SAA-C03 Design Resilient Architectures Practice Test 8 — 15 Questions

Question 1

A transactional application uses Amazon RDS for MySQL in a single Availability Zone. The team wants the database to fail over automatically if the primary DB instance becomes unavailable, and they want the application to recover with minimal code changes. Which two actions should they take? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the database to an RDS Multi-AZ deployment.. RDS Multi-AZ automatically synchronously replicates data to a standby instance in a different Availability Zone. If the primary fails, RDS automatically fails over to the standby, typically within 60–120 seconds, with no manual intervention required. This meets the requirement for automatic failover with minimal code changes.

Answer

Add a read replica and promote it manually during an outage.

Answer

Store the current DB instance IP address in the application configuration file.

Answer

Rely on nightly snapshots because they provide automatic failover to another Availability Zone.

Question 2

A production Amazon RDS database has automated backups enabled. An application mistakenly updates a table and the issue is discovered one hour later. The team needs to restore the database to the exact state it had 45 minutes ago. Which approach best meets the requirement?

Accepted Answer

Perform a point-in-time restore to a timestamp within the automated backup window.. Amazon RDS Point-in-Time Recovery (PITR) allows you to restore a DB instance to any specific second within the automated backup retention period, which includes the transaction logs needed to reconstruct the database state at the desired time. Since the issue is discovered one hour after the mistaken update, PITR can restore the database to exactly 45 minutes ago by replaying binary logs up to that precise timestamp, meeting the requirement without data loss.

Answer

Restore only from the latest daily snapshot, then manually undo the last hour’s changes.

Answer

Increase Multi-AZ to generate a new standby and redirect traffic back to the previous primary state.

Answer

Stop the database and change the application to ignore the table going forward.

Question 3

A company wants a disaster recovery setup for a web application. They want to keep costs low but still recover within a couple of hours after a regional disruption. They are willing to run only minimal infrastructure in the secondary location and scale it up during the outage. Which DR approach best matches this requirement?

Accepted Answer

Pilot light, where the secondary Region keeps minimal core components ready and scales up during failover.. The Pilot light approach is correct because it keeps minimal core components (e.g., a small database, a scaled-down application server) running in the secondary Region, allowing rapid failover by scaling up those resources during an outage. This meets the requirement of low cost during normal operations while achieving recovery within a couple of hours, as the core infrastructure is already provisioned and can be scaled horizontally (e.g., using Auto Scaling groups and pre-configured AMIs) without needing to rebuild from scratch.

Answer

Active-active, where both Regions run full production at all times.

Answer

Cold standby, where no infrastructure is running in the secondary Region until an outage occurs.

Answer

Backups-only, where recovery relies solely on manually restoring snapshots during an outage.

Question 4

A company hosts a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB and the Auto Scaling group are currently deployed in only one Availability Zone (AZ). The business wants the application to keep running if that AZ has an outage. What is the best change?

Accepted Answer

Deploy the ALB and the Auto Scaling group across at least two Availability Zones so healthy targets remain.. Deploying the ALB and Auto Scaling group across at least two Availability Zones (AZs) ensures that if one AZ fails, the ALB can route traffic to healthy EC2 instances in the remaining AZ(s). This is the fundamental AWS best practice for high availability: an ALB is a regional service that requires targets in multiple AZs to survive an AZ outage, and the Auto Scaling group must also span those AZs to maintain capacity. Without multi-AZ deployment, a single AZ failure makes the entire application unavailable regardless of instance health checks.

Answer

Increase the desired capacity in the existing Availability Zone to handle all traffic during an outage.

Answer

Enable longer ALB health check intervals so failing instances are detected more slowly.

Answer

Switch from the ALB to an Internet Gateway so instances can fail over to the public internet.

Question 5

A team runs an Amazon RDS for MySQL database in a single Availability Zone. They want automatic failover with minimal downtime if the primary database instance becomes unavailable. Automated backups are already enabled. Which configuration change best meets the requirement?

Accepted Answer

Enable RDS Multi-AZ so AWS maintains a standby in another Availability Zone for automatic failover.. Enabling Multi-AZ on Amazon RDS for MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, minimizing downtime without manual intervention. This meets the requirement for automatic failover with minimal downtime.

Answer

Keep the deployment as single-AZ, but increase automated backup retention to 35 days.

Answer

Create a read replica in another Availability Zone, but keep Multi-AZ disabled.

Answer

Rely on restoring from the most recent manual snapshot after an outage.

Question 6

An organization hosts the same public API in two AWS Regions. Normal traffic should go to the primary Region. If the primary endpoint becomes unhealthy, Route 53 should automatically route users to the secondary Region. What is the best Route 53 configuration approach?

Accepted Answer

Use Route 53 failover routing with health checks that mark the primary as unhealthy and fail over to the secondary.. Route 53 failover routing is designed for active-passive configurations where traffic is directed to a primary resource unless a health check marks it as unhealthy, at which point all traffic automatically shifts to the secondary resource. This directly matches the requirement of routing normal traffic to the primary Region and failing over to the secondary Region only when the primary endpoint becomes unhealthy.

Answer

Use simple routing with one record that contains both regions as weighted targets.

Answer

Use weighted routing and set the secondary Region weight to 0 until needed.

Answer

Use latency-based routing so requests go to the region with the lowest latency, regardless of health.

Question 7

An orders service currently sends HTTP requests directly to two downstream services (inventory and shipping). During peak load, inventory slows down, causing the orders service to slow as well. The team wants the orders service to remain responsive even when a downstream service is temporarily slow or restarted. Which design change best achieves this resiliency goal?

Accepted Answer

Introduce Amazon SQS as a buffer between orders and downstream services, with consumers processing from the queue.. Introducing Amazon SQS as a buffer decouples the orders service from the downstream inventory and shipping services. The orders service can immediately enqueue messages and respond to the client, while downstream consumers process messages at their own pace. This prevents backpressure from a slow or restarting downstream service from blocking the orders service, achieving the desired resiliency.

Answer

Keep HTTP calls but add longer client timeouts so orders requests wait for slow downstream responses.

Answer

Replace the downstream services with AWS Lambda functions that are invoked synchronously by the orders service.

Answer

Call the downstream services in parallel threads to reduce waiting time during peak load.

Question 8

A payment worker consumes messages from an Amazon SQS queue. Sometimes the worker finishes the payment creation, but a timeout prevents message deletion and the same payment request is delivered again. Which two design changes best reduce the risk of duplicate charges and keep bad messages from looping forever? Select two.

Accepted Answer

Make the payment operation idempotent by storing a unique request identifier before charging.. Making the payment operation idempotent ensures that even if the same message is processed multiple times due to a timeout, the payment is only charged once. This is typically achieved by storing a unique request identifier (e.g., a UUID or idempotency key) in a database or cache before processing; subsequent duplicate requests with the same identifier are detected and ignored, preventing duplicate charges.
Configuring a dead-letter queue (DLQ) with a redrive policy is crucial for handling messages that repeatedly fail processing. If a message exceeds a predefined maxReceiveCount (meaning it has been delivered and not deleted multiple times), it is automatically moved to the DLQ. This prevents 'bad messages' (often called poison pills) from endlessly looping in the main queue, consuming resources, and allows for manual inspection and debugging of these problematic messages.

Answer

Reduce the visibility timeout so retries happen sooner after each timeout.

Answer

Move the queue to Amazon SNS so each message is delivered only once.

Answer

Increase the message retention period so failed payments stay available longer.

Question 9

An application uses an Amazon RDS Multi-AZ DB instance. During a failover test, connections fail until the application is restarted, even though the database comes back online. Which two changes should the team make to improve resilience during failover? Select two.

Accepted Answer

Use the RDS endpoint name instead of hard-coding the current instance IP or hostname in the application.. The RDS endpoint is a DNS name that automatically resolves to the current writer instance's IP address. During a failover, the DNS record is updated to point to the new primary, so using the endpoint instead of a hard-coded IP or hostname allows the application to reconnect without manual intervention. Option D is correct because adding retry logic with exponential backoff handles transient failures during DNS resolution and connection establishment, which are common during the brief period when the DNS TTL has not yet expired after a failover.

Answer

Cache and reconnect to the current writer IP address to avoid DNS lookups during failover.

Answer

Switch to a read replica and let it promote manually after every outage.

Answer

Disable connection pooling so each request opens a fresh socket during normal operation.

Question 10

An internal API is deployed in two AWS Regions behind separate Application Load Balancers. The company wants clients to use the primary Region when it is healthy and automatically switch to the secondary Region if the primary health check fails. Which two Route 53 record configurations are required? Select two.

Accepted Answer

Create a primary failover record that points to the primary ALB and associates a Route 53 health check.. A primary failover record in Amazon Route 53 directs traffic to the primary ALB and is associated with a Route 53 health check. If the health check fails, Route 53 automatically fails over to the secondary failover record, ensuring high availability across Regions.

Answer

Create a weighted record set that sends 50 percent of traffic to each Region.

Answer

Create a latency-based record set so Route 53 always prefers the fastest Region.

Answer

Create a multivalue answer record to return both ALB addresses on each lookup.

Question 11

A production Amazon Aurora MySQL database is corrupted by a bad migration at 10:30 UTC, and the problem is discovered at 10:45 UTC. The team wants to recover to the state just before the migration with minimal manual effort. Which two actions should they take? Select two.

Accepted Answer

Perform a point-in-time restore to a new DB cluster or instance using automated backups.. Amazon Aurora supports point-in-time recovery (PITR) to any point within the backup retention window, allowing you to restore the database to a state just before the migration (e.g., 10:29 UTC). This uses automated backups and requires minimal manual effort, as you simply specify the target time and a new DB cluster is created.

Answer

Restore only the affected table from the latest snapshot and keep the current cluster online.

Answer

Reboot the writer so Aurora automatically rolls back the bad migration.

Answer

Promote a read replica from the same cluster without restoring from backup.

Question 12

An order service must notify inventory, shipping, and analytics independently when payment succeeds. The shipping service may be slow, but the order service should keep accepting new orders even if one consumer is unavailable. Which two changes best improve resilience? Select two.

Accepted Answer

Publish the event to an Amazon SNS topic and subscribe a separate SQS queue for each downstream service.. Publishing the event to an SNS topic allows the order service to emit a single notification that is then fanned out to multiple SQS queues, one per downstream service. This decouples the order service from the consumers, so even if the shipping service is slow or unavailable, the order service can continue accepting new orders without blocking. Each SQS queue provides independent buffering and retry logic, ensuring resilience against individual consumer failures.

Answer

Have the order service call all downstream services synchronously so failures are visible immediately.

Answer

Use one shared SQS queue for all three consumers so they always process the same message.

Answer

Store the event in a relational database and poll it from every consumer on a fixed schedule.

Question 13

Based on the exhibit, the team wants to stop poison messages from consuming worker capacity and also prevent duplicate side effects if the same message is delivered more than once. Which design change best meets the requirement?

Accepted Answer

Configure a dead-letter queue and make the handler idempotent by storing a durable processed-message key.. A dead-letter queue isolates poison messages that repeatedly fail processing, preventing them from consuming worker capacity. Making the handler idempotent by storing a durable processed-message key (e.g., using DynamoDB or a database) ensures that even if the same message is delivered more than once, duplicate side effects are avoided. This combination directly addresses both requirements: stopping poison messages from wasting resources and preventing duplicate processing.

Answer

Increase the SQS queue batch size so each worker processes more messages per request.

Answer

Replace SQS with Amazon SNS and let each worker subscribe directly to the topic.

Answer

Disable retries and shorten the visibility timeout so failed messages disappear sooner.

Question 14

Based on the exhibit, a faulty deployment corrupted production data at 10:30 UTC and the issue was discovered at 10:55 UTC. The team needs to recover the database to the last good state before the corruption. Which action should they take?

Accepted Answer

Use point-in-time restore to create a new database instance at 10:29 UTC, then switch the application to it.. Amazon RDS for MySQL (and other engines) supports point-in-time recovery (PITR), which allows you to restore a database to any second within the backup retention period, up to the last five minutes. By restoring to 10:29 UTC (one minute before the corruption at 10:30 UTC), the team can recover the database to its last good state with minimal data loss. After restoring, the application can be pointed to the new instance, avoiding the corrupted data.

Answer

Restore the latest manual snapshot and accept data loss since the snapshot was taken overnight.

Answer

Restart the database instance so the transaction log replays the failed migration cleanly.

Answer

Create a read replica and promote it, because replicas always contain the previous transaction state.

Question 15

Based on the exhibit, the application team wants the database to keep the same connection endpoint during failover and to reconnect automatically after the primary instance becomes unavailable. Which change best meets the requirement?

Accepted Answer

Replace the IP address with the RDS DNS endpoint and add client retry logic that re-resolves DNS after connection loss.. Using the RDS DNS endpoint ensures that the application connects to the current primary instance, even after a failover. When the primary becomes unavailable, RDS promotes a standby (or read replica) to a new primary and updates the DNS record to point to the new instance's IP. By adding client retry logic that re-resolves DNS after a connection loss, the application automatically picks up the new IP and reconnects without manual intervention, meeting both requirements of a stable endpoint and automatic reconnection.

Answer

Keep the IP address and increase the JDBC connection timeout so the application waits longer during failover.

Answer

Create an additional read replica and point the application to it so failover is faster.

Answer

Place a Network Load Balancer in front of the database and use the load balancer target IP to avoid DNS changes.