SAA-C03 Design Resilient Architectures Practice Test 3 — 15 Questions

Question 1

An order processing workflow uses Amazon SQS as the decoupling layer between a producer and a consumer Lambda function. The consumer intermittently fails due to a downstream dependency. The team has observed that certain “poison” messages keep being retried repeatedly and prevent other messages from being processed efficiently. Which SQS configuration most directly addresses this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a redrive policy with a dead-letter queue (DLQ) and set an appropriate visibility timeout greater than the maximum processing time.. Configuring a redrive policy with a dead-letter queue (DLQ) allows messages that repeatedly fail processing to be moved out of the main queue after a specified number of receive attempts. Setting an appropriate visibility timeout greater than the maximum processing time ensures that messages are not made visible again before the consumer finishes processing, preventing premature retries. This directly isolates poison messages so they no longer block the processing of other messages in the queue.

Answer

Set the SQS queue’s retention period to 10 years and rely on application retries to eventually succeed.

Answer

Increase visibility timeout to a very large value and avoid dead-letter queues to keep ordering stable.

Answer

Switch the queue to FIFO and remove retries in the Lambda event source mapping entirely.

Question 2

A media company stores original uploads in an S3 bucket. They must recover from accidental overwrites/deletes and also recover quickly from a full Region outage. The required RPO is about 1 hour. Which configuration best meets these requirements?

Accepted Answer

Enable S3 versioning and configure cross-Region replication to a bucket in another Region.. Enabling S3 versioning protects against accidental overwrites and deletes by preserving all object versions, while cross-Region replication (CRR) asynchronously replicates objects to a bucket in another Region, providing recovery from a full Region outage. With versioning enabled, CRR replicates both current and previous object versions, meeting the ~1-hour RPO (typically within minutes for new objects) and ensuring data durability across Regions.

Answer

Enable an S3 lifecycle policy to transition objects to Glacier after 7 days without enabling versioning.

Answer

Enable S3 cross-Region replication (CRR) but leave the bucket without versioning enabled.

Answer

Rely on frequent EBS snapshots of a temporary cache used during uploads.

Question 3

An ECS service runs on EC2 instances and is fronted by an ALB. The ALB spans two Availability Zones, and the ECS service desired count is 2 tasks. The underlying EC2 capacity uses an Auto Scaling group (ASG) with min size set to 1, and the ASG also spans only one subnet in practice. What is the most effective change to meet the requirement that the service continues during a single-AZ instance loss?

Accepted Answer

Increase ASG min size to at least 2 and ensure the ASG uses subnets in at least two Availability Zones.. The current architecture has a single point of failure because the Auto Scaling group (ASG) spans only one subnet (one Availability Zone). If that AZ fails, all EC2 instances are lost, and the ECS service cannot run any tasks. Increasing the ASG min size to at least 2 and configuring it to use subnets in at least two AZs ensures that EC2 instances are distributed across AZs, allowing the ECS service to maintain at least one task in the surviving AZ during a single-AZ failure.

Answer

Set the ECS deployment configuration to maximum percent 100 so tasks replace instances faster during rollouts.

Answer

Enable ALB connection draining longer than expected so existing connections survive longer during an AZ event.

Answer

Reduce task memory reservations to pack both tasks onto a single EC2 instance.

Question 4

An engineering team deploys a stateless web API on EC2 using an Auto Scaling group and an Application Load Balancer (ALB). During a recent test, they noticed that when one Availability Zone was unavailable, traffic failed until new instances were manually launched. Which change most directly improves automatic failover for the compute layer within a single Region?

Accepted Answer

Ensure the ALB and Auto Scaling group span multiple subnets in at least two Availability Zones.. An Application Load Balancer (ALB) and Auto Scaling group must span multiple subnets in at least two Availability Zones (AZs) to provide automatic failover. When one AZ becomes unavailable, the ALB automatically reroutes traffic to healthy targets in the remaining AZs, and the Auto Scaling group can launch replacement instances in the surviving AZs. This architecture ensures that the compute layer remains available without manual intervention.

Answer

Place the Auto Scaling group in only one subnet so instance launches are simpler.

Answer

Increase the target group deregistration delay to allow old instances to stay longer.

Answer

Use a Network Load Balancer, but keep all subnets in a single Availability Zone.

Question 5

Your media processing pipeline writes original uploads to an S3 bucket and later generates derivative files. An operator accidentally deletes a subset of original uploads in production. You need to (1) restore the deleted objects with minimal data loss and (2) protect against both regional disasters and future operator mistakes. The company requires recovery even if objects are deleted and later overwritten.

What is the most effective change to meet these requirements?

Accepted Answer

Enable S3 versioning on the bucket and configure cross-Region replication so previous versions are available after regional loss and accidental deletion.. Enabling S3 Versioning preserves all object versions, including overwrites and deletions (which become delete markers), allowing you to restore deleted objects by removing the delete marker. Cross-Region Replication (CRR) replicates both current and previous versions to a secondary Region, protecting against regional disasters. Together, they ensure recovery even if objects are deleted and later overwritten, meeting all requirements.

Answer

Move all objects to S3 Glacier Instant Retrieval and apply a lifecycle policy to keep only the latest object copy.

Answer

Use S3 server-side encryption with KMS keys and rely on access logs to manually recover the deleted objects.

Answer

Enable S3 bucket policies that deny DeleteObject, but do not enable versioning or replication.

Question 6

An order system receives events and uses a Lambda function to write each order into a database. During traffic spikes, the database sometimes throttles, and Lambda retries lead to occasional message loss in the event flow. The team wants buffering, automatic retries, and a way to isolate messages that repeatedly fail so they can be inspected later. What design change best meets this need?

Accepted Answer

Use Amazon SQS as a buffer between the event source and Lambda, with an SQS dead-letter queue (DLQ).. Amazon SQS acts as a durable buffer between the event source and Lambda, absorbing traffic spikes and decoupling the producer from the consumer. The SQS dead-letter queue (DLQ) automatically captures messages that exceed the configured maximum retries, allowing the team to inspect and reprocess them later without loss. This design provides the required buffering, automatic retries via the Lambda event source mapping, and isolation of repeatedly failing messages.

Answer

Send events directly from EventBridge to Lambda without any queue to simplify the flow.

Answer

Use SNS fan-out to multiple Lambda functions, but keep no retry logic and no DLQ.

Answer

Store events in an S3 bucket and trigger Lambda immediately after each upload, without using DLQs.

Question 7

A SaaS application is deployed in us-east-1 and us-west-2 behind separate ALBs. The business wants DNS to send new clients to the primary Region when it is healthy and automatically fail over to the secondary Region when the primary endpoint is unhealthy. Which two Route 53 settings are required? Select two.

Accepted Answer

Use a failover routing policy with a primary and secondary record.. A failover routing policy is correct because it allows you to designate one record as primary and another as secondary. Route 53 will route traffic to the primary record as long as it is healthy, and automatically fail over to the secondary record when the primary is unhealthy. This directly meets the requirement to send new clients to the primary region when healthy and fail over to the secondary region.

Answer

Use weighted routing with a 50/50 traffic split between both Regions.

Answer

Use latency-based routing so clients always choose the fastest Region.

Answer

Use a geolocation policy without health checks.

Question 8

Your ecommerce app runs behind an Application Load Balancer (ALB) and uses an RDS database for orders. During an AZ impairment in us-east-1, customers report that checkout takes several minutes to recover. The current design places EC2 instances only in private subnets of AZ-a, while the ALB spans multiple subnets. The RDS DB instance is Multi-AZ. Management wants automatic recovery within the same Region.

Which change best addresses the issue with minimal operational overhead?

Accepted Answer

Move the EC2 instances into Auto Scaling Groups that span private subnets in at least two AZs, keeping the ALB spanning those subnets.. The current design places EC2 instances only in AZ-a, so when that AZ becomes impaired, all compute capacity is lost, causing checkout to fail until the impairment ends or manual intervention occurs. By moving EC2 instances into Auto Scaling Groups spanning at least two AZs, the application gains automatic recovery within the same Region because the ALB can route traffic to healthy instances in the remaining AZs. This change minimizes operational overhead because Auto Scaling automatically replaces failed instances and maintains desired capacity across AZs, while the ALB’s health checks ensure traffic is only sent to healthy targets.

Answer

Switch from RDS Single-AZ to RDS Multi-AZ, keeping the EC2 instances in only AZ-a because failover will still reach them.

Answer

Terminate the ALB and use a Network Load Balancer (NLB) in front of the existing single-AZ EC2 instances.

Answer

Add more EC2 instances in AZ-a and increase the ALB health check thresholds to avoid unnecessary replacements during impairments.

Question 9

A team uses an S3 bucket to store important customer-generated exports. They need protection against accidental overwrites and also want copies of the data in another AWS Region for disaster recovery. Which S3 configuration best satisfies both requirements?

Accepted Answer

Enable S3 versioning and configure Cross-Region Replication to a destination bucket in another Region.. Enabling S3 versioning protects against accidental overwrites by preserving all object versions, allowing recovery of previous versions. Configuring Cross-Region Replication (CRR) automatically replicates objects to a destination bucket in another AWS Region, providing disaster recovery by maintaining a copy of the data in a separate geographic location.

Answer

Enable S3 lifecycle policies to automatically move objects to Glacier after 30 days only.

Answer

Disable all versioning and rely on AWS Backup to restore objects from a scheduled backup window.

Answer

Enable S3 Block Public Access and SSE-S3 encryption, without using versioning or replication.

Question 10

A company runs the same public API in two regions (Region A and Region B), each fronted by an ALB. They want Route 53 to automatically route clients to the Region B API when Region A becomes unhealthy, with minimal configuration effort. Which Route 53 approach should they use?

Accepted Answer

Use Route 53 failover routing with health checks for each region’s endpoint.. Route 53 failover routing with health checks is the correct choice because it automatically directs traffic to the secondary (Region B) endpoint when the primary (Region A) endpoint fails a health check. This provides automated DNS failover with minimal configuration effort, as Route 53 monitors the health of each ALB endpoint and updates DNS responses accordingly.

Answer

Use a single Route 53 A record that points only to Region A’s ALB and manually update it after failures.

Answer

Use Route 53 latency-based routing with separate records for each region.

Answer

Use weighted routing and set the Region B weight to 0 to ensure it is only used when needed.

Question 11

A retail platform needs disaster recovery across AWS Regions. The business requirement is: RTO up to 6 hours, RPO up to 1 hour, and they want the ability to start serving quickly during a Region outage but do not want to run full production capacity continuously. Which DR strategy best fits these requirements?

Accepted Answer

Warm standby, keeping a reduced but ready-to-scale environment in the secondary Region.. Warm standby is the correct strategy because it maintains a scaled-down but fully functional copy of the production environment in the secondary Region, which can be scaled up within the 6-hour RTO. The RPO of 1 hour is met by continuous replication (e.g., Amazon RDS cross-Region read replicas or DynamoDB global tables), and the reduced footprint avoids the cost of full production capacity while still enabling rapid failover.

Answer

Backup and restore only, with no continuously running infrastructure in the secondary Region.

Answer

Pilot light, keeping only the minimum resources needed to bootstrap the environment.

Answer

Multi-site active-active, serving production traffic from both Regions at all times.

Question 12

A fintech startup uses AWS to run a web API and a PostgreSQL database. They must meet an RPO of 15 minutes and an RTO of 2 hours for a Region-wide disaster. Budget allows running a small, always-on set of infrastructure in a secondary Region, but not full production capacity. The team wants a DR approach that is regularly testable without large manual effort.

Which disaster recovery strategy is the best fit?

Accepted Answer

Warm standby: keep a scaled-down application environment and database replication active in the secondary Region, using automated failover controls.. Warm standby (B) is the best fit because it maintains a scaled-down but fully functional application environment in the secondary Region with active database replication, meeting the RPO of 15 minutes via synchronous or near-synchronous replication (e.g., PostgreSQL streaming replication or AWS DMS with ongoing replication). Automated failover controls (e.g., Route 53 health checks and Lambda automation) can achieve the RTO of 2 hours by scaling up the standby environment, and the always-on infrastructure allows regular, low-effort testing of the failover process without manual intervention.

Answer

Pilot light: replicate databases and store backups, keep only minimal infrastructure in the secondary Region, and scale up fully during failover.

Answer

Backup and restore only: rely on daily automated backups and restore into the secondary Region during an incident.

Answer

Multi-site active-active: run both Regions at full capacity and route live traffic to both simultaneously.

Question 13

A media company stores daily financial exports in Amazon S3. The files must be protected against accidental overwrite or deletion, and the business also wants a second copy in another Region for recovery after a regional outage. Which two actions should the architect take? Select two.

Accepted Answer

Enable bucket versioning on the S3 bucket.. Enabling S3 Versioning protects objects from accidental overwrite or deletion by preserving previous versions. When a file is overwritten or deleted, the original version is retained, allowing recovery. This directly addresses the requirement to guard against data loss from user or application errors.

Answer

Turn on S3 Transfer Acceleration for the bucket.

Answer

Use only lifecycle policies to move objects to Glacier.

Answer

Enable S3 Block Public Access on the bucket.

Question 14

A SaaS platform serves an API using two regional deployments: us-east-1 (primary) and us-west-2 (secondary). Each region has its own ALB. The business requires automated DNS-based failover when the primary region becomes unhealthy, and they do not want manual DNS changes during incidents. 

Which Route 53 configuration is the best match?

Accepted Answer

Use Route 53 failover routing with a primary record pointing to the us-east-1 ALB and a secondary record pointing to the us-west-2 ALB, each using health checks.. Route 53 failover routing is designed specifically for active-passive failover scenarios where you have a primary and secondary resource. By associating health checks with each record, Route 53 automatically detects when the primary ALB in us-east-1 becomes unhealthy and routes traffic to the secondary ALB in us-west-2 without manual intervention. This meets the requirement for automated DNS-based failover without manual DNS changes.

Answer

Create a single Route 53 record using weighted routing across both ALBs with weights adjusted manually during an incident.

Answer

Use latency-based routing so Route 53 always selects the fastest region; health checks are unnecessary because client latency reflects availability.

Answer

Use a single A record with a static IP address that points to a NAT gateway, and update that IP during failure events.

Question 15

A company runs a customer portal on an Amazon Aurora PostgreSQL cluster. The application currently connects directly to the writer instance endpoint and keeps long-lived connections open. During a maintenance failover, writes fail until clients are restarted. The team wants the application to reconnect to the correct Aurora endpoint automatically and reduce user-visible write interruptions.

Which change is most likely to achieve this?

Accepted Answer

Use the Aurora cluster endpoint for write traffic, use the reader endpoint for read-only traffic, and implement connection retry or reconnect logic on failover.. The Aurora cluster endpoint automatically points to the current writer instance and updates DNS after a failover, so the application can reconnect without manual intervention. However, because the application keeps long-lived connections, it must implement connection retry or reconnect logic to detect the broken connection and re-resolve the DNS name to the new writer. This combination ensures writes resume automatically after failover.

Answer

Keep using the original writer instance endpoint so the database host name never changes during failover.

Answer

Convert the Aurora cluster to Single-AZ so there is only one database node to connect to.

Answer

Place Route 53 in front of the database and manually update DNS records whenever failover occurs.