SAA-C03 Design Resilient Architectures Practice Test 2 — 15 Questions

Question 1

Based on the exhibit, the web tier becomes unavailable if us-west-2a has an outage. What is the best change to improve resilience with the least redesign?

Accepted Answer

Attach the Application Load Balancer and Auto Scaling group to subnets in a second Availability Zone.. The web tier is currently deployed in a single Availability Zone (us-west-2a), so an outage of that AZ makes the entire tier unavailable. By attaching the Application Load Balancer and Auto Scaling group to subnets in a second Availability Zone, the application can continue serving traffic from the healthy AZ, achieving high availability with minimal architectural changes. This is the standard AWS best practice for multi-AZ resilience.

Answer

Increase the Auto Scaling group desired capacity from 2 to 3 in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Increase the health check grace period so instances stay registered longer.

Question 2

Based on the exhibit, the database is manually promoted during an Availability Zone failure and the application outage lasts longer than the target. What change best improves resilience with the least operational intervention?

Accepted Answer

Convert the database to an RDS Multi-AZ deployment so a synchronous standby can fail over automatically.. B is correct because RDS Multi-AZ automatically synchronously replicates data to a standby in a different Availability Zone and triggers an automatic failover with zero manual intervention when an AZ failure occurs. This directly addresses the requirement to improve resilience while minimizing operational effort, as the failover is handled by AWS without any runbook execution or manual promotion.

Answer

Keep the read replica and automate promotion with a runbook after CloudWatch alarms fire.

Answer

Use a cross-Region read replica so promotion happens faster during an AZ failure.

Answer

Increase the application retry count and keep the current database design.

Question 3

An application writes to an Amazon Aurora DB cluster. After a planned Aurora failover, the application experiences several minutes of connection errors.

The logs show the application continues connecting to the specific DB instance endpoint that was the primary before the failover.

What change most directly improves resilience during Aurora failovers?

Accepted Answer

Update the application to use the Aurora cluster writer endpoint for write traffic so it always resolves to the current writer instance.. The Aurora cluster writer endpoint always resolves to the current primary DB instance, even after a failover. By using this endpoint instead of a specific instance endpoint, the application automatically reconnects to the new writer without manual intervention or connection errors.

Answer

Increase Aurora storage autoscaling so failovers are unnecessary.

Answer

Point both reads and writes to the Aurora reader endpoint to keep the DNS name the same.

Answer

Disable Aurora failover capability so the cluster never switches writer instances.

Question 4

A service processes customer payments from a message queue. Because the queue provides at-least-once delivery, the same payment message can be delivered more than once if the consumer times out before committing its state. Currently, the service sometimes charges the customer twice.

Which design change most directly prevents duplicate charges while still allowing safe retries?

Accepted Answer

Make the payment processing idempotent by recording an idempotency key for each payment and ensuring repeated deliveries do not apply the charge twice.. Making payment processing idempotent using an idempotency key ensures that even if the same message is delivered multiple times due to at-least-once delivery semantics, the charge is applied only once. The consumer records a unique key (e.g., payment ID) in a durable store (like DynamoDB or Redis) and checks it before processing; if the key already exists, the charge is skipped. This directly prevents duplicate charges while still allowing safe retries, as the consumer can safely reprocess messages without side effects.

Answer

Delete the message from the queue immediately after receive to prevent redelivery.

Answer

Increase the queue visibility timeout to a very large value so messages rarely reappear.

Answer

Switch to a single-threaded consumer with one worker so messages are processed in order.

Question 5

Your web application is deployed in two AWS Regions (Region A and Region B). You want Route 53 to automatically fail over DNS traffic from Region A to Region B when Region A is unhealthy.

The failover decision must be based on health checks that verify whether the application in Region A is reachable.

Which Route 53 routing configuration best meets these requirements?

Accepted Answer

Failover routing using a primary record with an associated health check for Region A and a secondary record for Region B.. Route 53 failover routing allows you to create a primary record with an associated health check for Region A and a secondary record for Region B. When the health check for Region A fails, Route 53 automatically returns the secondary record's IP address, directing traffic to Region B. This directly meets the requirement for automatic failover based on application reachability.

Answer

Latency-based routing with regional aliases to split traffic based on measured latency.

Answer

Geolocation routing using country-based routing policies.

Answer

Weighted routing with weights set to 100 for Region A and 0 for Region B.

Question 6

Based on the exhibit, the payment worker sometimes processes the same SQS Standard message more than once after a timeout. What change best prevents duplicate charges while keeping the queue architecture?

Accepted Answer

Make the payment workflow idempotent by recording a unique order key before charging.. Making the payment workflow idempotent ensures that even if the same SQS Standard message is processed more than once (due to a visibility timeout), the duplicate charge is prevented by checking a unique order key before processing. This is the most robust solution for handling at-least-once delivery semantics of Standard queues without changing the queue architecture.

Answer

Increase the SQS visibility timeout to 15 minutes and leave the worker unchanged.

Answer

Replace the Standard queue with a FIFO queue and rely only on message ordering.

Answer

Add a second consumer so duplicate messages are processed faster.

Question 7

Based on the exhibit, duplicate payment charges occasionally occur when the worker times out after the charge is submitted but before the message is deleted. What change best prevents duplicate charges while keeping retry behavior?

Accepted Answer

Make the consumer idempotent by storing a processed payment key and rejecting repeat charges.. Making the consumer idempotent ensures that even if the same message is processed more than once (due to a timeout after the charge is submitted but before the message is deleted), the duplicate charge will be rejected. By storing a processed payment key (e.g., a unique transaction ID) and checking it before processing, the system can safely retry without causing duplicate payments. This approach preserves retry behavior while preventing duplicates, which is the core requirement.

Answer

Switch the queue to FIFO and rely on content-based deduplication to guarantee exactly-once processing.

Answer

Reduce the visibility timeout so the message becomes available again sooner after a timeout.

Answer

Add a dead-letter queue and disable retries so the message is never processed twice.

Question 8

A production team accidentally deletes critical rows in an Amazon RDS for PostgreSQL database. The deletion occurred about 6 hours ago. The team wants to recover to a specific point in time with minimal disruption.

Assuming automated backups are enabled, which approach provides the best resilience outcome?

Accepted Answer

Use point-in-time recovery (PITR) to restore a new DB instance to a timestamp shortly before the deletion, then switch application traffic to the restored instance.. Point-in-time recovery (PITR) allows you to restore a new DB instance to any second within the automated backup retention period, which includes transaction logs. By restoring to a timestamp just before the deletion, you recover the lost rows without affecting the current production instance, then switch traffic to the new instance for minimal disruption.

Answer

Restore the current DB instance in place by overwriting it with only the latest automated backup.

Answer

Create a manual snapshot and restore from it only if the snapshot date exactly matches today.

Answer

Perform a database-level rollback using transaction logs from the application server without using RDS restore features.

Question 9

A web application uses pooled JDBC connections to an Amazon Aurora cluster using the writer endpoint. During an Aurora planned failover, monitoring shows a short spike in failed requests. The Aurora cluster writer endpoint remains the same, but many existing pooled connections briefly fail. The application retries aggressively and overloads the new writer during the transition.

Which design change will most improve application resilience during Aurora failovers without requiring application redeployment?

Accepted Answer

Add an RDS Proxy between the application and Aurora to manage database connections across failovers.. RDS Proxy sits between the application and the Aurora cluster, maintaining a warm connection pool to the database. During a failover, RDS Proxy transparently reconnects to the new writer instance without dropping the application's existing connections, eliminating the spike in failed requests and preventing the aggressive retry storm that overloads the new writer. This requires no code changes or redeployment, as the application simply connects to the proxy endpoint instead of the cluster endpoint.

Answer

Change the Aurora cluster to Single-AZ to reduce failover events.

Answer

Increase the application thread count so more requests can be served while connections reconnect.

Answer

Pin all database traffic to a specific instance hostname instead of the writer cluster endpoint.

Question 10

Based on the exhibit, an administrator accidentally deleted data from Amazon RDS for PostgreSQL about 90 minutes ago. Which recovery approach best restores the database to the exact required point in time?

Accepted Answer

Restore the database to the specified point in time into a new DB instance.. Amazon RDS for PostgreSQL supports Point-in-Time Recovery (PITR), which allows you to restore a DB instance to any second within the backup retention period, up to the last five minutes. Since the deletion occurred approximately 90 minutes ago, you can restore to that exact point in time by specifying the timestamp, and RDS will create a new DB instance from automated backups and transaction logs. This is the only option that recovers the exact state before the accidental deletion.

Answer

Restore the latest automated snapshot back onto the existing DB instance.

Answer

Create a read replica and promote it after the deletion is noticed.

Answer

Enable Multi-AZ so the database can automatically undo application mistakes.

Question 11

Based on the exhibit, the current disaster recovery design misses the RTO target even though the database replica is current. Which deployment model best meets the requirements with the least always-on cost?

Accepted Answer

Warm standby, because a scaled-down application stack stays running in the secondary Region and can take over faster.. Warm standby is the correct choice because it keeps a scaled-down application stack running in the secondary Region, which can be scaled up quickly to handle production traffic. This design meets the RTO target by reducing failover time compared to a pilot light, while avoiding the higher always-on cost of an active-active deployment.

Answer

Pilot light, because only the database needs to be running in the secondary Region.

Answer

Active-active, because both Regions should always serve traffic to guarantee the RTO.

Answer

Backup and restore, because restoring from backups is the least expensive DR model available.

Question 12

Based on the exhibit, a web application must stay available if one Availability Zone fails. What is the best change to improve resilience?

Accepted Answer

Add a subnet in another Availability Zone to the Auto Scaling group and keep the ALB spanning both AZs.. Adding a subnet in another Availability Zone (AZ) to the Auto Scaling group and keeping the ALB spanning both AZs ensures that if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. This is the standard pattern for building multi-AZ resilient architectures with Auto Scaling and ALB, as it eliminates the single point of failure at the AZ level.

Answer

Increase the desired capacity to 8 instances in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Move the instances to a larger instance type with more CPU and memory.

Question 13

A global application experiences frequent writes and must survive a full Regional outage with near-zero data loss. The product team also requires that users can continue to write during the incident using the closest Region. Which approach is most aligned with these requirements?

Accepted Answer

Use an active/active design with multi-Region data replication (for example, global tables for the write-heavy datastore) and route traffic to multiple Regions based on health and latency.. An active/active design with multi-Region data replication, such as Amazon DynamoDB global tables, allows writes to occur in any Region and replicates them to all other Regions with near-real-time latency (typically sub-second). This meets the requirement for near-zero data loss during a full Regional outage, as data is asynchronously replicated to multiple Regions, and users can continue writing to the closest healthy Region via Route 53 latency-based or geolocation routing.

Answer

Use warm standby with periodic backups of the primary write datastore every 24 hours.

Answer

Use pilot light where the secondary Region runs only infrastructure templates and starts data replication only after detecting failure.

Answer

Use a single-writer model in one Region and deploy read-only replicas in the other Region for continuity.

Question 14

A team wants a web application to keep serving traffic if one Availability Zone fails. Match each architecture element to the resilience behavior it provides.

Accepted Answer

Application Load Balancer (ALB): Distributes incoming traffic across healthy targets in multiple Availability Zones.. These pairs match architecture elements with their resilience behaviors for surviving an Availability Zone failure, focusing on AWS services that provide high availability and fault tolerance.

Answer

Application Load Balancer (ALB): Automatically replaces failed instances across Availability Zones.

Answer

Auto Scaling group: Distributes incoming traffic across healthy instances in multiple Availability Zones.

Question 15

A company uses Amazon RDS for a PostgreSQL database powering a customer-facing application. The application’s availability depends on fast database failover with minimal manual intervention. The RDS instance currently runs as a single-AZ deployment in one DB subnet group. Which change most directly meets the goal?

Accepted Answer

Enable Multi-AZ for the RDS DB instance so AWS manages a standby in another Availability Zone with automatic failover.. Enabling Multi-AZ for the RDS DB instance creates a synchronous standby replica in a different Availability Zone. AWS automatically handles failover to the standby with no manual intervention required, which directly meets the goal of fast database failover with minimal manual intervention.

Answer

Create a read replica in a different Availability Zone and configure the application to fail over manually.

Answer

Switch the database to use EBS snapshots more frequently and restore in case of failure.

Answer

Pin the DB to a specific instance type with higher CPU credits to prevent CPU-related disconnects.