Amazon PAS-C01 Exam Questions Instant Access

Question 1

A company's basis administrator is planning to deploy SAP on AWS m Linux. The basis administrator must set up the proper storage to store SAP HANA data and log volumes. Which storage options should the basis administrator choose to meet these requirements? (Select TWO.)

AAmazon Elastic Block Store (Amazon EBS) Throughput Optimized HDD (st1)

BAmazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io1, k>2)

CAmazon S3

DAmazon Elastic File System (Amazon EFS)

EAmazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp2 gp3)

Answer : B, E

Amazon Elastic Block Store (EBS) Provisioned IOPS SSD (io1) provides high IOPS, low latency, and high throughput, making it ideal for use as a storage option for SAP HANA data and log volumes. It is designed for I/O-intensive workloads and is recommended for SAP HANA. Amazon Elastic Block Store (EBS) General Purpose SSD (gp2, gp3) is also a good choice for SAP HANA data and log storage, it provides a balance of performance and cost, with a low latency and high throughput. Amazon S3 is an object storage service and not suitable for storing the SAP HANA data and log volumes. Amazon Elastic File System (Amazon EFS) is a file storage service, it's not a good fit for block-based storage workloads like SAP HANA. https://docs.aws.amazon.com/sap/latest/sap-hana/hana-ops-storage-config.html

Question 2

An SAP specialist is budding an SAP environment The SAP environment contains Amazon EC2 instances that fun in a private subnet in a VPC. The VPC includes a NAT gateway.

The SAP specialist is selling up IBM Db2 high availability disaster recovery for the SAP duster. After configuration of overlay IP address routing traffic is not routing to the database EC2 instances.

What should the SAP specialist do to resolve this issue?

AOpen a security group tor SAP ports o allow traffic on port 443

BCreate route table entries to allow traffic from the database EC2 instances to the NAT gateway

CTurn off the source destination check for the database EC2 instances

DCreate an IAM role that has permission to access network traffic Associate the role with the database EC2 instances

Answer : C

C is correct because turning off the source destination check for the database EC2 instances is required to enable overlay IP address routing for IBM Db2 high availability disaster recovery. The source destination check prevents instances from sending or receiving traffic that is not intended for them. The other options are not relevant or necessary for resolving this issue. Reference: https://docs.aws.amazon.com/whitepapers/latest/sap-on-aws-technical-deployment-guide/high-availability.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check

Question 3

A company has deployed SAP workloads on AWS The AWS Data Provider for SAP is installed on the Amazon EC2 instance where the SAP application is running An SAP solutions architect has attached an IAM role to the EC2 instance with the following policy.

The AWS Data Provider for SAP is not returning any metrics to the SAP application. Which change should the SAP solutions architect make to the 1AM permissions to resolve this issued.

AAdd the cloudwatch ListMetrics action to the policy statement with Sid AWSDataProvider1.

BAdd the cloudwatch GetMetricStatrstics action to the policy statement with Sid AWSDataProvider1

CAdd the cloudwatch GetMetricStream action (o the policy statement with Sid AWSDataProvider

DAdd the cloudwatch DescribeAlarmsForMetric action to the policy statement with Sid AWSDataProvider

Answer : B

The AWS Data Provider for SAP requires the ability to access metrics data in order to return metrics to the SAP application. The IAM policy statement with Sid 'AWSDataProvider1' currently does not have the necessary permissions to access metrics data. The SAP solutions architect should add the cloudwatch:GetMetricStatistics action to the policy statement with Sid 'AWSDataProvider1' to grant the necessary permissions for the Data Provider to access metrics data.

The other actions such as 'EC2:DescribeInstances' and 'EC2:DescribeVolumes' are not related to CloudWatch metrics and only provide the ability to describe EC2 instances and volumes. Actions such as 's3:GetObject' are not related to CloudWatch metrics, it's used to get an object from an S3 bucket. Actions such as 'cloudwatch:ListMetrics' and 'cloudwatch:DescribeAlarmsForMetric' would not be necessary for the AWS Data Provider for SAP to return metrics to the SAP application and it's not related to the problem described.

https://docs.aws.amazon.com/sap/latest/general/data-provider-troubleshooting.html

Question 4

A company hosts an SAP HANA database on an Amazon EC2 instance in the us-easi-1 Region. The company needs to implement a disaster recovery (DR) site in the us-west-1 Region. The company needs a cost-optimized solution that offers a guaranteed capacity reservation an RPO of less than 30 minutes and an RTO of less than 30 minutes.

When solution will meet these requirements?

ADeploy a single EC2 instance to support the secondary database in us-west with additional storage Use this secondary database instance to support QA and production Configure the primary SAP HANA database in us-east-1 to constantly replicate the data to the secondary SAP HANA database in us-west-t by using SAP HANA system replication with preload off During DR shut down the QA SAP HANA instance and restart the production services at the secondary site

BDeploy a secondary staging server on an EC2 instance in us-west-1 Use CloudEndure Disaster Recovery to replicate changes at the database level from us-east-1 to the secondary staging server on an ongoing basis During DR, initiate cutover increase the size of the secondary EC2 instance to match the primary EC2 instance and start the secondary EC2 instance

CSet up the primary SAP HANA database in us-east-1 to constantly replicate the data to a secondary SAP HANA database in us-west-1 by using SAP HANA system replication with preload on Keep the secondary SAP HANA instance as a hot standby that is ready to take over in case of failure

DCreate an SAP HANA database AMI by using Amazon Elastic Block Store (Amazon EBS) snapshots Replicate the database and log backup files from a primary Amazon S3 bucket in us-east-1 to a secondary S3 bucket m us-west-1 During DR launch the EC2 instance in us-west-1 based on AMIs that are replicated Update host information Download database and log backups from the secondary S3 bucket Perform a point-in-time recovery

Answer : A

A is correct because deploying a single EC2 instance to support the secondary database in us-west-1 with additional storage is cost-optimized and offers a guaranteed capacity reservation. Configuring the primary SAP HANA database in us-east-1 to constantly replicate the data to the secondary SAP HANA database in us-west-1 by using SAP HANA system replication with preload off provides an RPO of less than 30 minutes. During DR, shutting down the QA SAP HANA instance and restarting the production services at the secondary site provides an RTO of less than 30 minutes. Reference: https://docs.aws.amazon.com/whitepapers/latest/sap-on-aws-technical-deployment-guide/disaster-recovery.html https://docs.aws.amazon.com/whitepapers/latest/sap-on-aws-technical-deployment-guide/sap-hana.html

Question 5

A company is implementing SAP HANA on AWS According 10 the company's security policy SAP backups must be encrypted Only authorized team members can have the ability to decrypt the SAP backups

What is the MOST operationally efficient solution that meets these requirements?

AConfigure AWS Backint Agent for SAP HANA to create SAP backups in an Amazon S3 bucket After a backup is created encrypt the backup by using client-side encryption Share the encryption key with authorized team members only

BConfigure AWS Backint Agent for SAP HANA to use AWS Key Management Service (AWS KMS) for SAP backups Create a key policy to grant decryption permission to authorized team members only

CConfigure AWS Storage Gateway to transfer SAP backups from a file system to an Amazon S3 bucket Use an S3 bucket policy to grant decryption permission to authorized team members only

DConfigure AWS Backint Agent for SAP HANA to use AWS Key Management Service (AWS KMS) for SAP backups Grant object ACL decryption permission to authorized team members only

Answer : B

This is the most operationally efficient solution that meets the company's security policy requirements. AWS KMS is a service that enables you to create and manage encryption keys that are used to encrypt and decrypt data. By configuring AWS Backup Agent for SAP HANA to use AWS KMS for SAP backups, the company can ensure that the backups are encrypted at rest and that only authorized team members have the ability to decrypt them. The key policy allows the company to define which team members are authorized to access the key, so that it can be used to decrypt the backup. This approach is operationally efficient because it does not require the company to manually encrypt and decrypt backups, and it enables the company to manage access to the encryption key through IAM policies, without the need for sharing encryption keys.

Question 6

A company hosts multiple SAP applications on Amazon EC2 instances in a VPC While monitoring the environment the company notices that multiple port scans are attempting to connect to SAP portals inside the VPC. These port scans are originating from the same IP address block. The company must deny access to the VPC from all the offending IP addresses for the next 24 hours.

Which solution win meet this requirement?

AModify network ACLs that are associated with all public subnets in the VPC to deny access from the IP address block

BAdd a rule in the security group of the EC2 instances to deny access from the IP address block

CCreate a policy in AWS identity and Access Management (1AM) to deny access from the IP address block

DConfigure the firewall m the operating system of the EC2 instances to deny access from the IP address block

Answer : A

The company can meet its requirement by modifying the network access control lists (ACLs) that are associated with all public subnets in the VPC to deny access from the offending IP address block. This would deny access to the VPC from all the IP addresses that are attempting port scans, and would be effective for the next 24 hours.

Security groups are associated with individual instances, it would be more time-consuming to update all instances security groups and it's not scalable. AWS Identity and Access Management (IAM) is mainly used to manage user access to AWS resources and it's not appropriate for this use case. Configuring the firewall on the operating system of the EC2 instances would be less effective as it does not provide a centralized and scalable solution for managing access control across all subnets in the VPC.

Top of Form

Question 7

A company is running SAP ERP Central Component (SAP ECC) with a Microsoft SQL Server database on AWS A solutions architect must attach an additional 1 TB Amazon Elastic Block Store (Amazon EBS) volume. The company needs to write the SQL Server database backups to this EBS volume before moving the database backups to Amazon S3 for long-term storage.

Which EBS volume type will meet these requirements MOST cost-effectively?

AThroughput Optimized HDD (st1)

BProvisioned IOPS SSD (io3)

CGeneral Purpose SSD (gp3)

DCold HDD (sc1)

Answer : A

'For SQL Server database backup, you can use one of the following methods: SQL native tools to take backup on disk: Backup requires high throughput compared to IOPS. We recommend using Throughput Optimized HDD (st1) which provides maximum throughput of 500 MB/s per volume.'

Amazon AWS Certified: SAP on AWS - Specialty PAS-C01 Exam Questions