SAA-C03 Design Resilient Architectures Practice Test 7 — 15 Questions

Question 1

A service processes messages from an Amazon SQS queue. Sometimes the worker finishes the business logic but does not delete the message before the visibility timeout expires, so the message is delivered again. Which two changes improve resilience and reduce the impact of duplicate processing? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Make the message handler idempotent.. Making the message handler idempotent ensures that even if a message is processed multiple times (due to visibility timeout expiry), the business outcome remains the same. Idempotency is a key design pattern for resilient architectures when using at-least-once delivery systems like SQS. Option B is correct because setting the visibility timeout long enough for normal processing prevents premature redelivery, reducing the chance of duplicate processing in the first place.

Answer

Switch from SQS to Amazon SNS for reliable buffering.

Answer

Shorten the queue retention period so messages expire quickly.

Answer

Disable retries in the consumer application.

Question 2

A batch processing job can be interrupted and restarted from checkpoints. The business wants to lower compute cost while still keeping the workload resilient to interruptions. Which two choices are best? Select two.

Accepted Answer

Run the workload on Amazon EC2 Spot Instances.. Amazon EC2 Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, stateless batch processing jobs that can be interrupted and restarted from checkpoints. The workload's ability to resume from checkpoints makes it resilient to Spot Instance interruptions, aligning perfectly with the business goal of lowering compute costs while maintaining resilience.

Answer

Use a single On-Demand instance in one Availability Zone only.

Answer

Disable automatic replacement so the job is never restarted.

Answer

Keep all intermediate state only in instance memory.

Question 3

A production application uses an Amazon RDS Multi-AZ DB instance. During an unplanned failover, the database endpoint remains the same. What change should the application team make to handle the failover reliably?

Accepted Answer

Keep using the same RDS endpoint and implement connection retry logic on failures.. The RDS Multi-AZ DNS endpoint remains unchanged during a failover, automatically pointing to the new writer instance. Implementing connection retry logic with exponential backoff allows the application to handle the brief DNS propagation delay and connection interruption, ensuring reliable recovery without manual intervention.

Answer

Hard-code the new writer instance IP address after failover completes.

Answer

Disable Multi-AZ and rely on manual intervention to switch endpoints.

Answer

Move reads to application-side caching only, and avoid reopening DB connections.

Question 4

Your web tier runs on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). You currently deploy both the ALB and the Auto Scaling group in only two Availability Zones (AZs). One AZ fails. What is the best configuration change to improve resilience?

Accepted Answer

Add a third Availability Zone so the ALB and Auto Scaling group span at least three AZs.. Adding a third Availability Zone (AZ) ensures that the Application Load Balancer (ALB) and Auto Scaling group (ASG) can continue to route traffic and maintain capacity even if one AZ fails. With only two AZs, a single AZ failure reduces the fleet by 50% and may cause the ALB to lose the minimum healthy hosts required to serve traffic. Spreading across three AZs provides a higher resilience margin, as the remaining two AZs can absorb the load while the failed AZ recovers.

Answer

Reduce health check timeouts so instances are replaced sooner in the failed AZ.

Answer

Enable instance scale-in protection to stop the ASG from terminating unhealthy instances.

Answer

Switch the ALB to an internal Network Load Balancer (NLB) to avoid cross-AZ traffic.

Question 5

An internal API is hosted in two AWS Regions behind Route 53. Under normal conditions, clients should use the primary region. If the primary endpoint becomes unhealthy, traffic must automatically switch to the secondary region. Which Route 53 setup best meets this requirement?

Accepted Answer

Use failover routing policy: create two alias records for the same name (primary and failover) and associate health checks with the primary record.. Route 53 failover routing policy is designed for active-passive failover scenarios. By creating two alias records (primary and secondary) for the same DNS name and associating a health check with the primary record, Route 53 automatically directs traffic to the secondary region if the primary health check fails. This meets the requirement of automatic failover without manual intervention.

Answer

Use latency-based routing with one record per region and no health checks.

Answer

Use weighted routing and manually change the weights during incidents.

Answer

Create a single alias record only for the primary region and rely on client-side DNS retries.

Question 6

An order-processing system publishes an event whenever a payment succeeds. Three downstream services (inventory, shipping, and analytics) must react independently. Analytics sometimes has high latency, but order processing must not be blocked. What is the best AWS approach to decouple these consumers?

Accepted Answer

Publish payment events to SNS (or EventBridge) and let each downstream service consume independently (for example, via SQS queues or other async targets).. Amazon SNS (or EventBridge) enables asynchronous, fan-out messaging where a single payment-success event is published once and delivered independently to multiple downstream services (inventory, shipping, analytics) via SQS queues or other targets. This decouples the producer from consumer latency—analytics can take its time without blocking order processing—and ensures each consumer processes the event at its own pace, meeting the requirement for independent, non-blocking reactions.

Answer

Have order processing call each service synchronously via HTTPS and retry on failures.

Answer

Store events in a single relational database table and let consumers poll continuously for new rows.

Answer

Send events directly from the producer to each consumer EC2 instance using SSH tunnels.

Question 7

A consumer application reads from an Amazon SQS queue. Some messages have an invalid format and always fail processing. They are retried repeatedly and consume consumer capacity. What is the best way to prevent these "poison pill" messages from blocking normal processing?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount.. A dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount allows messages that repeatedly fail processing to be moved to a separate queue after a specified number of receive attempts. This prevents poison pill messages from being retried indefinitely, freeing consumer capacity for valid messages. Amazon SQS automatically redirects messages to the DLQ once the maxReceiveCount threshold is exceeded, ensuring normal processing is not blocked.

Answer

Enable long polling and increase the maximum message retention to 30 days.

Answer

Switch the queue to FIFO and disable retries in the consumer code.

Answer

Delete the main queue and recreate it after every failure.

Question 8

An event consumer sometimes processes the same SQS message more than once due to timeouts and retries. The consumer must ensure the payment is not charged twice. What design choice best addresses this requirement?

Accepted Answer

Make the payment operation idempotent by using an idempotency key and skipping side effects when the key indicates the payment already succeeded.. Making the payment operation idempotent using an idempotency key ensures that even if the same SQS message is processed multiple times due to timeouts and retries, the payment will only be charged once. The consumer checks the idempotency key before executing the payment; if the key indicates the payment already succeeded, the consumer skips the side effect. This pattern directly addresses the requirement of not charging twice without relying on SQS's at-least-once delivery guarantee.

Answer

Assume messages are processed exactly once because SQS uses durable storage.

Answer

Increase the consumer visibility timeout to several days so messages are not redelivered.

Answer

Delete the message immediately even if processing fails validation.

Question 9

A company needs an Amazon RDS database that automatically fails over to a standby when the primary DB instance becomes unavailable. Which approach best meets the requirement with minimal operational effort?

Accepted Answer

Deploy the DB as a Multi-AZ DB instance so AWS maintains a synchronous standby in another Availability Zone and performs automated failover.. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone. When the primary DB instance fails, AWS handles the automatic failover to the standby with zero manual intervention, meeting the requirement with minimal operational effort.

Answer

Keep the DB as a single-AZ instance and implement a manual process to promote a standby when needed.

Answer

Enable versioned backups only, and restore the database each time the primary instance becomes unavailable.

Answer

Replicate the database to another region and switch clients to the secondary region using manual DNS changes.

Question 10

An internal service is hosted behind an Application Load Balancer (ALB) with targets spread across two Availability Zones. If the targets in one Availability Zone become unhealthy, the service must continue serving traffic from the healthy AZ. What change most directly improves resilience at the load-balancing layer?

Accepted Answer

Configure target group health checks so the ALB stops sending traffic to unhealthy targets and continues routing to healthy targets in the other Availability Zone.. Configuring target group health checks allows the ALB to automatically detect unhealthy targets and stop sending traffic to them, while continuing to route requests to healthy targets in the other Availability Zone. This directly improves resilience at the load-balancing layer by ensuring traffic is only forwarded to healthy instances, maintaining service availability even when an entire AZ fails.

Answer

Turn off health checks and rely only on instance CPU utilization to route traffic.

Answer

Configure ALB listener rules to route all traffic to a single target group in one Availability Zone.

Answer

Store requests in an SQS queue before routing them to the ALB.

Question 11

A worker consumes messages from an Amazon SQS queue. Some messages consistently fail validation and are retried until the worker can no longer process them. What is the most appropriate AWS mechanism to handle these poison messages while keeping the queue usable?

Accepted Answer

Send failing messages to an SQS dead-letter queue (DLQ) using a redrive policy based on receive count.. An SQS dead-letter queue (DLQ) with a redrive policy based on receive count allows messages that repeatedly fail processing (poison pills) to be moved out of the main queue after a specified number of retries. This keeps the main queue operational for valid messages and isolates problematic messages for later analysis or manual intervention.

Answer

Enable SQS long polling and increase the maximum message size for the queue.

Answer

Change the queue to a FIFO queue and handle duplicates in the worker code without DLQs.

Answer

Delete the queue and recreate it hourly to clear out any problematic messages.

Question 12

A production Amazon RDS database has automated backups enabled. At 10:45 UTC, an issue is discovered. The team needs to restore the database to its state as of 10:30 UTC. Which capability should they use?

Accepted Answer

Point-in-time restore (PITR) using automated backups to a specific timestamp.. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the backup retention period, restoring to a new DB instance. Since the issue was discovered at 10:45 UTC and the desired recovery point is 10:30 UTC, PITR can restore the database to that exact timestamp, provided it falls within the automated backup window and retention period.

Answer

Perform a Multi-AZ manual failover of the standby to recover to the earlier timestamp.

Answer

Promote a cross-region replication target to replace the current database with the last-known good copy.

Answer

Switch to a read replica to access an older view of data without restoring.

Question 13

A system processes events from Amazon SQS and sometimes sees duplicate messages due to retries. The business requirement is that each payment must be charged at most once. What design choice best addresses this resiliency requirement?

Accepted Answer

Implement idempotent processing using a deduplication key (for example, paymentId) and record completed charges so duplicates are safely ignored.. Implementing idempotent processing with a deduplication key (e.g., paymentId) ensures that even if duplicate messages arrive from SQS (due to retries or at-least-once delivery), the consumer can check a record of completed charges and safely ignore duplicates. This satisfies the business requirement of charging each payment at most once without relying on SQS’s best-effort deduplication or message ordering.

Answer

Assume duplicates never occur because the consumer deletes messages immediately after receiving them.

Answer

Increase the SQS visibility timeout until duplicates never happen.

Answer

Use SNS topics instead of SQS so retries are disabled by default.

Question 14

A company wants a disaster recovery setup for a web application. They need relatively quick recovery, but they can't afford running full production in the secondary location at all times. Which option best matches this requirement?

Accepted Answer

Warm standby: run a minimal but functional version of the application and supporting services in the secondary location, and scale up during a failure.. Warm standby (Option B) is correct because it runs a minimal but functional version of the application in the secondary region, allowing for faster recovery than a pilot light while avoiding the cost of full production. During a failure, you scale up the standby environment to handle production traffic, meeting the requirement for relatively quick recovery without the expense of active-active.

Answer

Pilot light: keep only essential infrastructure in the secondary location and scale up the application during a failure.

Answer

Active-active: run full production in both the primary and secondary locations at the same time.

Answer

Backup and restore only: rely on periodic backups and restore the application after a failure.

Question 15

A fintech company needs a disaster recovery design for a web application in two Regions. The business requires an RPO of 15 minutes and an RTO under 2 hours, but it cannot afford to keep a full production stack running in both Regions all the time. Which two DR strategies best fit the requirement? Select two.

Accepted Answer

Pilot light with critical data and minimal services pre-staged in the secondary Region.. A pilot light strategy is correct because it pre-stages only critical data (e.g., database replication) and minimal core services (e.g., a small EC2 instance or RDS standby) in the secondary Region, which can be scaled up to full production within the RTO of under 2 hours. The RPO of 15 minutes is achievable by using synchronous or near-synchronous replication (e.g., Amazon RDS Multi-AZ cross-Region or DynamoDB global tables) to keep data loss minimal. This approach avoids the cost of a full production stack while meeting the recovery objectives.

Answer

Active-active deployment with full production capacity in both Regions.

Answer

Backup-and-restore only, with no pre-provisioned resources in the secondary Region.

Answer

Single-Region deployment with Multi-AZ only, because that already covers disaster recovery.