How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the PAS-C01 exam, each with detailed explanations and wrong-answer analysis.

How should I approach PAS-C01 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified SAP on AWS Specialty PAS-C01 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified SAP on AWS Specialty PAS-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PAS-C01

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Read the full NAT/PAT explanation →

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

A
Assign the patch baseline to the instance IDs directly.
Why wrong: Patch baselines are assigned to patch groups, not individual instances.
B
Ensure that the instances have the appropriate IAM role that allows them to be patched.
Why wrong: While necessary, this is a prerequisite and not a troubleshooting step for specific failures.
C
Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.
The SSM Agent must be online to execute patching commands.
D
Check the output of the AWS-RunPatchBaseline SSM document in the Systems Manager Run Command history for the failed instances.
The command output provides error details for troubleshooting.
E
Configure a Maintenance Window for the patching operation.
Why wrong: Maintenance Windows are optional; patching can be done on demand.

Full breakdown with real-world context →

Question 2mediumdrag order

Full question →

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3easymultiple choice

Full question →

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

A
Modify the security group to allow all traffic temporarily
Why wrong: Opening security groups blindly reduces security and does not diagnose the issue.
B
Review CloudWatch metrics for the instance and the ALB target group
CloudWatch metrics provide baseline data for troubleshooting connectivity issues.
C
Terminate the instance and let Auto Scaling launch a new one
Why wrong: Terminating without investigation does not identify root cause.
D
Attach an additional Elastic Network Interface (ENI) to the instance
Why wrong: Adding an ENI does not diagnose intermittent connectivity and may complicate the setup.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

A
The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint
Missing outbound HTTPS from the instance to the SSM endpoint prevents communication.
B
The CodeDeploy agent on the instances is outdated
Why wrong: Patch Manager uses SSM Agent, not CodeDeploy Agent.
C
The instances are not registered as managed instances with the SSM ManagedInstance role
Why wrong: If they are already managed, this error is not related to registration.
D
The instances do not have an IAM instance profile attached
Why wrong: If the instance were missing an IAM role, it would not appear in the managed instances list at all.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

A
Examine the S3 server access logs for the bucket.
Why wrong: Server access logs do not include management API calls.
B
Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.
CloudTrail records all API calls with details.
C
Review the configuration timeline in AWS Config for the S3 bucket.
Why wrong: Config shows the changes but not the user identity.
D
Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.
Why wrong: Inefficient and not the direct tool.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

A
CloudFrontFullAccess
Why wrong: This policy is for CloudFront distributions, not S3 bucket operations.
B
AdministratorAccess
Why wrong: Overly permissive and not a best practice.
C
AmazonS3ReadOnlyAccess
Why wrong: This policy only allows read access, not write.
D
A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.
These are the minimum permissions needed to upload files to S3.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

A
Manually delete the DynamoDB table and then retry the stack update.
Why wrong: Manual deletion may cause data loss and does not resolve the rollback state.
B
Delete the stack and recreate it from the template.
Why wrong: Deleting the stack removes all resources, including the DynamoDB table with data.
C
Use the ContinueUpdateRollback API to resume the rollback.
This allows CloudFormation to retry rolling back the failed resource.
D
Update the stack again with a different change set to bypass the failed resource.
Why wrong: Updating again is not possible while the stack is in UPDATE_ROLLBACK_FAILED state.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/logs/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}
```

A
The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.
The bucket policy condition requires this header; without it, the request is denied.
B
The S3 bucket has versioning enabled, which requires additional permissions.
Why wrong: Versioning does not affect the ability to upload objects; the condition is the issue.
C
The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.
Why wrong: The resource ARN with logs/* is valid and restricts to the logs/ prefix.
D
The bucket policy does not grant the s3:PutObject permission to the IAM role.
Why wrong: The policy explicitly allows s3:PutObject for the specified role.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full NAT/PAT explanation →

A systems administrator is troubleshooting an SAP HANA database that runs on an EC2 instance. The exhibit shows the block device mappings of the EC2 instance. The administrator needs to ensure that the data volumes (/dev/sdf and /dev/sdg) are not accidentally terminated when the instance is terminated. However, the administrator also wants to take a nightly snapshot of these volumes using AWS Backup. Which of the following is a potential issue with the current configuration?

Network Topology

A
The volume /dev/sdf has DeleteOnTermination set to false, which will cause data persistence issues.
Why wrong: False is the correct setting to prevent data loss.
B
The device names /dev/sdf and /dev/sdg are reserved for NVMe instance storage and should not be used for EBS.
Why wrong: These device names are valid for EBS.
C
The volumes are attached to a running instance, which prevents snapshot creation.
Why wrong: Snapshots can be taken of attached volumes.
D
The volumes are not tagged, so AWS Backup may not automatically include them in backup plans.
AWS Backup typically uses tags to identify resources.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

An SAP administrator is creating an IAM policy for an EC2 instance that performs SAP database backups to S3 and creates EBS snapshots. The policy as shown fails to allow the EC2 instance to perform backup operations. What is the most likely reason?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::sap-backup-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSnapshot",
        "ec2:DescribeSnapshots"
      ],
      "Resource": "*"
    }
  ]
}

A
The S3 resource ARN is incorrect; it should be 'arn:aws:s3:::sap-backup-bucket' without the '/*'.
Why wrong: The ARN with '/*' is correct for object-level actions; list bucket requires the bucket ARN without '/*'.
B
The S3 actions are too permissive; they should be restricted to specific prefixes.
Why wrong: The actions are appropriate for backup operations; the issue is not over-permissiveness.
C
The ec2:CreateSnapshot action must be restricted to specific volume ARNs.
Why wrong: While best practice, it is not required; the policy works without volume ARN restriction.
D
The policy does not include the 's3:ListBucket' action for the bucket itself.
Without 's3:ListBucket' on the bucket resource, the instance cannot list objects or verify bucket existence, causing failures.

Full breakdown with real-world context →

Question 11hardmultiple choice

Review the full subnetting walkthrough →

An SAP system on AWS experiences intermittent connectivity issues between the SAP Central Services (SCS) instance and the application servers. The SCS instance is in a private subnet in us-east-1a, and the application servers are spread across us-east-1a and us-east-1b. Security groups allow traffic on all required ports. What is the MOST likely cause of the intermittent connectivity?

A
The route tables do not have a route for the SCS subnet.
Why wrong: Incorrect routing would cause persistent, not intermittent, failure.
B
The network ACLs are blocking the traffic.
Network ACLs are stateless and can cause intermittent issues if inbound rules allow but outbound rules deny return traffic.
C
The Internet Gateway is misconfigured.
Why wrong: Internet Gateway is not involved in private subnet communication.
D
The VPC peering connection is not established correctly.
Why wrong: No VPC peering is mentioned.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

An SAP administrator created the above IAM policy for an EC2 instance that performs automated SAP HANA backups. The backup script runs successfully but fails to upload the backup files to the S3 bucket. What is the most likely cause?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ec2:CreateSnapshot",
        "ec2:CreateTags"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::sap-backup-bucket/*"
    }
  ]
}

A
The S3 bucket policy denies the upload
Why wrong: There is no evidence of a bucket policy; the IAM policy is insufficient.
B
The IAM policy does not include permissions for multipart upload operations
Multipart uploads require additional actions like s3:AbortMultipartUpload.
C
The IAM policy does not allow s3:PutObject
Why wrong: The policy explicitly allows s3:PutObject.
D
The EC2 instance does not have permission to create snapshots
Why wrong: The policy allows ec2:CreateSnapshot.

Full breakdown with real-world context →

Question 13mediummultiple choice

Full question →

An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:DescribeInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*"
      ],
      "Resource": "*"
    }
  ]
}

A
The user does not have permission to describe instances.
Why wrong: ec2:DescribeInstances is allowed.
B
The resource ARN is too restrictive.
Why wrong: Resource is instance/* which covers all instances.
C
There is an implicit deny for all actions not listed.
Why wrong: Implicit deny exists but the missing action is the issue.
D
The policy does not include the ec2:CreateTags action.
Tagging requires ec2:CreateTags action.

Full breakdown with real-world context →

Question 14easymultiple choice

Full question →

An SAP system is running on an EC2 instance with an instance profile that grants access to an S3 bucket. The application is unable to read a specific object from the bucket. What is the first step to troubleshoot the issue?

A
Check the security group associated with the instance
Why wrong: Security groups do not control access to S3.
B
Check the network ACLs
Why wrong: NACLs are for VPC subnet traffic, not S3 access.
C
Check the IAM policy attached to the instance profile
The instance profile's IAM role must have s3:GetObject permission for the object.
D
Check the S3 bucket policy
Why wrong: Bucket policy might be blocking access, but first step is to check IAM permissions.

Full breakdown with real-world context →

Question 15easymultiple choice

Full question →

An SAP administrator is troubleshooting connectivity between SAP application servers and the SAP HANA database. The database security group has an inbound rule as shown in the exhibit. The application servers are in security group sg-12345. However, the application servers cannot connect to the database. What is the most likely reason?

Exhibit

Refer to the exhibit.
{
  "Rules": [
    {
      "SourceSecurityGroupId": "sg-12345",
      "IpProtocol": "tcp",
      "FromPort": 3300,
      "ToPort": 3300
    }
  ]
}

A
The source should be the IP address range of the application servers.
Why wrong: Using security group is correct.
B
The rule uses the wrong protocol; it should be UDP.
Why wrong: SAP HANA uses TCP.
C
The outbound rule on the application server security group is missing.
Why wrong: Outbound rules are typically allow-all by default.
D
The port number is incorrect for SAP HANA.
SAP HANA uses port 3<instance_number>15, not 3300.

Full breakdown with real-world context →

These PAS-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style PAS-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related PAS-C01 topic practice pages

Design of SAP Workloads on AWS practice questions

Technology practice questions

Migration practice questions

Operations and Maintenance practice questions

PAS-C01 fundamentals practice questions

PAS-C01 scenario practice questions

PAS-C01 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Exhibit

An SAP administrator is creating an IAM policy for an EC2 instance that performs SAP database backups to S3 and creates EBS snapshots. The policy as shown fails to allow the EC2 instance to perform backup operations. What is the most likely reason?

Exhibit

An SAP administrator created the above IAM policy for an EC2 instance that performs automated SAP HANA backups. The backup script runs successfully but fails to upload the backup files to the S3 bucket. What is the most likely cause?

Exhibit

An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?

Exhibit

An SAP system is running on an EC2 instance with an instance profile that grants access to an S3 bucket. The application is unable to read a specific object from the bucket. What is the first step to troubleshoot the issue?

Exhibit