA.

Why this answer

SAP Central Services (ASCS) and Enqueue Replication Server (ERS) must run on separate EC2 instances in different Availability Zones to achieve high availability. A Network Load Balancer (NLB) is used to distribute traffic and provide a single endpoint, while the enqueue replication mechanism (enrep) synchronizes the lock table between the two instances, enabling automatic failover without data loss.

Exam trap

The trap here is that candidates often assume ASCS and ERS can be co-located on the same instance or in the same AZ for simplicity, but the PAS-C01 exam explicitly tests the requirement for separate instances in different AZs with an NLB to meet SAP's HA architecture for critical services.

How to eliminate wrong answers

Option A is wrong because deploying ASCS and ERS on the same EC2 instance creates a single point of failure; S3 replication does not provide the low-latency shared storage or enqueue replication required for SAP HA. Option B is wrong because placing both instances in the same Availability Zone does not protect against AZ-level failures, and Route 53 health checks alone cannot handle the rapid, stateful failover required for SAP enqueue replication. Option D is wrong because a single EC2 instance is a single point of failure, S3 is not a supported shared filesystem for SAP (it lacks POSIX semantics and low latency), and Lambda cannot perform the real-time enqueue replication or orchestrate the failover of SAP Central Services.

Practice this question →

240

MCQhard

A company is running SAP HANA on AWS using a scale-out architecture with multiple worker nodes. The system is used for real-time analytics. Recently, query performance has degraded. The HANA administrator notices that the data is not evenly distributed across nodes. What is the best course of action?

A.Redistribute the tables across nodes using HANA's table partitioning features.

B.Increase the memory allocation for the HANA database.

C.Add more worker nodes to the scale-out cluster to distribute the load.

D.Upgrade the EC2 instance type of all nodes to a memory-optimized type.

AnswerA

Partitioning and redistribution ensures even data distribution.

Why this answer

SAP HANA's table partitioning features allow you to redistribute data across worker nodes in a scale-out architecture, addressing the root cause of uneven data distribution. This rebalancing improves query performance by ensuring parallel processing and minimizing data movement between nodes. The HANA administrator can use commands like ALTER TABLE ...

REBALANCE or partition management to achieve even distribution.

Exam trap

The trap here is that candidates often confuse scaling up (increasing resources) or scaling out (adding nodes) with the need to rebalance existing data, assuming that more capacity alone will fix performance degradation caused by data skew.

How to eliminate wrong answers

Option B is wrong because increasing memory allocation does not fix uneven data distribution; it only addresses memory pressure, not the logical imbalance of data across nodes. Option C is wrong because adding more worker nodes without redistributing existing data will not solve the uneven distribution; new nodes would remain underutilized while overloaded nodes continue to degrade performance. Option D is wrong because upgrading EC2 instance types to memory-optimized instances improves per-node capacity but does not redistribute data; the underlying skew remains, and query performance will still suffer due to uneven load.

Practice this question →

241

MCQhard

An SAP Basis team is designing a high-availability (HA) setup for SAP NetWeaver on AWS. They plan to use a shared file system for transport directories. Which storage solution provides the most cost-effective NFS share with support for automatic failover across Availability Zones?

A.Amazon Elastic File System (EFS)

B.Amazon EBS Multi-Attach gp3 volume

C.Amazon FSx for NetApp ONTAP

D.Amazon S3 with AWS Storage Gateway file gateway

AnswerC

FSx for NetApp ONTAP provides a fully managed NFS share with cross-AZ HA, suitable for SAP transport directories.

Why this answer

Amazon FSx for NetApp ONTAP is the correct choice because it provides a fully managed, highly available NFS share that supports automatic failover across Availability Zones (AZs) using NetApp's SnapMirror and multi-AZ HA pair architecture. It is the most cost-effective solution for SAP transport directories that require a shared file system with cross-AZ failover, as it offers native NFSv3/v4.1 support, consistent performance, and lower total cost of ownership compared to alternatives for this specific SAP workload.

Exam trap

The trap here is that candidates often assume Amazon EFS is the default choice for any NFS workload on AWS due to its simplicity and regional failover, but they overlook that FSx for NetApp ONTAP is specifically optimized for SAP workloads with better cost efficiency and performance consistency for transport directories, making it the correct answer in this context.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a regional NFS service that provides automatic failover across AZs, but it is not the most cost-effective for SAP transport directories due to higher per-GB storage costs and potential performance inconsistencies under high I/O workloads typical of SAP. Option B is wrong because Amazon EBS Multi-Attach gp3 volumes cannot span across Availability Zones; they are limited to a single AZ and do not support automatic failover across AZs, making them unsuitable for HA across AZs. Option D is wrong because Amazon S3 with AWS Storage Gateway file gateway does not provide native NFS failover across AZs; it relies on a single file gateway appliance in one AZ, and while S3 is durable, the gateway itself is a single point of failure without built-in automatic cross-AZ failover for NFS.

Practice this question →

242

MCQeasy

An SAP system administrator needs to ensure that all SAP application logs are centrally collected and monitored for errors. Which AWS service should they use to aggregate logs from multiple EC2 instances?

A.Amazon S3 with server access logs

B.Amazon Kinesis Data Firehose

C.Amazon CloudWatch Logs

D.AWS Lambda to process logs from each instance

AnswerC

CloudWatch Logs with the unified CloudWatch agent can collect and aggregate logs from multiple EC2 instances.

Why this answer

Amazon CloudWatch Logs is the correct service because it provides a centralized, agent-based log aggregation solution. The CloudWatch Logs agent (or unified CloudWatch agent) can be installed on each EC2 instance to automatically collect, encrypt, and stream SAP application logs to a central CloudWatch Logs group. This allows the administrator to monitor logs in real time, set metric filters for error patterns, and trigger alarms without needing to build custom infrastructure.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose as a direct log collector, but it requires a separate data producer and is not an agent-based aggregation service like CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with server access logs only captures HTTP requests made to the S3 bucket itself, not application logs from EC2 instances. Option B is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service that requires a separate producer (e.g., a CloudWatch Logs subscription filter or a custom agent) to send logs; it does not natively collect logs from EC2 instances without additional setup. Option D is wrong because AWS Lambda is a serverless compute service that can process logs but cannot directly aggregate them from multiple EC2 instances; it would need to be triggered by another service (like CloudWatch Logs or S3) and is not designed for continuous log collection.

Practice this question →

243

MCQeasy

A company wants to implement a backup strategy for SAP HANA on AWS. The backup must be stored securely and be accessible for restore to a different AWS Region. Which combination of AWS services should be used?

A.Take EBS snapshots and copy them to another region

B.Use AWS Backup with cross-region backup copy

C.Store HANA backups in Amazon S3 Standard-IA

D.Use Amazon S3 Glacier Deep Archive

AnswerB

AWS Backup supports cross-region copies and is integrated with HANA.

Why this answer

AWS Backup with cross-region backup copy is the correct choice because it provides a fully managed, policy-driven backup service that natively supports SAP HANA on Amazon EC2, including automated cross-region copy for disaster recovery. This ensures backups are stored securely (encrypted at rest and in transit) and can be restored in a different AWS Region without manual intervention.

Exam trap

The trap here is that candidates often assume EBS snapshots (Option A) are sufficient for database backups, overlooking the need for application-consistent backups and the managed cross-region replication that AWS Backup provides.

How to eliminate wrong answers

Option A is wrong because EBS snapshots alone do not provide application-consistent backups for SAP HANA; they capture only the block-level state of the volume, which can lead to data corruption if the database is not quiesced. Option C is wrong because storing HANA backups directly in Amazon S3 Standard-IA does not include built-in cross-region copy capabilities, requiring additional custom scripting and infrastructure to replicate backups to another region. Option D is wrong because Amazon S3 Glacier Deep Archive is designed for long-term archival with retrieval times of 12 hours or more, making it unsuitable for operational backups that need to be accessible for restore to a different region within acceptable recovery time objectives (RTOs).

Practice this question →

244

MCQeasy

An SAP administrator runs the df command on an SAP HANA server and sees the output above. The /hana/data filesystem is 96% full. Which action should be taken to prevent the database from running out of space?

A.Increase the IOPS of the EBS volume

B.Delete old database logs to free up space

C.Increase the size of the EBS volume and extend the filesystem

D.Migrate the database to a larger instance type

AnswerC

This is the standard procedure to add more disk space.

Why this answer

The correct action is to increase the size of the EBS volume and extend the filesystem because the /hana/data filesystem is 96% full, and SAP HANA requires sufficient free space for data growth and savepoint operations. Simply increasing the EBS volume size without extending the filesystem (e.g., using resize2fs or xfs_growfs) would not make the additional space available to the operating system. This approach directly addresses the capacity issue without unnecessary changes to performance or instance type.

Exam trap

A common misconception in the AWS SAP on AWS Specialty exam is that modifying performance parameters like IOPS or changing the instance type can resolve storage capacity issues. In reality, only resizing the underlying EBS volume and extending the filesystem (e.g., with xfs_growfs or resize2fs) directly addresses a full filesystem on /hana/data.

How to eliminate wrong answers

Option A is wrong because increasing IOPS addresses performance (throughput/latency), not storage capacity; the problem is space exhaustion, not I/O performance. Option B is wrong because deleting old database logs frees space on the /hana/log filesystem, not /hana/data; SAP HANA data files contain persistent data, not logs, and log deletion does not recover data volume space. Option D is wrong because migrating to a larger instance type increases compute and memory resources but does not change the size of the attached EBS volumes; the /hana/data filesystem would remain at the same capacity.

Practice this question →

245

MCQmedium

A company is running SAP NetWeaver on AWS and wants to implement a high-availability solution for the SAP Central Services (ASCS). Which AWS service can be used to manage the virtual IP address for failover?

A.Amazon Route 53 with failover routing

B.AWS Global Accelerator

C.Elastic Load Balancer (ELB)

D.Elastic IP address reassignment

AnswerA

Route 53 failover routing can redirect clients to the secondary ASCS.

Why this answer

Amazon Route 53 with failover routing is the correct choice because it can manage a virtual IP address (VIP) for SAP Central Services (ASCS) failover by using DNS health checks to detect ASCS failure and automatically update the DNS record to point to the healthy secondary instance. This aligns with the SAP on AWS high-availability pattern where a DNS-based VIP is preferred over traditional floating IPs, as AWS does not support layer 2 VIP failover across Availability Zones.

Exam trap

The trap here is that candidates often assume a floating IP (Elastic IP) or a load balancer is required for SAP ASCS VIP failover, but AWS DNS-based failover with Route 53 is the recommended and supported method for SAP on AWS, avoiding the limitations of layer 2 networking in the cloud.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator provides static anycast IP addresses for traffic routing and does not support the granular health-check-driven DNS failover needed for SAP ASCS VIP management; it is designed for global traffic optimization, not for single-region SAP failover. Option C is wrong because Elastic Load Balancer (ELB) operates at layer 4/7 and cannot be used to assign a virtual IP address directly to an ASCS instance; it distributes traffic across targets but does not provide a static VIP that the SAP application can bind to for failover. Option D is wrong because Elastic IP address reassignment requires manual intervention or custom scripting to detect failure and reassign the IP, and it does not provide automated health-check-based failover; additionally, Elastic IPs cannot be shared between instances in different Availability Zones for seamless failover without downtime.

Practice this question →

246

MCQhard

An SAP environment on AWS uses a shared /sapmnt file system via Amazon EFS. The company wants to encrypt data at rest for the entire stack. Which services require separate encryption configurations?

A.EBS volumes and EFS file system

B.Application Load Balancer and EFS

C.EFS file system and S3 bucket

D.CloudWatch Logs and EBS volumes

AnswerA

Both require separate encryption enablement.

Why this answer

Amazon EBS volumes and Amazon EFS file systems each require separate encryption configurations because they use distinct encryption mechanisms. EBS uses AWS KMS keys per volume at the block level, while EFS uses a different KMS key configuration at the file system level. Both must be explicitly enabled to achieve full at-rest encryption for the SAP stack.

Exam trap

The trap here is that candidates assume a single encryption setting (like enabling EBS default encryption) covers all storage services, but AWS requires separate encryption configurations for each service (EBS, EFS, S3, etc.) because they use independent encryption mechanisms and KMS key policies.

How to eliminate wrong answers

Option B is wrong because Application Load Balancer does not store data at rest; it only processes traffic in transit, so it does not require encryption configuration for data at rest. Option C is wrong because while EFS does require encryption configuration, the S3 bucket is not part of the shared /sapmnt file system described in the scenario; S3 encryption is separate and not required for this specific stack. Option D is wrong because CloudWatch Logs are encrypted by default using AWS service keys and do not require separate customer-managed encryption configuration for this scenario, and EBS volumes do require encryption but the pairing is incorrect.

Practice this question →

247

MCQeasy

A company is planning to migrate its SAP HANA workload to AWS. The system requires high network throughput and low latency between application and database servers. Which AWS networking feature should be used to meet these requirements?

A.Create a VPC Peering connection between the application and database subnets.

B.Use Elastic Fabric Adapter (EFA) for network connectivity.

C.Use Enhanced Networking on all instances.

D.Place the instances in a Cluster Placement Group.

AnswerD

A Cluster Placement Group places instances within a single Availability Zone, ensuring low-latency, non-blocking 10 Gbps or 25 Gbps network connectivity between SAP HANA application and database servers. This satisfies the requirement for high throughput and low latency by minimising physical distance and network hops, unlike spread or partition groups which prioritise fault isolation over performance.

Why this answer

A Cluster Placement Group (CPG) is a logical grouping of instances within a single Availability Zone that provides low-latency, high-throughput network connectivity by placing them in close physical proximity. For SAP HANA workloads requiring consistent high network throughput and low latency between application and database servers, a CPG ensures that all instances are co-located, minimizing network hops and jitter. This is the correct choice because it directly addresses the need for low-latency, high-bandwidth communication between tightly coupled components.

Exam trap

The trap here is that candidates often confuse Enhanced Networking (which improves individual instance performance) with the co-location benefits of a Cluster Placement Group, failing to recognize that low latency between instances requires physical proximity, not just faster virtualized networking.

How to eliminate wrong answers

Option A is wrong because VPC Peering connects separate VPCs but does not provide any special performance guarantees; it relies on the standard AWS network infrastructure and does not reduce latency or increase throughput between subnets within the same VPC. Option B is wrong because Elastic Fabric Adapter (EFA) is designed for tightly coupled HPC/ML workloads using MPI or NCCL, not for standard SAP HANA traffic, and it requires special OS and application support that SAP does not provide. Option C is wrong because Enhanced Networking (using SR-IOV) improves network performance by providing higher bandwidth and lower jitter compared to traditional virtualized networking, but it does not guarantee the low-latency, high-throughput co-location that a Cluster Placement Group offers; it is a prerequisite but not sufficient alone.

Practice this question →

248

MCQeasy

An SAP administrator needs to integrate SAP S/4HANA with Amazon S3 for archival purposes. Which AWS service should be used to enable secure and efficient data transfer from SAP to S3?

A.Amazon Kinesis

B.Amazon Athena

C.AWS Glue

D.AWS DataSync

AnswerD

DataSync is optimized for data transfers to S3.

Why this answer

AWS DataSync is the correct choice because it is purpose-built for efficiently and securely transferring large volumes of data from on-premises or SAP systems to Amazon S3. It automates the transfer process, supports encryption in transit (TLS) and at rest, and can handle the high-throughput requirements of SAP S/4HANA archival jobs without requiring custom scripting or complex network configurations.

Exam trap

The trap here is that candidates often confuse AWS DataSync with AWS Glue or Amazon Kinesis, mistakenly thinking that any data movement to S3 requires an ETL or streaming service, rather than recognizing DataSync as the dedicated, high-performance transfer service for large-scale batch workloads like SAP archiving.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis is a real-time data streaming service designed for ingesting and processing streaming data (e.g., clickstreams, logs), not for batch archival transfers from SAP S/4HANA to S3. Option B is wrong because Amazon Athena is an interactive query service for analyzing data directly in S3 using SQL, not a data transfer or integration tool. Option C is wrong because AWS Glue is a serverless data integration and ETL service primarily used for preparing and transforming data for analytics, not for direct, efficient bulk data movement from SAP to S3.

Practice this question →

249

Multi-Selecthard

Which THREE of the following are valid considerations when designing a SAP landscape on AWS?

Select 3 answers

A.The EBS volumes for HANA data and logs must be provisioned with the correct IOPS and throughput.

B.AWS Managed Services (AMS) is mandatory for running SAP on AWS.

C.The SAPRouter must be configured to allow SAP support access to the AWS environment.

D.An AWS Support plan that includes SAP support is required to get SAP support for AWS-related issues.

E.All SAP instances must be launched in a cluster placement group.

AnswersA, C, D

IOPS and throughput are critical for HANA performance.

Why this answer

SAP HANA is extremely sensitive to storage performance; EBS volumes for HANA data and log must be provisioned with sufficient IOPS and throughput to meet SAP's documented sizing guidelines. Inadequate IOPS can cause HANA to abort transactions or crash, and AWS allows you to use Provisioned IOPS (io1/io2) or gp3 volumes with custom IOPS and throughput settings to meet these requirements.

Exam trap

The trap here is that candidates often assume AWS Managed Services (AMS) is required for SAP on AWS because of the complexity, but AWS explicitly allows self-managed SAP deployments, and the exam tests knowledge of optional vs. mandatory services.

Practice this question →

250

MCQhard

A company is migrating an SAP HANA system from on-premises to AWS. The database size is 3 TB, and the network bandwidth to AWS is 1 Gbps. The migration window is limited to 48 hours. What is the most efficient migration strategy?

A.Set up an AWS Direct Connect connection and use HANA backup and restore

B.Use AWS Database Migration Service (DMS) for continuous replication

C.Use AWS Snowball Edge to transfer the HANA backup

D.Upload the HANA backup to Amazon S3 using multipart upload

AnswerC

Snowball Edge can transfer data offline at high speed.

Why this answer

The 3 TB database size and 1 Gbps bandwidth would require approximately 7 hours for data transfer alone, but the 48-hour migration window includes backup, transfer, and restore time. AWS Snowball Edge provides a petabyte-scale physical data transport solution that bypasses network constraints entirely, making it the most efficient strategy for transferring a 3 TB HANA backup within the limited window. Snowball Edge supports direct integration with SAP HANA backup workflows via NFS or S3-compatible endpoints, ensuring minimal migration time.

Exam trap

The trap here is that candidates often overestimate network transfer speeds and underestimate the total time required for backup, transfer, and restore, leading them to choose Direct Connect or S3 multipart upload without considering the physical data transport option for large datasets.

How to eliminate wrong answers

Option A is wrong because setting up AWS Direct Connect with 1 Gbps bandwidth would require over 6.7 hours for the raw data transfer (3 TB at 1 Gbps), but this does not account for backup creation, restore time, and potential network congestion, making it infeasible within a 48-hour window when considering end-to-end migration steps. Option B is wrong because AWS DMS is designed for continuous replication of transactional databases, not for large-scale backup and restore of SAP HANA systems; DMS does not support SAP HANA as a source for full database migration and cannot handle the 3 TB initial load efficiently within the time constraint. Option D is wrong because uploading a 3 TB HANA backup to Amazon S3 using multipart upload over a 1 Gbps link would still take approximately 7 hours for transfer alone, plus the time to create the backup and restore it on AWS, exceeding the 48-hour window when factoring in all steps and potential retries.

Practice this question →

251

Multi-Selectmedium

Which TWO AWS services can be used to monitor SAP HANA database performance in real time? (Select TWO.)

Select 2 answers

A.AWS Systems Manager

B.AWS CloudTrail

C.AWS Trusted Advisor

D.Amazon CloudWatch

E.AWS Config

AnswersA, D

Systems Manager can run scripts and collect performance data.

Why this answer

AWS Systems Manager is correct because it provides the capability to run SAP-specific commands and scripts on EC2 instances via Run Command or State Manager, enabling real-time monitoring of SAP HANA database performance metrics such as memory usage, CPU load, and SQL query execution. It integrates with SAP HANA's built-in monitoring tools (e.g., SAP HANA Studio or SAP HANA Cockpit) to collect and report performance data without requiring additional agents. Amazon CloudWatch is also correct because it can collect and track metrics from SAP HANA by using the CloudWatch agent or custom metrics, allowing real-time monitoring of key performance indicators like CPU utilization, memory consumption, and disk I/O.

CloudWatch integrates with SAP HANA via the SAP HANA CloudWatch connector or custom scripts, providing dashboards and alarms for proactive monitoring.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logs) or AWS Config (configuration tracking) with real-time performance monitoring, overlooking that Systems Manager and CloudWatch are the only services that can directly interact with SAP HANA's runtime metrics.

Practice this question →

252

MCQmedium

A company is designing a disaster recovery (DR) strategy for SAP S/4HANA on AWS. The primary site is in us-east-1. They want a secondary site in us-west-2 with a Recovery Point Objective (RPO) of 15 minutes and Recovery Time Objective (RTO) of 2 hours. Which solution meets these requirements with the LEAST operational overhead?

A.Take hourly backups to S3 and restore in us-west-2 when needed.

B.Use HANA System Replication to us-west-2 with manual failover.

C.Use HANA System Replication in async mode to us-west-2.

D.Use HANA System Replication in sync mode with automatic failover to us-west-2.

AnswerC

Correct. Asynchronous HANA System Replication with automatic failover provides a balance between data loss (within RPO) and performance, and automated failover meets RTO with low operational overhead.

Why this answer

HANA System Replication in asynchronous mode can meet the 15-minute RPO and 2-hour RTO requirements when combined with automatic failover. Asynchronous replication is recommended for cross-region DR on AWS to avoid performance impact from latency, and automatic failover minimizes operational overhead. Option D is not recommended because synchronous replication over long distances introduces latency that can degrade primary site performance and may not be feasible for cross-region scenarios.

Exam trap

Candidates often choose synchronous mode because it offers zero data loss, but they overlook the latency impact of cross-region replication. Asynchronous mode with automatic failover is sufficient for the given RPO/RTO and has lower operational overhead.

How to eliminate wrong answers

Option A is wrong because hourly backups to S3 cannot achieve a 15-minute RPO (backups are taken only once per hour) and restoring from S3 would take significantly longer than 2 hours, failing both RPO and RTO. Option B is wrong because HANA System Replication with manual failover introduces human intervention, which typically exceeds the 2-hour RTO due to detection and execution delays, and does not meet the 'least operational overhead' requirement. Option C is wrong because HANA System Replication in async mode can achieve a 15-minute RPO but may lose data during a failover if the primary fails before the last asynchronous replication completes; however, the primary issue is that it does not include automatic failover, so recovery still requires manual steps, increasing operational overhead and potentially exceeding the 2-hour RTO.

Practice this question →

253

MCQmedium

A company has deployed an SAP HANA database on AWS using a single EC2 instance with EBS volumes. The database is used for a critical SAP system. The company needs to ensure that the database can be restored to a point in time within the last 24 hours with minimal data loss. The administrator currently takes nightly EBS snapshots of the data and log volumes. However, recent tests show that recovery to a specific point in time (e.g., one hour ago) is not possible because the log volume is not backed up frequently enough. The administrator must implement a solution that allows point-in-time recovery with a recovery point objective (RPO) of 15 minutes. Which solution should the administrator implement?

A.Create EBS snapshots of the log volume every 15 minutes using a cron job

B.Use Amazon Data Lifecycle Manager (DLM) to schedule snapshots of the log volume every 15 minutes

C.Configure SAP HANA Backint agent to back up log files to Amazon S3 every 15 minutes

D.Enable EBS Multi-Attach on the log volume and attach it to a second instance to replicate logs

AnswerC

Correct. SAP HANA Backint to S3 allows frequent log backups (every 15 minutes), enabling point-in-time recovery with an RPO of 15 minutes. This is the recommended approach.

Why this answer

SAP HANA Backint enables log backups to Amazon S3 at frequent intervals (e.g., 15 minutes), allowing point-in-time recovery with minimal data loss. This is the native SAP HANA method for log backup and is efficient for achieving a 15-minute RPO. Option A is incorrect because EBS snapshots of the log volume every 15 minutes would be costly, cause I/O spikes, and are not recommended for frequent log backups.

Option B is incorrect because Amazon DLM automates EBS snapshots but still suffers from the same cost and performance issues as option A. Option D is incorrect because Multi-Attach does not address backup and replication of logs does not provide a usable backup for point-in-time recovery.

Exam trap

Candidates often confuse EBS snapshot automation (DLM) with SAP-native backup methods. The key is that SAP HANA requires log backups via Backint or similar to achieve frequent point-in-time recovery, not just volume snapshots.

Practice this question →

254

Multi-Selecteasy

Which TWO of the following are best practices for running SAP HANA on AWS? (Choose 2)

Select 2 answers

A.Stop HANA instances when not in use to save costs

B.Use general-purpose instances (e.g., t3) to reduce costs

C.Use separate EBS volumes for HANA data and log files

D.Use EBS-optimized instances for dedicated EBS bandwidth

E.Launch all HANA instances in a single placement group

AnswersC, D

Avoids I/O contention.

Why this answer

SAP HANA requires separate EBS volumes for data and log files to ensure I/O isolation and meet performance requirements. Data and log volumes have different I/O patterns (sequential for logs, random for data), and using separate volumes prevents contention, which is critical for HANA's high-throughput demands.

Exam trap

The trap here is that candidates may think stopping HANA instances saves costs (Option A) without realizing that HANA is an in-memory database that must remain running to preserve data, and that AWS charges for storage even when instances are stopped, making this a false economy for production systems.

Practice this question →

255

Multi-Selecthard

Which THREE considerations are important when designing a disaster recovery (DR) strategy for SAP on AWS?

Select 3 answers

A.Use EBS snapshots in the same Region for recovery

B.Copy Amazon Machine Images (AMIs) to the DR Region

C.Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO)

D.Use cross-Region replication for SAP HANA database backups

E.Deploy all SAP resources in a single AWS Region

AnswersB, C, D

Pre-built AMIs allow quick instance launch in DR.

Why this answer

Amazon Machine Images (AMIs) must be copied to the DR Region to ensure that the exact EC2 instance configuration, including the operating system, SAP application binaries, and any custom patches, is available for recovery. Without copying AMIs, you cannot launch identical instances in the DR Region, which is essential for a consistent SAP environment.

Exam trap

The trap here is that candidates often assume EBS snapshots in the same Region are sufficient for DR, but they fail to recognize that true DR requires cross-Region replication of both AMIs and database backups to meet RTO and RPO objectives.

Practice this question →

256

MCQeasy

An SAP system is running on AWS with an SAP HANA database. The administrator needs to back up the HANA database to Amazon S3. Which AWS service or feature should be used to perform efficient incremental backups?

A.AWS Backup with the SAP HANA backup plan

B.Amazon S3 Transfer Acceleration

C.AWS Storage Gateway with volume gateway

D.Amazon EBS snapshots of the HANA data volumes

AnswerA

AWS Backup integrates with SAP HANA to perform incremental backups to S3.

Why this answer

AWS Backup with the SAP HANA backup plan is correct because it provides native integration for SAP HANA databases, enabling automated, incremental, and log backups directly to Amazon S3. It uses the SAP HANA Backint agent to stream backup data to S3, supporting efficient incremental backups by only transferring changed data blocks since the last full or incremental backup, which minimizes storage and network costs.

Exam trap

The trap here is that candidates often confuse EBS snapshots (which are block-level incremental) with database-level incremental backups, failing to recognize that EBS snapshots do not integrate with SAP HANA's Backint protocol and require application-level consistency, making them unsuitable for efficient, non-disruptive HANA backups to S3.

How to eliminate wrong answers

Option B is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads over long distances by using AWS edge locations, but it does not perform backups or manage incremental backup logic; it is merely a transport optimization. Option C is wrong because AWS Storage Gateway with volume gateway provides iSCSI block storage volumes that can be backed up as EBS snapshots, but it does not natively support SAP HANA database backups or incremental backup streaming to S3; it is designed for on-premises caching and hybrid storage, not for HANA-specific Backint integration. Option D is wrong because Amazon EBS snapshots of the HANA data volumes capture the entire volume state at a point in time, but they are not incremental at the database level—they are block-level incremental but require the database to be in a consistent state (e.g., frozen or stopped), which is disruptive for a production SAP HANA system and does not support log backups or point-in-time recovery as efficiently as Backint-based backups.

Practice this question →

257

Multi-Selectmedium

Which THREE of the following are valid methods to secure network traffic between SAP application servers and the SAP HANA database on AWS? (Choose three.)

Select 3 answers

A.Use VPC peering to connect different VPCs securely.

B.Use AWS Direct Connect to encrypt traffic.

C.Use network ACLs to control traffic at the subnet level.

D.Use security groups to restrict traffic between instances.

E.Use AWS Shield to encrypt traffic.

AnswersA, C, D

VPC peering enables private connectivity.

Why this answer

VPC peering allows you to connect SAP application servers in one VPC to SAP HANA databases in another VPC securely using private IP addresses, with traffic staying within the AWS network and not traversing the public internet. This is a valid method for securing network traffic between these components when they are deployed in separate VPCs.

Exam trap

The trap here is that candidates often confuse AWS Direct Connect with encryption (it provides a private connection but no inherent encryption) and mistake AWS Shield (a DDoS protection service) for a traffic encryption solution.

Practice this question →

258

Multi-Selectmedium

A company is designing an SAP HANA disaster recovery solution on AWS across two regions. Which TWO actions meet the requirement of a Recovery Point Objective (RPO) of less than 5 minutes?

Select 2 answers

A.Set up AWS Database Migration Service (DMS) with ongoing replication from the primary to the DR region.

B.Use Amazon S3 Cross-Region Replication to copy HANA data files to the DR region every minute.

C.Schedule a script to run every minute that exports HANA data and uploads to S3 in the DR region.

D.Implement SAP HANA System Replication with asynchronous replication to the DR region.

E.Configure automated nightly snapshots of the HANA database and copy them to the DR region using AWS Backup.

AnswersA, D

AWS DMS with ongoing replication can achieve sub-5-minute RPO by continuously replicating changes.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication can continuously capture and apply changes from the SAP HANA source database to a target in the DR region, achieving sub-5-minute RPO by replicating transactions in near real-time. Option D is correct because SAP HANA System Replication with asynchronous mode replicates data at the database level, typically achieving RPO of seconds to a few minutes, well under the 5-minute requirement.

Exam trap

The trap here is that candidates may confuse S3 Cross-Region Replication or scripted exports as viable for low RPO, not realizing that these methods cannot provide the continuous, transactional consistency required for SAP HANA disaster recovery.

Practice this question →

259

Multi-Selectmedium

A company is designing an SAP system on AWS with SAP HANA as the database. The system must be highly available across multiple Availability Zones. Which TWO actions should the company take to meet this requirement?

Select 2 answers

A.Configure SAP HANA System Replication (HSR) in synchronous mode

B.Perform periodic EBS snapshots and restore in another AZ

C.Use Amazon S3 cross-region replication for the database files

D.Set up a Pacemaker cluster to automate failover between primary and secondary

E.Use manual failover by changing DNS records

AnswersA, D

HSR provides real-time replication to a secondary instance in another AZ.

Why this answer

SAP HANA System Replication (HSR) in synchronous mode ensures that every committed transaction is replicated to a secondary HANA instance in another Availability Zone before acknowledging the commit to the application. This provides zero data loss (RPO=0) and enables automatic failover, meeting the high availability requirement across AZs.

Exam trap

The trap here is that candidates may confuse backup strategies (EBS snapshots or S3 replication) with true high availability, or assume manual DNS changes are sufficient, while the exam expects understanding that synchronous HSR plus an automated cluster manager (Pacemaker) is mandatory for HA across AZs.

Practice this question →

260

MCQeasy

A company is migrating an SAP ERP system on Oracle to SAP HANA on AWS. The migration requires near-zero downtime. The company has a test environment that can be used for the migration rehearsal. The SAP HANA database will be 3 TB. Which migration approach should the company use to achieve near-zero downtime?

A.Use AWS Database Migration Service (DMS) for ongoing replication.

B.Perform a full backup of the Oracle database and restore to SAP HANA.

C.Use SAP Software Update Manager (SUM) with Database Migration Option (DMO).

D.Use SAP HANA Studio to export the Oracle schema and import into HANA.

AnswerC

DMO supports near-zero downtime migration.

Why this answer

SAP Software Update Manager (SUM) with Database Migration Option (DMO) is the correct approach because it combines the SAP system upgrade and the migration from Oracle to SAP HANA into a single process, leveraging SAP's own tools to minimize downtime. DMO uses a trigger-based replication mechanism that can achieve near-zero downtime by keeping the source Oracle database and target SAP HANA database synchronized during the migration window, which is critical for a 3 TB database where traditional backup-restore would exceed downtime limits.

Exam trap

The trap here is that candidates often assume AWS DMS is the universal tool for any database migration to AWS, but for SAP HANA migrations, the certified and supported approach is SAP's own DMO tool, not a generic AWS service.

How to eliminate wrong answers

Option A is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a target for ongoing replication from Oracle in a certified SAP migration scenario; DMS is designed for homogeneous or heterogeneous database migrations but lacks the SAP-specific schema and application-level consistency required for SAP workloads. Option B is wrong because performing a full backup of the Oracle database and restoring to SAP HANA would require a significant downtime window to complete the backup transfer and restore, which cannot achieve near-zero downtime for a 3 TB database. Option D is wrong because using SAP HANA Studio to export the Oracle schema and import into HANA is a manual, offline process that does not support ongoing replication or near-zero downtime; it would require the source system to be stopped during the export and import phases.

Practice this question →

261

MCQeasy

A company wants to run SAP S/4HANA on AWS and needs to ensure that the SAP application and database are deployed according to AWS best practices. Which deployment method should they use?

A.Manual deployment using EC2 and RDS

B.AWS Launch Wizard for SAP

C.AWS Quick Start for SAP

D.AWS CloudFormation with custom templates

AnswerB

Launch Wizard automates SAP deployment following AWS best practices.

Why this answer

AWS Launch Wizard for SAP is the correct deployment method because it provides a guided, best-practice-based deployment experience specifically for SAP S/4HANA, automatically provisioning EC2 instances, storage, and networking while validating SAP requirements such as kernel compatibility, sizing, and high availability. It reduces manual effort and errors by integrating directly with AWS services like Amazon EBS and Elastic Load Balancing, ensuring compliance with SAP on AWS best practices.

Exam trap

The trap here is that candidates often confuse AWS Quick Start for SAP with a guided deployment tool, but Quick Start only provides static templates without the real-time validation and optimization that Launch Wizard offers for SAP-specific workloads.

How to eliminate wrong answers

Option A is wrong because manual deployment using EC2 and RDS is not supported for SAP S/4HANA; SAP requires a certified database (e.g., SAP HANA or ASE) and RDS does not support SAP HANA, making this option technically invalid. Option C is wrong because AWS Quick Start for SAP provides reference architectures and CloudFormation templates but is not a guided deployment wizard; it requires manual configuration and does not perform real-time validation of SAP-specific parameters like SAPS sizing or high-availability setup. Option D is wrong because AWS CloudFormation with custom templates, while powerful, lacks the built-in SAP validation and optimization logic of Launch Wizard; users must manually ensure compliance with SAP on AWS best practices, increasing risk of misconfiguration.

Practice this question →

262

Multi-Selecthard

A company is designing a highly available SAP NetWeaver AS ABAP environment on AWS with a 2-node ASCS/ERS cluster. Which TWO of the following must be configured to ensure a successful failover? (Choose 2)

Select 2 answers

A.An AWS ASW (Automated SAP Workload) service

B.Amazon EBS io1 volumes with Multi-Attach enabled for the database

C.A shared file system (e.g., Amazon EFS) for /sapmnt

D.Each node must have its own /usr/sap/<SID>/ASCS and /usr/sap/<SID>/ERS directory on instance store

E.A virtual IP address (VIP) using Route53 health checks or the AWS CLI

AnswersC, E

Required for shared profile data.

Why this answer

SAP NetWeaver AS ABAP requires a shared /sapmnt directory accessible by both nodes in an ASCS/ERS cluster for consistent profile and configuration access during failover. Amazon EFS provides a POSIX-compliant, NFS-based shared file system that supports concurrent access from multiple EC2 instances across Availability Zones, which is essential for the cluster to function correctly. Option E is correct because a virtual IP address (VIP) is needed to provide a stable endpoint for clients to connect to the ASCS instance, regardless of which node is active.

This can be achieved using Route53 health checks with failover routing or AWS CLI scripts that reassign the IP to the active node, ensuring seamless failover.

Exam trap

A common pitfall in AWS SAP exams is thinking that instance store volumes are suitable for persistent SAP cluster directories, but they are ephemeral and will cause data loss on instance stop or termination, making them invalid for failover-critical components.

Practice this question →

263

Multi-Selecthard

Which THREE storage options are supported for SAP HANA data files on AWS? (Select THREE.)

Select 3 answers

A.Amazon EFS

B.NVMe instance store SSDs on i3en instances

C.Amazon EBS gp3 volumes with sufficient IOPS

D.Amazon EBS io2 Block Express volumes

E.Amazon S3

AnswersB, C, D

Instance store is supported on certified instances.

Why this answer

I3en instances provide NVMe instance store SSDs that are directly attached to the physical server, offering very low latency and high IOPS for SAP HANA data files. These instance stores are ephemeral but are the recommended storage for SAP HANA data and log volumes when using certified instance types, as they meet the strict performance requirements for HANA's in-memory database operations.

Exam trap

The trap here is that candidates often assume any high-performance storage (like EFS or S3) can support SAP HANA, but AWS explicitly requires block storage with guaranteed low latency and IOPS, which only NVMe instance store, gp3, and io2 Block Express provide.

Practice this question →

264

MCQmedium

A company runs SAP ERP on AWS with an Oracle database on an r5.4xlarge instance. The system experiences performance degradation during month-end closing. Monitoring shows high CPU and I/O wait on the database server. The storage is EBS gp2 volumes. The company plans to migrate to SAP HANA in the future. What immediate change should be made to improve performance?

A.Implement AWS RDS Oracle read replicas to offload reporting queries.

B.Migrate the database to SAP HANA immediately to improve performance.

C.Change the EBS volumes from gp2 to gp3 to improve I/O performance and throughput.

D.Increase the EC2 instance size to r5.8xlarge to provide more CPU and memory.

AnswerC

gp3 offers more consistent performance and higher throughput at lower cost than gp2.

Why this answer

Switching from gp2 to gp3 provides better baseline performance and higher throughput at lower cost. Option A (Implement RDS Oracle read replicas) is for RDS, not self-managed Oracle. Option B (Migrate to HANA immediately) is a longer-term solution, not immediate.

Option C (Change EBS volumes from gp2 to gp3) is the correct immediate change to improve I/O performance. Option D (Increase instance size) might help CPU but is more expensive and does not directly address I/O wait.

Practice this question →

265

MCQhard

A company is running SAP S/4HANA on AWS. The SAP application servers and database are in the same VPC. The security team requires encryption in transit between all SAP components. Which combination of services and configurations meets this requirement?

A.Use AWS Transit Gateway with encryption enabled.

B.Enable SAP SNC with TLS certificates on all SAP instances.

C.Use AWS VPN to connect all SAP instances to a single endpoint.

D.Create a VPC peering connection between the application and database subnets.

AnswerB

SNC encrypts SAP-specific communications.

Why this answer

SAP SNC (Secure Network Communications) with TLS certificates provides end-to-end encryption for communication between SAP components, including application servers and databases, regardless of network topology. Since all SAP components reside in the same VPC, the encryption requirement is satisfied at the application layer without relying on network-level encryption. SNC ensures that data in transit between SAP systems is encrypted using X.509 certificates, meeting the security team's mandate.

Exam trap

The trap here is that candidates often assume network-level encryption services like Transit Gateway or VPN are required for in-transit encryption, but the question specifically requires encryption between SAP components, which is natively achieved through SAP SNC at the application layer, not through AWS networking features.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub for routing traffic between VPCs and on-premises networks, but it does not natively encrypt traffic between resources within the same VPC; encryption would require additional VPN or TLS configurations. Option C is wrong because AWS VPN creates an encrypted tunnel between a VPC and an external network, but it does not encrypt traffic between SAP components within the same VPC; using it to connect all instances to a single endpoint would add unnecessary complexity and latency without addressing internal encryption. Option D is wrong because VPC peering connects subnets or VPCs at Layer 3 without providing any encryption; traffic between peered subnets remains unencrypted unless additional measures like TLS are applied.

Practice this question →

266

Multi-Selectmedium

A company is planning to run SAP HANA on AWS. Which TWO of the following are required to ensure the system is supported by SAP? (Choose TWO.)

Select 2 answers

A.Place all instances in a cluster placement group

B.Use only EBS io2 Block Express volumes for all HANA data

C.Use an operating system that is on the SAP HANA supported OS list

D.Enable termination protection on all instances

E.Use an SAP-certified EC2 instance type

AnswersC, E

SAP requires specific OS versions.

Why this answer

SAP requires the operating system to be listed on the SAP HANA supported OS list. Running an unsupported OS violates SAP's support policy and can lead to denial of support for the entire HANA system.

Exam trap

The trap here is that candidates often confuse operational best practices (like placement groups or termination protection) with mandatory SAP support requirements, leading them to select options that are not explicitly required by SAP.

Practice this question →

267

Multi-Selecteasy

Which TWO of the following are valid storage options for SAP HANA data files on AWS?

Select 2 answers

A.Amazon EBS gp3 volumes with sufficient IOPS

B.Amazon S3

C.Amazon EBS io2 Block Express volumes

D.Instance Store volumes

E.Amazon EFS

AnswersA, C

gp3 can be provisioned with adequate IOPS.

Why this answer

Amazon EBS gp3 volumes are a valid storage option for SAP HANA data files because they provide consistent baseline performance of 3,000 IOPS and 125 MB/s throughput, with the ability to provision additional IOPS independently of storage capacity. SAP HANA requires high IOPS and low latency for its data persistence layer, and gp3 volumes meet these requirements when configured with sufficient IOPS, making them a cost-effective choice for many HANA workloads on AWS.

Exam trap

The trap here is that candidates often confuse Amazon S3 or EFS as viable storage for SAP HANA data files because they are durable and scalable, but they fail to recognize that HANA requires block-level storage with low latency and high IOPS that only EBS volumes can provide.

Practice this question →

268

MCQmedium

A company is planning to migrate its SAP ECC system to SAP S/4HANA on AWS. The current system uses an IBM Db2 database on-premises. The target system will use SAP HANA as the database. The company wants to perform the migration with minimal downtime. Which tool or method should be used?

A.Use IBM Db2 native tools to export the database and import into HANA.

B.Use AWS Database Migration Service (DMS) to replicate data from Db2 to HANA.

C.Use SAP Software Update Manager (SUM) with the Database Migration Option (DMO).

D.Use SAP Landscape Transformation (SLT) to replicate data in real-time.

AnswerC

SUM with DMO supports migration from Db2 to HANA with minimal downtime.

Why this answer

SAP Software Update Manager (SUM) with the Database Migration Option (DMO) is the only tool that combines both the system upgrade from SAP ECC to SAP S/4HANA and the database migration from IBM Db2 to SAP HANA in a single, integrated process. DMO uses a trigger-based replication approach to minimize downtime by migrating data in the background while the source system remains operational, then performing a short final cutover. This is the officially recommended SAP methodology for heterogeneous migrations with minimal downtime.

Exam trap

The trap here is that candidates often confuse real-time replication tools like SLT or AWS DMS with the specialized SAP DMO process, not realizing that only DMO combines the database migration, system upgrade, and minimal downtime in a single, SAP-supported workflow.

How to eliminate wrong answers

Option A is wrong because IBM Db2 native tools (e.g., db2 export/import) are designed for homogeneous Db2-to-Db2 transfers and cannot convert the database schema or data to SAP HANA format; they also require the source system to be offline for the entire duration, causing significant downtime. Option B is wrong because AWS Database Migration Service (DMS) does not support SAP HANA as a target endpoint and cannot handle the complex SAP-specific data structures, application logic, or the required system conversion steps (e.g., Unicode conversion, S/4HANA simplification). Option D is wrong because SAP Landscape Transformation (SLT) is a real-time data replication tool primarily used for loading data into SAP BW or other systems, not for performing a full system migration with database conversion and application upgrade; it lacks the ability to execute the necessary SUM upgrade steps and HANA schema conversion.

Practice this question →

269

Multi-Selecthard

Which THREE security best practices should be implemented for SAP systems on AWS? (Choose three.)

Select 3 answers

A.Disable SSH key pair access and use only password authentication.

B.Use security groups to restrict inbound and outbound traffic to SAP systems.

C.Deploy all SAP systems in a single VPC for simplified management.

D.Use IAM roles for EC2 instances to access AWS services.

E.Enable encryption at rest for all EBS volumes used by SAP.

AnswersB, D, E

Security groups provide stateful filtering.

Why this answer

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. For SAP systems, this is critical to restrict access to only necessary ports (e.g., 3200 for SAP Application Server, 36xx for SAProuter, 443 for HTTPS) and trusted IP ranges, reducing the attack surface. Unlike network ACLs, security groups are stateful, meaning return traffic is automatically allowed, simplifying rule management for SAP communication flows.

Exam trap

The trap here is that candidates may confuse security groups with network ACLs or assume that a single VPC simplifies management, but AWS best practices emphasize isolation and least privilege for SAP workloads, not consolidation.

Practice this question →

270

Multi-Selecthard

Which THREE of the following are valid considerations when designing an SAP HANA backup strategy on AWS?

Select 3 answers

A.Use EBS snapshots for backing up HANA data volumes.

B.Store backups in Amazon S3 for long-term retention.

C.Use the AWS Backint agent for SAP HANA to back up to S3.

D.Back up HANA data directly to Amazon S3 using standard tools.

E.Replicate backups to another AWS Region using S3 Cross-Region Replication.

AnswersA, B, C

EBS snapshots are a valid backup method.

Why this answer

EBS snapshots provide a consistent, point-in-time backup of HANA data volumes when the database is in backup mode (e.g., using hdbsql to create a snapshot). This method is supported by SAP and AWS, and it allows for fast recovery by restoring the entire volume without needing to replay transaction logs from a separate backup.

Exam trap

The trap here is that candidates may assume any S3-based backup method (like direct copy) is valid, but AWS and SAP require certified tools (Backint or snapshot integration) to guarantee HANA consistency and supportability.

Practice this question →

271

Multi-Selectmedium

Which TWO of the following are required when integrating SAP HANA with AWS Direct Connect for hybrid connectivity?

Select 2 answers

A.A Public Virtual Interface to access the VPC.

B.A Virtual Private Gateway attached to the VPC.

C.A Direct Connect Gateway for the connection.

D.BGP peering between on-premises router and AWS router.

E.A VPN tunnel between on-premises and AWS.

AnswersB, D

VGW is required for Direct Connect private VIF.

Why this answer

A Virtual Private Gateway (VGW) is required to attach the VPC to the Direct Connect connection, enabling private IP traffic between on-premises and the VPC. Without a VGW, the Direct Connect virtual interface cannot terminate within the VPC, making hybrid connectivity impossible for SAP HANA workloads that require low-latency, private network paths.

Exam trap

The trap here is that candidates confuse a Public Virtual Interface with a Private Virtual Interface, assuming any Direct Connect interface can reach the VPC, but only a Private Virtual Interface combined with a VGW provides private VPC access.

Practice this question →

272

MCQeasy

A company runs SAP ERP on AWS using an Oracle database. To meet disaster recovery requirements, they need to replicate the database to a second AWS Region with low RPO. Which AWS service should be used for continuous, asynchronous replication of the Oracle database?

A.Copy the EC2 instance with the Oracle database as an AMI to the DR Region.

B.AWS Database Migration Service (DMS) with ongoing replication from the source Oracle database to a target Oracle database in the DR Region.

C.Amazon S3 Cross-Region Replication (CRR) to replicate database backups.

D.Amazon RDS for Oracle Read Replicas in the DR Region.

AnswerB

DMS supports continuous replication with low RPO.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports continuous, asynchronous change data capture (CDC) from an on-premises or EC2-hosted Oracle source to a target Oracle database in another AWS Region, achieving low RPO by replicating transactions in near real-time without requiring application downtime. This meets the DR requirement for cross-region replication of an Oracle database with minimal data loss.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which do not exist for Oracle RDS) with cross-region replication capabilities, or mistakenly think that S3 CRR can replicate live database changes, when in fact it only replicates static objects like backup files.

How to eliminate wrong answers

Option A is wrong because copying an EC2 instance as an AMI to the DR Region provides only a point-in-time snapshot, not continuous replication, and cannot achieve low RPO as it requires manual or scheduled automation. Option C is wrong because Amazon S3 Cross-Region Replication (CRR) replicates objects in S3 buckets, not live database transactions; it can only copy database backup files, which are point-in-time and do not provide continuous, asynchronous replication of the running database. Option D is wrong because Amazon RDS for Oracle Read Replicas are only supported within the same AWS Region and cannot be created across regions, and they are designed for read scaling, not for disaster recovery replication to a second Region.

Practice this question →

273

Multi-Selecteasy

A company is planning to run SAP NetWeaver on AWS and needs to ensure that the architecture supports high availability for the application layer. Which TWO components are essential for an HA SAP NetWeaver application server setup? (Choose TWO.)

Select 2 answers

A.Amazon ElastiCache for session management

B.Multiple EC2 instances in different Availability Zones

C.A single large EC2 instance for all application servers

D.An Application Load Balancer to distribute traffic

E.Amazon RDS for database layer

AnswersB, D

Multiple instances across AZs provide failover capability.

Why this answer

For high availability of the SAP NetWeaver application layer, you need multiple EC2 instances distributed across different Availability Zones (AZs) to eliminate a single point of failure. An Application Load Balancer (ALB) is essential to distribute incoming traffic across these instances and perform health checks, ensuring that if one instance or AZ fails, traffic is routed to healthy instances. This combination provides fault tolerance and automatic failover for the SAP application servers.

Exam trap

The trap here is that candidates often confuse the database layer (RDS) or caching services (ElastiCache) as part of the application layer HA, when in fact the core requirement is multiple EC2 instances across AZs and a load balancer to distribute traffic.

Practice this question →

274

MCQmedium

An SAP customer is using AWS KMS to encrypt EBS volumes for an SAP HANA database. The database administrator reports that the database is slow after enabling encryption. What is the MOST likely cause?

A.The KMS key is not rotated frequently enough.

B.The KMS API request rate limit is being exceeded, causing throttling.

C.The EBS volume is not using the correct instance type for encrypted volumes.

D.The KMS key is using a symmetric algorithm that degrades CPU performance.

AnswerB

High request rate can cause throttling and delays.

Why this answer

When EBS volumes are encrypted, every I/O operation to the volume must call AWS KMS to decrypt the data key. If the database workload generates a high rate of these requests, it can exceed the KMS API request rate limit (default 5,500 requests per second per Region for symmetric keys), causing throttling and increased latency. This is the most likely cause of the observed slowdown after enabling encryption.

Exam trap

The trap here is that candidates often attribute performance degradation to CPU overhead from encryption algorithms, but AWS KMS throttling is the real bottleneck because EBS encryption relies on API calls for key decryption, not on-instance cryptographic processing.

How to eliminate wrong answers

Option A is wrong because KMS key rotation does not affect the performance of ongoing encryption/decryption operations; it only changes the backing key used for new data, and the old key remains available for decryption. Option C is wrong because there is no 'correct instance type for encrypted volumes' — all EBS volume types and instance types support encryption without inherent performance degradation from the instance itself. Option D is wrong because symmetric encryption algorithms (like AES-256 used by KMS) are hardware-accelerated on modern AWS instances (e.g., using Intel AES-NI) and do not degrade CPU performance; the slowdown is due to API call throttling, not CPU overhead.

Practice this question →

275

MCQhard

A company runs SAP Business Suite on AWS with an Oracle database. The database is stored on Amazon EBS volumes. The architect wants to implement a backup strategy that meets a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. Which solution is the most cost-effective?

A.Maintain a standby Oracle database in another Availability Zone using Oracle Data Guard

B.Use Oracle Recovery Manager (RMAN) to back up to Amazon S3 every 15 minutes

C.Take EBS snapshots of the database volumes every 15 minutes and store them in Amazon S3

D.Use AWS Database Migration Service (DMS) with ongoing replication to a separate EC2 instance

AnswerC

EBS snapshots are incremental and cost-effective; automation can achieve 15-minute RPO.

Why this answer

The most cost-effective because EBS snapshots are incremental, storing only changed blocks, and can be automated via Amazon Data Lifecycle Manager to meet a 15-minute RPO. Restoring from an EBS snapshot to a new volume typically completes within minutes, easily satisfying the 2-hour RTO, and there are no ongoing compute costs for a standby instance or replication server.

Exam trap

The trap here is that candidates often assume a standby database (Data Guard) or continuous replication (DMS) is required for low RPO/RTO, overlooking that EBS snapshots taken every 15 minutes can achieve the same RPO at a fraction of the cost without ongoing compute overhead.

How to eliminate wrong answers

Option A is wrong because maintaining a standby Oracle database with Oracle Data Guard requires a second EC2 instance and additional EBS storage, incurring continuous compute and storage costs that are not cost-effective compared to snapshot-based backups. Option B is wrong because using RMAN to back up to Amazon S3 every 15 minutes would require frequent full or incremental backups that consume significant CPU and I/O on the database server, and RMAN backups to S3 typically involve higher latency and cost per backup than native EBS snapshots. Option D is wrong because AWS DMS with ongoing replication requires a separate replication instance and target EC2 instance, incurring ongoing costs and complexity, and is designed for migration rather than as a primary backup strategy for an Oracle database on EBS.

Practice this question →

276

Multi-Selectmedium

A company is designing a disaster recovery solution for SAP HANA on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. Which TWO strategies can be used to replicate HANA data to the DR region? (Choose TWO.)

Select 2 answers

A.Use AWS Database Migration Service (DMS) for ongoing replication

B.Use SAP HANA System Replication (HSR) with ASYNC mode

C.Copy EBS snapshots to the DR region using AWS CLI

D.Configure S3 Cross-Region Replication for HANA data files

E.Use AWS CloudEndure Disaster Recovery

AnswersA, B

DMS can perform continuous replication to a target database in DR.

Why this answer

AWS Database Migration Service (DMS) can be used for ongoing replication of SAP HANA data to a DR region by continuously capturing changes from the source HANA database and applying them to a target HANA instance in us-west-2. DMS supports HANA as both source and target, enabling near-real-time replication without requiring native HANA replication features. Additionally, SAP HANA System Replication (HSR) with ASYNC mode is a native HANA feature that replicates data at the database level asynchronously to a secondary system in the DR region.

HSR ASYNC minimizes performance impact on the primary and provides a consistent database copy for failover. Both strategies are valid for cross-region disaster recovery of SAP HANA on AWS.

Exam trap

The trap here is that candidates often assume any backup or replication tool (like EBS snapshots or S3 replication) can serve as a DR solution for SAP HANA, but they fail to recognize that HANA requires database-consistent, log-based replication to maintain ACID compliance and avoid data corruption during failover.

Practice this question →

277

MCQhard

An SAP system administrator needs to monitor the memory usage of SAP HANA on AWS. Which CloudWatch metric or log should be used to track HANA memory consumption?

A.CloudWatch Logs from HANA trace files

B.SAP HANA CloudWatch integration via SQL queries

C.EC2 instance-level memory metrics

D.AWS CloudWatch Agent for OS metrics

AnswerB

HANA exposes memory metrics via SQL, which can be sent to CloudWatch.

Why this answer

SAP HANA exposes memory consumption metrics via built-in SQL views (e.g., M_HOST_MEMORY, M_MEMORY), and the SAP HANA CloudWatch integration uses a dedicated AWS Lambda function to execute these SQL queries and push the results as custom CloudWatch metrics. This is the only option that directly captures HANA-specific memory usage, such as allocation limit, used memory, and heap memory, rather than generic OS-level metrics.

Exam trap

The trap here is that candidates often confuse OS-level memory metrics (which require the CloudWatch Agent) with HANA-specific memory metrics, not realizing that HANA’s internal memory management (e.g., column store, row store, heap) is only accessible through its SQL views, not through standard OS monitoring tools.

How to eliminate wrong answers

Option A is wrong because HANA trace files contain diagnostic logs (e.g., error traces, SQL traces) but do not expose structured, real-time memory consumption metrics suitable for CloudWatch monitoring. Option C is wrong because EC2 instance-level memory metrics are not available by default in CloudWatch; they require the CloudWatch Agent or a custom script, and even then they report OS-level memory (e.g., RAM usage) rather than HANA-specific memory allocation. Option D is wrong because the AWS CloudWatch Agent for OS metrics collects operating system metrics (e.g., memory utilization, disk I/O) from the EC2 instance, but it cannot query SAP HANA’s internal memory views or provide HANA-specific memory consumption data.

Practice this question →

278

Drag & Dropmedium

Drag and drop the steps to implement disaster recovery for SAP S/4HANA using AWS Elastic Disaster Recovery (DRS) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

DRS involves agent installation, configuration, testing, recovery initiation, and post-recovery steps.

Practice this question →

279

Multi-Selectmedium

Which TWO statements are true regarding Amazon EBS volume types for SAP HANA data volumes?

Select 2 answers

A.io1 volumes are the recommended choice for SAP HANA

B.io2 Block Express volumes provide up to 256,000 IOPS

C.gp3 volumes can be provisioned with up to 16,000 IOPS

D.st1 volumes are suitable for SAP HANA log volumes

E.sc1 volumes are cost-effective for SAP HANA data volumes

AnswersB, C

io2 Block Express offers high IOPS and durability for critical workloads.

Why this answer

Io2 Block Express volumes are designed for SAP HANA data volumes, offering up to 256,000 IOPS and 4,000 MB/s throughput per volume, which meets the high-performance requirements for SAP HANA. Option C is correct because gp3 volumes can be provisioned with up to 16,000 IOPS and 1,000 MB/s throughput, making them a cost-effective alternative for smaller SAP HANA workloads or non-production environments.

Exam trap

The trap here is that candidates may assume io1 is still the premium choice for SAP HANA, but AWS has deprecated io1 in favor of io2 Block Express, and they may also overlook that gp3 can meet SAP HANA data volume requirements with its provisioned IOPS capability.

Practice this question →

280

MCQhard

During a migration of an SAP system to AWS, the administrator notices that the SAP application servers are experiencing high network latency when communicating with the SAP HANA database. The application and database servers are in different VPCs connected via VPC peering. Which design change would most effectively reduce the latency?

A.Set up an AWS Direct Connect connection.

B.Enable Enhanced Networking on the EC2 instances.

C.Increase the bandwidth of the VPC peering connection.

D.Place the application and database servers in the same subnet.

AnswerD

Same subnet eliminates network hops, reducing latency.

Why this answer

Placing the SAP application servers and the SAP HANA database in the same subnet eliminates the need for traffic to traverse a VPC peering connection, which introduces additional network hops and potential latency. In a single subnet, all traffic stays within the same VPC and uses the local network infrastructure, providing the lowest possible latency for SAP HANA communication, which is critical for performance.

Exam trap

The trap here is that candidates assume VPC peering is a low-latency solution and overlook that any inter-VPC traffic introduces additional network hops, while the simplest and most effective fix is to co-locate the servers in the same subnet to avoid the peering overhead entirely.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a hybrid connectivity service that connects an on-premises data center to AWS, not a solution for reducing latency between two VPCs within the same AWS region; it would not address the inter-VPC latency issue. Option B is wrong because Enhanced Networking uses the SR-IOV (Single Root I/O Virtualization) driver to provide higher packet-per-second performance and lower jitter, but it does not reduce the physical network distance or the number of hops introduced by VPC peering. Option C is wrong because VPC peering connections do not have a configurable bandwidth limit; bandwidth is determined by the instance type and network performance, and increasing it is not a valid operation—the latency issue stems from the additional network hops, not bandwidth constraints.

Practice this question →

281

MCQmedium

A company runs SAP NetWeaver on AWS and needs to ensure that the SAP application server instances are evenly distributed across two Availability Zones. Which AWS service should be used to distribute traffic?

A.AWS Global Accelerator

B.Application Load Balancer

C.Amazon CloudFront

D.Amazon Route 53 weighted routing

AnswerB

ALB can distribute incoming traffic across multiple AZs and instances.

Why this answer

The Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as SAP application servers, in different Availability Zones. By registering SAP instances in two AZs and enabling cross-zone load balancing, the ALB ensures even distribution of traffic across both zones, which is critical for high availability and balanced resource utilization in SAP NetWeaver deployments.

Exam trap

The trap here is that candidates often confuse DNS-level routing (Route 53 weighted routing) with actual load balancing, not realizing that DNS does not control the distribution of individual requests and cannot react to instance health in real time, whereas an ALB provides layer-7 health checks and even distribution across AZs.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by routing traffic over the AWS global network to the optimal endpoint, but it does not provide native layer-7 load balancing or even distribution across specific AZs; it relies on an underlying load balancer or endpoint for that. Option C is wrong because Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations; it is not designed to distribute traffic to SAP application servers across AZs and lacks the necessary health checks and load balancing for SAP workloads. Option D is wrong because Amazon Route 53 weighted routing distributes DNS traffic based on weights assigned to records, but it operates at the DNS level and cannot evenly distribute individual requests across AZs in real time; it also does not perform health checks on SAP instances to reroute traffic in case of failure.

Practice this question →

282

MCQhard

An SAP administrator configures SAP HANA backup using Backint as shown in the exhibit. The backup job fails with an error indicating that the bucket 'sap-hana-backup-prod' does not exist. The administrator confirms that the bucket name is correct. What is the most likely cause of the failure?

A.The IAM role used by the instance does not have s3:PutObject permission.

B.The chunk size is too large for the bucket.

C.The bucket is in a different AWS region than the EC2 instance.

D.The bucket has a bucket policy that denies access.

AnswerC

Backint by default uses the region of the instance; if bucket is in different region, need to specify region.

Why this answer

The SAP HANA Backint agent communicates with Amazon S3 using the AWS SDK, which resolves the bucket endpoint based on the region configured in the agent or the instance metadata. If the bucket 'sap-hana-backup-prod' exists in a different AWS region than the EC2 instance, the Backint agent will attempt to access the bucket using the wrong regional endpoint, resulting in a 'bucket does not exist' error. This is a common misconfiguration when the Backint parameter file does not explicitly set the correct region or when the instance's default region differs from the bucket's region.

Exam trap

The trap here is that candidates often assume the error message 'bucket does not exist' always means the bucket name is incorrect or the bucket was deleted, overlooking the region mismatch issue that causes the S3 API to return a 404 when the bucket is in a different region.

How to eliminate wrong answers

Option A is wrong because the error message specifically states the bucket does not exist, not a permissions issue; an s3:PutObject permission failure would produce an 'Access Denied' or '403 Forbidden' error. Option B is wrong because the chunk size parameter in SAP HANA Backint controls the size of data segments sent to S3, and an oversized chunk would cause a 'Request entity too large' error, not a 'bucket does not exist' error. Option D is wrong because a bucket policy that denies access would result in an 'Access Denied' or '403 Forbidden' error, not a 'bucket does not exist' error.

Practice this question →

283

Multi-Selecthard

A company is migrating its SAP ERP system to AWS. The system includes an SAP Central Services (ASCS) instance and an SAP application server. Which TWO of the following are required for high availability? (Choose TWO.)

Select 2 answers

A.Use an EBS Multi-Attach volume for shared /sapmnt

B.Enqueue replication server (ERS) must be set up for the ASCS cluster

C.Configure an Elastic Load Balancer for ASCS

D.Set up a cluster for ASCS using AWS cluster management tools

E.Deploy at least two application servers in different Availability Zones

AnswersB, D

ERS is required for enqueue replication in HA.

Why this answer

The Enqueue Replication Server (ERS) is a mandatory component for an SAP ASCS high-availability cluster. In a clustered ASCS setup, the ERS replicates the lock table from the active ASCS node to the standby node, ensuring that in the event of a failover, the new active ASCS instance can recover the locks without data inconsistency. Without ERS, the ASCS cluster cannot provide true high availability for the enqueue service.

Exam trap

The trap here is that candidates often confuse high availability for the ASCS instance with general application-level redundancy, leading them to select 'deploy at least two application servers' (Option E) instead of recognizing that the ASCS cluster with ERS is the specific HA requirement for the SAP Central Services.

Practice this question →

284

MCQmedium

A company is migrating its SAP ERP system to AWS. They need to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS architecture should they implement?

A.Configure a two-node cluster with a virtual IP (VIP) using AWS Route 53 health checks and failover

B.Run ASCS on Amazon RDS for SAP with Multi-AZ

C.Deploy ASCS on a single large EC2 instance

D.Use an Auto Scaling group with a minimum of 2 instances

AnswerA

Cluster with VIP provides HA for ASCS.

Why this answer

SAP ASCS requires a highly available cluster with a virtual IP (VIP) that can fail over between two EC2 instances. AWS Route 53 health checks can monitor the VIP and update DNS records to redirect traffic to the standby node upon failure, providing the necessary high availability for the ASCS instance without relying on a single point of failure.

Exam trap

The trap here is that candidates confuse the high availability requirements of SAP ASCS (which needs a cluster with VIP and fencing) with generic AWS HA mechanisms like Auto Scaling or RDS Multi-AZ, which are not designed for stateful SAP application services.

How to eliminate wrong answers

Option B is wrong because Amazon RDS for SAP does not support SAP Central Services (ASCS); RDS is a managed database service for SAP HANA or other databases, not for application services like ASCS. Option C is wrong because deploying ASCS on a single large EC2 instance creates a single point of failure, which does not meet high availability requirements. Option D is wrong because Auto Scaling groups are designed for horizontal scaling of stateless applications, not for stateful SAP ASCS services that require a fixed VIP and controlled failover between two nodes.

Practice this question →

285

MCQmedium

A company is deploying SAP Business Suite on AWS and wants to minimize network latency between the SAP application servers and the database server. Which placement strategy is best?

A.Place the servers in the same placement group within a single Availability Zone.

B.Place the servers in different VPCs connected via VPC Peering.

C.Place the application and database servers in different Availability Zones within the same region.

D.Place the servers in different AWS Regions.

AnswerA

Placement groups ensure low-latency, high-bandwidth connectivity.

Why this answer

Placement groups in AWS allow you to influence the placement of a group of interdependent instances to meet the needs of your workload. For SAP Business Suite, which is sensitive to network latency between application and database servers, using a cluster placement group within a single Availability Zone ensures the lowest possible latency and maximum throughput, as instances are placed in close proximity to each other, often within the same rack, enabling high-bandwidth, low-latency networking.

Exam trap

The trap here is that candidates often assume that distributing servers across multiple Availability Zones provides high availability, but for latency-sensitive SAP workloads, the question specifically asks for minimizing latency, not maximizing fault tolerance, so the single-AZ placement group is the correct answer.

How to eliminate wrong answers

Option B is wrong because placing servers in different VPCs connected via VPC Peering introduces additional network hops and latency, as traffic must traverse the VPC peering connection and potentially transit gateways, which is counterproductive for minimizing latency. Option C is wrong because placing servers in different Availability Zones within the same region introduces inter-AZ latency, typically 1-2 milliseconds, which is significantly higher than the sub-millisecond latency achievable within a single AZ using a placement group. Option D is wrong because placing servers in different AWS Regions introduces inter-region latency, often tens of milliseconds, which is unacceptable for the tight latency requirements of SAP Business Suite's application-to-database communication.

Practice this question →

286

Multi-Selectmedium

An architect is designing a disaster recovery plan for an SAP system using SAP HANA. The primary site is in us-east-1 and the DR site is in us-west-2. The RPO is 15 minutes and RTO is 1 hour. Which TWO AWS services or features should the architect use to meet these requirements? (Choose TWO.)

Select 2 answers

A.AWS Transit Gateway with VPC peering

B.AWS Elastic Disaster Recovery (AWS DRS)

C.Amazon S3 Cross-Region Replication

D.SAP HANA System Replication

E.AWS CloudEndure Disaster Recovery

AnswersB, D

AWS DRS automates failover and recovery, meeting RTO.

Why this answer

SAP HANA System Replication (option D) is the native SAP mechanism for replicating HANA databases synchronously or asynchronously, supporting an RPO of 15 minutes with asynchronous replication. AWS Elastic Disaster Recovery (option B) provides continuous block-level replication for the entire SAP system (including OS and application volumes) and enables automated failover within the 1-hour RTO. Together, they ensure both database consistency and full infrastructure recovery.

Exam trap

The PAS-C01 exam often tests the distinction between native SAP replication (HANA System Replication) and AWS infrastructure-level DR services (AWS DRS), and the trap here is that candidates may think CloudEndure (option E) is a separate valid service, but it is simply the previous branding of AWS DRS, making it a duplicate and incorrect choice.

Practice this question →

287

MCQmedium

A company is planning to migrate SAP S/4HANA to AWS. The system has a high transaction rate and requires low network latency between SAP application servers and the database. Which AWS infrastructure design minimizes network latency between the SAP application tier and the database tier?

A.Place the database server in one Availability Zone and application servers in another to improve fault tolerance.

B.Use a cluster placement group for the application servers and a separate placement group for the database.

C.Use a mix of instance types optimized for compute and memory across different Availability Zones.

D.Place all SAP application servers and the database server in the same Availability Zone.

AnswerD

Same AZ ensures minimal network hops and lowest latency.

Why this answer

Placing all SAP application servers and the database server in the same Availability Zone (AZ) minimizes network latency by keeping traffic within a single, high-bandwidth, low-latency AWS data center. SAP S/4HANA with a high transaction rate is sensitive to inter-AZ latency (typically 1-2 ms), which can degrade performance for synchronous database calls. Co-locating all tiers in one AZ ensures the lowest possible round-trip time for SAP's dialog work processes and database commits.

Exam trap

The trap here is that candidates often confuse high availability with performance, assuming that spreading resources across AZs improves both, but for SAP S/4HANA with high transaction rates, the primary design goal for latency is co-location in a single AZ, not fault tolerance.

How to eliminate wrong answers

Option A is wrong because placing the database and application servers in different Availability Zones introduces inter-AZ latency (typically 1-2 ms), which increases response time for SAP's synchronous database calls and can degrade transaction throughput. Option B is wrong because using separate placement groups for application and database servers does not guarantee they are in the same AZ or same rack; cluster placement groups are designed for low-latency within a single group, not across groups, and splitting them can still result in cross-AZ or cross-rack latency. Option C is wrong because mixing instance types across different Availability Zones does not address latency; it may actually increase network distance and variability, and SAP workloads require consistent low latency between tiers, not just optimized compute or memory.

Practice this question →

288

MCQeasy

A company is running SAP S/4HANA on AWS and needs to ensure high availability for the database layer. Which AWS service should be used to replicate the database to a standby instance in a different Availability Zone?

A.EC2 Auto Scaling

B.Amazon S3

C.Amazon RDS Multi-AZ

D.AWS Database Migration Service (DMS)

AnswerD

AWS DMS can perform ongoing replication to a standby HANA database.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication from an SAP HANA source database to a standby instance in a different Availability Zone using change data capture (CDC). This allows continuous data synchronization without requiring native SAP HANA replication features, making it suitable for high-availability setups where the database layer must be replicated across AZs.

Exam trap

The trap here is that candidates often confuse Amazon RDS Multi-AZ with a generic high-availability solution, but RDS Multi-AZ does not support SAP HANA, making DMS the correct choice for replicating SAP S/4HANA databases across Availability Zones.

How to eliminate wrong answers

Option A is wrong because EC2 Auto Scaling is designed to automatically adjust compute capacity based on demand, not to replicate databases or provide database-level high availability across AZs. Option B is wrong because Amazon S3 is an object storage service and cannot be used for real-time database replication or as a standby database instance. Option C is wrong because Amazon RDS Multi-AZ is a managed database service that provides automatic failover for supported database engines, but it does not support SAP HANA as a database engine, which is required for SAP S/4HANA workloads.

Practice this question →

289

Multi-Selecthard

A company is designing a disaster recovery (DR) strategy for SAP HANA on AWS. Which TWO of the following are valid DR approaches? (Choose two.)

Select 2 answers

A.Configure HANA System Replication to a secondary Region.

B.Use S3 cross-Region replication (CRR) to copy HANA backups.

C.Copy EBS snapshots to another Region using cross-Region snapshot copy.

D.Use AWS Backup with cross-Region copy.

E.Use Amazon RDS cross-Region read replicas for HANA.

AnswersA, C

HANA System Replication provides near real-time replication.

Why this answer

HANA System Replication (HSR) is a native SAP feature that asynchronously replicates the in-memory database to a secondary Region, enabling a full DR failover with minimal data loss. This approach is fully supported on AWS by deploying HANA instances in different Availability Zones or Regions, and it meets the RPO/RTO requirements for enterprise SAP HANA workloads.

Exam trap

The trap here is that candidates confuse backup replication (S3 CRR, AWS Backup) with live database replication (HSR), assuming any cross-Region copy mechanism qualifies as DR for HANA, when only HSR provides the required near-real-time data consistency and failover capability.

Practice this question →

290

MCQhard

A company runs SAP NetWeaver on AWS. The system uses a shared file system for transport files via Amazon EFS. Recently, the transport directory performance has degraded. Which configuration change is most likely to improve the I/O performance for the transport directory?

A.Enable EFS performance mode with Max I/O.

B.Migrate the transport directory to an Amazon EBS volume.

C.Use Amazon S3 with a mount point.

D.Use EFS with Bursting Throughput mode.

AnswerA

Max I/O mode optimizes for high throughput and large file operations.

Why this answer

Enabling EFS Max I/O performance mode provides higher throughput and IOPS for workloads with high I/O demands, such as SAP transport directories. Max I/O mode scales horizontally by distributing file data across multiple servers, which improves performance for parallel access patterns common in SAP transport operations.

Exam trap

The trap here is that candidates often assume Bursting Throughput mode (Option D) is sufficient for all EFS workloads, but they overlook that SAP transport directories require sustained high I/O that can exhaust burst credits, making Max I/O mode the better choice for consistent performance.

How to eliminate wrong answers

Option B is wrong because migrating to an EBS volume would require re-architecting the shared file system, as EBS is a block-level storage attached to a single EC2 instance, not suitable for shared access across multiple SAP instances. Option C is wrong because Amazon S3 with a mount point (e.g., using S3FS or similar FUSE-based solutions) introduces significant latency and lacks POSIX compliance, making it unsuitable for SAP transport directories that require low-latency file locking and consistency. Option D is wrong because EFS Bursting Throughput mode relies on burst credits and may not sustain high I/O performance for continuous workloads like SAP transport, leading to throttling once credits are exhausted.

Practice this question →

291

MCQhard

A company is designing a disaster recovery (DR) solution for SAP HANA on AWS. The primary site is in us-east-1, and the DR site is in us-west-2. The RPO is 5 minutes, and the RTO is 1 hour. The company wants to use SAP HANA System Replication (HSR). Which configuration meets these requirements?

A.Use asynchronous HSR with multiple secondary instances (multi-target) in us-west-2.

B.Use synchronous HSR between us-east-1 and us-west-2.

C.Use asynchronous HSR with a single secondary instance in us-west-2.

D.Use EBS snapshots every 5 minutes and copy them to us-west-2.

AnswerA

Multi-target async replication provides better RPO by replicating to multiple targets.

Why this answer

Multi-target asynchronous HSR allows SAP HANA to replicate data to multiple secondary instances simultaneously, meeting the 5-minute RPO with asynchronous replication while providing the flexibility to fail over to a secondary instance in us-west-2 within the 1-hour RTO. Asynchronous replication is necessary over such a long distance (us-east-1 to us-west-2) to avoid latency impacting primary site performance, and multi-target enables multiple DR targets without additional primary-side overhead.

Exam trap

The trap here is that candidates often assume synchronous replication is always better for low RPO, but over long distances it introduces unacceptable latency, making asynchronous the only viable option for cross-region DR.

How to eliminate wrong answers

Option B is wrong because synchronous HSR over a cross-region distance (us-east-1 to us-west-2) would introduce significant network latency, causing transaction commit delays and potentially exceeding the RTO due to performance degradation or replication timeouts. Option C is wrong because a single secondary instance in us-west-2 does not provide the required high availability for DR; if that single instance fails or becomes unreachable, replication stops and the RPO/RTO cannot be guaranteed. Option D is wrong because EBS snapshots every 5 minutes cannot achieve a 5-minute RPO due to snapshot creation and copying latency, and restoring from snapshots typically takes longer than 1 hour, failing the RTO.

Practice this question →

292

MCQeasy

A company is migrating its SAP ERP system to AWS and needs to choose a storage option for the SAP HANA database. Which AWS storage service is most suitable for SAP HANA data volumes?

A.Amazon S3

B.Amazon EBS io2 Block Express volumes

C.Amazon EBS gp3 volumes

D.Amazon EFS

AnswerB

io2 Block Express volumes provide high throughput and low latency, suitable for SAP HANA.

Why this answer

Amazon EBS io2 Block Express volumes are the most suitable for SAP HANA data volumes because they provide the highest level of performance, durability, and consistency required for SAP HANA's demanding I/O workloads. io2 Block Express volumes offer up to 256,000 IOPS per volume and sub-millisecond latency, meeting SAP's certification requirements for production SAP HANA deployments on AWS. This storage type ensures the low-latency, high-throughput, and consistent performance that SAP HANA's in-memory database requires for its data and log volumes.

Exam trap

The trap here is that candidates often choose gp3 volumes (Option C) because they are cost-effective and offer good general-purpose performance, but they fail to recognize that SAP HANA production workloads require the maximum IOPS and sub-millisecond latency that only io2 Block Express volumes can provide, as per SAP's certification guidelines.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service with high latency and no support for file-level locking or POSIX semantics, making it unsuitable for SAP HANA database volumes that require block-level storage with low latency and high IOPS. Option C is wrong because Amazon EBS gp3 volumes, while offering good baseline performance, cannot match the maximum IOPS (16,000 per volume) and consistent sub-millisecond latency required by SAP HANA for production workloads, and they are not certified by SAP for HANA data volumes in large-scale deployments. Option D is wrong because Amazon EFS is a file-level NFS storage service with higher latency and lower IOPS compared to block storage, and it is not supported for SAP HANA data or log volumes as SAP HANA requires direct-attached block storage for its database files.

Practice this question →

293

MCQeasy

A company needs to back up its SAP HANA database running on AWS. The backup must be stored in a durable and cost-effective manner. Which AWS service should the company use for long-term backup storage?

A.Amazon EBS snapshots

B.Amazon Glacier

C.AWS Backup

D.Amazon S3

AnswerD

S3 is ideal for durable and cost-effective backup storage.

Why this answer

Amazon S3 is the correct choice for long-term backup storage of SAP HANA databases on AWS because it offers 99.999999999% durability, is cost-effective with lifecycle policies to transition data to lower-cost tiers like S3 Glacier Deep Archive, and supports native integration with SAP HANA backup tools via the SAP HANA Backint agent for S3. This allows direct backup to S3 without intermediate storage, meeting both durability and cost requirements.

Exam trap

The trap here is that candidates confuse Amazon Glacier as a separate service rather than recognizing it as a storage class within Amazon S3, and they overlook that AWS Backup is an orchestration layer, not the primary storage target for SAP HANA's native Backint integration.

How to eliminate wrong answers

Option A is wrong because Amazon EBS snapshots are stored in Amazon S3 but are tied to a specific Availability Zone and are not designed for long-term, cost-optimized archival; they lack native lifecycle management to lower-cost tiers and incur costs for each incremental snapshot. Option B is wrong because Amazon Glacier is a storage class within S3, not a standalone service for direct SAP HANA backups; using Glacier directly would require additional tooling and does not support the Backint agent, making it impractical for active backup workflows. Option C is wrong because AWS Backup is a centralized backup service that can orchestrate backups to S3, but it does not provide the direct, native SAP HANA Backint integration that S3 offers, and it adds overhead for a simple backup-to-S3 requirement.

Practice this question →

294

MCQeasy

A company is planning to run SAP S/4HANA on AWS. They need to ensure that the SAP system can be restored within 4 hours in the event of a disaster. Which AWS service should be used to achieve this recovery time objective (RTO)?

A.AWS Elastic Disaster Recovery

B.EBS snapshots copied to another region

C.AWS CloudEndure Disaster Recovery

D.Amazon S3 cross-region replication

AnswerA

DRS provides fast recovery for SAP systems.

Why this answer

AWS Elastic Disaster Recovery (AWS DRS) is the correct service because it provides continuous replication of SAP S/4HANA workloads with sub-second RPO and supports automated recovery orchestration, enabling restoration within the 4-hour RTO. It is the direct successor to CloudEndure Disaster Recovery and is purpose-built for enterprise applications like SAP, offering non-disruptive testing and fast failover to a secondary AWS Region or Availability Zone.

Exam trap

The trap here is that candidates confuse AWS Elastic Disaster Recovery with its predecessor name 'CloudEndure Disaster Recovery' (Option C), which is the same service but the exam expects the current AWS branding, or they mistakenly think periodic EBS snapshots (Option B) can achieve a 4-hour RTO for SAP without considering the recovery time for snapshot restoration and database consistency.

How to eliminate wrong answers

Option B is wrong because EBS snapshots copied to another region provide only periodic, point-in-time backups (typically every 1-24 hours), which cannot guarantee the sub-minute RPO needed for SAP S/4HANA and may require manual steps to restore, exceeding the 4-hour RTO. Option C is wrong because AWS CloudEndure Disaster Recovery is the previous name for AWS Elastic Disaster Recovery; it is the same service, but the current AWS service name is 'AWS Elastic Disaster Recovery' (the exam uses the updated name), so selecting this option indicates a misunderstanding of the service naming. Option D is wrong because Amazon S3 cross-region replication is an object-level replication service for S3 buckets, not a block-level replication solution for EC2 instances or SAP databases, and it cannot replicate the entire SAP system state (OS, database, application) required for disaster recovery.

Practice this question →

295

Multi-Selecthard

Which THREE factors should be considered when choosing an EC2 instance type for SAP HANA? (Choose three.)

Select 3 answers

A.The instance must have enough memory to fit the HANA database.

B.The instance must support high network throughput for data replication.

C.The instance should have GPU accelerators for faster query processing.

D.The instance must have local instance store volumes for data persistence.

E.The instance type must be listed in the SAP HANA hardware directory for AWS.

AnswersA, B, E

HANA is memory-optimized.

Why this answer

SAP HANA is an in-memory database that loads the entire dataset into RAM for processing. The EC2 instance must have sufficient memory to accommodate the HANA database size, including overhead for system tables and temporary data, as specified in the SAP HANA memory sizing guidelines.

Exam trap

The trap here is that candidates may mistakenly think GPU accelerators are needed for SAP HANA's analytical queries or that local instance store volumes provide persistent storage, when in fact SAP HANA requires certified instance types and persistent storage like EBS.

Practice this question →

296

MCQmedium

An SAP system on AWS uses a multi-AZ deployment with an Application Load Balancer (ALB) to distribute traffic across application servers. The ALB health checks are failing intermittently. What is the most likely cause?

A.The security group for the ALB is blocking health check traffic.

B.The target group is not associated with the ALB.

C.The health check path is not configured correctly for the SAP application.

D.The application servers are running on burstable instance types.

AnswerC

Incorrect health check path can cause intermittent failures if the application occasionally returns non-200 status.

Why this answer

The most likely cause of intermittent health check failures in an SAP system on AWS is a misconfigured health check path. SAP applications often have specific endpoints (e.g., /sap/public/ping or a custom health check URL) that must return a 200 OK response. If the ALB health check path does not match the SAP application's expected endpoint, the ALB will intermittently mark targets as unhealthy, especially under load or during application state changes.

Exam trap

The trap here is that candidates often assume network-level issues (security groups or target group association) are the cause of intermittent failures, but the PAS-C01 exam tests the understanding that application-level health check configuration is the most common culprit for intermittent ALB health check failures in SAP environments.

How to eliminate wrong answers

Option A is wrong because if the ALB's security group were blocking health check traffic, the health checks would fail consistently, not intermittently; ALB health checks originate from the ALB's own IP addresses, and the target security group must allow inbound traffic on the health check port from the ALB's security group. Option B is wrong because if the target group were not associated with the ALB, the ALB would have no targets to route traffic to, resulting in a complete failure of traffic distribution, not intermittent health check failures. Option D is wrong because while burstable instance types (e.g., t3, t4g) can cause performance degradation under sustained CPU load, they do not directly cause health check failures; health checks are based on TCP or HTTP response, not CPU credits, and intermittent failures would more likely stem from application-level misconfiguration.

Practice this question →

297

MCQmedium

An administrator is troubleshooting an SAP system where the application server cannot connect to the database server. Both servers are in the same VPC but different subnets. Security groups allow traffic on the database port. What is the next step to diagnose the issue?

A.Check the DB Subnet Group configuration

B.Verify route tables for the subnets

C.Review VPC Flow Logs for rejected traffic

D.Check the Network ACLs for both subnets to ensure inbound/outbound rules allow the database port

AnswerD

NACLs are stateless and must allow both inbound and outbound traffic.

Why this answer

Network ACLs (NACLs) are stateless, meaning they require explicit inbound and outbound rules for traffic to flow in both directions. Even if security groups allow the database port, a missing or misconfigured NACL rule on either subnet can silently drop traffic. Since the servers are in different subnets, checking NACLs is the next logical step after confirming security groups are correct.

Exam trap

The trap here is that candidates assume security groups are the only firewall layer, forgetting that NACLs are stateless and must be explicitly configured for both inbound and outbound traffic on each subnet.

How to eliminate wrong answers

Option A is wrong because DB Subnet Group configuration only determines which subnets an RDS instance can be placed in, not the network connectivity between an application server and a database server. Option B is wrong because route tables control traffic between subnets and other networks, but within the same VPC, subnets are implicitly connected via the VPC's main route table, so missing routes are unlikely to cause a connectivity issue between two subnets. Option C is wrong because VPC Flow Logs are a diagnostic tool for analyzing traffic after a problem is suspected, not the next step in a systematic troubleshooting process; they would be useful if NACLs and security groups appear correct but traffic is still failing.

Practice this question →

298

MCQhard

A company runs its SAP S/4HANA production workload on AWS using an 8xlarge instance with 2,000 GB of gp3 storage for /usr/sap and 6,000 GB of io2 Block Express with 64,000 IOPS for /hana/data and /hana/log. The system experiences intermittent performance degradation during peak hours, particularly for batch jobs that heavily write to the database. The SAP team reports that the database response time spikes from under 5 milliseconds to over 200 milliseconds during these periods. The AWS account has a default EBS IOPS limit of 80,000 per region. The current io2 volume is attached as a single volume. Which combination of actions would resolve the performance issue?

A.Replace the io2 volumes with larger gp3 volumes and increase the volume size to 8,000 GB to benefit from gp3 baseline performance.

B.Split the /hana/data volume into multiple io2 volumes, configure them as a RAID 0 stripe, and attach each to a separate EBS-optimized connection. Increase total provisioned IOPS to 80,000 distributed across volumes.

C.Migrate to a larger instance type with higher EBS-optimized bandwidth and increase the volume IOPS to 80,000.

D.Increase the provisioned IOPS on the existing io2 volume to 80,000 IOPS to stay within the default limit.

AnswerB

RAID 0 across multiple volumes increases aggregate IOPS and throughput, leveraging multiple EBS connections and avoiding single-volume limits.

Why this answer

Splitting the /hana/data volume into multiple io2 volumes and configuring them as a RAID 0 stripe distributes I/O across multiple EBS-optimized connections, effectively increasing the available throughput and IOPS beyond the limits of a single volume attachment. This approach also allows the total provisioned IOPS to reach 80,000, which is the regional default limit, while each individual volume stays within its own IOPS ceiling, thus resolving the database response time spikes during peak batch write operations.

Exam trap

The trap here is that candidates assume increasing IOPS on a single volume or moving to a larger instance alone will solve the performance issue, ignoring the fundamental single-volume throughput and IOPS ceiling that requires striping across multiple volumes to scale.

How to eliminate wrong answers

Option A is wrong because gp3 volumes, even at 8,000 GB, have a baseline IOPS of only 16,000 (with a maximum of 16,000 IOPS without additional cost), which is far below the required 64,000 IOPS and cannot match the low-latency performance of io2 Block Express for SAP HANA workloads. Option C is wrong because simply migrating to a larger instance type with higher EBS-optimized bandwidth does not address the single-volume bottleneck; the existing single io2 volume still cannot exceed its maximum IOPS limit (64,000) and the throughput limitation of a single EBS attachment, so performance degradation would persist. Option D is wrong because increasing the provisioned IOPS on the existing single io2 volume to 80,000 exceeds the volume-level IOPS limit for io2 (which is 64,000 IOPS for volumes up to 16 TB) and also does not resolve the throughput bottleneck of a single EBS-optimized connection.

Practice this question →

299

MCQmedium

A company running SAP on AWS wants to automate the start and stop of non-production instances to save costs. Which AWS service is best suited for scheduling instance state changes?

A.AWS Instance Scheduler

B.Amazon CloudWatch Events (EventBridge)

C.AWS Auto Scaling

D.AWS Lambda with custom code

AnswerA

Specifically designed for scheduling EC2 start/stop.

Why this answer

AWS Instance Scheduler is a purpose-built solution that uses AWS CloudFormation to deploy a scheduler that automatically starts and stops EC2 instances based on defined schedules. It is the recommended approach for SAP non-production instances because it natively supports tagging, time zones, and periodic schedules without requiring custom code, making it the most cost-effective and maintainable option for this use case.

Exam trap

The trap here is that candidates often choose AWS Lambda with custom code (Option D) because they think it gives more control, but the exam expects the purpose-built AWS Instance Scheduler as the best practice for scheduling instance state changes, as it is a managed solution that requires no custom development.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch Events (EventBridge) is a service for routing events to targets, not a scheduler itself; while it can invoke a Lambda function on a schedule, it lacks built-in instance management logic and would require additional custom code to handle start/stop operations. Option C is wrong because AWS Auto Scaling is designed to automatically adjust capacity based on demand or health checks, not to schedule instance state changes at specific times; it cannot start or stop instances on a fixed schedule. Option D is wrong because AWS Lambda with custom code is a valid approach but is not the best suited service for this task; it requires writing and maintaining custom scheduling logic, error handling, and state management, whereas AWS Instance Scheduler provides a ready-to-use, managed solution that reduces operational overhead.

Practice this question →

300

MCQmedium

An SAP administrator is designing a disaster recovery plan for SAP NetWeaver on AWS. They want to minimize RTO and RPO while keeping costs low. Which strategy should they use?

A.Use AWS Elastic Disaster Recovery (DRS) with SAP HANA system replication

B.Use AWS EC2 Image Builder to create daily AMIs

C.Take manual EBS snapshots every 12 hours

D.Replicate SAP application data to an S3 bucket in another region

AnswerA

DRS provides continuous replication, minimizing RTO and RPO.

Why this answer

AWS Elastic Disaster Recovery (DRS) with SAP HANA system replication is the correct strategy because it provides continuous replication at the block level, enabling sub-minute RPO and RTO of minutes, while minimizing costs by using lower-cost staging resources and only spinning up full-scale instances during a failover. This combination meets the requirement for minimal RTO/RPO and cost efficiency for SAP NetWeaver on AWS.

Exam trap

The trap here is that candidates often assume manual snapshots or AMI-based backups are sufficient for disaster recovery, but they fail to recognize that these methods cannot achieve the sub-minute RPO and low RTO required for critical SAP workloads, and they overlook the cost efficiency of DRS's staging architecture.

How to eliminate wrong answers

Option B is wrong because AWS EC2 Image Builder creates AMIs on a schedule, which can only achieve RPO of hours (not sub-minute) and requires launching new instances for recovery, leading to higher RTO; it does not provide continuous replication. Option C is wrong because manual EBS snapshots every 12 hours result in an RPO of up to 12 hours, which is far from minimal, and recovery requires restoring volumes and reconfiguring instances, increasing RTO. Option D is wrong because replicating SAP application data to an S3 bucket in another region does not provide a consistent, crash-consistent recovery point for the entire SAP stack (including database and application), and restoring from S3 requires manual steps, leading to high RTO and potential data loss.

Practice this question →