SAA-C03 Design Resilient Architectures Practice Test 11 — 15 Questions

Question 1

An orders service currently sends HTTP requests directly to two downstream services (inventory and shipping). During peak load, inventory slows down, causing the orders service to slow as well. The team wants the orders service to remain responsive even when a downstream service is temporarily slow or restarted. Which design change best achieves this resiliency goal?

Accepted Answer

Introduce Amazon SQS as a buffer between orders and downstream services, with consumers processing from the queue.. Option B is correct because introducing Amazon SQS as a buffer decouples the orders service from the downstream inventory and shipping services. The orders service can immediately enqueue messages and respond to the client, while downstream consumers process messages at their own pace. This prevents backpressure from a slow or restarting downstream service from blocking the orders service, achieving the desired resiliency.

Answer

Keep HTTP calls but add longer client timeouts so orders requests wait for slow downstream responses.

Answer

Replace the downstream services with AWS Lambda functions that are invoked synchronously by the orders service.

Answer

Call the downstream services in parallel threads to reduce waiting time during peak load.

Question 2

A payment worker consumes messages from an Amazon SQS queue. Sometimes the worker finishes the payment creation, but a timeout prevents message deletion and the same payment request is delivered again. Which two design changes best reduce the risk of duplicate charges and keep bad messages from looping forever? Select two.

Accepted Answer

Make the payment operation idempotent by storing a unique request identifier before charging.. Option A is correct because making the payment operation idempotent ensures that even if the same message is processed multiple times due to a timeout, the payment is only charged once. This is typically achieved by storing a unique request identifier (e.g., a UUID or idempotency key) in a database or cache before processing; subsequent duplicate requests with the same identifier are detected and ignored, preventing duplicate charges.

Answer

Reduce the visibility timeout so retries happen sooner after each timeout.

Answer

Move the queue to Amazon SNS so each message is delivered only once.

Answer

Increase the message retention period so failed payments stay available longer.

Question 3

An application uses an Amazon RDS Multi-AZ DB instance. During a failover test, connections fail until the application is restarted, even though the database comes back online. Which two changes should the team make to improve resilience during failover? Select two.

Accepted Answer

Use the RDS endpoint name instead of hard-coding the current instance IP or hostname in the application.. Option B is correct because the RDS endpoint is a DNS name that automatically resolves to the current writer instance's IP address. During a failover, the DNS record is updated to point to the new primary, so using the endpoint instead of a hard-coded IP or hostname allows the application to reconnect without manual intervention. Option D is correct because adding retry logic with exponential backoff handles transient failures during DNS resolution and connection establishment, which are common during the brief period when the DNS TTL has not yet expired after a failover.

Answer

Cache and reconnect to the current writer IP address to avoid DNS lookups during failover.

Answer

Switch to a read replica and let it promote manually after every outage.

Answer

Disable connection pooling so each request opens a fresh socket during normal operation.

Question 4

An internal API is deployed in two AWS Regions behind separate Application Load Balancers. The company wants clients to use the primary Region when it is healthy and automatically switch to the secondary Region if the primary health check fails. Which two Route 53 record configurations are required? Select two.

Accepted Answer

Create a primary failover record that points to the primary ALB and associates a Route 53 health check.. Option A is correct because a primary failover record in Amazon Route 53 directs traffic to the primary ALB and is associated with a Route 53 health check. If the health check fails, Route 53 automatically fails over to the secondary failover record, ensuring high availability across Regions.

Answer

Create a weighted record set that sends 50 percent of traffic to each Region.

Answer

Create a latency-based record set so Route 53 always prefers the fastest Region.

Answer

Create a multivalue answer record to return both ALB addresses on each lookup.

Question 5

A production Amazon Aurora MySQL database is corrupted by a bad migration at 10:30 UTC, and the problem is discovered at 10:45 UTC. The team wants to recover to the state just before the migration with minimal manual effort. Which two actions should they take? Select two.

Accepted Answer

Perform a point-in-time restore to a new DB cluster or instance using automated backups.. Option B is correct because Amazon Aurora supports point-in-time recovery (PITR) to any point within the backup retention window, allowing you to restore the database to a state just before the migration (e.g., 10:29 UTC). This uses automated backups and requires minimal manual effort, as you simply specify the target time and a new DB cluster is created.

Answer

Restore only the affected table from the latest snapshot and keep the current cluster online.

Answer

Reboot the writer so Aurora automatically rolls back the bad migration.

Answer

Promote a read replica from the same cluster without restoring from backup.

Question 6

An order service must notify inventory, shipping, and analytics independently when payment succeeds. The shipping service may be slow, but the order service should keep accepting new orders even if one consumer is unavailable. Which two changes best improve resilience? Select two.

Accepted Answer

Publish the event to an Amazon SNS topic and subscribe a separate SQS queue for each downstream service.. Option A is correct because publishing the event to an SNS topic allows the order service to emit a single notification that is then fanned out to multiple SQS queues, one per downstream service. This decouples the order service from the consumers, so even if the shipping service is slow or unavailable, the order service can continue accepting new orders without blocking. Each SQS queue provides independent buffering and retry logic, ensuring resilience against individual consumer failures.

Answer

Have the order service call all downstream services synchronously so failures are visible immediately.

Answer

Use one shared SQS queue for all three consumers so they always process the same message.

Answer

Store the event in a relational database and poll it from every consumer on a fixed schedule.

Question 7

Based on the exhibit, the team wants to stop poison messages from consuming worker capacity and also prevent duplicate side effects if the same message is delivered more than once. Which design change best meets the requirement?

Accepted Answer

Configure a dead-letter queue and make the handler idempotent by storing a durable processed-message key.. Option C is correct because a dead-letter queue isolates poison messages that repeatedly fail processing, preventing them from consuming worker capacity. Making the handler idempotent by storing a durable processed-message key (e.g., using DynamoDB or a database) ensures that even if the same message is delivered more than once, duplicate side effects are avoided. This combination directly addresses both requirements: stopping poison messages from wasting resources and preventing duplicate processing.

Answer

Increase the SQS queue batch size so each worker processes more messages per request.

Answer

Replace SQS with Amazon SNS and let each worker subscribe directly to the topic.

Answer

Disable retries and shorten the visibility timeout so failed messages disappear sooner.

Question 8

Based on the exhibit, a faulty deployment corrupted production data at 10:30 UTC and the issue was discovered at 10:55 UTC. The team needs to recover the database to the last good state before the corruption. Which action should they take?

Accepted Answer

Use point-in-time restore to create a new database instance at 10:29 UTC, then switch the application to it.. Option B is correct because Amazon RDS for MySQL (and other engines) supports point-in-time recovery (PITR), which allows you to restore a database to any second within the backup retention period, up to the last five minutes. By restoring to 10:29 UTC (one minute before the corruption at 10:30 UTC), the team can recover the database to its last good state with minimal data loss. After restoring, the application can be pointed to the new instance, avoiding the corrupted data.

Answer

Restore the latest manual snapshot and accept data loss since the snapshot was taken overnight.

Answer

Restart the database instance so the transaction log replays the failed migration cleanly.

Answer

Create a read replica and promote it, because replicas always contain the previous transaction state.

Question 9

Based on the exhibit, the application team wants the database to keep the same connection endpoint during failover and to reconnect automatically after the primary instance becomes unavailable. Which change best meets the requirement?

Accepted Answer

Replace the IP address with the RDS DNS endpoint and add client retry logic that re-resolves DNS after connection loss.. Option B is correct because using the RDS DNS endpoint ensures that the application connects to the current primary instance, even after a failover. When the primary becomes unavailable, RDS promotes a standby (or read replica) to a new primary and updates the DNS record to point to the new instance's IP. By adding client retry logic that re-resolves DNS after a connection loss, the application automatically picks up the new IP and reconnects without manual intervention, meeting both requirements of a stable endpoint and automatic reconnection.

Answer

Keep the IP address and increase the JDBC connection timeout so the application waits longer during failover.

Answer

Create an additional read replica and point the application to it so failover is faster.

Answer

Place a Network Load Balancer in front of the database and use the load balancer target IP to avoid DNS changes.

Question 10

Based on the exhibit, which Route 53 configuration should be used so traffic automatically returns to the secondary Region only when the primary Region becomes unhealthy?

Accepted Answer

Use failover routing with a primary alias record, a secondary alias record, and a Route 53 health check on the primary target.. Failover routing in Amazon Route 53 is designed for active-passive configurations. By creating a primary alias record pointing to the ALB in the primary Region and a secondary alias record pointing to the ALB in the secondary Region, and attaching a Route 53 health check to the primary target, traffic automatically fails over to the secondary Region only when the health check detects the primary as unhealthy. This meets the requirement of returning traffic to the secondary Region only upon primary failure.

Answer

Use latency-based routing with both ALB records enabled.

Answer

Use geolocation routing so users are always sent to the closest Region.

Answer

Use a CNAME record that points to both ALBs so DNS can round-robin between Regions.

Question 11

Based on the exhibit, the business needs Regional disaster recovery with an RTO of 45 minutes and an RPO of 15 minutes. The solution should keep cost lower than running two fully active production environments. Which DR strategy is the best fit?

Accepted Answer

Warm standby, because a scaled-down but fully functional copy can take traffic quickly while keeping costs below full duplication.. Warm standby is the best fit because it maintains a scaled-down but fully functional copy of the production environment in the recovery Region, which can be quickly scaled up to handle production traffic. This meets the RTO of 45 minutes and RPO of 15 minutes by keeping the standby environment ready with replicated data (e.g., using Amazon RDS Multi-AZ or cross-Region read replicas with synchronous replication), while costing less than two fully active environments since the standby runs on smaller instances or fewer resources until failover.

Answer

Backup and restore only, because the existing daily backups are already in another Region.

Answer

Pilot light, because the recovery Region only needs minimal resources and can be scaled after a disaster.

Answer

Active-active, because it minimizes RTO by keeping both Regions fully live all the time.

Question 12

Based on the exhibit, the application should continue serving requests if one Availability Zone fails. Which change best improves resilience with the least operational complexity?

Accepted Answer

Add at least one subnet from a second Availability Zone to both the ALB and the Auto Scaling group.. Option B is correct because adding subnets from a second Availability Zone to both the ALB and the Auto Scaling group distributes the application across multiple AZs. This ensures that if one AZ fails, the ALB can route traffic to healthy targets in the remaining AZ, and the Auto Scaling group can maintain capacity by launching instances in the surviving AZ. This approach directly addresses the requirement to continue serving requests during an AZ failure with minimal operational complexity.

Answer

Increase the desired capacity in AZ-a so more instances can absorb the failure of that same Availability Zone.

Answer

Disable health checks so the ALB stops removing targets during brief infrastructure issues.

Answer

Move the application to a single larger instance type so the fleet has fewer moving parts.

Question 13

Based on the exhibit, some SQS messages fail validation repeatedly and continue consuming worker time. What change best prevents the bad messages from being retried forever?

Accepted Answer

Configure a dead-letter queue and a redrive policy for messages that exceed the retry limit.. A dead-letter queue (DLQ) with a redrive policy allows messages that have been received a maximum number of times (e.g., after the configured retry limit) to be moved to a separate queue for analysis or manual handling. This prevents the same invalid message from being repeatedly processed by workers, freeing up compute resources and avoiding infinite retry loops.

Answer

Increase the visibility timeout so each message has more time to finish processing.

Answer

Replace the queue with an Amazon SNS topic so failed messages will not be retried.

Answer

Increase the number of workers so the queue drains faster during peak load.

Question 14

Based on the exhibit, the web team wants the application to continue serving traffic if one Availability Zone fails. Which change best meets the requirement with the least operational overhead?

Accepted Answer

Add the unused subnet in us-east-1b to the Auto Scaling group so instances can launch in both AZs.. Option B is correct because it adds the unused subnet in us-east-1b to the Auto Scaling group, enabling EC2 instances to launch across two Availability Zones. This provides fault isolation: if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. The change requires only a configuration update to the Auto Scaling group, minimizing operational overhead while meeting the high-availability requirement.

Answer

Increase desired capacity to 3 in the same Availability Zone so one extra instance is always available.

Answer

Replace the Application Load Balancer with a Network Load Balancer because it will automatically keep the app online.

Answer

Move the application to a larger EC2 instance type so a single server can handle the full workload.

Question 15

A payments API uses an RDS MySQL database and must remain available during an Availability Zone failure with minimal application changes. What should the architect enable?

Accepted Answer

Multi-AZ deployment for the RDS DB instance. Multi-AZ deployment for RDS MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of an AZ failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal application changes (the application only needs to reconnect to the same endpoint). This meets the requirement for availability during an AZ outage without requiring code modifications.

Answer

S3 Cross-Region Replication

Answer

Read replicas only

Answer

EBS snapshots every hour