SAA-C03 Design Resilient Architectures Practice Test 4 — 15 Questions

Question 1

A customer portal must recover from a regional outage within a few hours. The business wants lower ongoing cost than a fully active second Region and does not want to rebuild everything from scratch during the outage. Which two DR patterns best fit that goal? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pilot light. Pilot light is correct because it maintains a minimal, always-running core infrastructure (e.g., a small database and application server) in the secondary Region, replicating data continuously. During a regional outage, you can rapidly scale up the environment by provisioning additional resources (e.g., EC2 instances from pre-baked AMIs) to become fully active, meeting the recovery time objective (RTO) of a few hours while keeping ongoing costs lower than a fully active second Region.

Answer

Backup and restore

Answer

Multi-site active-active

Answer

Single-AZ deployment

Question 2

Your order-processing system uses EventBridge rules to send events to a Lambda function that updates order status. Over the last week, some events fail with a transient database timeout, and the Lambda retries intermittently but then the events are lost (no alerts after failures). You want at-least-once processing, bounded retries, and a way to inspect unprocessable events for later reprocessing.

Which architecture change best meets these requirements?

Accepted Answer

Send EventBridge events to an SQS queue, configure a redrive policy to move messages to a dead-letter queue (DLQ) after a defined receive count, and make the Lambda processing idempotent.. It introduces an SQS queue between EventBridge and Lambda, which provides at-least-once processing through message visibility timeouts and retries. The redrive policy moves messages to a dead-letter queue (DLQ) after a defined receive count, ensuring bounded retries and preserving unprocessable events for later inspection and reprocessing. Making the Lambda idempotent prevents duplicate side effects from at-least-once delivery.

Answer

Invoke Lambda directly from EventBridge in asynchronous mode, and increase the Lambda timeout to reduce failures.

Answer

Use SNS topics with Lambda subscriptions, but remove all retry and DLQ configuration to minimize duplicate events.

Answer

Store failed events only in CloudWatch logs, and have operators manually copy log entries back into the database for reprocessing.

Question 3

A company runs its customer-facing web app on EC2 behind an Application Load Balancer. The database is Amazon RDS for PostgreSQL. The requirement is that if a single Availability Zone fails, the database must automatically fail over within the same AWS Region with minimal application changes. Which database setup best meets this requirement?

Accepted Answer

Deploy the RDS PostgreSQL instance as Multi-AZ with automatic failover enabled.. RDS Multi-AZ with automatic failover provides synchronous replication to a standby instance in a different Availability Zone. If the primary AZ fails, RDS automatically flips the DNS CNAME to the standby, resulting in minimal application changes (only a brief connection interruption). This meets the requirement for automatic failover within the same region without manual intervention.

Answer

Use an RDS single-AZ instance and periodically restore from automated backups if needed.

Answer

Create a read replica in a different AZ and use it only when the primary fails.

Answer

Use RDS with Multi-AZ disabled, but increase storage IOPS to prevent failover.

Question 4

A retail API runs on Amazon EC2 instances behind an Application Load Balancer and stores orders in an Amazon RDS for PostgreSQL database. A test that stopped one Availability Zone caused the API to return errors because all application servers were in the same AZ and the database was single-AZ. Which two changes should the architect make to continue serving traffic during a single-AZ failure? Select two.

Accepted Answer

Configure the Auto Scaling group to launch instances across private subnets in at least two Availability Zones.. Distributing EC2 instances across multiple Availability Zones via an Auto Scaling group ensures that if one AZ fails, the remaining AZs continue to serve traffic. Option D is correct because converting the RDS for PostgreSQL database to a Multi-AZ deployment provides a standby replica in a different AZ, enabling automatic failover and continued database availability during a single-AZ failure.

Answer

Increase the EC2 instance size and keep all application servers in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer in a single Availability Zone.

Answer

Add an Amazon RDS read replica and point the application to the replica endpoint.

Question 5

A serverless order-ingestion API writes directly to a database. During traffic spikes, the database occasionally throttles, Lambda retries create duplicate order records, and some requests time out. Which two changes best improve buffering and safe retry behavior? Select two.

Accepted Answer

Put an Amazon SQS queue between the API and the database-processing function.. Inserting an SQS queue between the API Gateway and the Lambda function decouples the ingestion from the database write. During traffic spikes, SQS acts as a buffer, absorbing bursts and allowing the Lambda function to poll messages at a controlled rate, which prevents database throttling. Combined with a dead-letter queue, failed messages can be retried safely without overwhelming the database or creating duplicate records.

Answer

Increase the Lambda timeout and keep writing directly to the database.

Answer

Replace SQS with SNS so every request is delivered immediately to all subscribers.

Answer

Disable retries so failed writes are never duplicated.

Question 6

Match the disaster recovery strategy to the recovery posture it best fits for a Regional outage.

Accepted Answer

Backup & Restore: RPO hours, RTO hours. The pairs match disaster recovery strategies to their typical recovery posture for a regional outage, based on AWS Well-Architected Framework and common DR patterns.

Answer

Pilot Light: RPO seconds, RTO minutes

Answer

Warm Standby: RPO minutes, RTO minutes

Question 7

Based on the exhibit, the database must fail over automatically if the primary Availability Zone goes down. Which solution should the architect choose?

Accepted Answer

Convert the database to a Multi-AZ RDS deployment.. A Multi-AZ RDS deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention or changes to the application connection string.

Answer

Create a read replica in the same Availability Zone as the primary database.

Answer

Increase the backup retention period to 35 days.

Answer

Move the database to an EC2 instance with an attached EBS volume.

Question 8

An ECS service runs on EC2 instances and is fronted by an ALB. The ALB spans two Availability Zones, and the ECS service desired count is 2 tasks. The underlying EC2 capacity uses an Auto Scaling group (ASG) with min size set to 1, and the ASG also spans only one subnet in practice. What is the most effective change to meet the requirement that the service continues during a single-AZ instance loss?

Accepted Answer

Increase ASG min size to at least 2 and ensure the ASG uses subnets in at least two Availability Zones.. The current architecture has a single point of failure: the ASG spans only one subnet (one AZ), so if that AZ fails, all EC2 instances are lost, and the ECS service cannot run any tasks. By increasing the ASG min size to at least 2 and ensuring it uses subnets in at least two AZs, the ASG will maintain at least one healthy instance in each AZ, allowing the ECS service to survive a single-AZ outage. This aligns with the AWS Well-Architected Framework's principle of deploying across multiple AZs for high availability.

Answer

Set the ECS deployment configuration to maximum percent 100 so tasks replace instances faster during rollouts.

Answer

Enable ALB connection draining longer than expected so existing connections survive longer during an AZ event.

Answer

Reduce task memory reservations to pack both tasks onto a single EC2 instance.

Question 9

A company runs a stateful analytics workload on EC2 instances that use EBS volumes. The data must be restorable in another Region after a major outage, with frequent point-in-time recovery. Which approach provides the most suitable replication mechanism for the EBS-backed data?

Accepted Answer

Create scheduled EBS snapshots and copy them to another Region, then restore the volumes from those snapshots during recovery.. Scheduled EBS snapshots provide point-in-time recovery and can be copied to another Region for cross-region disaster recovery. When a major outage occurs, you can restore EBS volumes from those snapshots in the target Region, meeting the requirement for frequent restorable backups. This approach is native to AWS, cost-effective, and supports the stateful analytics workload without architectural changes.

Answer

Enable EBS multi-attach to spread the workload across AZs and replicate snapshots automatically between Regions.

Answer

Use RDS read replicas in another Region and keep the analytics dataset in an RDS instance only.

Answer

Rely on instance store for durability and copy only AMIs across Regions.

Question 10

A caching layer uses Amazon ElastiCache for Redis in front of a stateless web service. The service must continue to read cached responses during maintenance events and should automatically fail over to another node if one AZ becomes impaired. Which design change best satisfies this requirement?

Accepted Answer

Configure an ElastiCache Redis replication group with automatic failover across multiple Availability Zones.. An ElastiCache Redis replication group with automatic failover across multiple Availability Zones ensures that if the primary node or its AZ becomes impaired, a read-replica in another AZ is automatically promoted to primary. This allows the stateless web service to continue reading cached responses during maintenance events without interruption, as the failover is transparent to the application.

Answer

Deploy a single-node Redis cluster and rely on application-level retries when cache misses occur.

Answer

Move the cache into the VPC but keep it in one Availability Zone to reduce network latency.

Answer

Use a Memcached cluster and configure only client-side connection pooling without failover support.

Question 11

A stateless web API runs on EC2 instances behind an Application Load Balancer (ALB). The Auto Scaling group (ASG) currently uses subnets from only one Availability Zone, even though the ALB spans two Availability Zones. During maintenance of that single AZ, the ALB remains up but clients see timeouts because there are no healthy targets. Which change most directly improves resilience against an AZ failure?

Accepted Answer

Update the ASG to launch instances across subnets in at least two Availability Zones and ensure ALB health checks target an application-ready path.. It directly addresses the single point of failure: the ASG only launches instances in one AZ, so when that AZ fails, the ALB has no healthy targets to route traffic to, causing timeouts. By configuring the ASG to span at least two AZs, the ALB can distribute traffic to healthy instances in the remaining AZ during maintenance, ensuring high availability. The ALB health check must target an application-ready path (e.g., /health) to accurately detect instance health and avoid routing requests to impaired instances.

Answer

Keep the ASG in one subnet/AZ, but enable ALB stickiness to reduce session interruption.

Answer

Add a NAT gateway in the public subnets so instances can reach the internet during maintenance events.

Answer

Create a second ALB in the same Availability Zone and route traffic using DNS failover.

Question 12

A web app runs on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). The ALB is configured with health checks and the ASG spans three subnets in three Availability Zones. During an AZ outage, monitoring shows the number of healthy instances drops sharply and never returns to the original capacity until the ASG is manually adjusted. What change most directly improves resilience so capacity returns automatically during an AZ failure?

Accepted Answer

Configure the ASG to use the ALB target-group health checks (ELB/target-group health) and ensure the ASG has at least two subnets in different Availability Zones that remain available for instance placement.. Configuring the ASG to use ALB target-group health checks (ELB health checks) ensures that the ASG replaces instances that fail the ALB's health checks, including those in an impaired AZ. By also ensuring the ASG has at least two subnets in different AZs that remain available, the ASG can launch replacement instances in the healthy AZs when one AZ fails, automatically restoring capacity without manual intervention.

Answer

Reduce the ASG desired capacity by 1 and rely on the ALB to route traffic to fewer instances during the outage.

Answer

Move the ALB to only one subnet so health checks and routing remain consistent during the outage.

Answer

Add an S3 event trigger to terminate unhealthy instances so the ASG can scale back out using its scheduled actions.

Question 13

Your public API is hosted in two regions. You want Route 53 to automatically send traffic to the secondary region when the primary region’s endpoint fails. The primary API health check is returning failure codes, but clients still reach the primary region for several minutes. Which Route 53 configuration most directly addresses this behavior?

Accepted Answer

Use Route 53 failover routing with a primary record and a secondary record, each associated with its own health check, so Route 53 answers with the healthy region.. Route 53 failover routing with health checks on both primary and secondary records ensures that when the primary health check fails, Route 53 stops returning the primary record's IP and instead returns the secondary record's IP. This directly addresses the observed behavior where clients still reach the primary region for several minutes—likely because the primary record's health check was not configured or associated, or a simple routing policy was used without health check integration, causing stale DNS responses to be served until TTL expires.

Answer

Use a single Alias A record with simple routing and a short TTL so Route 53 quickly changes the IP address.

Answer

Use weighted routing to send a small percentage of traffic to the secondary region, increasing it manually when the primary fails.

Answer

Use latency routing only, letting Route 53 choose the lowest-latency region at query time, without health checks.

Question 14

An orders service publishes payment instructions to an Amazon SQS queue. After occasional processing timeouts, the downstream consumer sometimes processes the same instruction twice, resulting in duplicate payment attempts. The team currently uses an SQS Standard queue with a visibility timeout of 2 minutes and relies on the consumer to finish before the timeout expires. What approach best improves resilience against duplicate processing?

Accepted Answer

Make the consumer idempotent using the order ID as a deduplication key, and set the visibility timeout longer than the worst-case processing time.. Making the consumer idempotent using the order ID as a deduplication key ensures that even if the same message is processed multiple times, the downstream system will only apply the payment once. Setting the visibility timeout longer than the worst-case processing time prevents the message from becoming visible again before the consumer finishes, eliminating the root cause of duplicate processing in a Standard queue.

Answer

Decrease visibility timeout to 10 seconds so duplicates are less likely to occur.

Answer

Use an EventBridge rule with a fixed retry policy that only retries when the payload matches exactly.

Answer

Enable a dead-letter queue (DLQ) only, without changing the queue type or consumer logic.

Question 15

A developer accidentally deletes important rows in an RDS database. The mistake is discovered 45 minutes later. The database has automated backups enabled with a retention period of 7 days. What is the best way to restore the database to a point just before the deletion?

Accepted Answer

Use point-in-time restore (PITR) to restore the database to a specific timestamp before the deletion, based on automated backups.. Point-in-time restore (PITR) allows you to restore an RDS DB instance to any second within the automated backup retention period (here, 7 days). Since the deletion occurred 45 minutes ago, you can specify a timestamp just before the deletion, and RDS will replay the transaction logs to bring the database to that exact state. This is the most precise and efficient recovery method for accidental data modifications.

Answer

Restore the latest manual snapshot and then run SQL scripts to revert the deletion.

Answer

Promote an existing read replica to be the primary and then copy the missing rows from logs.

Answer

Recreate the instance using the most recent CloudWatch metric alarm snapshot of storage metrics.