SAA-C03 Design Resilient Architectures Practice Test 13 — 15 Questions

Question 1

A production Amazon RDS database has automated backups enabled with sufficient retention. At 10:30 UTC, a release corrupts specific rows. The issue is detected at 10:45 UTC. The team wants to restore the database state to before the corruption with minimal complexity. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a point-in-time restore (PITR) to a timestamp just before 10:30 UTC and create a restored DB instance/cluster.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore the database to any second within the backup retention period, using automated backups and transaction logs. By restoring to a timestamp just before 10:30 UTC, you can recover the database to a state before the corruption occurred, creating a new DB instance/cluster with minimal complexity and no data loss from the uncorrupted period.

Answer

Change the VPC route tables so the database restarts in a clean state.

Answer

Relaunch the same DB instance in the same Availability Zone and rely on caching to revert the changes.

Answer

Enable a DLQ on the database to store invalid SQL statements until the system is fixed.

Question 2

An orders service consumes payment instructions from an Amazon SQS queue. Sometimes the consumer times out after applying the payment but before deleting the SQS message. As a result, the same payment instruction is processed again. Which design change most directly prevents duplicate side effects caused by message retries?

Accepted Answer

Implement idempotency by recording a processed marker keyed by the instruction ID and ignoring duplicates.. Implementing idempotency ensures that even if the same payment instruction is processed multiple times due to a timeout and retry, the side effect (e.g., applying the payment) occurs only once. By recording a processed marker keyed by the instruction ID (e.g., using a DynamoDB table or Redis), the consumer can check the marker before processing and ignore duplicates. This directly addresses the root cause—duplicate processing—without altering the queue's retry behavior.

Answer

Delete the SQS message immediately after it is received, before processing, to ensure it is not retried.

Answer

Increase the SQS visibility timeout to a maximum value to avoid retries entirely.

Answer

Convert the queue to FIFO and enable content-based deduplication.

Question 3

A production Amazon RDS database has automated backups enabled with sufficient retention. At 10:30 UTC, a release corrupts specific rows. The issue is detected at 10:45 UTC. The team wants to restore the database state to before the corruption with minimal complexity. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use point-in-time recovery to restore the database to a timestamp just before 10:00 UTC, then swap application connectivity to the recovered instance.. Point-in-time recovery (PITR) allows you to restore the RDS instance to any second within the backup retention window, such as just before the faulty migration at 10:00 UTC. This restores a complete, consistent database state, minimizing data loss and avoiding manual row-by-row recovery. Swapping application connectivity to the restored instance is the least disruptive approach, as it avoids complex manual data merging and reduces downtime.

Answer

Perform a snapshot restore and attach the restored instance, then manually copy only the affected rows back into the current database.

Answer

Rely on automated backups to roll forward automatically until the data becomes correct.

Answer

Disable automated backups going forward to prevent future corruption, then reindex the corrupted table.

Question 4

An orders system sends payment instructions to an Amazon SQS queue. The consumer sometimes times out after it has already created the payment record but before it deletes the SQS message. As a result, the same instruction can be processed more than once. Which design best ensures the consumer remains resilient and does not create duplicate payments when the same instruction is delivered multiple times?

Accepted Answer

Use idempotency: store a deterministic payment request identifier in a DynamoDB table and only create a payment when a conditional write indicates it was not processed before.. It implements idempotency using a DynamoDB table with a conditional write. By storing a deterministic payment request identifier (e.g., a hash of the message body) and only creating the payment if the conditional write succeeds (i.e., the identifier does not already exist), the consumer can safely process the same SQS message multiple times without creating duplicate payments. This pattern ensures resilience against the at-least-once delivery semantics of SQS and consumer timeouts that prevent message deletion.

Answer

Assume the consumer will always delete the SQS message in the same execution path, and ignore the timeout case.

Answer

Switch to SQS Standard because it provides exactly-once delivery, so duplicates cannot happen.

Answer

Increase the consumer timeout and reduce the number of retries so that duplicates rarely occur.

Question 5

A company runs an Amazon Aurora DB cluster with a Multi-AZ deployment. The application is configured with a hard-coded endpoint that points to the current writer *DB instance* (an instance-specific endpoint), rather than the Aurora cluster writer endpoint. During an unexpected AZ failure, Aurora promotes the standby to become the new writer. However, the application continues to fail to connect until an operator updates the hard-coded endpoint. What change most directly improves resiliency so the application automatically reconnects after failover?

Accepted Answer

Connect using the Aurora cluster writer endpoint so DNS resolves to the current writer after failover.. The Aurora cluster writer endpoint is a DNS name that always resolves to the current writer instance in the cluster, even after a failover. By using this endpoint instead of a hard-coded instance-specific endpoint, the application automatically reconnects to the new writer without manual intervention, directly improving resiliency.

Answer

Keep using the writer DB instance endpoint, but increase the client connection timeout.

Answer

Disable Multi-AZ failover and rely on manual snapshot restore to bring the database back online.

Answer

Enable cross-Region read replicas and route application traffic to the replica during the outage.

Question 6

An event-driven order processing service consumes messages from an Amazon SQS Standard queue. After a deployment, about 1% of messages start failing validation because a required field is missing. The consumer catches the exception and returns control, so the messages are retried. However, those poison messages keep reappearing and repeatedly consuming processing time for hours, delaying handling of valid messages. What is the most resilient way to handle the poison messages while keeping the system available?

Accepted Answer

Configure an SQS redrive policy to send messages to a dead-letter queue (DLQ) after a limited number of receives (maxReceiveCount).. Configuring an SQS redrive policy with a maxReceiveCount (e.g., 3–5) automatically moves messages that repeatedly fail processing to a dead-letter queue (DLQ) after the specified number of receives. This isolates the poison messages, preventing them from consuming visibility timeout and processing resources, while allowing valid messages to be handled without delay. The DLQ can then be analyzed or reprocessed offline, maintaining system availability.

Answer

Set the consumer visibility timeout to a very large value so failing messages are hidden for hours.

Answer

Switch the SQS queue from Standard to FIFO so poison messages do not retry.

Answer

Increase the consumer concurrency indefinitely so the system processes all messages even if some fail validation.

Question 7

A company hosts an internal API behind an Application Load Balancer (ALB) in two AWS Regions. They want Amazon Route 53 to automatically fail over to the secondary Region when the primary Region’s ALB is unhealthy. Health checks for the primary ALB are already configured, but the DNS record currently uses a latency-based routing policy. Which Route 53 configuration most directly provides automatic failover based on health status?

Accepted Answer

Use a Route 53 failover routing policy: configure two alias records for the ALBs where the primary record is marked PRIMARY, the secondary is marked SECONDARY, and each record has an associated health check.. Route 53 failover routing policy is specifically designed to automatically route traffic away from an unhealthy resource to a healthy one. By creating two alias records (one PRIMARY with an associated health check for the primary ALB, and one SECONDARY for the secondary ALB), Route 53 will automatically fail over to the secondary record when the primary health check fails. This directly meets the requirement for automatic failover based on health status, unlike latency-based routing which only optimizes for response time.

Answer

Keep latency-based routing, and set the weights so the secondary Region rarely receives traffic unless manual changes are made.

Answer

Use an alias A record that returns both ALBs simultaneously so clients automatically load balance across Regions during outages.

Answer

Use geolocation routing to route users to the primary Region and rely on ALB health checks to shift requests between Regions.

Question 8

A web application runs on an EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG spans three Availability Zones. After a deployment, new instances frequently fail the ALB target group health checks with HTTP 5xx responses and are quickly terminated by the ASG. What change most improves resiliency during deployments with minimal downtime by preventing premature removal of instances that are still starting?

Accepted Answer

Use a longer ASG health check grace period and deploy new instances using controlled replacement (for example, rolling instance refresh) so existing healthy instances continue serving while new ones warm up.. Increasing the ASG health check grace period gives new instances more time to complete their startup and pass the ALB health checks before the ASG marks them unhealthy. A rolling instance refresh replaces instances in a controlled manner, ensuring that existing healthy instances continue serving traffic while new instances warm up, minimizing downtime and preventing premature termination.

Answer

Reduce the ASG health check grace period to 0 seconds so issues are detected faster.

Answer

Restrict the ASG to a single Availability Zone so health check evaluation is simpler.

Answer

Disable ALB health checks so the ASG does not terminate instances on HTTP 5xx responses.

Question 9

A fintech company has a two-Region DR requirement: RPO must be within 15 minutes and RTO must be under 2 hours. To control cost, they do not want to run full production infrastructure in the secondary Region continuously. They plan to continuously replicate the database and keep the application infrastructure in the secondary Region prepared, but at reduced capacity. Which DR strategy best matches this requirement and accurately describes their plan?

Accepted Answer

Warm standby: keep the essential parts of the application running in the secondary Region at reduced capacity, while using database replication to meet the RPO.. Warm standby is the correct strategy because it runs a scaled-down version of the production application in the secondary Region continuously, with database replication (e.g., Amazon RDS Multi-Region or Aurora Global Database) meeting the 15-minute RPO. The reduced-capacity infrastructure can be scaled up within the 2-hour RTO during a disaster, balancing cost and recovery requirements.

Answer

Pilot light: keep only minimal components (for example, replicated storage and a small amount of core services), so the app scales up during a disaster.

Answer

Active-active: run the application fully in both Regions with synchronized writes and share traffic continuously.

Answer

Cold standby: store backups in the secondary Region and provision all infrastructure only during a disaster.

Question 10

A service processes messages from an Amazon SQS queue. Sometimes the worker finishes the business logic but does not delete the message before the visibility timeout expires, so the message is delivered again. Which two changes improve resilience and reduce the impact of duplicate processing? Select two.

Accepted Answer

Make the message handler idempotent.. Making the message handler idempotent ensures that even if a message is processed multiple times (due to visibility timeout expiry), the business outcome remains the same. Idempotency is a key design pattern for resilient architectures when using at-least-once delivery systems like SQS. Option B is correct because setting the visibility timeout long enough for normal processing prevents premature redelivery, reducing the chance of duplicate processing in the first place.

Answer

Switch from SQS to Amazon SNS for reliable buffering.

Answer

Shorten the queue retention period so messages expire quickly.

Answer

Disable retries in the consumer application.

Question 11

A developer accidentally corrupts part of a production Amazon RDS database, and the issue is discovered 45 minutes later. The team needs to restore the database to the state immediately before the change. Which two actions should be part of the recovery plan? Select two.

Accepted Answer

Enable automated backups with a retention period that covers the recovery window.. Automated backups must be enabled to allow point-in-time recovery (PITR) within the retention window. Since the corruption occurred 45 minutes ago, the retention period must cover at least that duration to restore to the state immediately before the change. Option B is correct because PITR restores the database to a specified time (down to the second) within the backup retention period, creating a new DB instance that reflects the state just before the corruption.

Answer

Convert the database to a single-AZ deployment for faster restores.

Answer

Delete the corrupted rows manually and continue without restoring.

Answer

Use a read replica as the only recovery source for all deletions.

Question 12

A production application uses an Amazon RDS Multi-AZ DB instance. During an unplanned failover, the database endpoint remains the same. What change should the application team make to handle the failover reliably?

Accepted Answer

Keep using the same RDS endpoint and implement connection retry logic on failures.. The RDS Multi-AZ DNS endpoint remains unchanged during a failover, automatically pointing to the new writer instance. Implementing connection retry logic with exponential backoff allows the application to handle the brief DNS propagation delay and connection interruption, ensuring reliable recovery without manual intervention.

Answer

Hard-code the new writer instance IP address after failover completes.

Answer

Disable Multi-AZ and rely on manual intervention to switch endpoints.

Answer

Move reads to application-side caching only, and avoid reopening DB connections.

Question 13

An internal API is hosted in two AWS Regions behind Route 53. Under normal conditions, clients should use the primary region. If the primary endpoint becomes unhealthy, traffic must automatically switch to the secondary region. Which Route 53 setup best meets this requirement?

Accepted Answer

Use failover routing policy: create two alias records for the same name (primary and failover) and associate health checks with the primary record.. Route 53 failover routing policy is designed for active-passive failover scenarios. By creating two alias records (primary and secondary) for the same DNS name and associating a health check with the primary record, Route 53 automatically directs traffic to the secondary region if the primary health check fails. This meets the requirement of automatic failover without manual intervention.

Answer

Use latency-based routing with one record per region and no health checks.

Answer

Use weighted routing and manually change the weights during incidents.

Answer

Create a single alias record only for the primary region and rely on client-side DNS retries.

Question 14

An order-processing system publishes an event whenever a payment succeeds. Three downstream services (inventory, shipping, and analytics) must react independently. Analytics sometimes has high latency, but order processing must not be blocked. What is the best AWS approach to decouple these consumers?

Accepted Answer

Publish payment events to SNS (or EventBridge) and let each downstream service consume independently (for example, via SQS queues or other async targets).. Amazon SNS (or EventBridge) enables asynchronous, fan-out messaging where a single payment-success event is published once and delivered independently to multiple downstream services (inventory, shipping, analytics) via SQS queues or other targets. This decouples the producer from consumer latency—analytics can take its time without blocking order processing—and ensures each consumer processes the event at its own pace, meeting the requirement for independent, non-blocking reactions.

Answer

Have order processing call each service synchronously via HTTPS and retry on failures.

Answer

Store events in a single relational database table and let consumers poll continuously for new rows.

Answer

Send events directly from the producer to each consumer EC2 instance using SSH tunnels.

Question 15

A consumer application reads from an Amazon SQS queue. Some messages have an invalid format and always fail processing. They are retried repeatedly and consume consumer capacity. What is the best way to prevent these "poison pill" messages from blocking normal processing?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount.. A dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount allows messages that repeatedly fail processing to be moved to a separate queue after a specified number of receive attempts. This prevents poison pill messages from being retried indefinitely, freeing consumer capacity for valid messages. Amazon SQS automatically redirects messages to the DLQ once the maxReceiveCount threshold is exceeded, ensuring normal processing is not blocked.

Answer

Enable long polling and increase the maximum message retention to 30 days.

Answer

Switch the queue to FIFO and disable retries in the consumer code.

Answer

Delete the main queue and recreate it after every failure.