Troubleshooting practice questions

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2easymultiple choice

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

Trap 1: CloudFrontFullAccess

This policy is for CloudFront distributions, not S3 bucket operations.

Trap 2: AdministratorAccess

Overly permissive and not a best practice.

Trap 3: AmazonS3ReadOnlyAccess

This policy only allows read access, not write.

A
CloudFrontFullAccess
Why wrong: This policy is for CloudFront distributions, not S3 bucket operations.
B
AdministratorAccess
Why wrong: Overly permissive and not a best practice.
C
AmazonS3ReadOnlyAccess
Why wrong: This policy only allows read access, not write.
D
A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.
These are the minimum permissions needed to upload files to S3.

Question 3mediummultiple choice

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/logs/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}
```

Trap 1: The S3 bucket has versioning enabled, which requires additional…

Versioning does not affect the ability to upload objects; the condition is the issue.

Trap 2: The resource ARN in the bucket policy is incorrect; it should be…

The resource ARN with logs/* is valid and restricts to the logs/ prefix.

Trap 3: The bucket policy does not grant the s3:PutObject permission to the…

The policy explicitly allows s3:PutObject for the specified role.

A
The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.
The bucket policy condition requires this header; without it, the request is denied.
B
The S3 bucket has versioning enabled, which requires additional permissions.
Why wrong: Versioning does not affect the ability to upload objects; the condition is the issue.
C
The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.
Why wrong: The resource ARN with logs/* is valid and restricts to the logs/ prefix.
D
The bucket policy does not grant the s3:PutObject permission to the IAM role.
Why wrong: The policy explicitly allows s3:PutObject for the specified role.

Read the full NAT/PAT explanation →

Question 4hardmultiple choice

A systems administrator is troubleshooting an SAP HANA database that runs on an EC2 instance. The exhibit shows the block device mappings of the EC2 instance. The administrator needs to ensure that the data volumes (/dev/sdf and /dev/sdg) are not accidentally terminated when the instance is terminated. However, the administrator also wants to take a nightly snapshot of these volumes using AWS Backup. Which of the following is a potential issue with the current configuration?

Network Topology

Trap 1: The volume /dev/sdf has DeleteOnTermination set to false, which…

False is the correct setting to prevent data loss.

Trap 2: The device names /dev/sdf and /dev/sdg are reserved for NVMe…

These device names are valid for EBS.

Trap 3: The volumes are attached to a running instance, which prevents…

Snapshots can be taken of attached volumes.

A
The volume /dev/sdf has DeleteOnTermination set to false, which will cause data persistence issues.
Why wrong: False is the correct setting to prevent data loss.
B
The device names /dev/sdf and /dev/sdg are reserved for NVMe instance storage and should not be used for EBS.
Why wrong: These device names are valid for EBS.
C
The volumes are attached to a running instance, which prevents snapshot creation.
Why wrong: Snapshots can be taken of attached volumes.
D
The volumes are not tagged, so AWS Backup may not automatically include them in backup plans.
AWS Backup typically uses tags to identify resources.

Question 5easymultiple choice

An SAP administrator needs to review API calls made by a user who accidentally deleted an S3 bucket used for SAP backups. Which AWS service provides a record of these API calls?

Trap 1: Amazon S3 server access logs

S3 access logs record requests to S3, but not all AWS API calls.

Trap 2: Amazon CloudWatch Logs

CloudWatch Logs stores application logs, not API calls.

Trap 3: AWS Config

Config tracks configuration changes, not API calls.

A
Amazon S3 server access logs
Why wrong: S3 access logs record requests to S3, but not all AWS API calls.
B
Amazon CloudWatch Logs
Why wrong: CloudWatch Logs stores application logs, not API calls.
C
AWS Config
Why wrong: Config tracks configuration changes, not API calls.
D
AWS CloudTrail
CloudTrail provides a record of API calls for governance and auditing.

Question 6easymultiple choice

An SAP administrator is troubleshooting connectivity between SAP application servers and the SAP HANA database. The database security group has an inbound rule as shown in the exhibit. The application servers are in security group sg-12345. However, the application servers cannot connect to the database. What is the most likely reason?

Exhibit

Refer to the exhibit.
{
  "Rules": [
    {
      "SourceSecurityGroupId": "sg-12345",
      "IpProtocol": "tcp",
      "FromPort": 3300,
      "ToPort": 3300
    }
  ]
}

Trap 1: The source should be the IP address range of the application…

Using security group is correct.

Trap 2: The rule uses the wrong protocol; it should be UDP.

SAP HANA uses TCP.

Trap 3: The outbound rule on the application server security group is…

Outbound rules are typically allow-all by default.

A
The source should be the IP address range of the application servers.
Why wrong: Using security group is correct.
B
The rule uses the wrong protocol; it should be UDP.
Why wrong: SAP HANA uses TCP.
C
The outbound rule on the application server security group is missing.
Why wrong: Outbound rules are typically allow-all by default.
D
The port number is incorrect for SAP HANA.
SAP HANA uses port 3<instance_number>15, not 3300.

Question 7hardmultiple choice

An SAP administrator is troubleshooting a performance issue on an SAP HANA instance running on an EC2 instance. The instance type is r5.8xlarge with 256 GB of RAM. The administrator notices that the instance's CPU credit balance is depleting rapidly. What is the most likely cause?

Trap 1: The instance is using EBS-optimized with insufficient bandwidth

EBS optimization does not affect CPU credits.

Trap 2: The SAP application is using too much memory

Memory usage doesn't deplete CPU credits.

Trap 3: The instance has a high network throughput causing CPU overhead

Network throughput does not directly deplete CPU credits.

A
The instance is using EBS-optimized with insufficient bandwidth
Why wrong: EBS optimization does not affect CPU credits.
B
The SAP application is using too much memory
Why wrong: Memory usage doesn't deplete CPU credits.
C
The instance has a high network throughput causing CPU overhead
Why wrong: Network throughput does not directly deplete CPU credits.
D
The instance is a burstable performance instance (e.g., T3) not an r5
Burstable instances earn CPU credits; r5 instances do not have CPU credits.

Question 8hardmultiple choice

An SAP Basis administrator is troubleshooting a performance issue on an SAP HANA database running on an EC2 instance. The administrator notices that the 'hdbcons' command shows high 'wait time' for 'disk I/O' operations. The instance is an r5.4xlarge with 500 GB of gp2 EBS volumes for /hana/data and /hana/log. Which of the following is the MOST effective action to improve disk I/O performance?

Trap 1: Increase the frequency of EBS snapshots to offload I/O.

Snapshots do not offload I/O; they add overhead.

Trap 2: Upgrade to a larger EC2 instance type with more CPU and memory.

Larger instance type does not directly improve disk I/O.

Trap 3: Disable the HANA delta merge operation to reduce I/O load.

Delta merge helps maintain performance; disabling it increases fragmentation.

A
Increase the frequency of EBS snapshots to offload I/O.
Why wrong: Snapshots do not offload I/O; they add overhead.
B
Change the EBS volume type from gp2 to gp3 with higher IOPS and throughput.
gp3 provides better performance and is cost-effective.
C
Upgrade to a larger EC2 instance type with more CPU and memory.
Why wrong: Larger instance type does not directly improve disk I/O.
D
Disable the HANA delta merge operation to reduce I/O load.
Why wrong: Delta merge helps maintain performance; disabling it increases fragmentation.

Question 9hardmultiple choice

An SAP system administrator is troubleshooting a high CPU usage issue on an SAP application server (AS) running on an EC2 instance. The administrator suspects that a specific ABAP report is consuming excessive resources. Which AWS service can provide detailed CPU utilization metrics at the process level to confirm the suspicion?

Trap 1: AWS CloudTrail

CloudTrail records API activity, not OS-level process metrics.

Trap 2: AWS Systems Manager Inventory

Inventory collects installed software and configuration, not real-time resource usage.

Trap 3: AWS Compute Optimizer

Compute Optimizer analyzes utilization patterns over time to recommend instance types, not per-process metrics.

A
AWS CloudTrail
Why wrong: CloudTrail records API activity, not OS-level process metrics.
B
Amazon CloudWatch agent with the 'procstat' plugin
The CloudWatch agent can collect per-process CPU, memory, and disk metrics and publish them as custom CloudWatch metrics.
C
AWS Systems Manager Inventory
Why wrong: Inventory collects installed software and configuration, not real-time resource usage.
D
AWS Compute Optimizer
Why wrong: Compute Optimizer analyzes utilization patterns over time to recommend instance types, not per-process metrics.

Question 10mediummultiple choice

An SAP Basis administrator is troubleshooting a performance issue on an SAP NetWeaver application server running on Amazon EC2. The administrator notices that the CPU utilization is low but the application response times are high. The system is using an Amazon EBS gp2 volume. Which configuration change is most likely to improve performance?

Trap 1: Change the EBS volume to instance store.

Instance store is ephemeral and not for persistent data.

Trap 2: Move the EC2 instance to a larger instance family.

Instance size increase may not address disk I/O bottleneck.

Trap 3: Increase the number of vCPUs on the EC2 instance.

CPU is underutilized; more vCPUs won't help.

A
Increase the IOPS of the EBS gp2 volume or switch to io1.
Higher IOPS improves disk throughput, reducing I/O wait.
B
Change the EBS volume to instance store.
Why wrong: Instance store is ephemeral and not for persistent data.
C
Move the EC2 instance to a larger instance family.
Why wrong: Instance size increase may not address disk I/O bottleneck.
D
Increase the number of vCPUs on the EC2 instance.
Why wrong: CPU is underutilized; more vCPUs won't help.

Question 11mediummultiple choice

Refer to the exhibit. An administrator runs the AWS CLI command shown and receives the output. The instance is running, but the SAP application on the instance is not accessible. Which additional AWS CLI command should the administrator run to troubleshoot the network connectivity?

Network Topology

Trap 1: aws ec2 describe-subnets

This shows subnets but not instance-specific network details.

Trap 2: aws ec2 describe-network-interfaces

This shows network interfaces but not specifically for the instance.

Trap 3: aws ec2 describe-security-groups

This shows all security groups, not specifically attached to the instance.

A
aws ec2 describe-subnets
Why wrong: This shows subnets but not instance-specific network details.
B
aws ec2 describe-network-interfaces
Why wrong: This shows network interfaces but not specifically for the instance.
C
aws ec2 describe-security-groups
Why wrong: This shows all security groups, not specifically attached to the instance.
D
aws ec2 describe-instances --instance-ids i-0abcd1234efgh5678 --query 'Reservations[0].Instances[0].NetworkInterfaces'
This query returns network interface details including public IP, security groups, etc.