SAA-C03 Design Resilient Architectures — 40 Questions

Question 1

An order-processing service consumes messages from an Amazon SQS Standard queue using a custom worker. During traffic spikes, the worker occasionally times out after performing some work but before acknowledging the message, so SQS redelivers it and it may be processed again.

You also observe that a small set of “poison” messages always fail validation.

What change most directly improves resilience by (1) preventing poison messages from retrying indefinitely and (2) avoiding duplicate side effects caused by legitimate retries?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy that moves messages after maxReceiveCount, and implement idempotent processing in the consumer using an idempotency key.. Option C is correct because a dead-letter queue (DLQ) with a maxReceiveCount redrive policy directly addresses the poison message problem by moving messages that repeatedly fail validation out of the main queue after a set number of retries, preventing indefinite retries. Implementing idempotent processing using an idempotency key ensures that even if a legitimate message is redelivered due to a visibility timeout, the consumer can detect and skip duplicate side effects, thus solving both requirements most directly.

Answer

Increase the SQS visibility timeout and, when validation fails, call DeleteMessage in the consumer to remove the message immediately.

Answer

Move to SNS topics with subscriptions and rely on SNS to provide exactly-once delivery to eliminate duplicates automatically.

Answer

Change the queue to FIFO and enable content-based deduplication, leaving the consumer logic unchanged.

Question 2

Based on the exhibit, the application sees several minutes of connection errors during an Aurora failover. What is the best change to reduce failover impact?

Accepted Answer

Change the application to use the Aurora cluster writer endpoint and retry transient connections.. The Aurora cluster writer endpoint always points to the current primary instance, even after a failover. By using this endpoint and implementing retry logic for transient connection errors, the application can automatically reconnect to the new writer without manual intervention, reducing the impact of the failover from several minutes to seconds.

Answer

Add an Aurora read replica and keep using the same JDBC URL.

Answer

Increase the EC2 instance size of the application servers.

Answer

Switch to a single-AZ RDS PostgreSQL instance for simpler connectivity.

Question 3

A payments service receives payment orders by consuming messages from an Amazon SQS Standard queue. The downstream processor occasionally exceeds its processing timeout. As a result, some messages reappear in the queue and may be processed more than once.

The team wants to prevent duplicate side effects (for example, double-charging) and also ensure poison messages do not repeatedly consume processing capacity.

What approach best satisfies both goals?

Accepted Answer

Implement idempotent processing (for example, store processed payment IDs in DynamoDB) and configure an SQS dead-letter queue (DLQ) using a redrive policy with an appropriate maxReceiveCount.. Option A is correct because it addresses both requirements: idempotent processing (e.g., storing processed payment IDs in DynamoDB) ensures that even if a message is processed more than once, duplicate side effects like double-charging are prevented. Configuring an SQS dead-letter queue (DLQ) with a redrive policy and an appropriate maxReceiveCount (e.g., 3 or 5) automatically moves messages that exceed the maximum number of receives to the DLQ, preventing poison messages from repeatedly consuming processing capacity.

Answer

Rely only on increasing the SQS visibility timeout so duplicates rarely occur, without adding idempotency checks or a DLQ.

Answer

Switch to a FIFO queue and delete messages immediately upon receipt to avoid duplicates.

Answer

Move the workload to SNS and use synchronous HTTP endpoints so the sender retries until the receiver confirms success.

Question 4

A company runs an application behind an Application Load Balancer (ALB). An Auto Scaling group (ASG) is configured with desired capacity 2, but it is attached only to subnets in a single Availability Zone. The ALB is healthy because it is configured across multiple Availability Zones.

When the Availability Zone that contains the ASG subnets experiences an outage, what change most directly improves resilience and allows capacity to be restored automatically?

Accepted Answer

Update the ASG to use subnet IDs that span at least two Availability Zones so it can launch replacement instances after an AZ outage.. Option A is correct because an Auto Scaling group (ASG) can only launch instances into the subnets explicitly assigned to it. If those subnets reside in a single Availability Zone (AZ) and that AZ fails, the ASG has no capacity to launch replacement instances, even though the ALB is multi-AZ. By configuring the ASG with subnet IDs spanning at least two AZs, the ASG can automatically launch instances in a healthy AZ, restoring capacity and resilience.

Answer

Reduce the ALB health check interval to speed up detection of unhealthy targets.

Answer

Enable connection draining on the ALB so existing requests complete before targets are terminated.

Answer

Increase the ASG desired capacity from 2 to 6 to compensate for the missing subnets.

Question 5

Based on the exhibit, DNS still sends traffic to the primary Region even though Route 53 health checks show the primary endpoint is unhealthy. What is the best change to make failover work as intended?

Accepted Answer

Use a failover routing policy with a primary record and a secondary record, and attach the health check to the primary record.. Option B is correct because a failover routing policy with a health check attached to the primary record is the only configuration that allows Route 53 to automatically stop sending traffic to an unhealthy primary endpoint and redirect it to the secondary endpoint. Without the health check attached to the primary record, Route 53 has no mechanism to detect the failure and will continue routing traffic to the primary Region, even if the health check status shows unhealthy.

Answer

Change both records to weighted routing with a 50/50 split so Route 53 can shift traffic gradually.

Answer

Switch to latency-based routing so users are always directed to the lowest-latency Region.

Answer

Use geolocation routing so clients in one Region are sent to the healthier endpoint.

Question 6

Based on the exhibit, the web application must remain available even if one Availability Zone fails. What is the best change to improve resilience with the least redesign?

Accepted Answer

Add subnet-b1 in a different Availability Zone to the Auto Scaling group.. Adding subnet-b1 in a different Availability Zone to the Auto Scaling group ensures that EC2 instances are launched across two Availability Zones. If one zone fails, the ALB can route traffic to healthy instances in the other zone, maintaining application availability. This change requires minimal redesign because it only modifies the Auto Scaling group's subnet configuration without altering the load balancer or compute architecture.

Answer

Increase DesiredCapacity to 4 while keeping all instances in subnet-a1.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Enable EBS encryption on the launch template volumes.

Question 7

An Auto Scaling group behind an Application Load Balancer frequently replaces new EC2 instances. The application needs ~6 minutes to warm up after instance launch. However, the ALB target group health checks start immediately and mark the targets unhealthy until the application is ready. Because the targets become unhealthy early, the Auto Scaling group then terminates the instances and launches replacements, creating a repeated unhealthy/termination loop.

What configuration change will most directly improve recovery by preventing premature ASG termination while the application is warming up?

Accepted Answer

Set a health check grace period on the Auto Scaling group that exceeds the application startup/warm-up time.. The health check grace period on an Auto Scaling group (ASG) allows a newly launched EC2 instance to bypass health check failures for a specified duration. By setting this grace period to exceed the application's ~6-minute warm-up time, the ASG will not prematurely terminate the instance based on ALB health check results. This directly breaks the unhealthy/termination loop while the application initializes.

Answer

Increase the Auto Scaling group's desired capacity to a higher number than required.

Answer

Disable ALB target group health checks so instances are considered healthy as soon as they register.

Answer

Change the Auto Scaling health check type from ELB to EC2 so the ALB will no longer determine instance health.

Question 8

A company runs an internet-facing API in two AWS Regions. Route 53 currently uses simple routing to a primary Application Load Balancer (ALB) DNS name. When the primary Region experiences an outage, customers wait a long time because the DNS entry is not changed automatically.

The team wants automatic failover: if the primary Region ALB health check fails for a sustained period, Route 53 should route users to the secondary Region ALB.

Which Route 53 approach best meets this requirement?

Accepted Answer

Use Route 53 failover routing with a PRIMARY and SECONDARY record set for the same name, and attach health checks to the ALBs.. Route 53 failover routing is designed specifically for active-passive failover scenarios. By creating PRIMARY and SECONDARY record sets with the same DNS name and attaching health checks to the ALBs, Route 53 will automatically route traffic to the secondary ALB when the primary ALB health check fails for a sustained period. This meets the requirement for automatic failover without manual intervention.

Answer

Use latency-based routing so Route 53 automatically spreads traffic to both Regions based on measured latency.

Answer

Use weighted routing and configure the secondary ALB to receive 100% traffic when the primary returns HTTP 5xx responses.

Answer

Use geolocation routing and restrict the primary Region record to specific countries only.

Question 9

A team accidentally updates critical rows in an Amazon RDS for PostgreSQL database. Automated backups are enabled. They need to recover the data to the exact state as of 90 minutes ago.

They also cannot risk interrupting the current production database instance while investigators validate the restored data.

Which recovery strategy best meets these constraints?

Accepted Answer

Use point-in-time recovery (PITR) to restore to a new RDS DB instance as of 90 minutes ago, then validate and cut over after approval.. Point-in-time recovery (PITR) for Amazon RDS allows you to restore a DB instance to any second within the backup retention period, using automated backups and transaction logs. By restoring to a new RDS instance as of 90 minutes ago, you create an isolated copy for validation without affecting the production database. This meets both the recovery point objective (RPO) of 90 minutes and the constraint of no interruption to the current production instance.

Answer

Restore a manual snapshot and overwrite the existing production DB instance so the data matches exactly 90 minutes ago.

Answer

Wait for the next automated backup window and then restart the current DB instance to roll back changes automatically.

Answer

Use cross-region read replicas to rewind changes and promote the replica to become the writer immediately.

Question 10

Based on the exhibit, the database must continue serving if the current Availability Zone fails. What should you change?

Accepted Answer

Modify the DB instance to use a Multi-AZ deployment.. Option B is correct because Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This meets the requirement of continuing service during an AZ failure.

Answer

Create a read replica in another Availability Zone and promote it manually if needed.

Answer

Increase the automated backup retention period to 30 days.

Answer

Resize the DB instance to a larger class.

Question 11

Based on the exhibit, the application tier is not replacing unhealthy instances even though the Auto Scaling group spans two Availability Zones. What change most directly improves automatic recovery when the application process fails?

Accepted Answer

Set the Auto Scaling group health check type to ELB so target group health determines replacement.. Option B is correct because setting the Auto Scaling group health check type to ELB allows the ASG to use the target group's health checks, which monitor application-level health (e.g., HTTP 200 responses). When the application process fails, the ELB marks the instance as unhealthy, and the ASG immediately terminates and replaces it. This directly addresses the issue of unhealthy instances not being replaced, as the default EC2 health check only verifies instance status (e.g., running vs. stopped), not application responsiveness.

Answer

Increase the ASG desired capacity so that extra instances absorb the failed ones.

Answer

Replace the Application Load Balancer with a Network Load Balancer to improve failover speed.

Answer

Increase the HealthCheckGracePeriod to the maximum value so the instances have more time to stabilize.

Question 12

Based on the exhibit, the team must restore an Amazon RDS for PostgreSQL database to the exact state just before a bad delete happened. What is the best recovery approach?

Accepted Answer

Perform a point-in-time restore to 2026-04-27 15:10 UTC into a new DB instance, then cut over after validation.. Point-in-time recovery (PITR) allows you to restore an Amazon RDS for PostgreSQL database to any second within the backup retention period, using automated backups and transaction logs. By restoring to 2026-04-27 15:10 UTC, just before the bad delete occurred, you can recover the exact state without data loss, then cut over after validation.

Answer

Restore the latest automated snapshot and accept data loss from the last backup window.

Answer

Promote a read replica because it will contain the deleted rows and can replace the primary immediately.

Answer

Enable Multi-AZ on the current database and wait for automatic failover to reverse the delete.

Question 13

Based on the exhibit, the company wants DNS traffic to fail over automatically from the primary Region to a secondary Region when the primary endpoint is unhealthy. Which Route 53 change is best?

Accepted Answer

Create Route 53 failover records with health checks for the primary and secondary ALBs.. Route 53 failover routing with health checks is the only option that automatically directs DNS traffic away from an unhealthy primary endpoint to a healthy secondary endpoint. When the health check for the primary ALB fails, Route 53 returns the secondary ALB's IP address in DNS responses, providing automatic failover across regions. Simple, weighted, and geolocation routing do not natively support automatic failover based on endpoint health.

Answer

Keep simple routing and lower the TTL to 10 seconds.

Answer

Use weighted routing with equal weights for both ALBs.

Answer

Use geolocation routing so users in each continent reach a closer ALB.

Question 14

Based on the exhibit, downstream payment timeouts cause EventBridge deliveries to back up and some events are retried until they age out. What change best improves resilience and preserves events during downstream outages?

Accepted Answer

Put an Amazon SQS queue between EventBridge and the consumer, and have workers drain the queue with a DLQ for poison messages.. Option B is correct because introducing an SQS queue between EventBridge and the consumer decouples the event delivery from the downstream payment API. During outages, events are stored durably in SQS and can be processed later without being lost. A Dead Letter Queue (DLQ) captures events that fail repeatedly, preventing poison messages from blocking the queue and ensuring no events age out due to retry exhaustion.

Answer

Increase the Lambda timeout so each invocation can wait longer for the payment API.

Answer

Switch the target to a Lambda function with reserved concurrency of zero during outages.

Answer

Replace EventBridge with CloudWatch Logs subscriptions so the consumer can poll the log stream later.

Question 15

A SaaS platform plans to run in two AWS Regions for lower latency. The team wants to enable active-active writes (both regions accept updates) to avoid failover downtime. However, the business requires strong consistency for order status transitions (for example, only one transition from “Paid” to “Shipped” must be allowed).

Which statement is the best architectural choice to meet the consistency requirement?

Accepted Answer

Use active-active writes only when the workload tolerates eventual consistency; for strongly consistent transitions, use a single-writer pattern with failover (active-passive/pilot light).. Option A is correct because active-active writes across AWS Regions cannot guarantee strong consistency due to the inherent latency and lack of synchronous replication between Regions. For order status transitions that require exactly-once semantics (e.g., only one transition from 'Paid' to 'Shipped'), a single-writer pattern (active-passive or pilot light) ensures that only one Region accepts writes at a time, avoiding conflicts and maintaining a single source of truth. AWS services like DynamoDB global tables offer eventual consistency for multi-region writes, while Aurora Global Database provides read replicas with failover but not active-active writes for strong consistency.

Answer

Active-active writes always provide strong consistency because AWS replicates data across Regions automatically and immediately.

Answer

Active-active writes can be used safely by simply enabling retries and expecting the application to resolve conflicts without coordination.

Answer

To ensure strong consistency, run both Regions with different IAM roles and block cross-Region writes at the API layer only.

Question 16

Based on the exhibit, the web tier becomes unavailable if us-west-2a has an outage. What is the best change to improve resilience with the least redesign?

Accepted Answer

Attach the Application Load Balancer and Auto Scaling group to subnets in a second Availability Zone.. The web tier is currently deployed in a single Availability Zone (us-west-2a), so an outage of that AZ makes the entire tier unavailable. By attaching the Application Load Balancer and Auto Scaling group to subnets in a second Availability Zone, the application can continue serving traffic from the healthy AZ, achieving high availability with minimal architectural changes. This is the standard AWS best practice for multi-AZ resilience.

Answer

Increase the Auto Scaling group desired capacity from 2 to 3 in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Increase the health check grace period so instances stay registered longer.

Question 17

Based on the exhibit, the database is manually promoted during an Availability Zone failure and the application outage lasts longer than the target. What change best improves resilience with the least operational intervention?

Accepted Answer

Convert the database to an RDS Multi-AZ deployment so a synchronous standby can fail over automatically.. B is correct because RDS Multi-AZ automatically synchronously replicates data to a standby in a different Availability Zone and triggers an automatic failover with zero manual intervention when an AZ failure occurs. This directly addresses the requirement to improve resilience while minimizing operational effort, as the failover is handled by AWS without any runbook execution or manual promotion.

Answer

Keep the read replica and automate promotion with a runbook after CloudWatch alarms fire.

Answer

Use a cross-Region read replica so promotion happens faster during an AZ failure.

Answer

Increase the application retry count and keep the current database design.

Question 18

An application writes to an Amazon Aurora DB cluster. After a planned Aurora failover, the application experiences several minutes of connection errors.

The logs show the application continues connecting to the specific DB instance endpoint that was the primary before the failover.

What change most directly improves resilience during Aurora failovers?

Accepted Answer

Update the application to use the Aurora cluster writer endpoint for write traffic so it always resolves to the current writer instance.. The Aurora cluster writer endpoint always resolves to the current primary DB instance, even after a failover. By using this endpoint instead of a specific instance endpoint, the application automatically reconnects to the new writer without manual intervention or connection errors.

Answer

Increase Aurora storage autoscaling so failovers are unnecessary.

Answer

Point both reads and writes to the Aurora reader endpoint to keep the DNS name the same.

Answer

Disable Aurora failover capability so the cluster never switches writer instances.

Question 19

A service processes customer payments from a message queue. Because the queue provides at-least-once delivery, the same payment message can be delivered more than once if the consumer times out before committing its state. Currently, the service sometimes charges the customer twice.

Which design change most directly prevents duplicate charges while still allowing safe retries?

Accepted Answer

Make the payment processing idempotent by recording an idempotency key for each payment and ensuring repeated deliveries do not apply the charge twice.. Option B is correct because making payment processing idempotent using an idempotency key ensures that even if the same message is delivered multiple times due to at-least-once delivery semantics, the charge is applied only once. The consumer records a unique key (e.g., payment ID) in a durable store (like DynamoDB or Redis) and checks it before processing; if the key already exists, the charge is skipped. This directly prevents duplicate charges while still allowing safe retries, as the consumer can safely reprocess messages without side effects.

Answer

Delete the message from the queue immediately after receive to prevent redelivery.

Answer

Increase the queue visibility timeout to a very large value so messages rarely reappear.

Answer

Switch to a single-threaded consumer with one worker so messages are processed in order.

Question 20

Your web application is deployed in two AWS Regions (Region A and Region B). You want Route 53 to automatically fail over DNS traffic from Region A to Region B when Region A is unhealthy.

The failover decision must be based on health checks that verify whether the application in Region A is reachable.

Which Route 53 routing configuration best meets these requirements?

Accepted Answer

Failover routing using a primary record with an associated health check for Region A and a secondary record for Region B.. Option C is correct because Route 53 failover routing allows you to create a primary record with an associated health check for Region A and a secondary record for Region B. When the health check for Region A fails, Route 53 automatically returns the secondary record's IP address, directing traffic to Region B. This directly meets the requirement for automatic failover based on application reachability.

Answer

Latency-based routing with regional aliases to split traffic based on measured latency.

Answer

Geolocation routing using country-based routing policies.

Answer

Weighted routing with weights set to 100 for Region A and 0 for Region B.