SAA-C03 Design Resilient Architectures Practice Test 5 — 15 Questions

Question 1

An application uses an Amazon Aurora DB cluster. The cluster performs an automatic failover from the writer instance to a standby instance. After failover completes, reads succeed, but all new writes fail with errors indicating the application is connecting to the old writer endpoint. Which change best fixes the resiliency issue after failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the application to use the Aurora cluster writer endpoint (or the cluster endpoint intended for writes) rather than an instance-specific endpoint.. The application is failing writes because it is connecting to the old writer instance's endpoint, which is no longer the writer after failover. The Aurora cluster writer endpoint is a DNS name that always points to the current primary (writer) instance, regardless of failovers. By using the cluster writer endpoint, the application automatically connects to the new writer after failover, eliminating the need to manually update connection strings.

Answer

Enable Multi-AZ on the individual writer instance settings so it can automatically create a new instance during failover.

Answer

Increase the failover timeout for Aurora to 60 minutes to ensure the app finishes reconnecting.

Answer

Switch the cluster to a single-AZ configuration to reduce connection retries after failover.

Question 2

A company hosts a public API using two AWS regions behind a single custom domain. Route 53 is configured with latency-based routing and health checks. During a regional outage, application metrics confirm the primary API is unhealthy, but clients still resolve to the primary region for most requests. Which DNS configuration change will most directly ensure automatic failover to the secondary region when the primary fails?

Accepted Answer

Switch to Route 53 failover routing: configure the primary record with the primary health check and the secondary record with the secondary failover health check.. Route 53 failover routing with health checks explicitly directs traffic to the secondary region when the primary health check fails. This ensures automatic failover at the DNS level, whereas latency-based routing does not guarantee failover even with health checks—it only reduces latency and may still return unhealthy records if no healthier alternative exists.

Answer

Change the record type to A/AAAA alias with an active-active routing policy so both regions always receive equal traffic.

Answer

Keep latency-based routing but shorten the health check interval to 5 seconds.

Answer

Use geolocation routing so requests from each country route to the nearest region.

Question 3

An orders service publishes payment instructions to an Amazon SQS queue. The downstream consumer sometimes times out while processing a message. After the message becomes visible again, the consumer may process the same instruction more than once and occasionally creates duplicate orders. The team needs a resiliency-focused design that prevents duplicates from creating double-charges, even if the same message is processed multiple times. What is the best architectural change?

Accepted Answer

Make the consumer idempotent by using an idempotency key from the payment instruction (for example, a unique transaction/payment ID) and storing processing results with conditional writes so repeated deliveries do not create a second order.. Making the consumer idempotent ensures that processing the same payment instruction multiple times does not result in duplicate orders or double charges. By using a unique idempotency key (e.g., transaction ID) and conditional writes (e.g., DynamoDB conditional put or database INSERT ... ON CONFLICT DO NOTHING), the consumer can safely handle repeated message deliveries without side effects. This directly addresses the resiliency requirement without relying on SQS guarantees, which standard queues do not provide for exactly-once delivery.

Answer

Rely on SQS to guarantee exactly-once delivery for standard queues and remove all duplicate-handling logic in the consumer.

Answer

Increase the SQS visibility timeout to the maximum value so the consumer never retries the message.

Answer

Change the queue to SNS with a fan-out subscription so each consumer gets a separate copy, ensuring processing is sequential and duplicate-free.

Question 4

A web application runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). After a new release, instances begin failing ALB health checks with errors like 502 while the application is still starting up. CloudWatch shows that the ASG replaces the instances before they finish initializing, so traffic never reaches healthy targets. Which change most directly prevents premature replacement during startup so traffic can resume as soon as the instances are actually healthy?

Accepted Answer

Increase the Auto Scaling group health check grace period to cover application startup and initialization time.. B is correct because the Auto Scaling group health check grace period allows instances a specified amount of time to initialize before the ASG starts checking their health status. By increasing this grace period to cover the application startup time, the ASG will not prematurely replace instances that are still initializing, allowing them to pass the ALB health checks and begin receiving traffic once they are actually healthy.

Answer

Reduce the ALB health check timeout to 1 second so failures are detected faster.

Answer

Enable connection draining on the ALB target group but set deregistration delay to 0 seconds.

Answer

Switch the ALB target group health checks from HTTP to TCP so the application does not need to return HTTP 200.

Question 5

A company uses an Amazon Aurora DB cluster in a Multi-AZ configuration. During a planned failover of the writer instance, the database endpoints in the application are updated incorrectly. After failover, reads work but writes fail with connection errors and timeouts for several minutes. The team currently uses the instance endpoint for the writer. What should they change to improve write resilience during failovers?

Accepted Answer

Use the Aurora cluster writer endpoint for all write operations.. The Aurora cluster writer endpoint always points to the current primary (writer) instance, even after a failover. By using this endpoint instead of a static instance endpoint, the application automatically resolves to the new writer without manual updates, eliminating connection errors and timeouts during failover transitions.

Answer

Continue using the instance endpoint, but increase application retry count so the writer changes are handled more quickly.

Answer

Use a read replica endpoint for writes because it is typically stable across failovers.

Answer

Disable Multi-AZ failover so the writer instance never changes and writes remain consistent.

Question 6

A public API is deployed in two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The team wants Route 53 to automatically route users to the secondary region if the primary API becomes unhealthy. They will use Route 53 health checks that monitor the API’s /status endpoint over HTTPS. Which Route 53 configuration most directly implements this failover behavior?

Accepted Answer

Create a primary alias record and a failover alias record (secondary), configure failover routing policy, and attach health checks to both records.. B is correct because the failover routing policy in Route 53 is specifically designed for active-passive failover. By creating a primary alias record and a secondary failover alias record, each with an associated health check, Route 53 will automatically route traffic to the secondary region when the health check for the primary fails. This directly implements the required behavior without relying on latency or geographic proximity.

Answer

Create two latency-based alias records for the same name, each with different health checks; Route 53 will automatically shift to the secondary when primary is unhealthy.

Answer

Use geolocation routing with a health check; when the primary is unhealthy, Route 53 will automatically change the region mapping globally.

Answer

Use simple routing with weighted records and a low health check threshold so traffic quickly moves to the secondary region.

Question 7

An orders service publishes payment instructions to an Amazon SQS Standard queue. A downstream consumer sometimes times out and retries the work, causing the consumer to process the same instruction more than once. Operationally, the team must ensure that duplicate processing does not create duplicate charges. The queue type cannot be changed. What is the most resilient application-side approach?

Accepted Answer

Implement idempotent processing using a persistent deduplication key (for example, paymentInstructionId) so repeated messages are ignored or safely merged.. Implementing idempotent processing with a persistent deduplication key (e.g., paymentInstructionId) ensures that even if SQS Standard delivers the same message multiple times due to consumer timeouts and retries, the downstream logic will detect and ignore or safely merge duplicate charges. This is the most resilient application-side approach as it does not rely on queue configuration changes and works within the constraints of SQS Standard's at-least-once delivery model.

Answer

Rely on SQS Standard to provide exactly-once delivery for each message, since the consumer uses retries.

Answer

Increase the queue’s visibility timeout to 24 hours so messages never reappear even if the consumer times out.

Answer

Delete and recreate the queue with a different name whenever duplicates are detected in production.

Question 8

A service consumes messages from an SQS queue. Recently, a new message format started failing validation in the consumer. The consumer catches the exception but cannot successfully process those messages without code changes. The team wants failed messages to be isolated for later investigation instead of being retried indefinitely. What should they configure?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and set maxReceiveCount so messages move after repeated failed receives.. A dead-letter queue (DLQ) with a redrive policy is the correct solution because it allows messages that repeatedly fail processing to be moved to a separate queue after exceeding the maxReceiveCount. This isolates problematic messages for later investigation without blocking the main queue or causing infinite retries. The consumer catches the exception, so the message is not deleted and is returned to the queue for redelivery; the DLQ ensures that after a configurable number of attempts, the message is redirected instead of being retried indefinitely.

Answer

Set the queue’s retention period to 1 minute and rely on messages expiring naturally.

Answer

Increase the visibility timeout to 7 days so failed messages cannot be retried.

Answer

Publish the same message again to SNS on every failure so a different subscriber might succeed.

Question 9

A web application runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG uses the ALB target group health checks to decide when instances are healthy (for example, by using the ELB/target-group health check integration). During a deployment, the ASG performs instance replacement. Shortly after the deployment starts and while new instances are still bootstrapping, CloudWatch shows the ALB target group briefly has zero healthy targets, and users intermittently receive 502 responses. Which ASG deployment configuration best reduces the chance that there will be a period with zero healthy ALB targets, while still keeping failover behavior resilient?

Accepted Answer

Use an ASG rolling update approach that launches replacement instances first, ensures the new instances pass the ALB target group health checks, and only then terminates the old instances (for example, by configuring sufficient minimum healthy capacity and waiting on ALB health).. It describes a rolling update strategy that launches new instances first, waits for them to pass ALB target group health checks, and only then terminates old instances. This ensures that at all times during the deployment, there is a sufficient number of healthy instances to serve traffic, preventing the ALB target group from ever having zero healthy targets. The ASG's minimum healthy capacity setting and the wait for ALB health check integration guarantee that failover remains resilient because the old instances continue to handle requests until the new ones are fully ready.

Answer

Set the target group HealthCheckGracePeriod to a very short value so the ALB quickly declares instances healthy or unhealthy.

Answer

Disable ALB target group health checks and route traffic to any registered targets so replacements do not depend on health check status.

Answer

Reduce the ASG desired capacity by one instance during deployments so the replacement happens faster.

Question 10

You host a public API using Amazon API Gateway in two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). You want Route 53 to send client traffic to the secondary region only when the primary API is unhealthy. Which Route 53 setup best meets this requirement?

Accepted Answer

Use Route 53 failover routing with two ALIAS records (same DNS name) pointing to the API Gateway regional endpoints: one record is configured as PRIMARY with an associated health check, and the other is configured as SECONDARY.. Route 53 failover routing is designed for active-passive setups where traffic is sent to a primary resource unless it is unhealthy, in which case traffic is routed to a secondary resource. By creating two ALIAS records with the same DNS name, one marked PRIMARY with an associated health check and the other marked SECONDARY, Route 53 will automatically fail over to the secondary region when the health check for the primary API Gateway endpoint fails. This directly meets the requirement of sending traffic to the secondary region only when the primary API is unhealthy.

Answer

Use latency-based routing with one routing policy per region, and use CloudWatch alarms to update traffic weights between regions.

Answer

Use weighted routing across both regions and rely on Route 53 health checks to automatically set the secondary to 100% weight when the primary fails.

Answer

Use geolocation routing to map some client geographies to the secondary region and the rest to the primary region.

Question 11

An orders service publishes payment instructions to an Amazon SQS Standard queue. A downstream consumer sometimes times out or crashes after it has partially completed processing, causing the same instruction to be processed more than once. You must keep the design resilient without attempting to guarantee exactly-once processing. Which approach best handles duplicates safely?

Accepted Answer

Make the consumer idempotent by deriving a deterministic idempotency key from the payment instruction (for example, the instruction ID), persisting the result of successful processing, and skipping re-processing when that key is already marked successful.. Making the consumer idempotent ensures that even if the same payment instruction is processed multiple times due to timeouts or crashes, the system remains consistent. By deriving a deterministic idempotency key (e.g., the instruction ID) and persisting the result of successful processing, the consumer can skip re-processing when the key is already marked as successful. This approach aligns with the requirement to keep the design resilient without guaranteeing exactly-once processing, as it safely handles duplicates at the application level.

Answer

Set the SQS visibility timeout extremely long so the message cannot be retried even after processing failures.

Answer

Switch to an SQS FIFO queue but remove error handling in the consumer so duplicates never occur.

Answer

Send all failed messages to a DLQ and rely on it to deduplicate messages that were already successfully processed.

Question 12

A company uses Amazon RDS with automated backups enabled (retention period: 7 days). At 10:30 UTC, a bad release corrupts specific rows in a production table. The team detects the issue at 11:10 UTC. They need to revert the database state to what it was from 10:00–10:30 UTC, recover quickly, and minimize risk to the currently running workload. What is the best option?

Accepted Answer

Perform a point-in-time restore to a new DB instance using a timestamp before the corruption (for example, a time within 10:00–10:30 UTC).. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the retention window. By restoring to a timestamp between 10:00 and 10:30 UTC, you recover the database to a state before the corruption occurred, without affecting the current production instance. This minimizes risk to the running workload because the restore creates a new DB instance, leaving the original untouched until you are ready to switch.

Answer

Reboot the DB instance and rely on the corrupted data being overwritten by storage-level changes.

Answer

Restore only the most recent automated backup snapshot, even if it is after the corruption timestamp.

Answer

Create a read replica of the current DB instance and overwrite the corrupted table using SELECT queries from the replica.

Question 13

An internal-facing application is available in two AWS regions (Region 1 and Region 2). Each region has its own Application Load Balancer (ALB) and target group. The company uses an AWS Route 53 private hosted zone to route clients to Region 1 by default, but it must automatically fail over to Region 2 when Region 1’s ALB is unhealthy. Which Route 53 design best meets this requirement?

Accepted Answer

Use failover routing with two alias A records for the same name: one PRIMARY and one SECONDARY, both pointing to each region’s ALB; attach the health check to the PRIMARY record.. Route 53 failover routing with a PRIMARY and SECONDARY alias record allows automatic failover when the health check attached to the PRIMARY record fails. The health check monitors Region 1's ALB, and upon failure, Route 53 returns the SECONDARY record's IP (Region 2's ALB) to clients. This design meets the requirement for automatic failover without manual intervention.

Answer

Use latency-based routing with two alias records; Route 53 will automatically shift traffic away from the unhealthy region.

Answer

Use weighted routing with weights 100/0 and update weights manually after detecting failures.

Answer

Use geolocation routing with a single alias record for Region 1, and enable EDNS Client Subnet to detect unhealthy endpoints.

Question 14

An internal worker consumes messages from an Amazon SQS Standard queue. Recently, some messages fail validation in the worker (for example, missing required fields), causing the worker to crash before it can successfully process those messages. Those messages keep getting retried repeatedly, slowing down processing of valid messages. The team wants a resilient mechanism to quarantine bad messages after a limited number of receive attempts. What should they implement?

Accepted Answer

Configure a redrive policy with a Dead-Letter Queue (DLQ) and set maxReceiveCount so poison messages are moved to the DLQ after repeated failures.. Amazon SQS supports configuring a redrive policy with a Dead-Letter Queue (DLQ) that automatically moves messages after a specified number of receive attempts (maxReceiveCount). This isolates poison messages that fail validation and cause crashes, preventing them from being retried indefinitely and slowing down valid message processing. The worker can then focus on valid messages while the DLQ stores the problematic ones for later analysis or manual intervention.

Answer

Increase the SQS visibility timeout to several hours so the worker does not retry too quickly.

Answer

Switch the queue to an SNS topic and subscribe the worker directly, eliminating message retries.

Answer

Enable KMS encryption with a new CMK to ensure validation errors stop occurring.

Question 15

An orders service publishes payment instructions to an Amazon SQS Standard queue. The downstream processor sometimes times out after it has already applied the payment, but before it can delete the message from the queue. As a result, the same payment instruction can be processed more than once. The team wants the strongest way to prevent duplicate side effects while keeping the system decoupled. What should they implement?

Accepted Answer

Make the downstream processor idempotent by recording processed payment instruction IDs in a durable datastore and ignoring repeats.. Making the downstream processor idempotent ensures that duplicate payment instructions are safely ignored, even if the same message is delivered more than once. This approach provides the strongest guarantee against duplicate side effects without requiring changes to the queue type or increasing visibility timeouts, and it keeps the system fully decoupled.

Answer

Keep the queue as SQS Standard but increase the visibility timeout so duplicates are less likely to reappear during timeouts.

Answer

Change the queue to an SQS FIFO queue and use a stable deduplication ID derived from the payment instruction ID.

Answer

Use an ALB health check to restart the downstream processor when timeouts occur.