SAA-C03 Design Resilient Architectures Practice Test 8 — 15 Questions

Question 1

A company uses Amazon RDS with automated backups enabled (retention period: 7 days). At 10:30 UTC, a bad release corrupts specific rows in a production table. The team detects the issue at 11:10 UTC. They need to revert the database state to what it was from 10:00–10:30 UTC, recover quickly, and minimize risk to the currently running workload. What is the best option?

Accepted Answer

Perform a point-in-time restore to a new DB instance using a timestamp before the corruption (for example, a time within 10:00–10:30 UTC).. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the retention window. By restoring to a timestamp between 10:00 and 10:30 UTC, you recover the database to a state before the corruption occurred, without affecting the current production instance. This minimizes risk to the running workload because the restore creates a new DB instance, leaving the original untouched until you are ready to switch.

Answer

Reboot the DB instance and rely on the corrupted data being overwritten by storage-level changes.

Answer

Restore only the most recent automated backup snapshot, even if it is after the corruption timestamp.

Answer

Create a read replica of the current DB instance and overwrite the corrupted table using SELECT queries from the replica.

Question 2

An internal-facing application is available in two AWS regions (Region 1 and Region 2). Each region has its own Application Load Balancer (ALB) and target group. The company uses an AWS Route 53 private hosted zone to route clients to Region 1 by default, but it must automatically fail over to Region 2 when Region 1’s ALB is unhealthy. Which Route 53 design best meets this requirement?

Accepted Answer

Use failover routing with two alias A records for the same name: one PRIMARY and one SECONDARY, both pointing to each region’s ALB; attach the health check to the PRIMARY record.. Option C is correct because Route 53 failover routing with a PRIMARY and SECONDARY alias record allows automatic failover when the health check attached to the PRIMARY record fails. The health check monitors Region 1's ALB, and upon failure, Route 53 returns the SECONDARY record's IP (Region 2's ALB) to clients. This design meets the requirement for automatic failover without manual intervention.

Answer

Use latency-based routing with two alias records; Route 53 will automatically shift traffic away from the unhealthy region.

Answer

Use weighted routing with weights 100/0 and update weights manually after detecting failures.

Answer

Use geolocation routing with a single alias record for Region 1, and enable EDNS Client Subnet to detect unhealthy endpoints.

Question 3

An internal worker consumes messages from an Amazon SQS Standard queue. Recently, some messages fail validation in the worker (for example, missing required fields), causing the worker to crash before it can successfully process those messages. Those messages keep getting retried repeatedly, slowing down processing of valid messages. The team wants a resilient mechanism to quarantine bad messages after a limited number of receive attempts. What should they implement?

Accepted Answer

Configure a redrive policy with a Dead-Letter Queue (DLQ) and set maxReceiveCount so poison messages are moved to the DLQ after repeated failures.. Option B is correct because Amazon SQS supports configuring a redrive policy with a Dead-Letter Queue (DLQ) that automatically moves messages after a specified number of receive attempts (maxReceiveCount). This isolates poison messages that fail validation and cause crashes, preventing them from being retried indefinitely and slowing down valid message processing. The worker can then focus on valid messages while the DLQ stores the problematic ones for later analysis or manual intervention.

Answer

Increase the SQS visibility timeout to several hours so the worker does not retry too quickly.

Answer

Switch the queue to an SNS topic and subscribe the worker directly, eliminating message retries.

Answer

Enable KMS encryption with a new CMK to ensure validation errors stop occurring.

Question 4

An orders service publishes payment instructions to an Amazon SQS Standard queue. The downstream processor sometimes times out after it has already applied the payment, but before it can delete the message from the queue. As a result, the same payment instruction can be processed more than once. The team wants the strongest way to prevent duplicate side effects while keeping the system decoupled. What should they implement?

Accepted Answer

Make the downstream processor idempotent by recording processed payment instruction IDs in a durable datastore and ignoring repeats.. Option C is correct because making the downstream processor idempotent ensures that duplicate payment instructions are safely ignored, even if the same message is delivered more than once. This approach provides the strongest guarantee against duplicate side effects without requiring changes to the queue type or increasing visibility timeouts, and it keeps the system fully decoupled.

Answer

Keep the queue as SQS Standard but increase the visibility timeout so duplicates are less likely to reappear during timeouts.

Answer

Change the queue to an SQS FIFO queue and use a stable deduplication ID derived from the payment instruction ID.

Answer

Use an ALB health check to restart the downstream processor when timeouts occur.

Question 5

A web application runs on an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ALB is configured to use at least two Availability Zones (AZs), but the ASG currently uses subnets in only one AZ. If that AZ becomes unavailable, the application stops serving requests. Which change most directly improves resilience to an AZ outage?

Accepted Answer

Place the ASG across multiple Availability Zones by configuring it with subnets in at least two AZs.. Option B is correct because distributing an Auto Scaling group across multiple Availability Zones (AZs) ensures that if one AZ fails, the remaining AZs continue to serve traffic. The Application Load Balancer (ALB) is already configured for at least two AZs, but the ASG’s single-AZ subnet placement creates a single point of failure. By adding subnets in at least two AZs to the ASG, the application becomes resilient to an AZ outage without any other architectural changes.

Answer

Keep the ASG in one Availability Zone, but reduce ALB health check intervals.

Answer

Switch the load balancer from an ALB to an NLB to remove HTTP health check dependency.

Answer

Add an Amazon SQS queue to buffer requests during failures.

Question 6

Your company hosts an internal API in two AWS Regions. You want Amazon Route 53 to automatically send traffic to the secondary Region if the primary Region’s endpoint becomes unhealthy. Which Route 53 configuration best meets this requirement?

Accepted Answer

Failover routing with a primary record associated with a health check, and a secondary (failover) record associated with its own health check settings.. Failover routing in Route 53 is specifically designed for active-passive configurations where traffic is directed to a primary resource unless a health check indicates it is unhealthy, at which point traffic is automatically routed to the secondary (failover) record. By associating a health check with the primary record, Route 53 can monitor the endpoint's health and perform the failover seamlessly. This directly meets the requirement to send traffic to the secondary Region when the primary endpoint becomes unhealthy.

Answer

Latency-based routing with health checks for both Regions.

Answer

Weighted routing to distribute traffic evenly across both Regions.

Answer

Geolocation routing based on the client’s country to choose a Region.

Question 7

An internal worker consumes messages from an Amazon SQS queue. Occasionally, a message fails validation in the worker (for example, missing required fields). Reprocessing the same bad message repeatedly wastes processing time and delays healthy messages. What is the best AWS approach to handle these poison messages without blocking the rest of the queue?

Accepted Answer

Configure an SQS dead-letter queue (DLQ) using a redrive policy with a maxReceiveCount.. Option A is correct because an SQS dead-letter queue (DLQ) with a redrive policy that sets a maxReceiveCount allows the worker to process a message up to a specified number of times. After that threshold is exceeded, the message is automatically moved to the DLQ, isolating the poison message and preventing it from blocking or delaying the processing of healthy messages in the main queue.

Answer

Delete the SQS queue and recreate it daily to clear invalid messages.

Answer

Increase the consumer timeout/processing time so validation failures take longer to occur.

Answer

Use SNS fan-out without any DLQ and rely only on application retries.

Question 8

A team needs a relational database solution that can automatically fail over to a standby instance if the primary database becomes unavailable. They want the standby to be located in a different Availability Zone. Which RDS/Aurora configuration best satisfies this requirement?

Accepted Answer

Multi-AZ deployment with an automatically managed standby in a different Availability Zone and automatic failover.. Option B is correct because a Multi-AZ RDS deployment automatically provisions and maintains a standby instance in a different Availability Zone, and the failover is handled automatically by AWS without manual intervention. This meets the requirement for automatic failover to a standby in a different AZ, which is the core purpose of Multi-AZ deployments.

Answer

Single-AZ DB deployment and rely on manual snapshot restore during failures.

Answer

Enable read replicas only, and promote a replica manually when the primary fails.

Answer

Enable point-in-time recovery (PITR) without configuring any Multi-AZ standby.

Question 9

A production Amazon RDS database has automated backups enabled with sufficient retention. At 10:30 UTC, a release corrupts specific rows. The issue is detected at 10:45 UTC. The team wants to restore the database state to before the corruption with minimal complexity. What should they do?

Accepted Answer

Perform a point-in-time restore (PITR) to a timestamp just before 10:30 UTC and create a restored DB instance/cluster.. Option A is correct because Amazon RDS Point-in-Time Restore (PITR) allows you to restore the database to any second within the backup retention period, using automated backups and transaction logs. By restoring to a timestamp just before 10:30 UTC, you can recover the database to a state before the corruption occurred, creating a new DB instance/cluster with minimal complexity and no data loss from the uncorrupted period.

Answer

Change the VPC route tables so the database restarts in a clean state.

Answer

Relaunch the same DB instance in the same Availability Zone and rely on caching to revert the changes.

Answer

Enable a DLQ on the database to store invalid SQL statements until the system is fixed.

Question 10

An orders service consumes payment instructions from an Amazon SQS queue. Sometimes the consumer times out after applying the payment but before deleting the SQS message. As a result, the same payment instruction is processed again. Which design change most directly prevents duplicate side effects caused by message retries?

Accepted Answer

Implement idempotency by recording a processed marker keyed by the instruction ID and ignoring duplicates.. Option B is correct because implementing idempotency ensures that even if the same payment instruction is processed multiple times due to a timeout and retry, the side effect (e.g., applying the payment) occurs only once. By recording a processed marker keyed by the instruction ID (e.g., using a DynamoDB table or Redis), the consumer can check the marker before processing and ignore duplicates. This directly addresses the root cause—duplicate processing—without altering the queue's retry behavior.

Answer

Delete the SQS message immediately after it is received, before processing, to ensure it is not retried.

Answer

Increase the SQS visibility timeout to a maximum value to avoid retries entirely.

Answer

Convert the queue to FIFO and enable content-based deduplication.

Question 11

A production Amazon RDS database has automated backups enabled. At 10:00 UTC, an application deploy accidentally overwrote a subset of rows due to a faulty migration. The issue is detected at 10:45 UTC. The team confirms that the required retention window is still available. Which approach offers the most resilient and least disruptive way to recover the affected data close to the time of the event?

Accepted Answer

Use point-in-time recovery to restore the database to a timestamp just before 10:00 UTC, then swap application connectivity to the recovered instance.. Option B is correct because point-in-time recovery (PITR) allows you to restore the RDS instance to any second within the backup retention window, such as just before the faulty migration at 10:00 UTC. This restores a complete, consistent database state, minimizing data loss and avoiding manual row-by-row recovery. Swapping application connectivity to the restored instance is the least disruptive approach, as it avoids complex manual data merging and reduces downtime.

Answer

Perform a snapshot restore and attach the restored instance, then manually copy only the affected rows back into the current database.

Answer

Rely on automated backups to roll forward automatically until the data becomes correct.

Answer

Disable automated backups going forward to prevent future corruption, then reindex the corrupted table.

Question 12

An orders system sends payment instructions to an Amazon SQS queue. The consumer sometimes times out after it has already created the payment record but before it deletes the SQS message. As a result, the same instruction can be processed more than once. Which design best ensures the consumer remains resilient and does not create duplicate payments when the same instruction is delivered multiple times?

Accepted Answer

Use idempotency: store a deterministic payment request identifier in a DynamoDB table and only create a payment when a conditional write indicates it was not processed before.. Option B is correct because it implements idempotency using a DynamoDB table with a conditional write. By storing a deterministic payment request identifier (e.g., a hash of the message body) and only creating the payment if the conditional write succeeds (i.e., the identifier does not already exist), the consumer can safely process the same SQS message multiple times without creating duplicate payments. This pattern ensures resilience against the at-least-once delivery semantics of SQS and consumer timeouts that prevent message deletion.

Answer

Assume the consumer will always delete the SQS message in the same execution path, and ignore the timeout case.

Answer

Switch to SQS Standard because it provides exactly-once delivery, so duplicates cannot happen.

Answer

Increase the consumer timeout and reduce the number of retries so that duplicates rarely occur.

Question 13

A company runs an Amazon Aurora DB cluster with a Multi-AZ deployment. The application is configured with a hard-coded endpoint that points to the current writer *DB instance* (an instance-specific endpoint), rather than the Aurora cluster writer endpoint. During an unexpected AZ failure, Aurora promotes the standby to become the new writer. However, the application continues to fail to connect until an operator updates the hard-coded endpoint. What change most directly improves resiliency so the application automatically reconnects after failover?

Accepted Answer

Connect using the Aurora cluster writer endpoint so DNS resolves to the current writer after failover.. Option B is correct because the Aurora cluster writer endpoint is a DNS name that always resolves to the current writer instance in the cluster, even after a failover. By using this endpoint instead of a hard-coded instance-specific endpoint, the application automatically reconnects to the new writer without manual intervention, directly improving resiliency.

Answer

Keep using the writer DB instance endpoint, but increase the client connection timeout.

Answer

Disable Multi-AZ failover and rely on manual snapshot restore to bring the database back online.

Answer

Enable cross-Region read replicas and route application traffic to the replica during the outage.

Question 14

An event-driven order processing service consumes messages from an Amazon SQS Standard queue. After a deployment, about 1% of messages start failing validation because a required field is missing. The consumer catches the exception and returns control, so the messages are retried. However, those poison messages keep reappearing and repeatedly consuming processing time for hours, delaying handling of valid messages. What is the most resilient way to handle the poison messages while keeping the system available?

Accepted Answer

Configure an SQS redrive policy to send messages to a dead-letter queue (DLQ) after a limited number of receives (maxReceiveCount).. Option B is correct because configuring an SQS redrive policy with a maxReceiveCount (e.g., 3–5) automatically moves messages that repeatedly fail processing to a dead-letter queue (DLQ) after the specified number of receives. This isolates the poison messages, preventing them from consuming visibility timeout and processing resources, while allowing valid messages to be handled without delay. The DLQ can then be analyzed or reprocessed offline, maintaining system availability.

Answer

Set the consumer visibility timeout to a very large value so failing messages are hidden for hours.

Answer

Switch the SQS queue from Standard to FIFO so poison messages do not retry.

Answer

Increase the consumer concurrency indefinitely so the system processes all messages even if some fail validation.

Question 15

A company hosts an internal API behind an Application Load Balancer (ALB) in two AWS Regions. They want Amazon Route 53 to automatically fail over to the secondary Region when the primary Region’s ALB is unhealthy. Health checks for the primary ALB are already configured, but the DNS record currently uses a latency-based routing policy. Which Route 53 configuration most directly provides automatic failover based on health status?

Accepted Answer

Use a Route 53 failover routing policy: configure two alias records for the ALBs where the primary record is marked PRIMARY, the secondary is marked SECONDARY, and each record has an associated health check.. Option B is correct because Route 53 failover routing policy is specifically designed to automatically route traffic away from an unhealthy resource to a healthy one. By creating two alias records (one PRIMARY with an associated health check for the primary ALB, and one SECONDARY for the secondary ALB), Route 53 will automatically fail over to the secondary record when the primary health check fails. This directly meets the requirement for automatic failover based on health status, unlike latency-based routing which only optimizes for response time.

Answer

Keep latency-based routing, and set the weights so the secondary Region rarely receives traffic unless manual changes are made.

Answer

Use an alias A record that returns both ALBs simultaneously so clients automatically load balance across Regions during outages.

Answer

Use geolocation routing to route users to the primary Region and rely on ALB health checks to shift requests between Regions.