SAP HANA Backint with S3: Required Components
An SAP administrator is designing a backup strategy for an SAP HANA database on AWS. They want to use the Backint interface with Amazon S3. Which THREE components are required? (Choose three.)
Quick Answer
Backint is SAP HANA's standard interface for third-party backup tools, and using it with Amazon S3 means assembling the specific pieces that let the Backint agent actually authenticate to and write into S3 successfully. An S3 bucket to receive and store the backup files is the most basic component, since it's the actual destination the Backint agent writes to. Just as essential is an IAM role that grants the Backint agent the permissions it needs to perform operations like PutObject against that specific bucket - without that role in place, the agent has a destination to write to but no authorization to actually do so, and the backup will fail on the permissions check rather than completing. Thinking about it as a chain helps: Backint on the HANA side initiates the backup, but everything from that point onward depends on AWS-side plumbing being correctly set up, a bucket that exists and is reachable, and an IAM role attached to the resource performing the write that's scoped to allow it. This mirrors a broader pattern with AWS storage integrations generally: a storage destination alone is never sufficient on its own, since AWS's security model requires an explicit permission grant, typically via IAM, before any principal, including a backup agent, can write to that destination. When a question asks what's required for an on-AWS backup interface like Backint to work with S3, expect the answer to include both the storage destination itself and the IAM permissions that authorize writing to it.
⚠ Common exam trap
Watch out — candidates often assume EBS volumes are required for the backup catalog or that S3 Transfer Acceleration is mandatory for performance, but the Backint interface only needs the agent, an S3 bucket, and an IAM role with write permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM role with permissions to write to the S3 bucket
The Backint interface for SAP HANA on AWS requires an IAM role that grants the AWS Backint Agent permissions to write backup data to the designated S3 bucket. Without this IAM role, the agent cannot authenticate or perform PutObject operations against S3, making the backup fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EBS volumes for the backup catalog
Why it's wrong here
EBS volumes are not required; Backint manages catalog in S3.
- ✓
IAM role with permissions to write to the S3 bucket
Why this is correct
The EC2 instance needs an IAM role to access S3.
- ✓
AWS Backint Agent for SAP HANA
Why this is correct
The Backint agent integrates with SAP HANA to back up directly to S3.
- ✗
S3 Transfer Acceleration enabled
Why it's wrong here
Transfer Acceleration is optional, not required.
- ✓
An S3 bucket to store the backups
Why this is correct
S3 bucket is the target for Backint backups.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An SAP administrator configures SAP HANA backup using Backint as shown in the exhibit. The backup job fails with an error indicating that the bucket 'sap-hana-backup-prod' does not exist. The administrator confirms that the bucket name is correct. What is the most likely cause of the failure?
hard- A.The IAM role used by the instance does not have s3:PutObject permission.
- B.The chunk size is too large for the bucket.
- ✓ C.The bucket is in a different AWS region than the EC2 instance.
- D.The bucket has a bucket policy that denies access.
Why C: The SAP HANA Backint agent communicates with Amazon S3 using the AWS SDK, which resolves the bucket endpoint based on the region configured in the agent or the instance metadata. If the bucket 'sap-hana-backup-prod' exists in a different AWS region than the EC2 instance, the Backint agent will attempt to access the bucket using the wrong regional endpoint, resulting in a 'bucket does not exist' error. This is a common misconfiguration when the Backint parameter file does not explicitly set the correct region or when the instance's default region differs from the bucket's region.
Variation 2. An SAP HANA database administrator needs to restore a database from a backup stored in Amazon S3. The backup was taken using SAP HANA Backint. Which AWS service should be used to retrieve the backup files from S3?
easy- ✓ A.SAP HANA Backint agent
- B.Amazon S3 console
- C.AWS CLI
- D.AWS Backup
Why A: SAP HANA Backint is the native SAP interface for integrating with third-party backup tools. When a backup is taken using Backint, the backup files are stored in Amazon S3 via the Backint agent for SAP HANA on AWS. To restore from these backups, the same Backint agent must be used because it understands the proprietary metadata and file format that Backint writes to S3, and it handles the direct S3 API calls required to retrieve the files. Other methods like the S3 console or AWS CLI cannot interpret Backint-specific metadata or restore the database correctly.
Variation 3. An SAP administrator is creating an IAM policy for an EC2 instance that performs SAP database backups to S3 and creates EBS snapshots. The policy as shown fails to allow the EC2 instance to perform backup operations. What is the most likely reason?
medium- A.The S3 resource ARN is incorrect; it should be 'arn:aws:s3:::sap-backup-bucket' without the '/*'.
- B.The S3 actions are too permissive; they should be restricted to specific prefixes.
- C.The ec2:CreateSnapshot action must be restricted to specific volume ARNs.
- ✓ D.The policy does not include the 's3:ListBucket' action for the bucket itself.
Why D: The policy lacks the `s3:ListBucket` action for the bucket itself (ARN without `/*`). When an EC2 instance performs SAP database backups to S3, the AWS SDK or CLI first issues a `ListBucket` request to verify the bucket exists and to list objects before uploading. Without this permission, the backup operation fails at the initial listing step, even if `s3:PutObject` is allowed on the object ARN.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.