SAA-C03 Design Resilient Architectures Practice Test 9 — 15 Questions

Question 1

Based on the exhibit, the database is manually promoted during an Availability Zone failure and the application outage lasts longer than the target. What change best improves resilience with the least operational intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the database to an RDS Multi-AZ deployment so a synchronous standby can fail over automatically.. B is correct because RDS Multi-AZ automatically synchronously replicates data to a standby in a different Availability Zone and triggers an automatic failover with zero manual intervention when an AZ failure occurs. This directly addresses the requirement to improve resilience while minimizing operational effort, as the failover is handled by AWS without any runbook execution or manual promotion.

Answer

Keep the read replica and automate promotion with a runbook after CloudWatch alarms fire.

Answer

Use a cross-Region read replica so promotion happens faster during an AZ failure.

Answer

Increase the application retry count and keep the current database design.

Question 2

An application writes to an Amazon Aurora DB cluster. After a planned Aurora failover, the application experiences several minutes of connection errors.

The logs show the application continues connecting to the specific DB instance endpoint that was the primary before the failover.

What change most directly improves resilience during Aurora failovers?

Accepted Answer

Update the application to use the Aurora cluster writer endpoint for write traffic so it always resolves to the current writer instance.. The Aurora cluster writer endpoint always resolves to the current primary DB instance, even after a failover. By using this endpoint instead of a specific instance endpoint, the application automatically reconnects to the new writer without manual intervention or connection errors.

Answer

Increase Aurora storage autoscaling so failovers are unnecessary.

Answer

Point both reads and writes to the Aurora reader endpoint to keep the DNS name the same.

Answer

Disable Aurora failover capability so the cluster never switches writer instances.

Question 3

A service processes customer payments from a message queue. Because the queue provides at-least-once delivery, the same payment message can be delivered more than once if the consumer times out before committing its state. Currently, the service sometimes charges the customer twice.

Which design change most directly prevents duplicate charges while still allowing safe retries?

Accepted Answer

Make the payment processing idempotent by recording an idempotency key for each payment and ensuring repeated deliveries do not apply the charge twice.. Making payment processing idempotent using an idempotency key ensures that even if the same message is delivered multiple times due to at-least-once delivery semantics, the charge is applied only once. The consumer records a unique key (e.g., payment ID) in a durable store (like DynamoDB or Redis) and checks it before processing; if the key already exists, the charge is skipped. This directly prevents duplicate charges while still allowing safe retries, as the consumer can safely reprocess messages without side effects.

Answer

Delete the message from the queue immediately after receive to prevent redelivery.

Answer

Increase the queue visibility timeout to a very large value so messages rarely reappear.

Answer

Switch to a single-threaded consumer with one worker so messages are processed in order.

Question 4

Your web application is deployed in two AWS Regions (Region A and Region B). You want Route 53 to automatically fail over DNS traffic from Region A to Region B when Region A is unhealthy.

The failover decision must be based on health checks that verify whether the application in Region A is reachable.

Which Route 53 routing configuration best meets these requirements?

Accepted Answer

Failover routing using a primary record with an associated health check for Region A and a secondary record for Region B.. Route 53 failover routing allows you to create a primary record with an associated health check for Region A and a secondary record for Region B. When the health check for Region A fails, Route 53 automatically returns the secondary record's IP address, directing traffic to Region B. This directly meets the requirement for automatic failover based on application reachability.

Answer

Latency-based routing with regional aliases to split traffic based on measured latency.

Answer

Geolocation routing using country-based routing policies.

Answer

Weighted routing with weights set to 100 for Region A and 0 for Region B.

Question 5

Based on the exhibit, the payment worker sometimes processes the same SQS Standard message more than once after a timeout. What change best prevents duplicate charges while keeping the queue architecture?

Accepted Answer

Make the payment workflow idempotent by recording a unique order key before charging.. Making the payment workflow idempotent ensures that even if the same SQS Standard message is processed more than once (due to a visibility timeout), the duplicate charge is prevented by checking a unique order key before processing. This is the most robust solution for handling at-least-once delivery semantics of Standard queues without changing the queue architecture.

Answer

Increase the SQS visibility timeout to 15 minutes and leave the worker unchanged.

Answer

Replace the Standard queue with a FIFO queue and rely only on message ordering.

Answer

Add a second consumer so duplicate messages are processed faster.

Question 6

Based on the exhibit, duplicate payment charges occasionally occur when the worker times out after the charge is submitted but before the message is deleted. What change best prevents duplicate charges while keeping retry behavior?

Accepted Answer

Make the consumer idempotent by storing a processed payment key and rejecting repeat charges.. Making the consumer idempotent ensures that even if the same message is processed more than once (due to a timeout after the charge is submitted but before the message is deleted), the duplicate charge will be rejected. By storing a processed payment key (e.g., a unique transaction ID) and checking it before processing, the system can safely retry without causing duplicate payments. This approach preserves retry behavior while preventing duplicates, which is the core requirement.

Answer

Switch the queue to FIFO and rely on content-based deduplication to guarantee exactly-once processing.

Answer

Reduce the visibility timeout so the message becomes available again sooner after a timeout.

Answer

Add a dead-letter queue and disable retries so the message is never processed twice.

Question 7

A production team accidentally deletes critical rows in an Amazon RDS for PostgreSQL database. The deletion occurred about 6 hours ago. The team wants to recover to a specific point in time with minimal disruption.

Assuming automated backups are enabled, which approach provides the best resilience outcome?

Accepted Answer

Use point-in-time recovery (PITR) to restore a new DB instance to a timestamp shortly before the deletion, then switch application traffic to the restored instance.. Point-in-time recovery (PITR) allows you to restore a new DB instance to any second within the automated backup retention period, which includes transaction logs. By restoring to a timestamp just before the deletion, you recover the lost rows without affecting the current production instance, then switch traffic to the new instance for minimal disruption.

Answer

Restore the current DB instance in place by overwriting it with only the latest automated backup.

Answer

Create a manual snapshot and restore from it only if the snapshot date exactly matches today.

Answer

Perform a database-level rollback using transaction logs from the application server without using RDS restore features.

Question 8

Based on the exhibit, an administrator accidentally deleted data from Amazon RDS for PostgreSQL about 90 minutes ago. Which recovery approach best restores the database to the exact required point in time?

Accepted Answer

Restore the database to the specified point in time into a new DB instance.. Amazon RDS for PostgreSQL supports Point-in-Time Recovery (PITR), which allows you to restore a DB instance to any second within the backup retention period, up to the last five minutes. Since the deletion occurred approximately 90 minutes ago, you can restore to that exact point in time by specifying the timestamp, and RDS will create a new DB instance from automated backups and transaction logs. This is the only option that recovers the exact state before the accidental deletion.

Answer

Restore the latest automated snapshot back onto the existing DB instance.

Answer

Create a read replica and promote it after the deletion is noticed.

Answer

Enable Multi-AZ so the database can automatically undo application mistakes.

Question 9

Based on the exhibit, the current disaster recovery design misses the RTO target even though the database replica is current. Which deployment model best meets the requirements with the least always-on cost?

Accepted Answer

Warm standby, because a scaled-down application stack stays running in the secondary Region and can take over faster.. Warm standby is the correct choice because it keeps a scaled-down application stack running in the secondary Region, which can be scaled up quickly to handle production traffic. This design meets the RTO target by reducing failover time compared to a pilot light, while avoiding the higher always-on cost of an active-active deployment.

Answer

Pilot light, because only the database needs to be running in the secondary Region.

Answer

Active-active, because both Regions should always serve traffic to guarantee the RTO.

Answer

Backup and restore, because restoring from backups is the least expensive DR model available.

Question 10

Based on the exhibit, a web application must stay available if one Availability Zone fails. What is the best change to improve resilience?

Accepted Answer

Add a subnet in another Availability Zone to the Auto Scaling group and keep the ALB spanning both AZs.. Adding a subnet in another Availability Zone (AZ) to the Auto Scaling group and keeping the ALB spanning both AZs ensures that if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. This is the standard pattern for building multi-AZ resilient architectures with Auto Scaling and ALB, as it eliminates the single point of failure at the AZ level.

Answer

Increase the desired capacity to 8 instances in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Move the instances to a larger instance type with more CPU and memory.

Question 11

Match the disaster recovery strategy to the recovery posture it best fits for a Regional outage.

Accepted Answer

Backup & Restore: RPO hours, RTO 24+ hours. These pairs match disaster recovery strategies to their recovery postures, aligning with AWS DR strategies where RTO and RPO define the recovery objectives.

Answer

Backup & Restore: RPO seconds, RTO minutes

Answer

Multi-Site Active/Active: RPO hours, RTO 24+ hours

Question 12

A global application experiences frequent writes and must survive a full Regional outage with near-zero data loss. The product team also requires that users can continue to write during the incident using the closest Region. Which approach is most aligned with these requirements?

Accepted Answer

Use an active/active design with multi-Region data replication (for example, global tables for the write-heavy datastore) and route traffic to multiple Regions based on health and latency.. An active/active design with multi-Region data replication, such as Amazon DynamoDB global tables, allows writes to occur in any Region and replicates them to all other Regions with near-real-time latency (typically sub-second). This meets the requirement for near-zero data loss during a full Regional outage, as data is asynchronously replicated to multiple Regions, and users can continue writing to the closest healthy Region via Route 53 latency-based or geolocation routing.

Answer

Use warm standby with periodic backups of the primary write datastore every 24 hours.

Answer

Use pilot light where the secondary Region runs only infrastructure templates and starts data replication only after detecting failure.

Answer

Use a single-writer model in one Region and deploy read-only replicas in the other Region for continuity.

Question 13

A company uses Amazon RDS for a PostgreSQL database powering a customer-facing application. The application’s availability depends on fast database failover with minimal manual intervention. The RDS instance currently runs as a single-AZ deployment in one DB subnet group. Which change most directly meets the goal?

Accepted Answer

Enable Multi-AZ for the RDS DB instance so AWS manages a standby in another Availability Zone with automatic failover.. Enabling Multi-AZ for the RDS DB instance creates a synchronous standby replica in a different Availability Zone. AWS automatically handles failover to the standby with no manual intervention required, which directly meets the goal of fast database failover with minimal manual intervention.

Answer

Create a read replica in a different Availability Zone and configure the application to fail over manually.

Answer

Switch the database to use EBS snapshots more frequently and restore in case of failure.

Answer

Pin the DB to a specific instance type with higher CPU credits to prevent CPU-related disconnects.

Question 14

A stateless web API runs on EC2 instances behind an Application Load Balancer (ALB). The Auto Scaling group (ASG) currently uses subnets from only one Availability Zone, even though the ALB spans two Availability Zones. During maintenance of that single AZ, the ALB remains up but clients see timeouts because there are no healthy targets. Which change most directly improves resilience against an AZ failure?

Accepted Answer

Update the ASG to launch instances across subnets in at least two Availability Zones and ensure ALB health checks target an application-ready path.. The most direct fix for AZ failure resilience is to distribute the ASG across multiple Availability Zones. With the ALB already spanning two AZs, if the ASG only launches instances in one AZ, a failure of that AZ leaves the ALB with zero healthy targets, causing timeouts. By configuring the ASG to launch instances in at least two AZs and setting ALB health checks to an application-ready path, the ALB can route traffic to healthy instances in the surviving AZ, maintaining availability.

Answer

Keep the ASG in one subnet/AZ, but enable ALB stickiness to reduce session interruption.

Answer

Add a NAT gateway in the public subnets so instances can reach the internet during maintenance events.

Answer

Create a second ALB in the same Availability Zone and route traffic using DNS failover.

Question 15

A caching layer uses Amazon ElastiCache for Redis in front of a stateless web service. The service must continue to read cached responses during maintenance events and should automatically fail over to another node if one AZ becomes impaired. Which design change best satisfies this requirement?

Accepted Answer

Configure an ElastiCache Redis replication group with automatic failover across multiple Availability Zones.. An ElastiCache Redis replication group with automatic failover across multiple Availability Zones ensures that if the primary node or its AZ becomes impaired, a read-replica in another AZ is automatically promoted to primary. This allows the stateless web service to continue reading cached responses without interruption, satisfying both the maintenance and AZ impairment requirements.

Answer

Deploy a single-node Redis cluster and rely on application-level retries when cache misses occur.

Answer

Move the cache into the VPC but keep it in one Availability Zone to reduce network latency.

Answer

Use a Memcached cluster and configure only client-side connection pooling without failover support.