SAA-C03 Design Resilient Architectures Practice Test 6 — 15 Questions

Question 1

Your company hosts an internal API in two AWS Regions. You want Amazon Route 53 to automatically send traffic to the secondary Region if the primary Region’s endpoint becomes unhealthy. Which Route 53 configuration best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Failover routing with a primary record associated with a health check, and a secondary (failover) record associated with its own health check settings.. Failover routing in Route 53 is specifically designed for active-passive configurations where traffic is directed to a primary resource unless a health check indicates it is unhealthy, at which point traffic is automatically routed to the secondary (failover) record. By associating a health check with the primary record, Route 53 can monitor the endpoint's health and perform the failover seamlessly. This directly meets the requirement to send traffic to the secondary Region when the primary endpoint becomes unhealthy.

Answer

Latency-based routing with health checks for both Regions.

Answer

Weighted routing to distribute traffic evenly across both Regions.

Answer

Geolocation routing based on the client’s country to choose a Region.

Question 2

An internal worker consumes messages from an Amazon SQS queue. Occasionally, a message fails validation in the worker (for example, missing required fields). Reprocessing the same bad message repeatedly wastes processing time and delays healthy messages. What is the best AWS approach to handle these poison messages without blocking the rest of the queue?

Accepted Answer

Configure an SQS dead-letter queue (DLQ) using a redrive policy with a maxReceiveCount.. An SQS dead-letter queue (DLQ) with a redrive policy that sets a maxReceiveCount allows the worker to process a message up to a specified number of times. After that threshold is exceeded, the message is automatically moved to the DLQ, isolating the poison message and preventing it from blocking or delaying the processing of healthy messages in the main queue.

Answer

Delete the SQS queue and recreate it daily to clear invalid messages.

Answer

Increase the consumer timeout/processing time so validation failures take longer to occur.

Answer

Use SNS fan-out without any DLQ and rely only on application retries.

Question 3

A team needs a relational database solution that can automatically fail over to a standby instance if the primary database becomes unavailable. They want the standby to be located in a different Availability Zone. Which RDS/Aurora configuration best satisfies this requirement?

Accepted Answer

Multi-AZ deployment with an automatically managed standby in a different Availability Zone and automatic failover.. A Multi-AZ RDS deployment automatically provisions and maintains a standby instance in a different Availability Zone, and the failover is handled automatically by AWS without manual intervention. This meets the requirement for automatic failover to a standby in a different AZ, which is the core purpose of Multi-AZ deployments.

Answer

Single-AZ DB deployment and rely on manual snapshot restore during failures.

Answer

Enable read replicas only, and promote a replica manually when the primary fails.

Answer

Enable point-in-time recovery (PITR) without configuring any Multi-AZ standby.

Question 4

A production Amazon RDS database has automated backups enabled with sufficient retention. At 10:30 UTC, a release corrupts specific rows. The issue is detected at 10:45 UTC. The team wants to restore the database state to before the corruption with minimal complexity. What should they do?

Accepted Answer

Perform a point-in-time restore (PITR) to a timestamp just before 10:30 UTC and create a restored DB instance/cluster.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore the database to any second within the backup retention period, using automated backups and transaction logs. By restoring to a timestamp just before 10:30 UTC, you can recover the database to a state before the corruption occurred, creating a new DB instance/cluster with minimal complexity and no data loss from the uncorrupted period.

Answer

Change the VPC route tables so the database restarts in a clean state.

Answer

Relaunch the same DB instance in the same Availability Zone and rely on caching to revert the changes.

Answer

Enable a DLQ on the database to store invalid SQL statements until the system is fixed.

Question 5

An orders service consumes payment instructions from an Amazon SQS queue. Sometimes the consumer times out after applying the payment but before deleting the SQS message. As a result, the same payment instruction is processed again. Which design change most directly prevents duplicate side effects caused by message retries?

Accepted Answer

Implement idempotency by recording a processed marker keyed by the instruction ID and ignoring duplicates.. Implementing idempotency ensures that even if the same payment instruction is processed multiple times due to a timeout and retry, the side effect (e.g., applying the payment) occurs only once. By recording a processed marker keyed by the instruction ID (e.g., using a DynamoDB table or Redis), the consumer can check the marker before processing and ignore duplicates. This directly addresses the root cause—duplicate processing—without altering the queue's retry behavior.

Answer

Delete the SQS message immediately after it is received, before processing, to ensure it is not retried.

Answer

Increase the SQS visibility timeout to a maximum value to avoid retries entirely.

Answer

Convert the queue to FIFO and enable content-based deduplication.

Question 6

A production Amazon RDS database has automated backups enabled. At 10:00 UTC, an application deploy accidentally overwrote a subset of rows due to a faulty migration. The issue is detected at 10:45 UTC. The team confirms that the required retention window is still available. Which approach offers the most resilient and least disruptive way to recover the affected data close to the time of the event?

Accepted Answer

Use point-in-time recovery to restore the database to a timestamp just before 10:00 UTC, then swap application connectivity to the recovered instance.. Point-in-time recovery (PITR) allows you to restore the RDS instance to any second within the backup retention window, such as just before the faulty migration at 10:00 UTC. This restores a complete, consistent database state, minimizing data loss and avoiding manual row-by-row recovery. Swapping application connectivity to the restored instance is the least disruptive approach, as it avoids complex manual data merging and reduces downtime.

Answer

Perform a snapshot restore and attach the restored instance, then manually copy only the affected rows back into the current database.

Answer

Rely on automated backups to roll forward automatically until the data becomes correct.

Answer

Disable automated backups going forward to prevent future corruption, then reindex the corrupted table.

Question 7

An orders system sends payment instructions to an Amazon SQS queue. The consumer sometimes times out after it has already created the payment record but before it deletes the SQS message. As a result, the same instruction can be processed more than once. Which design best ensures the consumer remains resilient and does not create duplicate payments when the same instruction is delivered multiple times?

Accepted Answer

Use idempotency: store a deterministic payment request identifier in a DynamoDB table and only create a payment when a conditional write indicates it was not processed before.. It implements idempotency using a DynamoDB table with a conditional write. By storing a deterministic payment request identifier (e.g., a hash of the message body) and only creating the payment if the conditional write succeeds (i.e., the identifier does not already exist), the consumer can safely process the same SQS message multiple times without creating duplicate payments. This pattern ensures resilience against the at-least-once delivery semantics of SQS and consumer timeouts that prevent message deletion.

Answer

Assume the consumer will always delete the SQS message in the same execution path, and ignore the timeout case.

Answer

Switch to SQS Standard because it provides exactly-once delivery, so duplicates cannot happen.

Answer

Increase the consumer timeout and reduce the number of retries so that duplicates rarely occur.

Question 8

A company runs an Amazon Aurora DB cluster with a Multi-AZ deployment. The application is configured with a hard-coded endpoint that points to the current writer *DB instance* (an instance-specific endpoint), rather than the Aurora cluster writer endpoint. During an unexpected AZ failure, Aurora promotes the standby to become the new writer. However, the application continues to fail to connect until an operator updates the hard-coded endpoint. What change most directly improves resiliency so the application automatically reconnects after failover?

Accepted Answer

Connect using the Aurora cluster writer endpoint so DNS resolves to the current writer after failover.. The Aurora cluster writer endpoint is a DNS name that always resolves to the current writer instance in the cluster, even after a failover. By using this endpoint instead of a hard-coded instance-specific endpoint, the application automatically reconnects to the new writer without manual intervention, directly improving resiliency.

Answer

Keep using the writer DB instance endpoint, but increase the client connection timeout.

Answer

Disable Multi-AZ failover and rely on manual snapshot restore to bring the database back online.

Answer

Enable cross-Region read replicas and route application traffic to the replica during the outage.

Question 9

An event-driven order processing service consumes messages from an Amazon SQS Standard queue. After a deployment, about 1% of messages start failing validation because a required field is missing. The consumer catches the exception and returns control, so the messages are retried. However, those poison messages keep reappearing and repeatedly consuming processing time for hours, delaying handling of valid messages. What is the most resilient way to handle the poison messages while keeping the system available?

Accepted Answer

Configure an SQS redrive policy to send messages to a dead-letter queue (DLQ) after a limited number of receives (maxReceiveCount).. Configuring an SQS redrive policy with a maxReceiveCount (e.g., 3–5) automatically moves messages that repeatedly fail processing to a dead-letter queue (DLQ) after the specified number of receives. This isolates the poison messages, preventing them from consuming visibility timeout and processing resources, while allowing valid messages to be handled without delay. The DLQ can then be analyzed or reprocessed offline, maintaining system availability.

Answer

Set the consumer visibility timeout to a very large value so failing messages are hidden for hours.

Answer

Switch the SQS queue from Standard to FIFO so poison messages do not retry.

Answer

Increase the consumer concurrency indefinitely so the system processes all messages even if some fail validation.

Question 10

A company hosts an internal API behind an Application Load Balancer (ALB) in two AWS Regions. They want Amazon Route 53 to automatically fail over to the secondary Region when the primary Region’s ALB is unhealthy. Health checks for the primary ALB are already configured, but the DNS record currently uses a latency-based routing policy. Which Route 53 configuration most directly provides automatic failover based on health status?

Accepted Answer

Use a Route 53 failover routing policy: configure two alias records for the ALBs where the primary record is marked PRIMARY, the secondary is marked SECONDARY, and each record has an associated health check.. Route 53 failover routing policy is specifically designed to automatically route traffic away from an unhealthy resource to a healthy one. By creating two alias records (one PRIMARY with an associated health check for the primary ALB, and one SECONDARY for the secondary ALB), Route 53 will automatically fail over to the secondary record when the primary health check fails. This directly meets the requirement for automatic failover based on health status, unlike latency-based routing which only optimizes for response time.

Answer

Keep latency-based routing, and set the weights so the secondary Region rarely receives traffic unless manual changes are made.

Answer

Use an alias A record that returns both ALBs simultaneously so clients automatically load balance across Regions during outages.

Answer

Use geolocation routing to route users to the primary Region and rely on ALB health checks to shift requests between Regions.

Question 11

A web application runs on an EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG spans three Availability Zones. After a deployment, new instances frequently fail the ALB target group health checks with HTTP 5xx responses and are quickly terminated by the ASG. What change most improves resiliency during deployments with minimal downtime by preventing premature removal of instances that are still starting?

Accepted Answer

Use a longer ASG health check grace period and deploy new instances using controlled replacement (for example, rolling instance refresh) so existing healthy instances continue serving while new ones warm up.. Increasing the ASG health check grace period gives new instances more time to complete their startup and pass the ALB health checks before the ASG marks them unhealthy. A rolling instance refresh replaces instances in a controlled manner, ensuring that existing healthy instances continue serving traffic while new instances warm up, minimizing downtime and preventing premature termination.

Answer

Reduce the ASG health check grace period to 0 seconds so issues are detected faster.

Answer

Restrict the ASG to a single Availability Zone so health check evaluation is simpler.

Answer

Disable ALB health checks so the ASG does not terminate instances on HTTP 5xx responses.

Question 12

A fintech company has a two-Region DR requirement: RPO must be within 15 minutes and RTO must be under 2 hours. To control cost, they do not want to run full production infrastructure in the secondary Region continuously. They plan to continuously replicate the database and keep the application infrastructure in the secondary Region prepared, but at reduced capacity. Which DR strategy best matches this requirement and accurately describes their plan?

Accepted Answer

Warm standby: keep the essential parts of the application running in the secondary Region at reduced capacity, while using database replication to meet the RPO.. Warm standby is the correct strategy because it runs a scaled-down version of the production application in the secondary Region continuously, with database replication (e.g., Amazon RDS Multi-Region or Aurora Global Database) meeting the 15-minute RPO. The reduced-capacity infrastructure can be scaled up within the 2-hour RTO during a disaster, balancing cost and recovery requirements.

Answer

Pilot light: keep only minimal components (for example, replicated storage and a small amount of core services), so the app scales up during a disaster.

Answer

Active-active: run the application fully in both Regions with synchronized writes and share traffic continuously.

Answer

Cold standby: store backups in the secondary Region and provision all infrastructure only during a disaster.

Question 13

A web application runs on an Auto Scaling group behind an Application Load Balancer. The business wants the service to keep running if one Availability Zone goes down. Which two changes should you make? Select two.

Accepted Answer

Place the Auto Scaling group in subnets across at least two Availability Zones.. Placing the Auto Scaling group in subnets across at least two Availability Zones ensures that if one AZ fails, the Auto Scaling group can still launch instances in the remaining healthy AZ(s). This is a fundamental pattern for high availability, as the Auto Scaling group distributes instances across the specified subnets, and if an entire AZ becomes unavailable, instances in other AZs continue to serve traffic.

Answer

Increase the instance size so each server can handle more traffic alone.

Answer

Disable ALB health checks so instances stay registered longer.

Answer

Run the whole stack in one Availability Zone for simpler networking.

Question 14

A production Amazon RDS database must continue serving the application if the primary DB instance fails. The application should reconnect automatically without hard-coding a new IP address. Which two actions should you take? Select two.

Accepted Answer

Create an RDS Multi-AZ deployment for the database.. A is correct because an RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention. This ensures high availability and continuity for the production database.

Answer

Disable automated backups to reduce the time needed for failover.

Answer

Use a single-AZ deployment so the standby is not split across Zones.

Answer

Replace the database with an Amazon S3 bucket and store rows as objects.

Question 15

A company hosts an internal API in two AWS Regions. Traffic must automatically switch to the secondary Region when the primary Region's endpoint is unhealthy. Which two Route 53 settings are required? Select two.

Accepted Answer

Use a failover routing policy for the DNS record.. A failover routing policy is required because it allows Route 53 to automatically route traffic from a primary resource to a secondary resource when the primary is unhealthy. This is the only routing policy that supports active-passive failover across two AWS Regions. Without this policy, Route 53 would not know which endpoint to consider primary or how to switch traffic upon failure.

Answer

Use geolocation routing so users are always sent to the closest Region.

Answer

Use a private hosted zone to expose the API to the internet.

Answer

Set the TTL to zero and skip health checks to make failover faster.