PAS-C01 · Question #6
A company has deployed SAP HANA in the AWS Cloud. The company needs its SAP HANA database to be highly available. An SAP solutions architect has deployed the SAP HANA database in separate Availability
The correct answer is B. Change the Action element to ec2:ReplaceRoute.. The overlay IP address pattern for SAP HANA HA on AWS works by updating a VPC route table entry so that the overlay IP CIDR routes to the ENI of the active node. During failover, the Pacemaker resource agent must update the existing route-not create a new one-because the route al
Question
A company has deployed SAP HANA in the AWS Cloud. The company needs its SAP HANA database to be highly available. An SAP solutions architect has deployed the SAP HANA database in separate Availability Zones in a single AWS Region. SUSE Linux Enterprise High Availability Extension is configured with an overlay IP address. The overlay IP resource agent has the following IAM policy:
During a test of failover, the SAP solutions architect finds that the overlay IP address does not change to the secondary Availability Zone. Which change should the SAP solutions architect make in the policy statement for Sid oip1 to fix this error?
Options
- AChange the Action element to ec2:CreateRoute.
- BChange the Action element to ec2:ReplaceRoute.
- CChange the Action element to ec2:ReplaceRouteTableAssociation.
- DChange the Action element to ec2:ReplaceTransitGatewayRoute.
How the community answered
(28 responses)- A7% (2)
- B86% (24)
- C4% (1)
- D4% (1)
Explanation
The overlay IP address pattern for SAP HANA HA on AWS works by updating a VPC route table entry so that the overlay IP CIDR routes to the ENI of the active node. During failover, the Pacemaker resource agent must update the existing route-not create a new one-because the route already exists in the table pointing to the primary node. The correct API action is ec2:ReplaceRoute, which modifies an existing route's target to the secondary instance's network interface. Answer A (ec2:CreateRoute) would fail if the route already exists, causing a conflict error and leaving the overlay IP pointing to the failed node. Answer C (ec2:ReplaceRouteTableAssociation) changes which route table is associated with a subnet, which is unrelated to updating a specific route entry. Answer D (ec2:ReplaceTransitGatewayRoute) applies to Transit Gateway routing tables, not VPC route tables. Granting ec2:ReplaceRoute resolves the failover issue.
Topics
Community Discussion
No community discussion yet for this question.