CCNA Sap Workload Design Questions — Page 2 of 6

Multi-Selectmedium

Which THREE are valid strategies for backing up an SAP HANA database on AWS? (Choose three.)

Select 3 answers

A.Use Amazon EBS snapshots of the HANA data volumes.

B.Use AWS Backup to schedule and manage HANA backups.

C.Use SAP HANA Backint agent to back up to Amazon S3.

D.Set up an Amazon RDS for SAP HANA read replica.

E.Configure a lifecycle policy to move backups to Amazon S3 Glacier immediately.

AnswersA, B, C

EBS snapshots are crash-consistent and can be used for HANA backups with application consistency steps.

Why this answer

Amazon EBS snapshots provide crash-consistent, point-in-time backups of the HANA data volumes. When used with SAP HANA's snapshot mode (e.g., via hdbsql or Python scripts), they ensure transactional consistency by quiescing the database before the snapshot. This is a valid and commonly used backup strategy for SAP HANA on AWS.

Exam trap

The trap here is that candidates may confuse Amazon RDS with EC2-based deployments, incorrectly assuming RDS supports SAP HANA, or they may think immediate Glacier transitions are acceptable without considering SAP HANA's need for rapid restore access.

Practice this question →

MCQhard

An SAP system uses an Amazon RDS for SAP ASE database. The database is experiencing high connection timeouts. The SAP team notices that the RDS instance's maximum connections parameter is set to 500. What should be done to resolve the issue?

A.Upgrade the RDS instance to a larger size with more vCPUs.

B.Modify the RDS parameter group to increase max_connections.

C.Create a read replica to offload connections.

D.Increase the allocated storage for the RDS instance.

AnswerB

Directly addresses the connection limit.

Why this answer

The high connection timeouts are caused by the max_connections parameter being set to 500, which is the default for many RDS for SAP ASE instances. Increasing this value in the RDS parameter group allows more concurrent connections to the database, directly resolving the timeout issue without changing the instance size or storage. This is the simplest and most effective fix because the database engine itself is capable of handling more connections if the parameter is adjusted.

Exam trap

The trap here is that candidates often assume connection timeouts are caused by insufficient compute or storage resources, leading them to choose instance upgrades or storage increases, when the actual root cause is a misconfigured database parameter that directly controls the connection limit.

How to eliminate wrong answers

Option A is wrong because upgrading to a larger instance with more vCPUs does not automatically increase the max_connections limit; it only provides more compute resources, but the connection limit is a separate parameter that must be explicitly modified. Option C is wrong because creating a read replica does not offload connections from the primary database; read replicas handle read-only traffic, but connection timeouts are typically caused by the primary database reaching its connection limit, and read replicas do not reduce the number of connections to the primary instance. Option D is wrong because increasing allocated storage does not affect the max_connections parameter; storage size is unrelated to the number of concurrent database connections.

Practice this question →

Multi-Selectmedium

A company is migrating an SAP NetWeaver system to AWS. The system uses an on-premises shared file system (NFS). Which TWO AWS services can provide a scalable, highly available NFS share for SAP transport directories?

Select 2 answers

A.AWS Storage Gateway File Gateway

B.Amazon Elastic Block Store (EBS) with a shared volume

C.Amazon Elastic File System (EFS)

D.Amazon S3 with S3 File Gateway

E.Amazon FSx for NetApp ONTAP

AnswersC, E

EFS is a scalable NFS file system.

Why this answer

Amazon EFS provides a scalable, fully managed NFS file system that is highly available across multiple Availability Zones, making it suitable for SAP transport directories. It supports the NFSv4 protocol required by SAP and automatically scales storage capacity as files are added or removed, eliminating the need for manual provisioning.

Exam trap

The trap here is that candidates may confuse AWS Storage Gateway File Gateway or S3 File Gateway with native NFS services, not realizing that these gateway solutions introduce additional latency and are not recommended for SAP transport directories due to performance and consistency requirements.

Practice this question →

MCQeasy

An SAP Basis administrator needs to automate the start and stop of SAP application servers on AWS to reduce costs during non-business hours. The instance must be stopped (not terminated) to preserve the data. Which AWS service can be used to schedule the start and stop?

A.AWS Auto Scaling

B.Amazon CloudWatch Alarms

C.AWS Instance Scheduler

D.AWS Systems Manager Maintenance Windows

AnswerC

Specifically designed to schedule start/stop of instances.

Why this answer

AWS Instance Scheduler is a solution that uses AWS Lambda and Amazon CloudWatch Events (Amazon EventBridge) to automatically start and stop EC2 instances based on a defined schedule. For SAP Basis administrators, this allows stopping (not terminating) SAP application server instances during non-business hours, preserving all data on the attached EBS volumes. The solution supports tagging instances with schedule tags, making it ideal for cost optimization without data loss.

Exam trap

The trap here is that candidates confuse 'scheduling start/stop' with 'automating scaling' (Auto Scaling) or 'scheduling maintenance tasks' (Maintenance Windows), but only AWS Instance Scheduler is purpose-built for time-based instance state transitions without termination.

How to eliminate wrong answers

Option A is wrong because AWS Auto Scaling is designed to automatically adjust capacity based on demand or health checks, not to schedule start/stop actions on a fixed time-based schedule; it would terminate instances during scale-in, which would destroy data. Option B is wrong because Amazon CloudWatch Alarms monitor metrics and trigger actions based on thresholds (e.g., CPU utilization), not on a recurring time schedule; they cannot reliably stop and start instances at specific times like 6 PM and 6 AM. Option D is wrong because AWS Systems Manager Maintenance Windows are used to schedule administrative tasks (e.g., patching, running commands) on instances that are already running, not to start or stop instances; they require the instance to be running to execute actions.

Practice this question →

MCQmedium

A company is running SAP ERP on AWS. They want to implement automated backups for the SAP HANA database using AWS Backup. Which AWS service should they use to orchestrate the HANA backup?

A.AWS Backup

B.AWS Lambda

C.Amazon Data Lifecycle Manager

D.AWS Systems Manager

AnswerA

AWS Backup supports SAP HANA via Backint.

Why this answer

AWS Backup natively supports SAP HANA databases by integrating with the SAP HANA Backint agent, which allows you to define backup policies, retention rules, and cross-region copy directly from the AWS Backup console. This eliminates the need for custom scripting or manual orchestration, making it the correct service for automating HANA backups on AWS.

Exam trap

The trap here is that candidates may confuse AWS Backup's general snapshot capabilities with services like DLM or Systems Manager, not realizing that AWS Backup has specific SAP HANA Backint integration that makes it the only correct choice for orchestrating HANA database backups.

How to eliminate wrong answers

Option B is wrong because AWS Lambda is a serverless compute service used for running code in response to events, not for orchestrating database backups; it would require custom code to invoke HANA backup commands and manage lifecycle, adding complexity without native backup integration. Option C is wrong because Amazon Data Lifecycle Manager (DLM) is designed for automating the creation, retention, and deletion of Amazon EBS snapshots and EBS-backed AMIs, not for orchestrating SAP HANA database backups which require Backint integration. Option D is wrong because AWS Systems Manager is a management service for operational tasks like patching and automation runbooks, but it does not provide native backup orchestration for SAP HANA; while it can trigger scripts, it lacks the built-in backup policy and retention management that AWS Backup offers for HANA.

Practice this question →

MCQmedium

A company is running SAP on AWS and wants to use a custom AMI for SAP application servers. They need to ensure that the AMI is encrypted using AWS KMS. Which step is required to launch encrypted instances from this AMI?

A.Use an AWS Marketplace AMI that is already encrypted.

B.Use the AWS Management Console to modify the AMI to enable encryption.

C.Specify the KMS key ID in the run-instances command.

D.Copy the AMI and specify a KMS key for encryption.

AnswerD

Copying allows encryption of the AMI.

Why this answer

To launch encrypted instances from an unencrypted custom AMI, you must first copy the AMI and specify a KMS key for encryption during the copy process. This creates an encrypted AMI that can then be used to launch encrypted instances. AWS does not allow you to directly encrypt an existing AMI in place; the copy operation is the required mechanism.

Exam trap

The trap here is that candidates confuse encrypting the instance's root volume at launch (option C) with encrypting the AMI itself, not realizing that only a copy operation with a KMS key creates a persistently encrypted AMI.

How to eliminate wrong answers

Option A is wrong because the question specifies using a custom AMI, not an AWS Marketplace AMI, and the requirement is to encrypt a custom AMI, not to use a pre-encrypted one. Option B is wrong because the AWS Management Console does not provide a direct 'modify AMI to enable encryption' action; AMI encryption is only achieved through the copy operation or during instance launch with encryption settings. Option C is wrong because specifying a KMS key ID in the run-instances command only encrypts the root volume of the instance being launched, not the AMI itself; the AMI remains unencrypted, and subsequent launches from that AMI would not be encrypted unless the AMI is first copied with encryption.

Practice this question →

MCQmedium

A retail company runs its SAP ERP system on AWS. The system includes an SAP HANA database on an r5.8xlarge instance with 4TB of storage using a single EBS io1 volume with 16000 provisioned IOPS. The application experiences periodic slowdowns during end-of-month financial closing, which typically lasts for 2 hours. The CloudWatch metrics show that during the slowdown, the EBS volume's Average Queue Length peaks at 20, and the instance's EBS Bandwidth is at 3500 Mbps (the maximum for r5.8xlarge is 4750 Mbps). The database team confirms that HANA is not CPU-bound during these periods. The SAP team wants a cost-effective solution to eliminate the performance bottleneck. Which solution should be recommended?

A.Use an Amazon FSx for Lustre file system as the HANA data volume for higher throughput.

B.Move to an r5n.24xlarge instance and use multiple io1 volumes in a RAID 0 stripe to increase throughput.

C.Increase the provisioned IOPS on the io1 volume to 32000 IOPS to reduce queue length.

D.Switch to a gp3 volume with 16000 IOPS and 1000 MB/s throughput to reduce cost.

AnswerB

Larger instance provides more EBS bandwidth; RAID 0 improves aggregate IOPS and throughput.

Why this answer

The bottleneck is EBS bandwidth, not IOPS. The r5.8xlarge instance has a maximum EBS bandwidth of 4750 Mbps, and during the slowdown the volume is already using 3500 Mbps, leaving limited headroom. By moving to an r5n.24xlarge instance, which offers significantly higher EBS bandwidth (up to 19,000 Mbps), and using multiple io1 volumes in a RAID 0 stripe, you can distribute the I/O load and increase both throughput and IOPS, eliminating the queue length issue cost-effectively without over-provisioning a single volume.

Exam trap

The trap here is that candidates often focus on increasing IOPS (option C) when the real bottleneck is EBS bandwidth, which is an instance-level limit, not a volume-level limit.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Lustre is a high-performance file system designed for HPC and large-scale analytics, not for SAP HANA data volumes; SAP HANA requires block storage (EBS) for its data and log volumes, and using a file system would introduce unacceptable latency and complexity. Option C is wrong because increasing provisioned IOPS to 32000 on a single io1 volume would not resolve the bottleneck; the instance's EBS bandwidth limit of 4750 Mbps caps the maximum throughput, and the queue length is caused by bandwidth saturation, not insufficient IOPS. Option D is wrong because switching to a gp3 volume with 16000 IOPS and 1000 MB/s throughput would actually reduce performance; gp3 has a baseline throughput of only 125 MB/s (1000 Mbps) and would throttle the workload, worsening the slowdown, and it does not address the instance-level bandwidth limitation.

Practice this question →

MCQhard

A company is running SAP HANA on AWS and wants to encrypt the EBS volumes at rest. They also need to manage the encryption keys themselves. Which solution should they use?

A.Use AWS KMS with a customer managed key (CMK)

B.Enable EBS encryption with the default AWS managed KMS key

C.Use AWS CloudHSM to store keys

D.Use AWS Systems Manager Parameter Store

AnswerA

CMK allows customer to manage keys.

Why this answer

AWS KMS with a customer managed key (CMK) allows the company to have full control over the encryption keys used for EBS volume encryption, including key rotation, access policies, and disabling or deleting the key. This meets the requirement to manage the encryption keys themselves while still leveraging AWS KMS for key management and auditing.

Exam trap

The trap here is that candidates may confuse CloudHSM as a valid option for EBS encryption because it provides key storage, but AWS EBS encryption only supports KMS keys, not direct CloudHSM integration.

How to eliminate wrong answers

Option B is wrong because using the default AWS managed KMS key means AWS manages the key lifecycle and the customer cannot control or manage the key themselves, which violates the requirement to manage encryption keys. Option C is wrong because AWS CloudHSM provides hardware security modules for key storage but does not directly integrate with EBS encryption; EBS encryption requires a KMS key, and CloudHSM cannot be used as the key source for EBS volume encryption. Option D is wrong because AWS Systems Manager Parameter Store is a service for storing configuration data and secrets, not for managing encryption keys for EBS volumes, and it does not provide the cryptographic operations needed for EBS encryption.

Practice this question →

MCQhard

A company runs SAP ERP 6.0 on an Oracle database on EC2. The system is experiencing high CPU usage on the database server during peak hours. Analysis shows that the CPU is consumed by log writes. Which configuration change can reduce CPU usage?

A.Disable archiving of redo logs.

B.Switch from EBS gp3 to io2 Block Express volumes.

C.Upgrade to a larger EC2 instance type with more vCPUs.

D.Increase the Oracle log buffer size to reduce the number of log write operations.

AnswerD

Larger log buffer reduces write frequency, lowering CPU usage.

Why this answer

High CPU usage from log writes indicates that the database is spending excessive CPU cycles on writing redo log entries to disk. Increasing the Oracle log buffer size reduces the frequency of log write operations by allowing more redo data to accumulate before a write is triggered, thereby lowering CPU overhead. This directly addresses the root cause without changing storage or compute capacity.

Exam trap

The trap here is that candidates often confuse storage performance improvements (like faster EBS volumes) with database-level tuning, assuming that faster I/O reduces CPU usage, when in fact the CPU is consumed by the overhead of too many small write operations, not by slow I/O.

How to eliminate wrong answers

Option A is wrong because disabling archiving of redo logs would prevent point-in-time recovery and is not a supported configuration for production SAP systems, nor does it reduce CPU usage from log writes (it only stops copying to archive logs). Option B is wrong because switching to io2 Block Express volumes improves IOPS and throughput but does not reduce the number of log write operations; CPU consumption from log writes is a database-level issue, not a storage latency issue. Option C is wrong because upgrading to a larger EC2 instance adds more vCPUs but does not address the underlying inefficiency of frequent log writes; it would mask the symptom rather than fix the cause.

Practice this question →

MCQhard

An SAP environment on AWS is using a single Availability Zone. The company wants to achieve high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which architecture should they implement?

A.Deploy ASCS and ERS in the same Availability Zone with a second instance as passive.

B.Place ASCS and ERS on the same instance to reduce complexity.

C.Deploy ASCS and ERS in separate Availability Zones using AWS Launch Wizard for SAP.

D.Use Auto Scaling groups to automatically replace failed instances.

AnswerC

AWS Launch Wizard for SAP can deploy a multi-AZ HA architecture with automatic failover.

Why this answer

Achieving high availability for SAP Central Services (ASCS) and Enqueue Replication Server (ERS) on AWS requires deploying them in separate Availability Zones (AZs) to protect against an entire AZ failure. AWS Launch Wizard for SAP automates the deployment of a multi-AZ SAP system, including the necessary infrastructure components like Elastic Load Balancing and Amazon EFS, ensuring that the ASCS and ERS instances are in different AZs with a replicated enqueue table. This architecture aligns with SAP's recommendation for a high-availability setup using a Pacemaker cluster with STONITH fencing, which is supported by AWS.

Exam trap

The trap here is that candidates often assume that a passive instance in the same AZ provides sufficient redundancy, overlooking that AWS defines an Availability Zone as a single failure domain, so true high availability requires separation across AZs.

How to eliminate wrong answers

Option A is wrong because deploying ASCS and ERS in the same Availability Zone with a passive instance does not protect against an AZ outage; if that single AZ fails, both the active and passive instances become unavailable, violating the high-availability requirement. Option B is wrong because placing ASCS and ERS on the same instance eliminates redundancy and creates a single point of failure; SAP explicitly requires separate instances for ASCS and ERS in a high-availability configuration to allow independent failover. Option D is wrong because Auto Scaling groups are designed for stateless, horizontally scalable workloads and cannot handle the stateful failover requirements of SAP ASCS/ERS, which rely on cluster-aware fencing and enqueue replication, not instance replacement.

Practice this question →

MCQeasy

A company is designing a highly available SAP NetWeaver system on AWS. They plan to use a two-node ASCS/ERS cluster with SUSE Linux Enterprise Server (SLES). Which AWS service is required to manage the virtual IP address for the cluster?

A.AWS VPC Peering

B.Amazon Route 53

C.Amazon EBS

D.Elastic Load Balancing

AnswerB

Route 53 can be configured with DNS failover to route traffic to the active node using the virtual IP.

Why this answer

Amazon Route 53 is required to manage the virtual IP address for the two-node ASCS/ERS cluster by using DNS failover. In a SLES-based SAP NetWeaver cluster on AWS, the cluster software (e.g., Pacemaker) updates a Route 53 DNS record with the private IP address of the active node, enabling clients to connect via a hostname that resolves to the current primary node. This DNS-based approach replaces traditional virtual IP (VIP) floating, which is not natively supported in AWS VPC due to the lack of gratuitous ARP or multicast.

Exam trap

The trap here is that candidates often confuse the need for a virtual IP address with traditional network-level VIPs (e.g., using Elastic IP or ENI attachment) and overlook that AWS does not support gratuitous ARP, so DNS-based failover via Route 53 is the required method for SAP ASCS/ERS clusters on SLES.

How to eliminate wrong answers

Option A is wrong because AWS VPC Peering is a network connectivity feature that connects VPCs, not a service for managing virtual IP addresses or DNS failover for an SAP cluster. Option C is wrong because Amazon EBS provides block-level storage volumes for EC2 instances, but it does not manage IP addresses or provide any DNS-based failover mechanism. Option D is wrong because Elastic Load Balancing distributes incoming traffic across multiple targets, but it cannot be used to manage a single virtual IP address for an ASCS/ERS cluster; the cluster requires a static VIP that follows the active node, which ELB does not support.

Practice this question →

MCQmedium

A company has deployed SAP S/4HANA on AWS using a single EC2 instance for the HANA database and multiple EC2 instances for the application servers. The system is in production and the company wants to implement high availability for the HANA database to minimize downtime during patching and failures. The HANA database is critical and must have an RTO of less than 5 minutes and an RPO of zero. The current setup uses a single EBS volume for /hana/data and another for /hana/log. The company has two Availability Zones available. Which solution meets the requirements?

A.Configure SAP HANA System Replication with automatic failover to a secondary HANA instance in another AZ.

B.Attach the EBS volumes to two EC2 instances using EBS Multi-Attach.

C.Use AWS Backup to schedule snapshots every 5 minutes and restore in another AZ if needed.

D.Deploy the HANA database on a larger EC2 instance with higher availability SLA.

AnswerA

Synchronous replication provides zero RPO and fast failover.

Why this answer

SAP HANA System Replication (HSR) with automatic failover meets the RTO < 5 minutes and RPO = 0 requirements by synchronously replicating data to a secondary HANA instance in another Availability Zone. Automatic failover ensures the secondary takes over without manual intervention, minimizing downtime during patching or failures. This is the only option that provides synchronous replication with zero data loss and fast failover across AZs.

Exam trap

The trap here is that candidates may confuse EBS Multi-Attach with a cross-AZ solution, but Multi-Attach is strictly single-AZ and cannot provide the required cross-AZ high availability for SAP HANA.

How to eliminate wrong answers

Option B is wrong because EBS Multi-Attach does not support attaching a single EBS volume to EC2 instances in different Availability Zones; it only works within the same AZ, so it cannot provide cross-AZ high availability. Option C is wrong because AWS Backup snapshots are asynchronous and taken at intervals (e.g., every 5 minutes), which cannot achieve an RPO of zero; restoring a snapshot also takes longer than 5 minutes, failing the RTO requirement. Option D is wrong because simply using a larger EC2 instance with a higher availability SLA does not provide failover to another instance or AZ; it only reduces the chance of failure but does not eliminate downtime during patching or actual failures.

Practice this question →

MCQmedium

An SAP system on AWS is running on an r5.16xlarge instance. The system is experiencing network throughput bottlenecks. Which step should be taken to improve network performance?

A.Move the instance to a placement group

B.Attach an Elastic Fabric Adapter

C.Enable Enhanced Networking and install the ENA driver

D.Change the instance type to c5.18xlarge

AnswerC

ENA provides higher bandwidth and lower latency.

Why this answer

Enabling Enhanced Networking and installing the Elastic Network Adapter (ENA) driver is the standard method to achieve higher packet-per-second (PPS) performance, lower latency, and increased network bandwidth on supported instance types like r5.16xlarge. Without the ENA driver, the instance uses the older Xen network driver, which cannot utilize the full 25 Gbps network bandwidth available to r5 instances, leading to throughput bottlenecks.

Exam trap

The trap here is that candidates assume changing to a larger or different instance type (like c5.18xlarge) will automatically increase network bandwidth, when in fact the root cause is the missing ENA driver, and the r5.16xlarge already supports the same 25 Gbps bandwidth once Enhanced Networking is enabled.

How to eliminate wrong answers

Option A is wrong because placement groups (cluster, spread, partition) affect network latency and throughput between instances within the same group, but they do not increase the maximum network bandwidth of a single instance; they only reduce inter-instance latency and jitter. Option B is wrong because Elastic Fabric Adapter (EFA) is designed for tightly coupled HPC/ML workloads using OS-bypass (e.g., Libfabric) and is not supported or beneficial for SAP workloads, which rely on standard TCP/IP networking. Option D is wrong because changing to c5.18xlarge does not inherently improve network performance; both r5.16xlarge and c5.18xlarge offer up to 25 Gbps network bandwidth, but the bottleneck is due to missing ENA driver, not instance type; additionally, c5 instances lack the memory required for SAP workloads, making this change impractical.

Practice this question →

MCQmedium

A company runs SAP HANA on AWS using an m5.24xlarge instance. The storage is configured with multiple EBS io1 volumes striped with LVM. Recently, the database performance has degraded. CloudWatch shows that the EBS write latency averages 5 ms, and the queue depth is consistently below 1. What is the most likely cause of the performance degradation?

A.The LVM stripe width is misconfigured causing uneven I/O distribution

B.The EBS-optimized instance feature is not enabled

C.The EBS volume type should be changed to gp3

D.The EBS write latency is too high and requires a larger instance

AnswerA

Improper stripe width can lead to hot spots.

Why this answer

With EBS write latency averaging 5 ms and queue depth consistently below 1, the storage subsystem is not saturated; the bottleneck is likely an uneven distribution of I/O across the LVM striped volumes. A misconfigured stripe width (e.g., too small or not aligned with the SAP HANA page size of 16 KB) can cause certain volumes to handle disproportionate write traffic, leading to localized latency spikes and overall performance degradation even when aggregate metrics appear acceptable.

Exam trap

The trap here is that candidates often assume high latency or low queue depth automatically points to an instance or volume type issue, rather than considering LVM striping misconfiguration as the root cause of uneven I/O distribution.

How to eliminate wrong answers

Option B is wrong because the m5.24xlarge instance is EBS-optimized by default, and the queue depth being below 1 indicates that the instance’s network bandwidth to EBS is not a limiting factor. Option C is wrong because changing to gp3 would not resolve an I/O distribution issue; gp3 offers baseline performance but still relies on proper LVM striping, and the current io1 volumes with adequate IOPS are not the root cause. Option D is wrong because a 5 ms write latency is within acceptable limits for EBS io1 (typically under 10 ms), and the queue depth below 1 shows the instance is not waiting on EBS; a larger instance would not fix a misconfigured stripe width.

Practice this question →

Multi-Selectmedium

A company is deploying SAP NetWeaver on AWS and needs to ensure high availability for the SAP Central Services (ASCS) and Enqueue Replication Server (ERS). Which AWS services can be used to implement a failover cluster for ASCS and ERS? (Select THREE.)

Select 3 answers

A.AWS CloudTrail

B.Elastic Load Balancing

C.Amazon Route 53

D.AWS Config

E.Custom scripts to manage floating IP and start/stop services

AnswersB, C, E

Can be used to route traffic to the active ASCS instance.

Why this answer

Elastic Load Balancing (ELB) is correct because it can be used in conjunction with a Network Load Balancer (NLB) to provide a stable endpoint for SAP ASCS and ERS failover. The NLB supports static IP addresses and can be configured with health checks that monitor the SAP service, automatically routing traffic to the healthy node in the cluster. This eliminates the need for a traditional floating IP and integrates with AWS-native failover mechanisms.

Exam trap

The trap here is that candidates often assume a traditional floating IP is required for SAP ASCS/ERS failover, but AWS recommends using an NLB and/or Route 53 to provide a stable endpoint, making custom scripts for floating IP management optional rather than mandatory.

Practice this question →

MCQhard

An SAP system on AWS has an SAP Central Services (ASCS) instance running on an EC2 instance. The solution must ensure high availability for the ASCS in case of an EC2 failure. The ASCS uses a shared file system for the /sapmnt and /usr/sap/trans directories. Which architecture meets the high availability requirement with the least administrative overhead?

A.Deploy a second ASCS instance in another AZ and use an EC2 instance running NFS server with an EBS volume

B.Use an Amazon EBS volume attached to the ASCS instance and replicate it to another Availability Zone using EBS Snapshots

C.Use Amazon S3 and mount it using s3fs-fuse for the shared file system

D.Use Amazon EFS for /sapmnt and /usr/sap/trans, and configure a Pacemaker cluster across two Availability Zones

AnswerD

EFS is a managed NFS file system that is highly available and integrates with Pacemaker for automatic failover.

Why this answer

Amazon EFS provides a fully managed, highly available, and durable NFS file system that can be mounted concurrently across multiple EC2 instances in different Availability Zones. By using EFS for /sapmnt and /usr/sap/trans, and configuring a Pacemaker cluster across two AZs, you achieve automatic failover for the ASCS instance without the administrative overhead of managing a separate NFS server or replicating snapshots.

Exam trap

The trap here is that candidates may overlook the need for a fully managed, POSIX-compliant shared file system and instead choose a self-managed NFS server or a non-POSIX solution like S3, not realizing that SAP ASCS requires concurrent access with file locking and low latency.

How to eliminate wrong answers

Option A is wrong because it introduces a single point of failure with the EC2 instance running NFS server and requires manual management of the NFS server and EBS volume replication, increasing administrative overhead. Option B is wrong because EBS Snapshots are point-in-time backups, not a real-time replication mechanism, and cannot provide the synchronous shared file system required for ASCS high availability; restoring from a snapshot would cause significant downtime and data loss. Option C is wrong because s3fs-fuse is a FUSE-based filesystem that does not provide the POSIX compliance, low latency, or concurrent access guarantees required by SAP ASCS, and it introduces performance and consistency issues.

Practice this question →

Multi-Selectmedium

Which THREE of the following are best practices for securing an SAP system on AWS? (Choose THREE.)

Select 3 answers

A.Enable CloudTrail to log API calls for auditing

B.Use AWS Key Management Service (KMS) to encrypt EBS volumes

C.Use the same security group for all SAP instances

D.Store SAP license keys in a public S3 bucket

E.Restrict network access using security groups and network ACLs

AnswersA, B, E

Auditing is a security best practice.

Why this answer

AWS CloudTrail records all API calls made to the AWS environment, including those that modify SAP infrastructure (e.g., EC2 instance launches, security group changes). Enabling CloudTrail provides an immutable audit log that is essential for compliance, security incident investigation, and operational troubleshooting in an SAP landscape. This aligns with the AWS shared responsibility model, where customers must log and monitor actions taken on their SAP workloads.

Exam trap

The trap here is that candidates may think sharing a security group simplifies management, but AWS explicitly requires separate security groups for different SAP tiers to enforce network segmentation and meet SAP certification requirements.

Practice this question →

MCQeasy

A customer wants to migrate their SAP HANA database to AWS and needs to ensure that the EBS volumes for /hana/data and /hana/log are configured for maximum throughput and low latency. Which EBS volume type should be used for /hana/data?

A.st1

B.io2

C.gp3

D.sc1

AnswerB

io2 provides low latency and high IOPS suitable for HANA.

Why this answer

For SAP HANA workloads on AWS, the /hana/data volume requires the highest level of IOPS and low latency to support real-time data processing. io2 Block Express volumes provide up to 256,000 IOPS and sub-millisecond latency, making them the correct choice for /hana/data. io2 volumes also offer 99.999% durability, which is critical for SAP HANA database consistency.

Exam trap

The trap here is that candidates often choose gp3 (Option C) because it is the default general-purpose SSD and can be provisioned for high IOPS, but they overlook that SAP HANA certification for /hana/data mandates io1 or io2 volumes to guarantee the consistent low latency and durability required for production workloads.

How to eliminate wrong answers

Option A (st1) is wrong because st1 is a throughput-optimized HDD volume designed for large sequential workloads like big data and log processing, not for the random I/O and low-latency requirements of SAP HANA /hana/data. Option C (gp3) is wrong because while gp3 offers baseline performance and can be provisioned for higher IOPS, it does not match the maximum throughput and sub-millisecond latency of io2 Block Express, and SAP HANA certification for production /hana/data specifically requires io1 or io2 volumes. Option D (sc1) is wrong because sc1 is a cold HDD volume designed for infrequently accessed data with the lowest cost, and its performance is completely inadequate for the high IOPS and low latency demands of SAP HANA /hana/data.

Practice this question →

MCQeasy

A company is planning to migrate its SAP HANA database to AWS. They require high availability with automatic failover in less than 30 seconds. Which AWS service should be used to meet this requirement?

A.Elastic Load Balancing

B.AWS Direct Connect

C.AWS Global Accelerator

D.Amazon Route 53

AnswerD

Route 53 with failover routing can meet the sub-30-second failover requirement.

Why this answer

Amazon Route 53 can be configured with health checks and DNS failover to automatically redirect traffic to a standby SAP HANA database in a different Availability Zone or region when the primary fails. With a low TTL (e.g., 5 seconds) and active-passive routing, failover can occur in under 30 seconds, meeting the high availability requirement.

Exam trap

The trap here is that candidates often confuse high-availability load balancing (ELB) with DNS-based failover (Route 53), assuming ELB can handle database failover, but ELB cannot redirect traffic to a standby database in a different AZ or region with sub-30-second failover timing.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing operates at Layer 4/7 and is designed for distributing traffic across multiple healthy targets, but it does not provide automatic DNS-based failover for database endpoints and cannot reroute traffic to a standby database in a different region within 30 seconds. Option B is wrong because AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, but it does not offer any automatic failover or routing logic for database availability. Option C is wrong because AWS Global Accelerator improves performance and provides static IP addresses with health-check-based traffic shifting, but it operates at the network layer and is not designed for DNS-level failover of database endpoints with sub-30-second failover times.

Practice this question →

Multi-Selectmedium

Which TWO statements are correct regarding SAP HANA backup strategies on AWS? (Choose two.)

Select 2 answers

A.EBS snapshots are the most cost-effective option for long-term backup retention.

B.S3 can be used as a backup destination for SAP HANA using AWS Backup.

C.S3 Standard-IA storage class is optimal for cross-region replication.

D.EBS snapshots can be used for fast recovery of HANA database volumes.

E.SAP HANA backup to EBS volumes is the recommended method for long-term archival.

AnswersB, D

AWS Backup supports SAP HANA on EC2.

Why this answer

AWS Backup natively supports SAP HANA as a managed backup service, allowing backups to be stored directly in Amazon S3. This provides a durable, scalable, and cost-effective backup destination without the need to manage backup infrastructure or scripts. Option B is correct because AWS Backup integrates with SAP HANA to automate full, incremental, and differential backups to S3.

Exam trap

The trap here is that candidates often assume EBS snapshots are the best for all backup scenarios due to their speed and simplicity, but they overlook that AWS Backup with S3 provides superior cost efficiency and lifecycle management for long-term retention and archival.

Practice this question →

MCQmedium

An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?

A.The user does not have permission to describe instances.

B.The resource ARN is too restrictive.

C.There is an implicit deny for all actions not listed.

D.The policy does not include the ec2:CreateTags action.

AnswerD

Tagging requires ec2:CreateTags action.

Why this answer

The IAM policy explicitly grants ec2:StartInstances and ec2:StopInstances actions but does not include ec2:CreateTags. Without the ec2:CreateTags action, the user lacks the required permission to create or modify tags on EC2 instances, even though they can start and stop them.

Exam trap

The trap here is that candidates assume that having permissions to start and stop instances implicitly includes the ability to tag them, but AWS IAM treats tagging as a distinct action requiring explicit authorization.

How to eliminate wrong answers

Option A is wrong because describing instances is not required for tagging; the ec2:DescribeInstances action is separate from ec2:CreateTags and is not needed to perform tagging operations. Option B is wrong because the resource ARN in the policy is not too restrictive; it correctly targets EC2 instances, and tagging is an action that can be applied to instances, so the ARN does not block tagging. Option C is wrong because while an implicit deny exists for actions not explicitly allowed, the core issue is the missing ec2:CreateTags action, not the implicit deny itself—the deny is a consequence of the missing permission, not a separate reason.

Practice this question →

MCQmedium

A company is migrating an SAP Business Suite system to AWS. The system has a large database and requires high network throughput between the application and database tiers. Which Amazon EC2 placement group strategy should be used?

A.Spread placement group

B.Partition placement group

C.Cluster placement group

D.No placement group

AnswerC

Cluster groups provide low-latency, high-throughput within an AZ.

Why this answer

A cluster placement group is the correct choice because it provides low-latency, high-throughput networking by placing all instances in a single Availability Zone within the same logical rack. For SAP Business Suite with a large database, the application and database tiers require high network throughput (e.g., up to 100 Gbps for supported instance types) and minimal latency, which a cluster placement group delivers by ensuring all instances are in close physical proximity. In contrast, a spread placement group distributes instances across distinct hardware to reduce risk of simultaneous failure but does not optimize network performance.

A partition placement group spreads instances across logical partitions to isolate failures but also lacks the high-bandwidth, low-latency benefits of a cluster group. Using no placement group may result in instances being placed on separate racks, increasing network latency and reducing throughput.

Exam trap

The trap here is that candidates often confuse placement groups and assume a spread or partition group provides better fault isolation, but for SAP workloads requiring high network throughput, the cluster placement group's low-latency and high-bandwidth characteristics are the primary requirement, not fault domain separation.

How to eliminate wrong answers

Option A is wrong because a spread placement group spreads instances across distinct hardware racks to reduce correlated failures, which does not optimize for high network throughput between tiers and can increase latency. Option B is wrong because a partition placement group divides instances into logical partitions to isolate failures across racks, but it does not guarantee the low-latency, high-bandwidth connectivity needed for SAP application-to-database communication. Option D is wrong because using no placement group means instances may be placed on different racks or even different Availability Zones, leading to higher latency and lower network throughput, which is unsuitable for a latency-sensitive SAP workload.

Practice this question →

Multi-Selecteasy

Which TWO AWS services can be used to monitor the performance of SAP applications? (Select two.)

Select 2 answers

A.Amazon CloudWatch

B.AWS Config

C.AWS Shield

D.AWS CloudTrail

E.AWS X-Ray

AnswersA, E

CloudWatch collects metrics and logs from SAP infrastructure.

Why this answer

Amazon CloudWatch is correct because it provides comprehensive monitoring for SAP applications by collecting metrics such as CPU utilization, memory usage, disk I/O, and network throughput from EC2 instances running SAP. You can set custom CloudWatch alarms to trigger actions when SAP-specific performance thresholds are breached, and integrate with SAP's CCMS (Computing Center Management System) via the AWS SAP Monitoring agent to pull SAP application-level metrics like dialog response times and buffer hit ratios.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (audit logging) with CloudWatch (monitoring), or assume AWS Config can monitor performance because it tracks resource state changes, but neither provides the real-time metric collection needed for SAP performance analysis.

Practice this question →

MCQeasy

A company is running SAP Business Suite on AWS and needs to back up the SAP HANA database daily. Which AWS service can be used to automate HANA backups to Amazon S3?

A.AWS Storage Gateway

B.Amazon EBS snapshots

C.AWS Backup

D.AWS DataSync

AnswerC

AWS Backup can orchestrate SAP HANA backups to S3 with application consistency.

Why this answer

AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that natively supports SAP HANA databases running on Amazon EC2. It automates the creation, retention, and deletion of HANA backups directly to Amazon S3 using the Backint agent, eliminating the need for custom scripts or manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Backup with EBS snapshots, assuming that block-level snapshots are sufficient for database backups, but they fail to recognize that SAP HANA requires application-consistent backups managed through its own backup catalog and the Backint interface.

How to eliminate wrong answers

Option A is wrong because AWS Storage Gateway is a hybrid storage service for on-premises integration with AWS storage, not a backup automation service for SAP HANA; it cannot orchestrate HANA-specific backups or use the Backint interface. Option B is wrong because Amazon EBS snapshots capture the entire volume at the block level, which is not crash-consistent for a running SAP HANA database and does not support HANA's log backup or point-in-time recovery requirements; they also lack integration with HANA's backup catalog. Option D is wrong because AWS DataSync is designed for high-speed data transfer between on-premises storage and AWS, not for automating database backups; it cannot trigger HANA backup jobs or manage backup retention policies.

Practice this question →

100

MCQhard

An SAP administrator notices that the SAP HANA database is running on an EC2 instance with a single EBS volume for /hana/data and /hana/log. The system is experiencing high latency during write operations. What is the most cost-effective design change to improve performance?

A.Create separate EBS volumes for /hana/data and /hana/log, attaching them to the instance

B.Use an Instance Store volume for /hana/data

C.Modify the EBS volume to use Provisioned IOPS (io2) with higher IOPS

D.Increase the size of the existing EBS volume to gain more throughput

AnswerA

Separating data and log volumes eliminates contention and improves write latency cost-effectively.

Why this answer

SAP HANA requires separate EBS volumes for /hana/data and /hana/log to avoid I/O contention. When both directories share a single volume, write operations to the log (sequential) and data (random) compete for the same queue depth and bandwidth, causing high latency. Separating them allows each workload to use dedicated IOPS and throughput, which is the most cost-effective fix without upgrading to premium volume types.

Exam trap

The trap here is that candidates often choose Provisioned IOPS (io2) or volume size increases, thinking more performance is needed, when the real issue is I/O contention from sharing a single volume between two distinct workload types.

How to eliminate wrong answers

Option B is wrong because Instance Store volumes are ephemeral and do not persist data across instance stops or terminations, making them unsuitable for SAP HANA database files that require durability. Option C is wrong because switching to Provisioned IOPS (io2) increases cost significantly without addressing the root cause of I/O contention between /hana/data and /hana/log; separation is more cost-effective. Option D is wrong because simply increasing the size of the existing EBS volume does not resolve the contention between the two workloads; throughput gains from size increases are marginal and do not eliminate queueing delays from mixed access patterns.

Practice this question →

101

MCQhard

A company is running SAP Business Suite on AWS. The SAP application servers are behind an Application Load Balancer (ALB). Users are experiencing session timeouts because the ALB is distributing requests to different application servers. What should the company configure on the ALB to maintain session stickiness?

A.Use a Network Load Balancer instead of an Application Load Balancer.

B.Enable sticky sessions using the ALB-generated cookie.

C.Enable cross-zone load balancing on the ALB.

D.Enable path-based routing to route all requests from a user to the same server.

AnswerB

Sticky sessions ensure user requests go to the same server.

Why this answer

Enabling sticky sessions (session affinity) on an Application Load Balancer using the ALB-generated cookie (AWSALB) ensures that all requests from a user session are routed to the same target (SAP application server). This prevents session timeouts caused by requests being distributed to different servers, which would lose in-memory session state. The ALB-generated cookie is the simplest and most appropriate method for SAP Business Suite, as it does not require custom application code.

Exam trap

The trap here is that candidates often confuse cross-zone load balancing (which improves availability) with session stickiness, or they incorrectly assume that an NLB can provide the same cookie-based stickiness as an ALB, leading them to choose Option A or C instead of the correct sticky sessions configuration.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) operates at Layer 4 and does not support HTTP/HTTPS session stickiness via cookies; it only provides source IP-based stickiness, which is less reliable for SAP sessions behind NAT or proxies. Option C is wrong because cross-zone load balancing distributes traffic evenly across targets in all Availability Zones but does not affect session stickiness; it can actually increase the chance of requests hitting different servers if sticky sessions are not enabled. Option D is wrong because path-based routing directs traffic based on URL paths, not user sessions; it cannot ensure that all requests from the same user go to the same server.

Practice this question →

102

MCQhard

An SAP system on AWS is using an Oracle database. The company wants to implement automated backups to Amazon S3. Which AWS service should be used to orchestrate the backup process?

A.Amazon RDS for Oracle

B.AWS Backup

C.Amazon S3 Lifecycle policies

D.AWS Database Migration Service (DMS)

AnswerB

AWS Backup can automate backups of Oracle databases to S3.

Why this answer

AWS Backup is the correct service because it provides a fully managed, policy-driven backup solution that can orchestrate backups for SAP workloads running on Amazon EC2 with Oracle databases. It integrates directly with Amazon S3 for storing backup data and supports custom backup scripts via the AWS Backup API or AWS Lambda, enabling automated, scheduled backups without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Backup with Amazon RDS automated backups, assuming RDS can back up any Oracle database, when in fact RDS only manages its own database instances and cannot orchestrate backups for an Oracle database running on an EC2 instance.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for Oracle is a managed database service that cannot be used to back up an Oracle database running on an EC2 instance (as in this SAP scenario); it is a separate service for RDS-managed databases, not for orchestrating backups of self-managed databases. Option C is wrong because Amazon S3 Lifecycle policies manage the lifecycle of objects already in S3 (e.g., transitioning to Glacier or deleting), but they do not orchestrate the backup process itself—they only act on data after it is stored. Option D is wrong because AWS Database Migration Service (DMS) is designed for migrating databases to AWS or between database engines, not for orchestrating ongoing automated backups to S3.

Practice this question →

103

MCQhard

A company is running a mission-critical SAP S/4HANA system on AWS in the us-east-1 region. The system uses a two-tier architecture with the SAP application server and HANA database on the same EC2 instance. The instance type is an r5.24xlarge with 12 x 2 TB gp3 EBS volumes striped using LVM. The HANA data volume is 10 TB. The company has a disaster recovery (DR) requirement with an RPO of 15 minutes and an RTO of 4 hours. The DR site must be in us-west-2. The company currently takes daily EBS snapshots of the data volume and copies them to us-west-2. However, they are not meeting the RPO. The operations team is considering implementing SAP HANA System Replication (HSR) asynchronously to the DR region. However, network latency between us-east-1 and us-west-2 averages 60 ms. The SAP HANA database has a heavy write workload, with average log writes of 500 MB/sec. The team is concerned that the replication may fall behind and cause data loss. What should the team do to meet the DR requirements while minimizing data loss?

A.Implement HSR asynchronously and also enable HANA log backups to an S3 bucket in us-west-2.

B.Switch to synchronous replication to ensure zero data loss.

C.Increase the HANA log buffer size to reduce the frequency of log flushes, so that less data is sent over the network.

D.Use HSR with multiple replicas in us-west-2 to improve replication speed.

AnswerA

Log backups provide an additional recovery point if replication lags.

Why this answer

Combining asynchronous HANA System Replication (HSR) with HANA log backups to an S3 bucket in us-west-2 provides a dual-layer protection strategy. Asynchronous HSR will replicate log changes in near real-time, but given the 60 ms latency and 500 MB/sec write workload, it may fall behind; the log backups act as a safety net to capture any log data that hasn't been replicated yet, allowing recovery with minimal data loss while still meeting the 15-minute RPO.

Exam trap

The trap here is that candidates assume asynchronous replication alone is sufficient for DR, but they overlook that under high latency and heavy write workloads, the replication lag can exceed the RPO, making a complementary log backup strategy essential to meet the recovery objectives.

How to eliminate wrong answers

Option B is wrong because synchronous replication requires sub-millisecond latency to avoid impacting application performance; with 60 ms latency between us-east-1 and us-west-2, synchronous HSR would cause severe write latency and likely timeouts, making it impractical for a heavy write workload. Option C is wrong because increasing the HANA log buffer size does not reduce the frequency of log flushes; log flushes are triggered by transaction commits and log buffer fullness, so a larger buffer only delays flushing but does not reduce the amount of data sent over the network per second, and it can increase data loss risk if the instance crashes before a flush. Option D is wrong because using multiple replicas in us-west-2 does not improve replication speed; HSR with multiple replicas adds overhead and complexity without addressing the fundamental latency bottleneck, and it does not reduce the risk of falling behind under high write loads.

Practice this question →

104

MCQmedium

A company is running SAP on AWS and needs to back up their SAP HANA database daily. The backup must be stored cost-effectively and retained for 7 years for compliance. Which AWS service should be used for long-term backup storage?

A.Amazon S3 One Zone-IA

B.Amazon S3 Standard

C.Amazon S3 Glacier Deep Archive

D.Amazon EBS Snapshots

AnswerC

Most cost-effective for long-term archival.

Why this answer

Amazon S3 Glacier Deep Archive is the correct choice because it provides the lowest-cost storage for long-term archival data, with retrieval times ranging from 12 to 48 hours, which is acceptable for a daily backup retained for 7 years. This service is specifically designed for compliance and regulatory retention where infrequent access is expected, making it the most cost-effective option for the given requirements.

Exam trap

The trap here is that candidates often confuse 'long-term backup storage' with 'frequent access needs' and select Amazon S3 Standard or Amazon EBS Snapshots, overlooking the cost implications of retaining data for 7 years, or they mistakenly think S3 One Zone-IA is suitable for compliance data despite its lack of multi-AZ resilience and higher cost compared to Glacier Deep Archive.

How to eliminate wrong answers

Option A is wrong because Amazon S3 One Zone-IA is designed for infrequently accessed data that can be recreated if lost, but it does not provide the durability or cost efficiency needed for 7-year compliance retention, and it lacks the multi-AZ resilience required for critical backups. Option B is wrong because Amazon S3 Standard is optimized for frequently accessed data with low latency and high throughput, making it unnecessarily expensive for long-term archival storage that is rarely accessed. Option D is wrong because Amazon EBS Snapshots are incremental backups tied to specific EC2 instances and Availability Zones, and they are not designed for long-term, cost-effective archival storage; they also incur higher costs for long retention periods compared to S3 Glacier Deep Archive.

Practice this question →

105

MCQhard

An SAP system on AWS is experiencing high CPU utilization on the application server during peak hours. The SAP administrator wants to add a new application server instance to distribute the load. Which AWS service should be used to automatically register the new instance with the existing SAP system's load balancer?

A.Auto Scaling group

B.AWS Lambda

C.Amazon SQS

D.AWS CloudFormation

AnswerA

Auto Scaling can automatically register new instances with a load balancer.

Why this answer

An Auto Scaling group can automatically launch new EC2 instances based on scaling policies (e.g., when CPU utilization exceeds a threshold) and, when configured with a lifecycle hook or a launch template that includes a user-data script, can register the new instance with the existing SAP system's load balancer (such as an Application Load Balancer or Classic Load Balancer). This ensures the new application server is automatically added to the load balancer target group, distributing incoming traffic without manual intervention.

Exam trap

The trap here is that candidates may confuse Auto Scaling groups with CloudFormation, thinking that CloudFormation can dynamically register instances, but CloudFormation is a provisioning tool that does not handle real-time auto-registration of instances with a load balancer.

How to eliminate wrong answers

Option B is wrong because AWS Lambda is a serverless compute service for running code in response to events, not a service for automatically registering instances with a load balancer; while it could be used in a custom solution, it is not the native AWS service designed for this purpose. Option C is wrong because Amazon SQS is a message queuing service for decoupling application components, not a service that manages instance registration with a load balancer. Option D is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, but it does not automatically register new instances with a load balancer in real time; it would require manual or scheduled updates to the stack.

Practice this question →

106

MCQhard

A company is designing a disaster recovery strategy for SAP S/4HANA. The primary site is in us-east-1 and the DR site is in us-west-2. The RPO must be less than 30 minutes and RTO less than 2 hours. Which approach meets these requirements?

A.Configure HANA System Replication in asynchronous mode with automatic takeover

B.Configure HANA System Replication in synchronous mode across regions

C.Take nightly backups to S3 and restore in DR

D.Use AWS Backup to copy daily snapshots to DR region

AnswerA

Async replication can meet <30 min RPO and with pre-provisioned DR instances, RTO <2 hours.

Why this answer

HANA System Replication in asynchronous mode with automatic takeover meets the RPO of less than 30 minutes and RTO of less than 2 hours. Asynchronous replication provides near-real-time data transfer across AWS regions with minimal impact on primary performance, and automatic takeover enables fast failover to the DR instance, satisfying the RTO requirement.

Exam trap

The trap here is that candidates confuse synchronous mode as more reliable for DR, but fail to recognize that cross-region latency makes synchronous replication impractical, while asynchronous mode with automatic takeover is the standard AWS-recommended approach for SAP HANA disaster recovery.

How to eliminate wrong answers

Option B is wrong because HANA System Replication in synchronous mode across regions introduces high latency and potential transaction blocking, making it impractical for cross-region setups and unable to meet the RPO/RTO without significant performance degradation. Option C is wrong because nightly backups to S3 cannot achieve an RPO of less than 30 minutes, as backups are taken only once per day, and restoring from S3 typically exceeds the 2-hour RTO due to data transfer and recovery time. Option D is wrong because AWS Backup copying daily snapshots to the DR region results in an RPO of at least 24 hours, far exceeding the 30-minute requirement, and snapshot restoration is slower than HANA System Replication failover.

Practice this question →

107

MCQmedium

A company is migrating its SAP HANA database to AWS. The database requires high I/O and low latency. Which storage option should be used for the /hana/data volume?

A.io2 EBS volume

B.gp3 EBS volume

C.Amazon S3

D.Amazon EFS

AnswerA

io2 EBS volumes provide high IOPS and low latency required for SAP HANA data.

Why this answer

The /hana/data volume for SAP HANA requires high I/O and low latency, which is best met by io2 EBS volumes. io2 volumes are provisioned IOPS SSD volumes designed for latency-sensitive transactional workloads, offering up to 64,000 IOPS per volume and 99.999% durability, making them ideal for SAP HANA data files.

Exam trap

The trap here is that candidates often confuse gp3's high baseline performance with suitability for production SAP HANA, but the exam expects knowledge that only io2 (or io1) volumes meet the strict latency and IOPS consistency requirements for /hana/data as per SAP's official guidance.

How to eliminate wrong answers

Option B (gp3 EBS volume) is wrong because gp3 volumes are general-purpose SSDs with baseline performance that may not sustain the consistently high IOPS and sub-millisecond latency required for SAP HANA /hana/data, especially under heavy write loads. Option C (Amazon S3) is wrong because S3 is an object storage service with higher latency and no file system semantics, making it unsuitable for database block-level storage. Option D (Amazon EFS) is wrong because EFS is a network file system (NFS) that introduces additional latency and throughput variability compared to block storage, and it is not supported for SAP HANA data volumes.

Practice this question →

108

MCQhard

A company runs SAP Business Suite on AWS. They notice that their SAP application servers are not evenly distributing load across multiple instances. They have configured an Application Load Balancer (ALB) in front of the SAP Web Dispatchers. What is the MOST likely cause of uneven load distribution?

A.Sticky sessions (session stickiness) are enabled on the ALB.

B.The ALB health check interval is too short.

C.Cross-zone load balancing is enabled.

D.The ALB is using the least outstanding requests routing algorithm.

AnswerA

Sticky sessions cause uneven distribution with long-lived sessions.

Why this answer

When sticky sessions (session stickiness) are enabled on an Application Load Balancer, the ALB uses a cookie to bind a client's session to a specific target (SAP Web Dispatcher). This prevents the load balancer from distributing subsequent requests from that client to other healthy targets, causing an uneven distribution of load across the SAP application servers, especially if a few clients generate a disproportionate number of requests.

Exam trap

The trap here is that candidates often assume sticky sessions are always beneficial for stateful applications, but they fail to recognize that sticky sessions directly contradict the goal of even load distribution by pinning clients to specific targets.

How to eliminate wrong answers

Option B is wrong because a short health check interval would cause the ALB to mark targets as unhealthy more frequently, potentially removing them from the rotation, but it would not cause uneven distribution of load across healthy instances; it would simply reduce the number of available targets. Option C is wrong because cross-zone load balancing is enabled by default on ALBs and actually improves load distribution by evenly routing traffic across all targets in all enabled Availability Zones, so it would not cause uneven load. Option D is wrong because the least outstanding requests routing algorithm is designed to send traffic to the target with the fewest pending requests, which actively promotes even load distribution, not uneven distribution.

Practice this question →

109

Multi-Selecthard

An SAP administrator needs to ensure high availability for SAP NetWeaver ABAP stack on AWS. Which three components should be configured in a multi-AZ active/passive cluster? (Select THREE.)

Select 3 answers

A.Enqueue Replication Server (ERS).

B.ABAP SAP Central Services (ASCS).

C.Database instance.

D.SAP Gateway.

E.Dialog instances.

AnswersA, B, C

ERS works with ASCS for failover.

Why this answer

The Enqueue Replication Server (ERS) is a critical component in an SAP NetWeaver ABAP stack active/passive cluster because it replicates the lock table from the primary ASCS instance to the standby node. In a multi-AZ setup, this ensures that if the primary ASCS fails, the standby can take over with minimal disruption, as the lock state is preserved. Without ERS, a failover would require all locked resources to be released, causing data inconsistencies or application errors.

Exam trap

AWS often tests the misconception that all SAP components must be in an active/passive cluster for high availability, but only stateful components like ASCS, ERS, and the database require this; stateless components like SAP Gateway and Dialog instances can be distributed across AZs in an active/active manner.

Practice this question →

110

MCQeasy

A company is setting up a disaster recovery (DR) site for SAP on AWS. They need to replicate the SAP HANA database to another region. Which AWS service is BEST suited for this?

A.SAP HANA System Replication

B.AWS Backup cross-region copy

C.AWS Database Migration Service (DMS)

D.Amazon S3 Cross-Region Replication

AnswerA

HANA System Replication is designed for cross-region DR.

Why this answer

SAP HANA System Replication (HSR) is the native, SAP-supported mechanism for replicating HANA databases asynchronously or synchronously across regions. It replicates at the database level using log shipping and is the only option that maintains full SAP HANA consistency, transaction integrity, and support for takeover in a DR scenario.

Exam trap

The trap here is that candidates confuse general-purpose AWS backup or replication services (like AWS Backup or S3 CRR) with SAP-specific replication, assuming any cross-region copy can serve as DR, but only HSR provides the required database-level consistency and SAP certification for HANA DR.

How to eliminate wrong answers

Option B (AWS Backup cross-region copy) is wrong because it creates point-in-time snapshots of the entire HANA instance, not continuous log replication, leading to potential data loss and longer recovery time objectives (RTO/RPO) unsuitable for SAP HANA DR. Option C (AWS Database Migration Service) is wrong because DMS is designed for one-time or ongoing migration between heterogeneous databases, not for continuous replication of a live SAP HANA system with full transaction consistency and failover support. Option D (Amazon S3 Cross-Region Replication) is wrong because S3 CRR replicates objects in S3 buckets, not database files or logs, and cannot maintain the transactional state of a running HANA database.

Practice this question →

111

MCQhard

An SAP Basis team is migrating an SAP Business Suite system to AWS. The system has a large number of background jobs and requires consistent performance for batch processing. Which Amazon EC2 instance type is most suitable for this workload?

A.i3.2xlarge

B.g4dn.xlarge

C.z1d.xlarge

D.t3.large

AnswerC

z1d instances offer high CPU frequency and large memory, suitable for SAP batch workloads.

Why this answer

The z1d.xlarge instance is most suitable because it offers a high baseline clock speed of up to 4.0 GHz with Intel Turbo Boost, which is critical for SAP Business Suite batch processing workloads that are CPU-bound and sensitive to single-threaded performance. SAP background jobs often require consistent, high-frequency CPU performance to meet batch window SLAs, and the z1d family is specifically designed for such high-performance, memory-intensive SAP workloads on AWS.

Exam trap

The trap here is that candidates often confuse storage-optimized instances (i3) with compute-optimized needs, or mistakenly think burstable instances (t3) can handle sustained batch loads due to their low cost, ignoring CPU credit exhaustion and performance throttling.

How to eliminate wrong answers

Option A (i3.2xlarge) is wrong because it is an instance optimized for high-speed NVMe SSD storage and low-latency I/O, not for high CPU clock speed; it is intended for database workloads like SAP HANA, not for CPU-bound batch processing. Option B (g4dn.xlarge) is wrong because it is a GPU-accelerated instance designed for machine learning and graphics workloads, not for SAP batch jobs that do not leverage GPU compute. Option D (t3.large) is wrong because it is a burstable performance instance that uses CPU credits; sustained batch processing would deplete credits and throttle performance, making it unsuitable for consistent batch processing requirements.

Practice this question →

112

MCQeasy

A company is designing a new SAP environment on AWS. The SAP application servers communicate with the database over the network. The architect wants to minimize latency and maximize throughput. Which placement strategy should the architect use?

A.Place all servers in a single Availability Zone and use a cluster placement group.

B.Place the application servers in one Availability Zone and the database in a different Availability Zone.

C.Place the application servers in one VPC and the database in a different VPC connected via VPC peering.

D.Place the application servers in one AWS Region and the database in another Region.

AnswerA

Cluster placement group provides low latency and high throughput.

Why this answer

A cluster placement group is the correct choice because it provides the lowest possible latency and highest throughput by ensuring that all SAP application and database servers are placed in close physical proximity within a single Availability Zone. This placement minimizes network hops and leverages non-blocking, high-bandwidth networking, which is critical for SAP's latency-sensitive communication between application and database layers.

Exam trap

The trap here is that candidates may assume spreading resources across multiple Availability Zones improves availability, but for SAP workloads requiring minimal latency, a single-AZ cluster placement group is the correct performance optimization, even though it sacrifices AZ-level fault tolerance.

How to eliminate wrong answers

Option B is wrong because placing the application servers and database in different Availability Zones introduces cross-AZ network latency (typically 1-2 ms) and additional data transfer costs, which degrades SAP performance. Option C is wrong because using separate VPCs connected via VPC peering adds extra network hops and does not guarantee the same physical proximity or bandwidth as a single VPC, increasing latency. Option D is wrong because inter-Region latency (often 10-100 ms) is far too high for SAP's real-time database communication, making it impractical for production workloads.

Practice this question →

113

MCQhard

A company is running a large SAP S/4HANA production system on AWS. The system consists of a single HANA database instance running on an r5.24xlarge EC2 instance (with 768 GB of RAM), and multiple application server instances behind an Application Load Balancer. The database uses six EBS io1 volumes for data and log files, each with 20,000 provisioned IOPS. The application servers are in an Auto Scaling group. Recently, the company experienced a prolonged database outage when the primary EC2 instance failed. The recovery took over 4 hours because a new instance had to be launched and snapshots restored. The company wants to improve the Recovery Time Objective (RTO) to less than 30 minutes for the HANA database. They also want to minimize data loss with an RPO of less than 5 minutes. The company has a second AWS region (us-west-2) available for disaster recovery but prefers to keep costs low for the DR site. Which solution should the company implement?

A.Configure SAP HANA System Replication to a standby instance in the same region but use a larger instance to ensure capacity.

B.Configure automated Amazon EBS snapshots every 5 minutes and create an AMI for the HANA instance. In the event of a failure, launch a new instance from the AMI in the same Availability Zone.

C.Set up SAP HANA System Replication to a standby HANA instance in a different Availability Zone. Use a smaller instance type for the standby to reduce costs. Automate failover using a cluster manager like Pacemaker.

D.Use Amazon RDS for SAP HANA with Multi-AZ deployment to automatically failover to a standby in another Availability Zone.

AnswerC

HSR with failover can achieve RTO < 30 minutes and RPO < 5 minutes.

Why this answer

SAP HANA System Replication (HSR) with a standby instance in a different Availability Zone provides synchronous replication, achieving an RPO of less than 5 minutes, and automated failover via a cluster manager like Pacemaker can bring the database online in under 30 minutes. Using a smaller instance for the standby reduces DR costs while still allowing the system to run in degraded mode during failover. This meets the RTO and RPO requirements without the high cost of a full-sized DR site in another region.

Exam trap

The trap here is that candidates may assume a second region is required for DR, but the question explicitly allows using a different Availability Zone within the same region to meet the RTO and RPO goals while keeping costs low, and they may also mistakenly think Amazon RDS supports SAP HANA.

How to eliminate wrong answers

Option A is wrong because configuring HSR to a standby in the same region does not address the requirement to use the second region for DR, and using a larger instance increases costs unnecessarily without improving RTO beyond what a properly configured standby in another AZ can achieve. Option B is wrong because automated EBS snapshots every 5 minutes cannot guarantee an RPO of less than 5 minutes due to snapshot consistency delays and the time required to restore from snapshots (launching a new instance and restoring volumes typically takes well over 30 minutes). Option D is wrong because Amazon RDS for SAP HANA does not exist; RDS supports other databases but not SAP HANA, so this option is technically invalid.

Practice this question →

114

MCQhard

An SAP HANA database on AWS is using EBS gp3 volumes with 3000 IOPS. The database team observes that the write latency is high during peak hours. The EBS volume is not exceeding its bandwidth limit. What is the most likely cause?

A.The EBS volume is not attached as a dedicated EBS bandwidth volume.

B.The EBS volume's IOPS limit is being reached, causing queuing.

C.The EC2 instance's EBS bandwidth is saturated.

D.The EC2 instance does not have EBS optimization enabled.

AnswerB

3000 IOPS may be insufficient, leading to high queue depth and latency.

Why this answer

The observed high write latency during peak hours, despite the EBS volume not exceeding its bandwidth limit, indicates that the volume's IOPS limit of 3000 is being reached. When the IOPS limit is hit, the EBS volume queues I/O requests, which increases latency. This is a classic symptom of IOPS saturation rather than bandwidth saturation.

Exam trap

The trap here is that candidates confuse IOPS limits with bandwidth limits, assuming high latency must be due to bandwidth saturation, but the question explicitly rules out bandwidth as the cause, pointing directly to IOPS queuing.

How to eliminate wrong answers

Option A is wrong because there is no such concept as a 'dedicated EBS bandwidth volume' in AWS; EBS bandwidth is determined by the EC2 instance type and volume type, not by a dedicated attachment setting. Option C is wrong because the question explicitly states the EBS volume is not exceeding its bandwidth limit, so the EC2 instance's EBS bandwidth is not saturated. Option D is wrong because EBS optimization is enabled by default on all current-generation EC2 instances, and if it were disabled, the instance would be throttled at the network level, not specifically cause write latency only during peak hours without bandwidth saturation.

Practice this question →

115

Multi-Selectmedium

Which TWO of the following are best practices for running SAP HANA on AWS?

Select 2 answers

A.Use RAID 0 across multiple EBS volumes to increase IOPS.

B.Deploy the HANA database in multiple Availability Zones for high availability.

C.Store HANA data and log files on Amazon S3.

D.Use EBS-optimized instances for dedicated storage throughput.

E.Use burstable instance types for cost savings.

AnswersB, D

Multi-AZ is key for HA.

Why this answer

Deploying the HANA database in multiple Availability Zones is a best practice for high availability because it protects against an entire AZ failure. SAP HANA supports system replication (HSR) in synchronous or synchronous-memory mode across AZs, enabling automatic failover with minimal data loss. This aligns with the AWS Well-Architected Framework's reliability pillar for critical SAP workloads.

Exam trap

The trap here is that candidates often confuse high availability (multi-AZ) with disaster recovery (multi-Region), or they assume RAID 0 is a performance best practice without considering the data integrity risks for a mission-critical database like SAP HANA.

Practice this question →

116

MCQhard

A company runs SAP ECC on AWS with a multi-ASCS architecture for high availability. During a failover test, the secondary ASCS instance does not take over. The cluster logs indicate that the 'aws-cluster' resource agent failed to release the Elastic IP. What is the MOST likely cause?

A.The Elastic IP is associated with the primary private IP address of the ENI.

B.The Elastic IP is in a different Availability Zone than the secondary ASCS instance.

C.The cluster is using a NAT Gateway for outbound traffic, conflicting with the Elastic IP.

D.The IAM role assigned to the instances does not have permission to release the Elastic IP.

AnswerA

EIPs are associated with private IPs; if it's on the primary IP, the ENI cannot be moved without detaching. A secondary IP allows reassignment.

Why this answer

In a multi-ASCS SAP cluster on AWS, the 'aws-cluster' resource agent manages Elastic IP (EIP) failover by disassociating the EIP from the primary instance and associating it with the secondary instance. If the EIP is associated with the primary private IP address of the Elastic Network Interface (ENI) rather than the ENI itself, the resource agent cannot release it because the association is at the IP level, not the ENI level. This prevents the secondary ASCS instance from acquiring the EIP, causing the failover to fail.

Exam trap

The trap here is that candidates often assume IAM permissions (Option D) are the root cause of any AWS resource management failure, but the specific log message about 'failed to release' points to a technical limitation of the resource agent with IP-level EIP associations, not an authorization issue.

How to eliminate wrong answers

Option B is wrong because Elastic IPs are regional resources that can be associated with instances in any Availability Zone within the same region; a different AZ does not prevent release or association. Option C is wrong because a NAT Gateway is used for outbound internet traffic and does not conflict with Elastic IP operations; the cluster resource agent interacts directly with the EC2 API to manage EIPs, independent of NAT Gateway routing. Option D is wrong because the IAM role permissions issue would typically cause an authorization error in the logs, but the question states the logs indicate the resource agent 'failed to release the Elastic IP' — this points to a technical limitation of the agent, not a permissions failure.

Practice this question →

117

MCQmedium

A company is planning to run SAP NetWeaver on AWS and wants to use Auto Scaling for the application server tier. Which consideration is critical when implementing Auto Scaling for SAP application servers?

A.Ensure the database can scale automatically with the application tier.

B.Enable termination protection on all Auto Scaling instances.

C.Use encrypted EBS volumes for all instances.

D.Automatically register new instances with the SAP Central Services instance.

AnswerD

New app servers must be registered with ASCS to join the SAP system.

Why this answer

SAP application servers must be registered with the SAP Central Services instance (ASCS/SCS) to be recognized as part of the SAP system. Auto Scaling can launch new instances, but without automatic registration via sapstartsrv or the SAP Host Agent, the new instances will not be able to communicate with the Central Services instance, and the SAP system will not utilize them for workload.

Exam trap

The trap here is that candidates often focus on infrastructure-level concerns like encryption or termination protection, overlooking the application-level dependency that SAP application servers must be explicitly registered with Central Services to function as part of the SAP system.

How to eliminate wrong answers

Option A is wrong because the database tier in an SAP NetWeaver landscape is typically a single, stateful component that cannot be scaled automatically with the application tier; Auto Scaling is designed for stateless application servers, and the database must be scaled independently, often requiring manual intervention or separate database clustering solutions. Option B is wrong because termination protection is a safety feature to prevent accidental deletion of instances, but it is not a critical consideration for implementing Auto Scaling for SAP application servers; in fact, Auto Scaling requires the ability to terminate instances during scale-in events, and enabling termination protection would break the scaling process. Option C is wrong while encrypted EBS volumes are a security best practice, they are not a critical consideration specific to Auto Scaling for SAP application servers; encryption does not affect the ability to scale or register instances with Central Services.

Practice this question →

118

MCQmedium

A company is migrating its SAP HANA database to AWS and needs to choose the most appropriate EC2 instance type. The workload requires high memory bandwidth and is CPU-intensive. Which instance family would best meet these requirements?

A.M5 instance family

B.I3 instance family

C.C5 instance family

D.X1e instance family

AnswerD

X1e instances are memory-optimized with high memory bandwidth, ideal for SAP HANA workloads.

Why this answer

The X1e instance family is purpose-built for high-memory, CPU-intensive SAP HANA workloads, offering up to 3.9 TB of memory and high memory bandwidth per vCPU. This aligns with SAP HANA's requirement for large in-memory databases and compute-intensive processing, making D the correct choice.

Exam trap

The trap here is that candidates often confuse compute-optimized (C5) or storage-optimized (I3) families with SAP HANA requirements, overlooking that SAP HANA's in-memory nature demands memory-optimized instances like X1e with high memory bandwidth and capacity, not just raw CPU or I/O performance.

How to eliminate wrong answers

Option A is wrong because the M5 instance family is a general-purpose option that balances compute, memory, and networking, but lacks the high memory bandwidth and large memory capacity required for SAP HANA. Option B is wrong because the I3 instance family is storage-optimized with high local NVMe SSD performance, designed for I/O-intensive workloads like databases with high throughput, not for CPU-intensive, high-memory-bandwidth SAP HANA. Option C is wrong because the C5 instance family is compute-optimized, focusing on high CPU performance for workloads like batch processing or web servers, but it does not provide the large memory footprint or memory bandwidth needed for SAP HANA in-memory operations.

Practice this question →

119

Multi-Selecteasy

A company is deploying SAP on AWS and needs to ensure high availability for the SAP application servers. Which TWO strategies can be used to achieve this? (Choose TWO.)

Select 2 answers

A.Use Amazon RDS Multi-AZ for the application tier

B.Use a single large EC2 instance with an Elastic IP

C.Use an Auto Scaling group with an Application Load Balancer

D.Attach the same EBS volume to multiple instances

E.Deploy application servers in multiple Availability Zones

AnswersC, E

An Auto Scaling group combined with an Application Load Balancer (ALB) automatically distributes incoming traffic across multiple SAP application server instances and replaces failed instances. The ALB performs health checks and routes traffic only to healthy instances, while Auto Scaling maintains the desired instance count across Availability Zones.

Why this answer

Options C and E are correct. Option C uses an Auto Scaling group with an Application Load Balancer to automatically distribute traffic across multiple SAP application server instances and replace failed ones, ensuring high availability. Option E deploys application servers in multiple Availability Zones to eliminate a single point of failure, as AZs are independent failure domains.

Both strategies are recommended for SAP on AWS.

Exam trap

The trap here is that candidates confuse the database tier (where Multi-AZ is appropriate) with the application tier, or mistakenly think that a single large instance with an Elastic IP provides high availability, when in fact it creates a single point of failure.

Practice this question →

120

MCQmedium

A company is designing a highly available SAP HANA system on AWS. They need to replicate data synchronously to a secondary site in a different Availability Zone. Which AWS service should they use?

A.Amazon S3 cross-region replication

B.AWS Database Migration Service (DMS)

C.Amazon RDS Multi-AZ

D.SAP HANA System Replication (HSR)

AnswerD

HSR is SAP's native replication for HANA.

Why this answer

SAP HANA System Replication (HSR) is the native SAP mechanism for synchronously replicating HANA data to a secondary system. It supports synchronous replication mode, which ensures zero data loss (RPO=0) by committing transactions only after they are confirmed on the secondary site, making it the correct choice for a highly available SAP HANA system across Availability Zones.

Exam trap

The trap here is that candidates confuse AWS-managed HA services (like RDS Multi-AZ) with SAP-specific replication, forgetting that SAP HANA on AWS is an EC2-based workload requiring native HANA tools, not AWS database services.

How to eliminate wrong answers

Option A is wrong because Amazon S3 cross-region replication is an object-level, asynchronous replication feature for S3 buckets; it cannot replicate SAP HANA database transactions or provide the synchronous, low-latency replication required for HANA HA. Option B is wrong because AWS Database Migration Service (DMS) is designed for one-time or ongoing migration of databases to AWS, not for real-time synchronous replication between two active HANA instances; it introduces latency and does not support HANA's native replication protocols. Option C is wrong because Amazon RDS Multi-AZ is a managed database HA feature for RDS engines (e.g., MySQL, PostgreSQL, Oracle, SQL Server), not for SAP HANA; SAP HANA on AWS is deployed on EC2, not RDS, and RDS Multi-AZ uses storage-level or engine-level replication incompatible with HANA's requirements.

Practice this question →

121

MCQmedium

An SAP administrator created the IAM policy shown in the exhibit to allow a monitoring tool to start and stop SAP application servers tagged with Environment=Production. When testing the policy, the tool fails to start an instance. What is the most likely cause?

A.The policy requires the instance to be stopped before starting.

B.The policy is missing the ec2:DescribeInstances action.

C.The policy does not allow starting instances that are already running.

D.The resource ARN does not match the instance ID.

AnswerC

ec2:StartInstances only works on stopped instances; attempting to start a running instance fails.

Why this answer

The policy uses a condition that checks if the instance is already running (`ec2:InstanceState/Name` equals `running`). The `ec2:StartInstances` action is only allowed when the instance is in the `running` state, but starting an instance requires it to be in the `stopped` state. This mismatch causes the start action to fail for production-tagged instances.

Exam trap

The trap here is that candidates assume the condition `ec2:InstanceState/Name` equals `running` is correct for starting instances, confusing the required state for start (stopped) with the state for stop (running).

How to eliminate wrong answers

Option A is wrong because the policy does not require the instance to be stopped before starting; the condition incorrectly requires the instance to be running, which is the opposite of what is needed for a start operation. Option B is wrong because the `ec2:DescribeInstances` action is not required for starting instances; the `ec2:StartInstances` action alone is sufficient, and the failure is due to the condition, not a missing action. Option D is wrong because the resource ARN uses a wildcard (`*`) for the instance ID, which matches any instance ID, so the ARN format is not the issue.

Practice this question →

122

MCQeasy

A company is running SAP HANA on an r5.8xlarge instance. They want to scale up to meet increased memory requirements. Which instance family would be the MOST suitable for a scale-up scenario?

A.x1e.32xlarge

B.r5.24xlarge

C.i3.16xlarge

D.c5.18xlarge

AnswerA

x1e is designed for large SAP HANA scale-up.

Why this answer

The x1e.32xlarge instance is part of the X1e family, which is specifically designed for high-memory workloads like SAP HANA. With 3,904 GiB of memory, it provides the largest memory capacity among AWS instances, making it the most suitable for scaling up SAP HANA to meet increased memory requirements. SAP HANA is an in-memory database, so scaling up requires instances with high memory-to-vCPU ratios, which the X1e family delivers.

Exam trap

The trap here is that candidates may choose the r5.24xlarge because it is memory-optimized, but they overlook that the X1e family offers much higher memory capacity specifically required for SAP HANA scale-up scenarios.

How to eliminate wrong answers

Option B (r5.24xlarge) is wrong because while the R5 family is memory-optimized, it offers only 768 GiB of memory, which is significantly less than the x1e.32xlarge and may not meet the increased memory requirements for a scale-up scenario. Option C (i3.16xlarge) is wrong because the I3 family is storage-optimized with high local NVMe SSD performance, not designed for large memory capacity; it provides only 488 GiB of memory, which is insufficient for SAP HANA scale-up. Option D (c5.18xlarge) is wrong because the C5 family is compute-optimized, focusing on high CPU performance with only 144 GiB of memory, making it completely unsuitable for memory-intensive SAP HANA workloads.

Practice this question →

123

MCQeasy

An SAP workload on AWS uses a single Availability Zone deployment. The company wants to improve high availability without changing the existing architecture significantly. Which action should be taken?

A.Use an Amazon EBS volume attached to multiple instances across AZs.

B.Add a second SAP application server in a different Availability Zone and configure load balancing.

C.Increase the size of the EC2 instances to handle failover.

D.Enable EBS Multi-Attach on the database volume.

AnswerB

This provides application tier HA across AZs.

Why this answer

Adding a second SAP application server in a different Availability Zone and configuring load balancing provides high availability by distributing traffic across multiple AZs, ensuring that if one AZ fails, the application remains accessible. This approach aligns with SAP's recommended architecture for multi-AZ deployments without requiring significant changes to the existing single-AZ setup, as it only adds an additional application tier instance and a load balancer.

Exam trap

The trap here is that candidates often confuse scaling (increasing instance size) with high availability, or assume EBS Multi-Attach works across Availability Zones, when in fact it is restricted to a single AZ and specific volume types.

How to eliminate wrong answers

Option A is wrong because an Amazon EBS volume cannot be attached to multiple EC2 instances across different Availability Zones; EBS volumes are AZ-specific and can only be attached to instances within the same AZ, and multi-attach is limited to specific volume types and instances within the same AZ. Option C is wrong because increasing the size of EC2 instances does not provide high availability; it only improves performance or capacity for a single instance, which remains a single point of failure in the event of an AZ outage. Option D is wrong because EBS Multi-Attach is only supported for io1 or io2 volumes within a single Availability Zone and cannot be used across AZs; it also does not address application-level high availability and is not suitable for SAP database volumes that require consistent read/write access from multiple instances.

Practice this question →

124

Multi-Selectmedium

Which TWO of the following are valid strategies for reducing the total cost of ownership (TCO) for SAP workloads on AWS?

Select 2 answers

A.Schedule start/stop of non-production instances using Instance Scheduler

B.Use Reserved Instances for production systems

C.Use GP2 EBS volumes instead of GP3

D.Use Graviton-based instances for SAP application servers

E.Deploy SAP HANA in Multi-AZ configuration

AnswersA, B

Stops instances when not needed.

Why this answer

AWS Instance Scheduler allows you to define start and stop schedules for non-production SAP instances, significantly reducing compute costs during off-hours. This is a direct TCO reduction strategy for SAP workloads, as non-production environments often run 24/7 unnecessarily.

Exam trap

The trap here is that candidates may confuse cost-reduction strategies with performance or availability strategies, such as choosing GP2 over GP3 (which actually increases cost) or assuming Graviton is supported for SAP when it is not.

Practice this question →

125

MCQmedium

An SAP system running on AWS is experiencing high latency to its S3-backed backup destination. Which architectural change would most effectively reduce backup latency?

A.Configure an S3 Gateway Endpoint in the VPC to route traffic to S3 privately.

B.Increase the size of the EC2 instance running SAP to improve I/O throughput.

C.Move the SAP instance to a different Availability Zone closer to the S3 bucket.

D.Enable S3 Transfer Acceleration on the backup bucket.

AnswerA

An S3 Gateway Endpoint keeps traffic within the AWS network, reducing latency and improving performance.

Why this answer

An S3 Gateway Endpoint provides a private, low-latency path from the SAP EC2 instance to S3 without traversing the public internet or NAT gateways. This eliminates network hops and reduces latency by keeping traffic within the AWS network, directly addressing the high-latency issue for S3-backed backups.

Exam trap

The trap here is that candidates often confuse S3 Transfer Acceleration (which is for long-distance, cross-region speed) with a solution for within-region latency, or assume that moving to a different Availability Zone reduces latency to a regional service like S3.

How to eliminate wrong answers

Option B is wrong because increasing EC2 instance size improves compute and I/O throughput for local storage, but does not reduce network latency to S3, which is the root cause. Option C is wrong because moving the SAP instance to a different Availability Zone does not change the physical distance to the S3 bucket (S3 is a regional service), and may even increase latency if the new AZ is farther from the S3 endpoints. Option D is wrong because S3 Transfer Acceleration optimizes upload speed over long distances via edge locations, but adds overhead and cost; it does not reduce latency for backups within the same region and may actually increase latency for short-distance transfers.

Practice this question →

126

MCQmedium

An SAP administrator runs the above CLI command to find the public IP of an m5.2xlarge instance. The output is null. Which of the following is the most likely reason?

A.The security group blocks the public IP

B.The CLI command has a syntax error

C.The instance type m5.2xlarge does not support public IP addresses

D.The instance does not have a public IP address assigned

AnswerD

The instance may be in a private subnet or launched without a public IP.

Why this answer

The CLI command `aws ec2 describe-instances --instance-ids <id> --query 'Reservations[0].Instances[0].PublicIpAddress'` returns null because the instance does not have a public IP address assigned. In AWS, a public IP is only assigned to an instance if it is launched in a subnet that auto-assigns public IPv4 addresses, or if an Elastic IP is attached. The command itself is syntactically correct and will output null (or an empty string) when no public IP exists, not an error.

Exam trap

The trap here is that candidates may incorrectly attribute the null output to a security group blocking the IP or a syntax error, rather than understanding that the instance simply lacks a public IP address due to subnet configuration or missing Elastic IP.

How to eliminate wrong answers

Option A is wrong because security groups do not block or hide the public IP address; they control inbound/outbound traffic at the instance level, but the public IP metadata is still available via the EC2 API regardless of security group rules. Option B is wrong because the CLI command shown is syntactically valid; if there were a syntax error, the AWS CLI would return an error message (e.g., 'Bad value for --query'), not a null output. Option C is wrong because the m5.2xlarge instance type fully supports public IP addresses; public IP assignment depends on subnet settings or Elastic IP association, not on the instance type.

Practice this question →

127

MCQhard

An SAP Basis administrator is troubleshooting a performance issue on a SAP HANA database running on an r5.4xlarge instance with dedicated tenancy. The instance is part of a placement group named 'sap-cluster'. The administrator suspects network throughput is suboptimal. Based on the exhibit, what is the MOST likely reason?

A.Dedicated tenancy prevents the use of Enhanced Networking.

B.The instance type r5.4xlarge does not support Enhanced Networking.

C.The placement group 'sap-cluster' restricts network throughput.

D.The instance is using the Xen paravirtual network driver (xen-net) instead of Enhanced Networking with ENA, resulting in suboptimal throughput.

AnswerD

Xen hypervisor indicates no Enhanced Networking.

Why this answer

The exhibit shows the network driver is 'xen-net', indicating the instance is using the Xen PV (paravirtual) driver instead of the Elastic Network Adapter (ENA). While the r5.4xlarge instance uses the Nitro hypervisor, launching with an older AMI that lacks ENA support results in the Xen PV driver being used. This driver does not provide the advanced networking features of ENA, leading to suboptimal network throughput.

Therefore, the most likely reason is option D, as the instance is effectively using a Xen-based driver configuration that does not support ENA.

Exam trap

The trap here is that candidates may assume all modern instance types automatically have Enhanced Networking enabled, but the actual driver and AMI support determine whether ENA is used, and the exhibit's network driver information reveals the root cause.

How to eliminate wrong answers

Option A is wrong because dedicated tenancy does not prevent the use of Enhanced Networking; Enhanced Networking with ENA is supported on dedicated instances. Option B is wrong because the r5.4xlarge instance type fully supports Enhanced Networking with ENA. Option C is wrong because placement groups do not restrict network throughput; they can actually improve network performance by placing instances in close proximity within a single Availability Zone.

Practice this question →

128

MCQhard

A company is designing a high-availability architecture for SAP NetWeaver on AWS. The architecture includes two application server instances in different Availability Zones, a shared file system using Amazon EFS, and a database using SAP HANA with HANA System Replication (HSR). During a failover test, the application servers cannot connect to the database after the HANA secondary becomes the primary. What is the most likely cause?

A.HANA System Replication is not configured correctly for automatic failover.

B.The SAP application servers are configured with the hostname of the primary HANA instance, which did not update after failover.

C.The Amazon EFS file system is not available in the secondary Availability Zone.

D.The security group of the application servers does not allow outbound traffic to the secondary HANA instance.

AnswerB

Application servers need to have a virtual hostname or use a DNS name that updates to the new primary.

Why this answer

In SAP NetWeaver, application servers connect to the database using a fixed hostname or virtual IP address. After HANA System Replication (HSR) failover, the secondary becomes the primary but retains its own hostname unless a virtual hostname (e.g., using Amazon Route 53 or Elastic IP) is configured to automatically update. If the application servers are hardcoded with the original primary's hostname, they cannot resolve or reach the new primary, causing connection failure.

Exam trap

The trap here is that candidates often assume HSR automatic failover (Option A) is the root cause, but the real issue is the lack of a virtual hostname or DNS update mechanism, which is a common misconfiguration in SAP on AWS architectures.

How to eliminate wrong answers

Option A is wrong because HSR automatic failover is not required for the application servers to reconnect; even with manual failover, the connection would fail if the hostname is not updated. Option C is wrong because Amazon EFS is a regional, multi-AZ service that is available in all Availability Zones simultaneously, so its availability does not affect database connectivity. Option D is wrong because outbound traffic from application servers to the secondary HANA instance is typically allowed by default in security groups; the issue is name resolution, not network access.

Practice this question →

129

MCQeasy

A company is deploying a new SAP BusinessObjects system on AWS. The system will consist of multiple servers: a CMS database server, an audit database server, and several processing servers. The administrator needs to ensure that all servers can communicate with each other and with corporate on-premises systems via a VPN connection. The AWS environment is in a single VPC with public and private subnets. Which network architecture should be used to meet these requirements?

A.Place servers in private subnets and use a NAT Gateway for outbound internet and a VPN gateway for on-premises connectivity.

B.Place all servers in public subnets with Elastic IPs and use security groups to restrict access.

C.Use a single public subnet for all servers and rely on network ACLs for isolation.

D.Place servers in private subnets and use a bastion host for all inter-server communication.

AnswerA

Private subnets with NAT and VPN provide secure connectivity.

Why this answer

Placing the SAP BusinessObjects servers in private subnets ensures they are not directly exposed to the internet, which is a security best practice. A NAT Gateway provides outbound internet access for tasks like software updates, while a VPN Gateway (or Virtual Private Gateway) establishes encrypted connectivity to the corporate on-premises systems, meeting the requirement for inter-server and hybrid communication.

Exam trap

The trap here is that candidates often confuse the purpose of a NAT Gateway (outbound internet only) with a bastion host (administrative access) or mistakenly think public subnets are acceptable for SAP servers, ignoring the security and compliance requirements for private, isolated workloads.

How to eliminate wrong answers

Option B is wrong because placing all servers in public subnets with Elastic IPs exposes them directly to the internet, violating security best practices and increasing the attack surface unnecessarily. Option C is wrong because using a single public subnet for all servers and relying solely on network ACLs for isolation does not provide the private, secure environment required for SAP workloads and does not address the need for VPN-based on-premises connectivity. Option D is wrong because a bastion host is used for administrative access to private instances, not for inter-server communication; inter-server traffic should flow directly within the VPC using private IPs, not be routed through a bastion host.

Practice this question →

130

MCQeasy

A company is planning to run SAP HANA on AWS and needs to ensure that the instance is optimally placed for low latency between the application and database tiers. Which AWS feature should be used?

A.Application Load Balancer

B.VPC endpoint

C.Cluster placement group

D.Auto Scaling group

AnswerC

Cluster placement groups provide low-latency network performance within an AZ.

Why this answer

A cluster placement group is the correct choice because it provides low-latency, high-throughput network connectivity by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth. For SAP HANA, where the application and database tiers require sub-millisecond latency for optimal performance, a cluster placement group ensures that all instances are physically close together, minimizing network hops and jitter.

Exam trap

The trap here is that candidates often confuse a cluster placement group with a spread placement group or partition placement group, assuming any placement group reduces latency, but only the cluster type is designed for low-latency, tightly coupled workloads like SAP HANA.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer operates at Layer 7 and distributes traffic across multiple targets, but it does not influence the physical proximity or network latency between instances; it adds network hops rather than reducing them. Option B is wrong because a VPC endpoint enables private connectivity to AWS services (e.g., S3, DynamoDB) without traversing the internet, but it does not affect the placement or latency between EC2 instances within the same VPC. Option D is wrong because an Auto Scaling group manages instance count and health based on scaling policies, but it does not control the physical placement of instances to achieve low latency; instances in an Auto Scaling group can be spread across multiple Availability Zones, increasing latency.

Practice this question →

131

MCQhard

An SAP administrator created the above IAM policy for an EC2 instance that performs automated SAP HANA backups. The backup script runs successfully but fails to upload the backup files to the S3 bucket. What is the most likely cause?

A.The S3 bucket policy denies the upload

B.The IAM policy does not include permissions for multipart upload operations

C.The IAM policy does not allow s3:PutObject

D.The EC2 instance does not have permission to create snapshots

AnswerB

Multipart uploads require additional actions like s3:AbortMultipartUpload.

Why this answer

The IAM policy shown in the question (not fully displayed here) likely includes s3:PutObject but omits the required s3:PutObjectPart and s3:AbortMultipartUpload permissions. SAP HANA backups often produce large files that exceed the 5 GB single-upload limit, forcing the AWS CLI or SDK to use multipart upload. Without these permissions, the upload fails after the script runs successfully.

Exam trap

The key trap is that s3:PutObject alone is insufficient for large uploads; candidates mistakenly assume that granting s3:PutObject covers all upload scenarios when multipart upload permissions are also required.

How to eliminate wrong answers

Option A is wrong because the question states the backup script runs successfully and only fails during the upload to S3, implying the S3 bucket policy is not the issue; if it denied the upload, the script would fail earlier or receive an Access Denied error. Option B is wrong because it is actually the correct answer. Option C is wrong because the IAM policy does include s3:PutObject (as the script runs and attempts the upload), but the failure occurs due to missing multipart upload permissions.

Option D is wrong because the question is about uploading to S3, not creating snapshots; EC2 snapshot permissions are irrelevant to S3 uploads.

Practice this question →

132

MCQhard

An SAP landscape on AWS includes several instances in a VPC. The administrator needs to ensure that SAProuter can connect to the SAP system from the internet securely. Which networking component should be used?

A.AWS Direct Connect with a public VIF

B.Internet Gateway with a public IP on the SAProuter instance

C.AWS CloudFront with a security group

D.AWS VPN connection to the customer's network

AnswerD

VPN provides encrypted tunnel for secure SAProuter communication.

Why this answer

An AWS VPN connection establishes an encrypted tunnel over the internet between the customer's on-premises network and the VPC, allowing SAProuter to connect securely to the SAP system without exposing any instance to the public internet. This aligns with the requirement for secure, authenticated connectivity from the internet while maintaining network isolation.

Exam trap

The trap here is that candidates often confuse 'secure connectivity from the internet' with simply providing internet access via an Internet Gateway, overlooking the need for encrypted tunneling and network isolation that a VPN provides.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect with a public VIF provides a dedicated network connection to AWS public services, but it does not inherently secure SAProuter traffic from the internet; it bypasses the internet but still requires additional security measures and does not address the 'from the internet' requirement directly. Option B is wrong because attaching an Internet Gateway with a public IP on the SAProuter instance exposes the instance directly to the internet, violating security best practices for SAP systems and increasing the attack surface. Option C is wrong because AWS CloudFront is a content delivery network (CDN) for distributing static and dynamic web content, not a networking component for routing SAProuter traffic; it cannot establish a secure tunnel for SAProuter's proprietary protocol.

Practice this question →

133

MCQhard

A company is planning to run SAP S/4HANA on AWS and needs to ensure that the system can automatically recover from an Availability Zone failure. They want to use SAP HANA System Replication with automatic failover. Which AWS configuration is required?

A.AWS Auto Scaling groups with lifecycle hooks

B.Pacemaker cluster with STONITH across two Availability Zones

C.Amazon RDS Multi-AZ deployment

D.Amazon EFS as shared storage for HANA data

AnswerB

Pacemaker with STONITH provides automatic failover and fencing.

Why this answer

SAP HANA System Replication with automatic failover requires a Pacemaker cluster with STONITH (Shoot The Other Node In The Head) configured across two Availability Zones. This setup provides the fencing mechanism necessary to prevent split-brain scenarios and ensures that the failed primary node is forcibly isolated before the secondary node takes over, enabling reliable automatic failover for SAP S/4HANA on AWS.

Exam trap

The trap here is that candidates confuse managed database services like Amazon RDS Multi-AZ with the specific requirements of SAP HANA System Replication, assuming that AWS's built-in high availability features can replace the need for a Pacemaker cluster with STONITH, but SAP HANA on AWS requires explicit cluster configuration and fencing to achieve automatic failover across Availability Zones.

How to eliminate wrong answers

Option A is wrong because AWS Auto Scaling groups with lifecycle hooks are designed for scaling EC2 instances based on demand, not for orchestrating SAP HANA System Replication failover or providing the fencing and cluster coordination required for automatic recovery from an Availability Zone failure. Option C is wrong because Amazon RDS Multi-AZ deployment is a managed database service for relational databases like MySQL or PostgreSQL, not for SAP HANA, and it does not support SAP S/4HANA's native HANA System Replication or Pacemaker clustering. Option D is wrong because Amazon EFS is a shared file system for NFS workloads, but SAP HANA requires high-performance, low-latency block storage (e.g., Amazon EBS gp3 or io2) for its data and log volumes, and shared storage is not used in HANA System Replication; instead, each node has its own dedicated storage.

Practice this question →

134

MCQeasy

An SAP administrator is designing a new SAP NetWeaver system on AWS. They need to choose an EC2 instance type that is certified for SAP. Which source should they consult?

A.Amazon EC2 console

B.AWS Pricing Calculator

C.SAP Note 2235581 (SAP HANA Hardware Directory)

D.AWS documentation on EC2 instance types

AnswerC

SAP Note 2235581 provides the official SAP HANA hardware directory.

Why this answer

SAP Note 2235581 is the authoritative source for the SAP HANA Hardware Directory, which lists all EC2 instance types certified for SAP HANA and SAP NetWeaver. AWS relies on SAP's own certification process, so only SAP's official directory provides the definitive list of supported instance types.

Exam trap

The trap here is that candidates assume AWS documentation or the EC2 console would list SAP-certified instances, but SAP maintains its own hardware directory independently, and only SAP Note 2235581 is the definitive source.

How to eliminate wrong answers

Option A is wrong because the Amazon EC2 console does not display SAP certification status; it only shows general instance type information and features. Option B is wrong because the AWS Pricing Calculator is a cost estimation tool and does not include SAP certification data. Option D is wrong because AWS documentation on EC2 instance types describes general capabilities but does not maintain the official SAP certification list, which is exclusively managed by SAP.

Practice this question →

135

MCQhard

An administrator needs to back up SAP HANA database to S3 with encryption. The backup must be encrypted at rest in S3. Which combination of actions should be taken?

A.Use AWS CloudHSM to generate keys and store them in S3

B.Enable S3 Versioning and use S3-managed keys

C.Configure S3 bucket with default encryption using SSE-S3 or SSE-KMS

D.Use AWS Backup to back up to S3 with default settings

AnswerC

Default encryption ensures all objects are encrypted at rest.

Why this answer

Configuring an S3 bucket with default encryption using SSE-S3 or SSE-KMS ensures that backups written to S3 are automatically encrypted at rest. SSE-S3 uses Amazon-managed keys with AES-256, while SSE-KMS allows you to use AWS KMS customer managed keys (CMKs) for additional control. This meets the requirement for encryption at rest in S3 without requiring additional infrastructure or manual key management.

Exam trap

The trap here is that candidates confuse S3 Versioning (which protects against accidental deletion) with encryption, or assume that AWS Backup automatically enforces encryption without explicitly configuring bucket default encryption.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM generates keys that are stored in the HSM itself, not in S3; storing keys in S3 would defeat the purpose of a hardware security module and is not a supported pattern for S3 encryption. Option B is wrong because enabling S3 Versioning provides object versioning, not encryption; S3-managed keys (SSE-S3) are a valid encryption method, but Versioning alone does not encrypt data. Option D is wrong because AWS Backup with default settings does not guarantee encryption at rest in S3; default settings may use SSE-S3, but the question requires a specific action to ensure encryption, and AWS Backup does not inherently configure S3 bucket encryption.

Practice this question →

136

MCQmedium

A company is running SAP ERP on AWS with an Oracle database. The application servers are deployed in an Auto Scaling group across three Availability Zones. The database is hosted on a single EC2 instance in us-east-1a. The company wants to improve availability with minimal changes to the application. The database must be highly available with automatic failover and no data loss. The database size is 1 TB. The current RTO is 2 hours and RPO is 1 hour. The company is considering using Oracle Data Guard for replication. Which solution should the company implement to meet the HA requirements?

A.Use AWS Database Migration Service (DMS) to replicate the Oracle database to a second EC2 instance in another AZ, and use an Amazon Route 53 health check to redirect traffic.

B.Migrate the Oracle database to Amazon RDS for Oracle with Multi-AZ deployment and automatic failover.

C.Configure Oracle Data Guard with synchronous replication and Fast-Start Failover (FSFO) to automatically fail over to a standby instance in another AZ.

D.Configure Oracle Data Guard with asynchronous replication to a standby instance in us-east-1b, and use a custom script to detect failure and promote the standby.

AnswerC

Synchronous replication ensures zero data loss; FSFO provides automatic failover.

Why this answer

Oracle Data Guard with synchronous replication ensures zero data loss by committing transactions only after they are written to both primary and standby redo logs. Fast-Start Failover (FSFO) automates the failover process without manual intervention, meeting the RTO of 2 hours and RPO of 1 hour while requiring minimal application changes since the database remains Oracle-native.

Exam trap

The trap here is that candidates often assume AWS-managed services like RDS Multi-AZ are always the best choice for high availability, but the question explicitly requires minimal application changes and zero data loss, making Oracle-native Data Guard with synchronous replication the correct fit despite the operational overhead.

How to eliminate wrong answers

Option A is wrong because AWS DMS is a migration tool, not a high-availability replication solution; it does not support automatic failover or synchronous replication, and using Route 53 health checks for traffic redirection introduces DNS propagation delays that violate the RTO. Option B is wrong because migrating to Amazon RDS for Oracle with Multi-AZ is not a minimal change—it requires application connection string changes and may not support all SAP ERP-specific Oracle features or customizations, and Multi-AZ uses asynchronous replication by default, risking data loss. Option D is wrong because asynchronous replication does not guarantee zero data loss (RPO=0), and relying on a custom script for failover detection and promotion introduces complexity and potential delays that could exceed the RTO.

Practice this question →

137

MCQhard

A company is migrating an SAP BusinessObjects system to AWS. The system includes a Central Management Server (CMS) and several processing servers. The CMS uses a SQL Server database. The company wants to use a managed database service on AWS to reduce operational overhead. The database size is 100 GB and is expected to grow 10% annually. The company requires automatic failover to a secondary Availability Zone with minimal downtime. Which AWS database service should the company use for the CMS database?

A.Amazon RDS for SQL Server with Multi-AZ deployment

B.Amazon EC2 with SQL Server installed

C.Amazon Aurora SQL Server

D.Amazon DynamoDB

AnswerA

Amazon RDS for SQL Server with Multi-AZ deployment provides a managed SQL Server database with automatic failover to a secondary Availability Zone, ensuring minimal downtime and reducing operational overhead.

Why this answer

Amazon RDS for SQL Server with Multi-AZ deployment is the correct choice because it provides a managed database service with automatic failover to a standby instance in a different Availability Zone, meeting the requirement for minimal downtime. Amazon Aurora does not support SQL Server compatibility; Aurora is MySQL/PostgreSQL-compatible. Amazon EC2 with SQL Server installed is not a managed service, increasing operational overhead.

Amazon DynamoDB is a NoSQL database and not compatible with SQL Server, which requires a relational database.

Practice this question →

138

MCQmedium

A company is running SAP ERP on AWS and wants to ensure high availability for the SAP Central Services (ASCS) instance. Which AWS service should be used to achieve this?

A.EC2 Auto Scaling

B.Elastic Load Balancer (NLB)

C.Amazon Route 53

D.AWS Global Accelerator

AnswerB

Network Load Balancer can distribute traffic to multiple ASCS instances for HA.

Why this answer

For SAP ASCS high availability, AWS recommends using a Network Load Balancer (NLB) to manage the virtual IP address (VIP) required by SAP. The NLB handles the failover of the ASCS instance between two EC2 nodes by directing traffic to the active node, ensuring seamless client connectivity without relying on a floating IP or custom scripts.

Exam trap

The trap here is that candidates often confuse DNS-based services like Route 53 or Global Accelerator with the Layer 4 load balancing required for SAP ASCS VIP management, overlooking the NLB’s ability to provide a static IP and sub-second failover.

How to eliminate wrong answers

Option A is wrong because EC2 Auto Scaling is designed for horizontal scaling of stateless applications, not for managing the failover of a stateful SAP ASCS instance that requires a stable VIP and controlled cluster failover. Option C is wrong because Amazon Route 53 is a DNS service that provides global traffic routing and health checks, but it cannot provide the sub-second failover and VIP management required for SAP ASCS; DNS caching and propagation delays make it unsuitable for high-availability failover. Option D is wrong because AWS Global Accelerator improves performance and availability by directing traffic over the AWS global network, but it does not manage the virtual IP or cluster failover for SAP ASCS within a single region.

Practice this question →

139

MCQeasy

An SAP administrator is troubleshooting connectivity between SAP application servers and the SAP HANA database. The database security group has an inbound rule as shown in the exhibit. The application servers are in security group sg-12345. However, the application servers cannot connect to the database. What is the most likely reason?

A.The source should be the IP address range of the application servers.

B.The rule uses the wrong protocol; it should be UDP.

C.The outbound rule on the application server security group is missing.

D.The port number is incorrect for SAP HANA.

AnswerD

SAP HANA uses port 3<instance_number>15, not 3300.

Why this answer

SAP HANA uses TCP port 30015 by default for client connections (3<instance>15). If the security group inbound rule specifies a different port, such as 30013 or 31015, the application servers will be unable to establish a TCP connection to the database. The exhibit likely shows an incorrect port number, making option D the most likely cause.

Exam trap

The trap here is that candidates often assume a security group rule referencing another security group is invalid or that the source must be an IP range, but AWS security groups can reference each other, and the real issue is typically a port mismatch or incorrect protocol.

How to eliminate wrong answers

Option A is wrong because security group rules can reference other security groups as sources, which is a valid and recommended AWS practice for allowing traffic between instances in different security groups without needing to specify IP ranges. Option B is wrong because SAP HANA uses TCP, not UDP, for client-to-database communication; UDP is used only for certain internal replication or name resolution tasks. Option C is wrong because the outbound rule on the application server security group is not the issue—by default, security groups allow all outbound traffic, and the problem is inbound connectivity to the database, not outbound from the app servers.

Practice this question →

140

MCQmedium

A company is migrating its SAP ERP system to AWS. The system requires high availability for the SAP Central Services (ASCS) instance. Which AWS architecture should be used to meet this requirement?

A.Use a multi-AZ deployment with Amazon FSx for NetApp ONTAP as a shared file system and place ASCS on two EC2 instances in different Availability Zones with an Elastic IP address.

B.Use Amazon S3 to store the ASCS configuration and launch a single EC2 instance with an Auto Scaling group.

C.Deploy ASCS on a single EC2 instance in one Availability Zone with an EBS volume snapshot for recovery.

D.Use Amazon RDS for SAP Central Services running in a Multi-AZ configuration.

AnswerA

This provides high availability with failover across AZs.

Why this answer

SAP ASCS requires a highly available shared file system and a floating IP address for failover. Amazon FSx for NetApp ONTAP provides a highly available, NFS-based shared file system that supports the SAP transport and profile directories across Availability Zones. Placing two EC2 instances in different AZs with an Elastic IP address allows the ASCS instance to be failed over manually or via a cluster manager, meeting the high availability requirement.

Exam trap

The trap here is that candidates confuse SAP Central Services (ASCS) with a database service and incorrectly select Amazon RDS, or assume that a single-instance recovery solution like EBS snapshots meets high availability requirements, when in fact SAP ASCS requires a clustered architecture with shared storage and a floating IP.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object store and does not support the POSIX file system semantics required by SAP ASCS for shared directories like /usr/sap/trans and profile files; Auto Scaling groups are designed for stateless scaling, not for stateful SAP ASCS failover. Option C is wrong because a single EC2 instance with an EBS snapshot provides only backup and recovery, not high availability; it cannot achieve the sub-minute failover required for SAP ASCS. Option D is wrong because Amazon RDS is a managed database service for relational databases, not for SAP Central Services, which is an application service that requires a shared file system and cluster management, not a database.

Practice this question →

141

MCQmedium

A company is designing a backup strategy for SAP HANA on AWS. The HANA database is 2 TB in size. The company requires daily full backups and hourly incremental backups. Which AWS service should be used to store the backups cost-effectively with high durability?

A.Amazon S3 with lifecycle policies to transition to Glacier.

B.Amazon EBS Snapshots stored in Amazon S3.

C.AWS Storage Gateway with volume gateway.

D.Amazon EFS for shared backup storage.

AnswerA

S3 offers durability and cost-effectiveness for backups.

Why this answer

Amazon S3 with lifecycle policies to transition to Glacier is correct because S3 provides 99.999999999% durability and cost-effective storage for SAP HANA backups. Lifecycle policies automatically move older backups to lower-cost tiers like Glacier, reducing costs while meeting the 2 TB database's daily full and hourly incremental backup requirements.

Exam trap

The trap here is that candidates often choose EBS Snapshots (Option B) because they assume snapshots are the native backup method for SAP HANA on AWS, but they fail to recognize that SAP HANA requires file-based backups for point-in-time recovery and that S3 offers superior cost optimization through lifecycle policies.

How to eliminate wrong answers

Option B is wrong because Amazon EBS Snapshots are stored in Amazon S3 internally, but they are not directly accessible or manageable as backup files for SAP HANA; they are tied to EBS volumes and lack the flexibility for granular backup scheduling and lifecycle management. Option C is wrong because AWS Storage Gateway with volume gateway provides block storage for on-premises applications to cache data in AWS, but it is not designed for direct backup storage of SAP HANA databases and introduces unnecessary complexity and latency. Option D is wrong because Amazon EFS is a file system for shared access, not optimized for backup storage; it lacks the cost efficiency of S3's tiered storage and does not support lifecycle transitions to Glacier for long-term retention.

Practice this question →

142

MCQhard

A company has an SAP HANA database running on a r5.8xlarge EC2 instance with 3.5 TB of data. They want to back up the database to Amazon S3 using Backint. What is the most cost-effective and performant backup strategy?

A.Use EBS snapshots and copy them to S3.

B.Use multiple parallel Backint streams to a single S3 bucket with S3 Standard storage.

C.Use multiple parallel Backint streams to multiple S3 buckets with S3 Glacier storage.

D.Use a single Backint stream to one S3 bucket with S3 Standard storage.

AnswerB

Parallel streams improve throughput; single bucket is simpler and cost-effective.

Why this answer

Backint is the native SAP HANA backup integration that sends backup data directly to Amazon S3. Using multiple parallel Backint streams maximizes throughput by leveraging S3's high request rate limits, and S3 Standard storage provides the low-latency access needed for frequent backups and restores without incurring retrieval costs. This combination is both cost-effective and performant for a 3.5 TB database.

Exam trap

The trap here is that candidates often choose S3 Glacier for cost savings, overlooking the retrieval latency and costs for frequent backups, or they choose a single stream assuming simplicity, missing the performance benefits of parallelism for large datasets.

How to eliminate wrong answers

Option A is wrong because EBS snapshots capture the entire volume, including unused blocks, and require copying to S3, which adds latency and cost without leveraging Backint's native SAP integration for HANA. Option C is wrong because S3 Glacier storage incurs retrieval fees and delays (minutes to hours) that are unsuitable for frequent backups and rapid restores required by SAP HANA. Option D is wrong because a single Backint stream creates a bottleneck, limiting throughput to a single connection and failing to utilize S3's parallel processing capabilities, resulting in slower backup times for a 3.5 TB dataset.

Practice this question →

143

MCQhard

A company is designing a multi-zone SAP system on AWS. They want to minimize network latency between SAP application servers and the SAP HANA database. What is the best practice for deploying these components?

A.Deploy in different VPCs and use VPC peering.

B.Deploy in different AWS Regions.

C.Deploy application servers and HANA in the same AZ and same VPC.

D.Deploy application servers in one AZ and HANA in another AZ.

AnswerC

Same AZ and VPC minimizes latency.

Why this answer

Deploying both the SAP application servers and the SAP HANA database in the same Availability Zone (AZ) and the same VPC minimizes network latency because traffic stays within a single data center, using low-latency, high-bandwidth links. SAP HANA is latency-sensitive, and even single-digit millisecond increases can degrade performance; co-location in the same AZ ensures the lowest possible round-trip time (RTT) for SQL queries and data transfers.

Exam trap

The trap here is that candidates often assume cross-AZ deployment provides high availability without considering the latency penalty, but for SAP HANA, latency is prioritized over AZ-level redundancy in this design scenario, and the question explicitly asks for minimizing latency, not maximizing availability.

How to eliminate wrong answers

Option A is wrong because deploying in different VPCs and using VPC peering introduces additional network hops and potential bandwidth constraints, increasing latency compared to a single VPC. Option B is wrong because deploying in different AWS Regions incurs inter-Region latency (typically tens of milliseconds), which is unacceptable for SAP HANA's real-time processing requirements. Option D is wrong because deploying application servers in one AZ and HANA in another AZ adds cross-AZ latency (typically 1-2 ms), which can still impact performance for latency-critical SAP workloads, whereas same-AZ placement eliminates this entirely.

Practice this question →

144

MCQmedium

A company runs SAP ERP on AWS. The system needs to be highly available with automatic failover in case of an Availability Zone failure. Which architecture should be used?

A.Route 53 failover routing policy

B.Auto Scaling group with multiple EC2 instances in different AZs

C.SAP HANA System Replication across two Availability Zones with automatic failover

D.AWS RDS Multi-AZ deployment

AnswerC

HANA SR across AZs provides automatic failover for HA.

Why this answer

SAP HANA System Replication (HSR) across two Availability Zones with automatic failover is the correct architecture because it provides synchronous or asynchronous replication of the SAP HANA database at the storage or log level, enabling automatic failover to a standby instance in a different AZ when the primary fails. This meets the requirement for high availability and automatic failover during an AZ failure, as HSR is the native SAP mechanism for database-level HA on AWS, unlike generic AWS services that do not handle SAP-specific application state or replication requirements.

Exam trap

The trap here is that candidates confuse generic AWS high-availability services (like Auto Scaling or RDS Multi-AZ) with SAP-specific requirements, failing to recognize that SAP HANA requires its own replication mechanism (HSR) and that RDS does not support SAP HANA at all.

How to eliminate wrong answers

Option A is wrong because Route 53 failover routing policy only handles DNS-level traffic routing to healthy endpoints, not automatic failover of the SAP ERP application or database; it cannot initiate database failover or maintain session state, and it requires health checks that do not replace SAP HANA's replication and takeover logic. Option B is wrong because an Auto Scaling group with multiple EC2 instances in different AZs provides compute-level redundancy but does not manage SAP HANA database replication or automatic failover; it lacks the database synchronization and takeover mechanisms needed for SAP ERP, and scaling out instances does not address database state consistency. Option D is wrong because AWS RDS Multi-AZ deployment is designed for relational databases like MySQL, PostgreSQL, or Oracle, not for SAP HANA; SAP HANA is an in-memory database that requires its own replication technology (HSR) and is not supported by RDS Multi-AZ, which also does not provide SAP-specific application-aware failover.

Practice this question →

145

MCQmedium

An administrator is reviewing a CloudFormation template to deploy an SAP ASCS instance. The template snippet is shown in the exhibit. What is a potential issue with this configuration for a production deployment?

A.The AMI ID is not specified correctly.

B.The instance type m5.large is not certified for SAP ASCS.

C.The security group is not defined in the template.

D.The tags are not sufficient for SAP discovery.

AnswerB

SAP ASCS requires certified instance types; m5.large is not certified.

Why this answer

The m5.large instance type is not certified for SAP ASCS on AWS. SAP requires specific instance types that have passed SAP's certification tests for high-availability and performance requirements of the ASCS (ABAP Central Services) role. Using an uncertified instance type can lead to unsupported configurations, potential performance issues, and lack of SAP support.

Exam trap

The trap here is that candidates often assume any instance type in a family (e.g., m5) is automatically certified for SAP, but SAP certification is granular per specific size and role, and m5.large is explicitly excluded for ASCS in production.

How to eliminate wrong answers

Option A is wrong because the AMI ID is not specified in the template snippet shown, but this is not inherently an issue—the AMI can be provided as a parameter or mapped later, and the question focuses on the ASCS deployment configuration, not the AMI. Option C is wrong because security groups can be referenced by name or ID without being defined inline in the same template; they may exist externally or be imported, and this does not directly affect ASCS certification. Option D is wrong because tags are not a certification requirement for SAP ASCS; while tags help with resource identification and automation, insufficient tags do not prevent a production deployment or violate SAP certification.

Practice this question →

146

MCQeasy

An SAP administrator is planning a Disaster Recovery (DR) strategy for SAP HANA on AWS. The DR site is in a different AWS Region. Which AWS service can replicate SAP HANA data to the DR region with low Recovery Point Objective (RPO)?

A.Amazon EBS snapshots copied to the DR region

B.SAP HANA System Replication with log shipping

C.AWS Database Migration Service (DMS) with ongoing replication

D.Amazon S3 cross-region replication

AnswerB

HANA System Replication provides continuous synchronization with low RPO.

Why this answer

SAP HANA System Replication with log shipping is the correct choice because it provides near-synchronous or synchronous replication of HANA data and transaction logs to a secondary system in another AWS Region, enabling a Recovery Point Objective (RPO) of seconds or even zero data loss. This native HANA feature is optimized for SAP workloads and integrates directly with HANA's persistence layer, making it the most suitable DR method for low RPO requirements.

Exam trap

The trap here is that candidates often confuse Amazon EBS snapshots or S3 replication as viable low-RPO solutions for SAP HANA, but these are not designed for real-time database replication and cannot match the sub-second RPO of HANA's native log shipping mechanism.

How to eliminate wrong answers

Option A is wrong because Amazon EBS snapshots are point-in-time copies of block-level data, and copying them to a DR region introduces significant delays (snapshot creation time, transfer time) that result in a high RPO, often minutes to hours, not low RPO. Option C is wrong because AWS Database Migration Service (DMS) with ongoing replication is designed for heterogeneous database migrations and continuous replication to supported targets, but it does not natively support SAP HANA as a source for ongoing replication to another HANA instance, and it cannot achieve the sub-second RPO that HANA System Replication offers. Option D is wrong because Amazon S3 cross-region replication is an object-level replication feature for S3 buckets, not a mechanism for replicating live SAP HANA database data, which requires transaction-consistent log shipping or block-level replication.

Practice this question →

147

Multi-Selectmedium

An SAP system on AWS uses an Oracle database. The administrator wants to automate the creation of daily backups and retain them for 30 days. Which THREE AWS services can be used together to achieve this? (Choose three.)

Select 3 answers

A.Amazon S3 lifecycle policies

B.AWS Lambda

C.Amazon EBS snapshots

D.AWS Backup

E.Amazon CloudWatch Events

AnswersA, C, D

To expire old backups.

Why this answer

Amazon S3 lifecycle policies (A) are correct because they can be used to automatically transition backup data to lower-cost storage tiers (e.g., S3 Standard-IA or S3 Glacier) and expire objects after a specified retention period (30 days). This enables cost-effective, automated management of daily backups without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Lambda or CloudWatch Events as primary backup services, when in fact they are only orchestration or scheduling tools that require additional services to actually create and manage backups.

Practice this question →

148

MCQeasy

A company wants to automate the installation of SAP software on AWS. Which AWS service is most appropriate for orchestrating the deployment of SAP systems?

A.AWS CloudFormation

B.AWS OpsWorks

C.AWS CodeDeploy

D.AWS Lambda

AnswerA

CloudFormation allows infrastructure as code to provision all AWS resources for SAP.

Why this answer

AWS CloudFormation is the most appropriate service for orchestrating the deployment of SAP systems because it allows you to define the entire infrastructure as code using templates, enabling automated, repeatable, and consistent provisioning of SAP landscapes. It supports custom resources and nested stacks, which are essential for managing the complex dependencies and multi-tier architecture typical of SAP deployments on AWS.

Exam trap

The trap here is that candidates often confuse AWS OpsWorks or CodeDeploy with infrastructure orchestration, but the PAS-C01 exam specifically tests the understanding that CloudFormation is the primary service for automating the provisioning of SAP systems on AWS, while OpsWorks and CodeDeploy serve different purposes in configuration management and application deployment, respectively.

How to eliminate wrong answers

Option B (AWS OpsWorks) is wrong because it is designed for configuration management using Chef or Puppet, not for orchestrating the deployment of complex SAP systems; it lacks native support for SAP-specific resources and templates. Option C (AWS CodeDeploy) is wrong because it is intended for deploying application code to EC2 instances or on-premises servers, not for provisioning the underlying infrastructure or orchestrating multi-tier SAP landscapes. Option D (AWS Lambda) is wrong because it is a serverless compute service for running event-driven code, not a deployment orchestration tool; it cannot manage the lifecycle of infrastructure resources like EC2 instances, storage, and networking required for SAP.

Practice this question →

149

MCQmedium

A company is running SAP ERP on AWS and needs to encrypt data at rest for all SAP-related storage. Which combination of AWS services can be used to achieve this? (Select TWO.)

A.AWS Identity and Access Management (IAM)

B.Amazon S3 server-side encryption

C.AWS WAF

D.Amazon EBS encryption

E.Amazon CloudWatch Logs

AnswerB, D

Encrypts objects stored in S3, such as backups.

Why this answer

Amazon EBS encryption (Option D) provides at-rest encryption for the block storage volumes used by SAP EC2 instances, ensuring data on the underlying disks is encrypted. Amazon S3 server-side encryption (Option B) encrypts data at rest in S3 buckets, which can be used for SAP backups, log archives, or other SAP-related object storage. Together, they cover the primary storage types for SAP on AWS.

Exam trap

The trap here is that candidates may confuse access control services (IAM) or security monitoring (WAF, CloudWatch) with encryption services, failing to recognize that only storage-level services like EBS and S3 provide native at-rest encryption for SAP data.

How to eliminate wrong answers

Option A is wrong because AWS Identity and Access Management (IAM) is an access control service that manages permissions and authentication, not data encryption at rest. Option C is wrong because AWS WAF is a web application firewall that protects against web exploits, not a data encryption service. Option E is wrong because Amazon CloudWatch Logs is a monitoring and logging service that stores log data but does not provide native encryption at rest for SAP storage; it relies on underlying service encryption, but it is not a direct encryption mechanism for SAP-related storage.

Practice this question →

150

Multi-Selecthard

Which THREE of the following are valid options for high availability of SAP HANA on AWS? (Choose THREE.)

Select 3 answers

A.Storage replication using NetApp Cloud Volumes ONTAP.

B.HANA System Replication with automatic failover using AWS Elastic IP or Route53.

C.SAP HANA replication to a secondary region with asynchronous replication.

D.Amazon RDS Multi-AZ for HANA.

E.HANA System Replication with manual failover.

AnswersA, B, E

Third-party storage replication can provide HA.

Why this answer

NetApp Cloud Volumes ONTAP provides storage-level replication that can be used for SAP HANA high availability. This solution replicates storage volumes between availability zones or regions, enabling failover at the storage layer independently of the database, which is a valid HA architecture for SAP HANA on AWS.

Exam trap

The trap here is confusing disaster recovery (asynchronous replication to a secondary region) with high availability (synchronous replication within the same region), and assuming that managed services like RDS Multi-AZ support SAP HANA when they do not.

Practice this question →