Historical exam notice (November 2026): AWS retired the SAP on AWS – Specialty PAS-C01 exam on April 29, 2024. The following ten questions are newly written educational scenarios, not authentic or leaked exam items and not a current AWS practice test. They retain this article’s SAP-on-AWS scenario-practice intent while requiring verification against current AWS and SAP-supported configurations.
An organization is planning SAProuter access for an all-on-AWS deployment. Which network design should it evaluate?
Answer and explanation: A design with SAProuter in a suitably protected public subnet, a stable Elastic IP address, a tightly scoped security group for the SAP support network, and secure SAP communication is consistent with AWS’s documented all-on-AWS SAProuter guidance. The decision is not a blanket endorsement of allowing any internet client to reach an SAP system. The SAProuter role should be isolated from application and database tiers, rules should limit relevant sources and ports, and system ownership should be clear. Secure Network Communications (SNC) and the precise SAP support-connectivity prerequisites must be checked in the current AWS and SAP documentation. A private database subnet cannot simply be made publicly accessible because the support path works. Test permitted and denied network flows before considering the design complete.
A production SAP HANA deployment needs a defined recovery time objective. Does a backup alone establish high availability?
Answer and explanation: No. A recoverable backup protects against data loss under its retention and restore assumptions, but it does not provide automated failover or guarantee a short recovery time. For highly available SAP HANA on AWS, evaluate supported instance configurations, availability-zone layout, HANA System Replication, cluster resource orchestration, network failover behavior, and the required recovery objectives. The chosen configuration must be validated against SAP-supported operating systems, software releases and AWS instance types. An architect should describe the RTO and RPO and then conduct an actual failover and restore drill. It is possible for a backup to exist but not meet the application’s recovery deadline, especially when restoring large in-memory database volumes and reconnecting dependent application services.
A team wants to migrate an SAP application while changing the database platform. Can AWS DMS alone migrate the complete SAP system?
Answer and explanation: No. AWS Database Migration Service may be relevant to supported database migration tasks, but an SAP system migration can require SAP-supported procedures, software installation, schema conversion, application consistency, business validation, and licensing planning beyond copying table data. Determine whether the move is a lift-and-shift, homogeneous system copy, database migration, or platform transformation before selecting tools. Evaluate SAP Software Provisioning Manager, Software Update Manager with database migration options, SAP HANA-specific methods and AWS migration tools according to actual source and target support. A good plan includes a dry run, transport or application dependency review, rollback decision, and business reconciliations. Never infer that a successful database connection test proves the SAP application is ready for production.
Users report that SAP transactions slow down after migration. What should an engineer investigate first?
Answer and explanation: Start with evidence across the entire transaction path, not only CPU utilization. Compare application response times, SAP work process behavior, HANA memory and query statistics, storage latency and throughput, network connectivity to dependencies, and AWS instance metrics. Determine whether the regression affects all transactions or particular users and activities. Correlate the start time with software changes, scaling events, backup jobs and data-volume growth. CloudWatch can help with AWS infrastructure signals, while SAP monitoring tools provide application-level context that CloudWatch does not automatically know. Changing instance type or buying more capacity before identifying the constrained resource can increase cost without fixing the root cause. Document a baseline and a post-change verification procedure.
A company wants to reduce SAP infrastructure spend by selecting smaller EC2 instances. What validation is needed?
Answer and explanation: Rightsizing must follow measured utilization and SAP-certified or otherwise supported infrastructure requirements, not a generic percentage discount promise. Evaluate CPU, memory, SAP HANA sizing, storage IOPS and throughput, burst behavior, network demands, licensing, and high-availability failover capacity. An instance that appears idle at night can still be undersized for month-end processing. Confirm supported AWS instance families and SAP Notes that apply to the release and workload. Consider the complete cost model: compute commitments, EBS, snapshots, inter-Availability-Zone data transfer, data egress, operational overhead, and recovery capacity. Perform a nonproduction representative performance test, and preserve rollback instructions. Cost optimization is successful when service requirements remain satisfied at a lower verified total cost.
A SAP HANA database contains regulated financial records. Which shared-responsibility controls should be addressed?
Answer and explanation: AWS manages security of the underlying cloud infrastructure, while the customer must configure appropriate identity, application access, data protection, operating-system maintenance responsibilities, and security monitoring. Define the identities used by administrators, application services and backup processes and restrict IAM roles to permitted actions. Evaluate encryption for EBS, snapshots, S3 backups, database communications, and SAP-managed security features where supported. Key management must cover access controls, rotation policy, disaster recovery and cross-account or cross-Region use. CloudTrail can record AWS control-plane changes, but SAP database access auditing requires application or database-specific logging. Compliance is not established merely by selecting an AWS service with a certification badge.
An SAP workload must communicate with an on-premises ERP integration system. How should the hybrid network be designed?
Answer and explanation: Start with an inventory of endpoints, port requirements, expected throughput, latency sensitivity, DNS resolution, authentication, and required availability. AWS Site-to-Site VPN and Direct Connect can each form part of a hybrid design, but they differ in connectivity, cost, encryption, redundancy and operational needs. Direct Connect is a dedicated connection, not an automatic application-level encryption guarantee. Ensure routing does not create overlapping CIDR conflicts or unintended transitive access. Restrict security groups and network controls, validate return routes and test failure of the primary path. SAP application dependencies and interface retries must be included in the cutover plan. For a migration, use staged traffic tests and keep a reversible route or interface configuration until data and business process reconciliation succeeds.
How should a team evaluate a SAP HANA backup strategy on AWS?
Answer and explanation: Specify the recovery point and time objectives for the actual business processes. Evaluate SAP-certified backup mechanisms, storage destinations, backup encryption, retention, restore performance and how a failure in one Region or availability zone affects recoverability. Separate database-consistent backup procedures from a generic instance snapshot. Conduct a test restore into an isolated environment, validate transaction and application data, and check required post-restore system identifiers, networking and authorizations. Do not assume that a snapshot is usable just because the AWS console lists it. If backups are replicated across accounts, confirm the KMS key and access policies permit a recovery team to restore them. Monitoring should alert on incomplete backups and aging recovery points, not just on whether a job started.
A consulting team proposes to keep every SAP component in one Availability Zone to save network charges. Is that acceptable?
Answer and explanation: The answer depends on workload criticality and requirements. A single Availability Zone can be appropriate for some nonproduction or temporary environments, but it concentrates the failure domain and may conflict with a production recovery objective. For a business-critical architecture, evaluate supported multi-zone patterns for application servers, SAP HANA replication, shared storage, cluster control, and network failover. Some SAP components have placement requirements that are not solved by simply distributing virtual machines at random. Cross-zone traffic and standby capacity can create costs, but a credible design compares those costs with expected downtime impact and recovery operations. Test failure of the primary site and verify dependent services reconnect; architecture diagrams alone cannot prove a service-level objective.
How can retired PAS-C01 practice material still be used responsibly?
Answer and explanation: PAS-C01, the AWS Certified SAP on AWS – Specialty exam, retired in April 2024, and AWS no longer offers that exam for new candidates. Archived scenarios can still be used as learning prompts for SAP architecture trade-offs, but they should not be presented as current exam questions or guaranteed answer keys. Verify each technical claim against current AWS SAP guides, current SAP Notes where access is required, and the versions of the system under discussion. Treat deployment and sizing examples as illustrative, not universal commands. A current learner can document their design decisions, conduct hands-on labs in supported environments and seek active role-aligned AWS training resources. The objective is defensible operational knowledge, not simulation of an examination that cannot be scheduled.
How to review SAP-on-AWS scenarios after the specialty exam retirement
Use these problems as architecture exercises rather than attempting to memorize a former certification answer key. Draw the SAP application and database tiers, map network dependencies, identify the workload’s supported software and instance combinations, and write down the required recovery objectives. Distinguish migration downtime from steady-state availability, and verify whether a proposed backup or failover procedure is actually supported for that SAP release. For each proposed change, identify who can execute it, what audit evidence it creates and what could go wrong if the operation is repeated or interrupted.
Finally, estimate costs from actual system requirements, including standby capacity, storage, replication traffic, migration transfer and managed monitoring. A convincing design should have a tested operating procedure and a responsible owner. Historical PAS-C01 material may still introduce useful concepts, but no one should treat a retired question bank or an unsourced customer-success story as proof of present product capabilities. Verify the current official AWS SAP and SAP vendor documentation, particularly when specific SAP Notes or certified infrastructure sizes determine what is supported.