PAS-C01 Exam Dumps - AWS Certified: SAP on AWS - Specialty

C is correct because turning off the source destination check for the database EC2 instances is required to enable overlay IP address routing for IBM Db2 high availability disaster recovery. The source destination check prevents instances from sending or receiving traffic that is not intended for them. The other options are not relevant or necessary for resolving this issue. References: https://docs.aws.amazon.com/whitepapers/latest/sap-on-aws-technical-deployment-guide/high-availability.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check

AWS DataSync can be used to schedule and automate the transfer of data between on-premises NFS servers and Amazon EFS on AWS. It also allows data to be encrypted during transfer, which meets the requirement for encryption.

This is the most operationally efficient solution that meets the company's security policy requirements. AWS KMS is a service that enables you to create and manage encryption keys that are used to encrypt and decrypt data. By configuring AWS Backup Agent for SAP HANA to use AWS KMS for SAP backups, the company can ensure that the backups are encrypted at rest and that only authorized team members have the ability to decrypt them. The key policy allows the company to define which team members are authorized to access the key, so that it can be used to decrypt the backup. This approach is operationally efficient because it does not require the company to manually encrypt and decrypt backups, and it enables the company to manage access to the encryption key through IAM policies, without the need for sharing encryption keys.

The error message "AccessDenied" usually indicates that the AWS Backint agent does not have the necessary permissions to access the target S3 bucket. To resolve this error, an SAP basis administrator should assign an IAM role to the EC2 instance that is running the AWS Backint agent. Then, the administrator should attach a policy to the IAM role that grants the necessary permissions to access the target S3 bucket. This will allow the AWS Backint agent to access the S3 bucket and complete the backups successfully.

• Option B is correct because it uses a Network Load Balancer to enable network access to the overlay IP address for the SAP NetWeaver system. A Network Load Balancer supports TCP protocol and can route traffic to targets using IP addresses. It also provides high availability and scalability for the network connection.
• Option C is correct because it uses Amazon Route 53 private zone to create an A record that has the overlay IP address as a target. This allows the SAP GUI client tool to resolve the overlay IP address to the SAP NetWeaver system. It also uses the existing private connectivity to the VPC without requiring any additional components or configuration.
• Option A is incorrect because it uses an Application Load Balancer, which does not support TCP protocol for the SAP NetWeaver system. It also uses an overlay IP address as a target, which is not necessary for the network access to the SAP NetWeaver system.
• Option D is incorrect because it uses AWS Transit Gateway, which is not a network configuration for data transfer. It also uses an overlay IP address as a static route in the transit gateway route table, which may cause routing conflicts or errors with the existing private connectivity to the VPC.
• Option E is incorrect because it uses a NAT gateway, which is not a network configuration for data transfer. It also uses an overlay IP address as a target, which may cause routing conflicts or errors with the existing private connectivity to the VPC.

References:

• https://docs.aws.amazon.com/sap/latest/sap-hana/sap-ha-overlay-ip.html
• https://docs.aws.amazon.com/sap/latest/sap-netweaver/cluster-configuration-prereqs-sap-netweaver-ha.html
• https://docs.aws.amazon.com/sap/latest/sap-hana/sap-oip-overlay-ip-routing-using-aws-transit-gateway.html

B is correct because using Amazon EventBridge (Amazon CloudWatch Events) and Amazon CloudWatch alarms to stop the development and sandbox EC2 instances from 7 PM every night to 7 AM the next day reduces the infrastructure cost for the non-critical systems that are not used during that time. This solution also requires the least amount of administrative effort as it is automated and does not require manual intervention. References: https://docs.aws.amazon.com/whitepapers/latest/sap-on-aws-technical-deployment-guide/cost-optimization.html https://docs.aws.amazon.com/whitepapers/latest/sap-on-aws-technical-deployment-guide/amazon-ec2.html