SAA-C03 Design Resilient Architectures Practice Test 14 — 15 Questions

Question 1

An event consumer sometimes processes the same SQS message more than once due to timeouts and retries. The consumer must ensure the payment is not charged twice. What design choice best addresses this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Make the payment operation idempotent by using an idempotency key and skipping side effects when the key indicates the payment already succeeded.. Making the payment operation idempotent using an idempotency key ensures that even if the same SQS message is processed multiple times due to timeouts and retries, the payment will only be charged once. The consumer checks the idempotency key before executing the payment; if the key indicates the payment already succeeded, the consumer skips the side effect. This pattern directly addresses the requirement of not charging twice without relying on SQS's at-least-once delivery guarantee.

Answer

Assume messages are processed exactly once because SQS uses durable storage.

Answer

Increase the consumer visibility timeout to several days so messages are not redelivered.

Answer

Delete the message immediately even if processing fails validation.

Question 2

A company needs an Amazon RDS database that automatically fails over to a standby when the primary DB instance becomes unavailable. Which approach best meets the requirement with minimal operational effort?

Accepted Answer

Deploy the DB as a Multi-AZ DB instance so AWS maintains a synchronous standby in another Availability Zone and performs automated failover.. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone. When the primary DB instance fails, AWS handles the automatic failover to the standby with zero manual intervention, meeting the requirement with minimal operational effort.

Answer

Keep the DB as a single-AZ instance and implement a manual process to promote a standby when needed.

Answer

Enable versioned backups only, and restore the database each time the primary instance becomes unavailable.

Answer

Replicate the database to another region and switch clients to the secondary region using manual DNS changes.

Question 3

An internal service is hosted behind an Application Load Balancer (ALB) with targets spread across two Availability Zones. If the targets in one Availability Zone become unhealthy, the service must continue serving traffic from the healthy AZ. What change most directly improves resilience at the load-balancing layer?

Accepted Answer

Configure target group health checks so the ALB stops sending traffic to unhealthy targets and continues routing to healthy targets in the other Availability Zone.. Configuring target group health checks allows the ALB to automatically detect unhealthy targets and stop sending traffic to them, while continuing to route requests to healthy targets in the other Availability Zone. This directly improves resilience at the load-balancing layer by ensuring traffic is only forwarded to healthy instances, maintaining service availability even when an entire AZ fails.

Answer

Turn off health checks and rely only on instance CPU utilization to route traffic.

Answer

Configure ALB listener rules to route all traffic to a single target group in one Availability Zone.

Answer

Store requests in an SQS queue before routing them to the ALB.

Question 4

A worker consumes messages from an Amazon SQS queue. Some messages consistently fail validation and are retried until the worker can no longer process them. What is the most appropriate AWS mechanism to handle these poison messages while keeping the queue usable?

Accepted Answer

Send failing messages to an SQS dead-letter queue (DLQ) using a redrive policy based on receive count.. An SQS dead-letter queue (DLQ) with a redrive policy based on receive count allows messages that repeatedly fail processing (poison pills) to be moved out of the main queue after a specified number of retries. This keeps the main queue operational for valid messages and isolates problematic messages for later analysis or manual intervention.

Answer

Enable SQS long polling and increase the maximum message size for the queue.

Answer

Change the queue to a FIFO queue and handle duplicates in the worker code without DLQs.

Answer

Delete the queue and recreate it hourly to clear out any problematic messages.

Question 5

A production Amazon RDS database has automated backups enabled. At 10:45 UTC, an issue is discovered. The team needs to restore the database to its state as of 10:30 UTC. Which capability should they use?

Accepted Answer

Point-in-time restore (PITR) using automated backups to a specific timestamp.. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the backup retention period, restoring to a new DB instance. Since the issue was discovered at 10:45 UTC and the desired recovery point is 10:30 UTC, PITR can restore the database to that exact timestamp, provided it falls within the automated backup window and retention period.

Answer

Perform a Multi-AZ manual failover of the standby to recover to the earlier timestamp.

Answer

Promote a cross-region replication target to replace the current database with the last-known good copy.

Answer

Switch to a read replica to access an older view of data without restoring.

Question 6

A system processes events from Amazon SQS and sometimes sees duplicate messages due to retries. The business requirement is that each payment must be charged at most once. What design choice best addresses this resiliency requirement?

Accepted Answer

Implement idempotent processing using a deduplication key (for example, paymentId) and record completed charges so duplicates are safely ignored.. Implementing idempotent processing with a deduplication key (e.g., paymentId) ensures that even if duplicate messages arrive from SQS (due to retries or at-least-once delivery), the consumer can check a record of completed charges and safely ignore duplicates. This satisfies the business requirement of charging each payment at most once without relying on SQS’s best-effort deduplication or message ordering.

Answer

Assume duplicates never occur because the consumer deletes messages immediately after receiving them.

Answer

Increase the SQS visibility timeout until duplicates never happen.

Answer

Use SNS topics instead of SQS so retries are disabled by default.

Question 7

An order-processing worker consumes messages from Amazon SQS. Occasionally, the worker times out after successfully creating a payment record but before deleting the message, which causes duplicate charges during retries. Some messages also fail validation repeatedly because required fields are missing. Which two changes should the team make? Select two.

Accepted Answer

Make the payment step idempotent using a unique transaction identifier.. Making the payment step idempotent using a unique transaction identifier ensures that if the same message is processed multiple times due to a timeout, the payment is only charged once. This is a common pattern for handling at-least-once delivery semantics in Amazon SQS, where the worker must be designed to handle duplicate messages safely.

Answer

Reduce the visibility timeout so failed messages return to the queue faster.

Answer

Run only one long-lived worker instance so the queue can never be processed twice.

Answer

Switch from a standard queue to a FIFO queue and remove all other changes.

Question 8

A production Amazon RDS database already has automated backups enabled. At 10:45 UTC, the team discovers that a faulty migration corrupted rows in a table at 10:30 UTC. The business wants the database restored to exactly the state it had at 10:30 UTC with minimal risk. Which two actions should the team take? Select two.

Accepted Answer

Restore the database to a new instance using point-in-time restore for 10:30 UTC.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore a DB instance to any second within the backup retention period, including 10:30 UTC. This uses automated backups and transaction logs to reconstruct the exact database state at that specific time, providing a precise recovery point with minimal data loss.

Answer

Restore the most recent manual snapshot because it will include the 10:30 UTC state.

Answer

Overwrite the existing database instance in place so the application keeps the same storage volume.

Answer

Wait for automated backups to complete again, then replay the migration to restore the missing rows.

Question 9

A worker service consumes messages from an Amazon SQS queue. Some messages are malformed and always fail validation. The worker retries, but it keeps reprocessing the same bad messages and consumes processing capacity that should be used for valid work. What is the best solution to prevent “poison messages” from blocking progress?

Accepted Answer

Configure a Dead-Letter Queue (DLQ) and set a redrive policy so messages move to the DLQ after a maximum number of receives.. A Dead-Letter Queue (DLQ) with a redrive policy is the standard AWS mechanism for handling poison messages. By setting a maximum receive count (e.g., 5), the SQS queue automatically moves messages that fail processing repeatedly to the DLQ, isolating them from the main queue. This prevents the worker from wasting capacity on invalid messages and allows the main queue to continue processing valid work without interruption.

Answer

Increase the visibility timeout so the worker gets fewer retries per hour.

Answer

Disable SQS retries by deleting messages immediately on any processing error.

Answer

Create a second worker that polls the queue less frequently until the malformed message is processed successfully.

Question 10

A company wants a disaster recovery setup for a web application. They want to keep costs low but still recover within a couple of hours after a regional disruption. They are willing to run only minimal infrastructure in the secondary location and scale it up during the outage. Which DR approach best matches this requirement?

Accepted Answer

Pilot light, where the secondary Region keeps minimal core components ready and scales up during failover.. The Pilot light approach is correct because it keeps minimal core components (e.g., a small database, a scaled-down application server) running in the secondary Region, allowing rapid failover by scaling up those resources during an outage. This meets the requirement of low cost during normal operations while achieving recovery within a couple of hours, as the core infrastructure is already provisioned and can be scaled horizontally (e.g., using Auto Scaling groups and pre-configured AMIs) without needing to rebuild from scratch.

Answer

Active-active, where both Regions run full production at all times.

Answer

Cold standby, where no infrastructure is running in the secondary Region until an outage occurs.

Answer

Backups-only, where recovery relies solely on manually restoring snapshots during an outage.

Question 11

A company hosts a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB and the Auto Scaling group are currently deployed in only one Availability Zone (AZ). The business wants the application to keep running if that AZ has an outage. What is the best change?

Accepted Answer

Deploy the ALB and the Auto Scaling group across at least two Availability Zones so healthy targets remain.. Deploying the ALB and Auto Scaling group across at least two Availability Zones (AZs) ensures that if one AZ fails, the ALB can route traffic to healthy EC2 instances in the remaining AZ(s). This is the fundamental AWS best practice for high availability: an ALB is a regional service that requires targets in multiple AZs to survive an AZ outage, and the Auto Scaling group must also span those AZs to maintain capacity. Without multi-AZ deployment, a single AZ failure makes the entire application unavailable regardless of instance health checks.

Answer

Increase the desired capacity in the existing Availability Zone to handle all traffic during an outage.

Answer

Enable longer ALB health check intervals so failing instances are detected more slowly.

Answer

Switch from the ALB to an Internet Gateway so instances can fail over to the public internet.

Question 12

A team runs an Amazon RDS for MySQL database in a single Availability Zone. They want automatic failover with minimal downtime if the primary database instance becomes unavailable. Automated backups are already enabled. Which configuration change best meets the requirement?

Accepted Answer

Enable RDS Multi-AZ so AWS maintains a standby in another Availability Zone for automatic failover.. Enabling Multi-AZ on Amazon RDS for MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, minimizing downtime without manual intervention. This meets the requirement for automatic failover with minimal downtime.

Answer

Keep the deployment as single-AZ, but increase automated backup retention to 35 days.

Answer

Create a read replica in another Availability Zone, but keep Multi-AZ disabled.

Answer

Rely on restoring from the most recent manual snapshot after an outage.

Question 13

An organization hosts the same public API in two AWS Regions. Normal traffic should go to the primary Region. If the primary endpoint becomes unhealthy, Route 53 should automatically route users to the secondary Region. What is the best Route 53 configuration approach?

Accepted Answer

Use Route 53 failover routing with health checks that mark the primary as unhealthy and fail over to the secondary.. Route 53 failover routing is designed for active-passive configurations where traffic is directed to a primary resource unless a health check marks it as unhealthy, at which point all traffic automatically shifts to the secondary resource. This directly matches the requirement of routing normal traffic to the primary Region and failing over to the secondary Region only when the primary endpoint becomes unhealthy.

Answer

Use simple routing with one record that contains both regions as weighted targets.

Answer

Use weighted routing and set the secondary Region weight to 0 until needed.

Answer

Use latency-based routing so requests go to the region with the lowest latency, regardless of health.

Question 14

An orders service currently sends HTTP requests directly to two downstream services (inventory and shipping). During peak load, inventory slows down, causing the orders service to slow as well. The team wants the orders service to remain responsive even when a downstream service is temporarily slow or restarted. Which design change best achieves this resiliency goal?

Accepted Answer

Introduce Amazon SQS as a buffer between orders and downstream services, with consumers processing from the queue.. Introducing Amazon SQS as a buffer decouples the orders service from the downstream inventory and shipping services. The orders service can immediately enqueue messages and respond to the client, while downstream consumers process messages at their own pace. This prevents backpressure from a slow or restarting downstream service from blocking the orders service, achieving the desired resiliency.

Answer

Keep HTTP calls but add longer client timeouts so orders requests wait for slow downstream responses.

Answer

Replace the downstream services with AWS Lambda functions that are invoked synchronously by the orders service.

Answer

Call the downstream services in parallel threads to reduce waiting time during peak load.

Question 15

An application uses an Amazon RDS Multi-AZ DB instance. During a failover test, connections fail until the application is restarted, even though the database comes back online. Which two changes should the team make to improve resilience during failover? Select two.

Accepted Answer

Use the RDS endpoint name instead of hard-coding the current instance IP or hostname in the application.. The RDS endpoint is a DNS name that automatically resolves to the current writer instance's IP address. During a failover, the DNS record is updated to point to the new primary, so using the endpoint instead of a hard-coded IP or hostname allows the application to reconnect without manual intervention. Option D is correct because adding retry logic with exponential backoff handles transient failures during DNS resolution and connection establishment, which are common during the brief period when the DNS TTL has not yet expired after a failover.

Answer

Cache and reconnect to the current writer IP address to avoid DNS lookups during failover.

Answer

Switch to a read replica and let it promote manually after every outage.

Answer

Disable connection pooling so each request opens a fresh socket during normal operation.