SAA-C03 Design Resilient Architectures Practice Test 9 — 15 Questions

Question 1

A web application runs on an EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG spans three Availability Zones. After a deployment, new instances frequently fail the ALB target group health checks with HTTP 5xx responses and are quickly terminated by the ASG. What change most improves resiliency during deployments with minimal downtime by preventing premature removal of instances that are still starting?

Accepted Answer

Use a longer ASG health check grace period and deploy new instances using controlled replacement (for example, rolling instance refresh) so existing healthy instances continue serving while new ones warm up.. Option B is correct because increasing the ASG health check grace period gives new instances more time to complete their startup and pass the ALB health checks before the ASG marks them unhealthy. A rolling instance refresh replaces instances in a controlled manner, ensuring that existing healthy instances continue serving traffic while new instances warm up, minimizing downtime and preventing premature termination.

Answer

Reduce the ASG health check grace period to 0 seconds so issues are detected faster.

Answer

Restrict the ASG to a single Availability Zone so health check evaluation is simpler.

Answer

Disable ALB health checks so the ASG does not terminate instances on HTTP 5xx responses.

Question 2

A fintech company has a two-Region DR requirement: RPO must be within 15 minutes and RTO must be under 2 hours. To control cost, they do not want to run full production infrastructure in the secondary Region continuously. They plan to continuously replicate the database and keep the application infrastructure in the secondary Region prepared, but at reduced capacity. Which DR strategy best matches this requirement and accurately describes their plan?

Accepted Answer

Warm standby: keep the essential parts of the application running in the secondary Region at reduced capacity, while using database replication to meet the RPO.. Warm standby is the correct strategy because it runs a scaled-down version of the production application in the secondary Region continuously, with database replication (e.g., Amazon RDS Multi-Region or Aurora Global Database) meeting the 15-minute RPO. The reduced-capacity infrastructure can be scaled up within the 2-hour RTO during a disaster, balancing cost and recovery requirements.

Answer

Pilot light: keep only minimal components (for example, replicated storage and a small amount of core services), so the app scales up during a disaster.

Answer

Active-active: run the application fully in both Regions with synchronized writes and share traffic continuously.

Answer

Cold standby: store backups in the secondary Region and provision all infrastructure only during a disaster.

Question 3

A web application runs on an Auto Scaling group behind an Application Load Balancer. The business wants the service to keep running if one Availability Zone goes down. Which two changes should you make? Select two.

Accepted Answer

Place the Auto Scaling group in subnets across at least two Availability Zones.. Option A is correct because placing the Auto Scaling group in subnets across at least two Availability Zones ensures that if one AZ fails, the Auto Scaling group can still launch instances in the remaining healthy AZ(s). This is a fundamental pattern for high availability, as the Auto Scaling group distributes instances across the specified subnets, and if an entire AZ becomes unavailable, instances in other AZs continue to serve traffic.

Answer

Increase the instance size so each server can handle more traffic alone.

Answer

Disable ALB health checks so instances stay registered longer.

Answer

Run the whole stack in one Availability Zone for simpler networking.

Question 4

A production Amazon RDS database must continue serving the application if the primary DB instance fails. The application should reconnect automatically without hard-coding a new IP address. Which two actions should you take? Select two.

Accepted Answer

Create an RDS Multi-AZ deployment for the database.. A is correct because an RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention. This ensures high availability and continuity for the production database.

Answer

Disable automated backups to reduce the time needed for failover.

Answer

Use a single-AZ deployment so the standby is not split across Zones.

Answer

Replace the database with an Amazon S3 bucket and store rows as objects.

Question 5

A company hosts an internal API in two AWS Regions. Traffic must automatically switch to the secondary Region when the primary Region's endpoint is unhealthy. Which two Route 53 settings are required? Select two.

Accepted Answer

Use a failover routing policy for the DNS record.. A failover routing policy is required because it allows Route 53 to automatically route traffic from a primary resource to a secondary resource when the primary is unhealthy. This is the only routing policy that supports active-passive failover across two AWS Regions. Without this policy, Route 53 would not know which endpoint to consider primary or how to switch traffic upon failure.

Answer

Use geolocation routing so users are always sent to the closest Region.

Answer

Use a private hosted zone to expose the API to the internet.

Answer

Set the TTL to zero and skip health checks to make failover faster.

Question 6

A service processes messages from an Amazon SQS queue. Sometimes the worker finishes the business logic but does not delete the message before the visibility timeout expires, so the message is delivered again. Which two changes improve resilience and reduce the impact of duplicate processing? Select two.

Accepted Answer

Make the message handler idempotent.. Option A is correct because making the message handler idempotent ensures that even if a message is processed multiple times (due to visibility timeout expiry), the business outcome remains the same. Idempotency is a key design pattern for resilient architectures when using at-least-once delivery systems like SQS. Option B is correct because setting the visibility timeout long enough for normal processing prevents premature redelivery, reducing the chance of duplicate processing in the first place.

Answer

Switch from SQS to Amazon SNS for reliable buffering.

Answer

Shorten the queue retention period so messages expire quickly.

Answer

Disable retries in the consumer application.

Question 7

A developer accidentally corrupts part of a production Amazon RDS database, and the issue is discovered 45 minutes later. The team needs to restore the database to the state immediately before the change. Which two actions should be part of the recovery plan? Select two.

Accepted Answer

Enable automated backups with a retention period that covers the recovery window.. Option A is correct because automated backups must be enabled to allow point-in-time recovery (PITR) within the retention window. Since the corruption occurred 45 minutes ago, the retention period must cover at least that duration to restore to the state immediately before the change. Option B is correct because PITR restores the database to a specified time (down to the second) within the backup retention period, creating a new DB instance that reflects the state just before the corruption.

Answer

Convert the database to a single-AZ deployment for faster restores.

Answer

Delete the corrupted rows manually and continue without restoring.

Answer

Use a read replica as the only recovery source for all deletions.

Question 8

A batch processing job can be interrupted and restarted from checkpoints. The business wants to lower compute cost while still keeping the workload resilient to interruptions. Which two choices are best? Select two.

Accepted Answer

Run the workload on Amazon EC2 Spot Instances.. Amazon EC2 Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, stateless batch processing jobs that can be interrupted and restarted from checkpoints. The workload's ability to resume from checkpoints makes it resilient to Spot Instance interruptions, aligning perfectly with the business goal of lowering compute costs while maintaining resilience.

Answer

Use a single On-Demand instance in one Availability Zone only.

Answer

Disable automatic replacement so the job is never restarted.

Answer

Keep all intermediate state only in instance memory.

Question 9

A production application uses an Amazon RDS Multi-AZ DB instance. During an unplanned failover, the database endpoint remains the same. What change should the application team make to handle the failover reliably?

Accepted Answer

Keep using the same RDS endpoint and implement connection retry logic on failures.. Option B is correct because the RDS Multi-AZ DNS endpoint remains unchanged during a failover, automatically pointing to the new writer instance. Implementing connection retry logic with exponential backoff allows the application to handle the brief DNS propagation delay and connection interruption, ensuring reliable recovery without manual intervention.

Answer

Hard-code the new writer instance IP address after failover completes.

Answer

Disable Multi-AZ and rely on manual intervention to switch endpoints.

Answer

Move reads to application-side caching only, and avoid reopening DB connections.

Question 10

Your web tier runs on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). You currently deploy both the ALB and the Auto Scaling group in only two Availability Zones (AZs). One AZ fails. What is the best configuration change to improve resilience?

Accepted Answer

Add a third Availability Zone so the ALB and Auto Scaling group span at least three AZs.. Adding a third Availability Zone (AZ) ensures that the Application Load Balancer (ALB) and Auto Scaling group (ASG) can continue to route traffic and maintain capacity even if one AZ fails. With only two AZs, a single AZ failure reduces the fleet by 50% and may cause the ALB to lose the minimum healthy hosts required to serve traffic. Spreading across three AZs provides a higher resilience margin, as the remaining two AZs can absorb the load while the failed AZ recovers.

Answer

Reduce health check timeouts so instances are replaced sooner in the failed AZ.

Answer

Enable instance scale-in protection to stop the ASG from terminating unhealthy instances.

Answer

Switch the ALB to an internal Network Load Balancer (NLB) to avoid cross-AZ traffic.

Question 11

An internal API is hosted in two AWS Regions behind Route 53. Under normal conditions, clients should use the primary region. If the primary endpoint becomes unhealthy, traffic must automatically switch to the secondary region. Which Route 53 setup best meets this requirement?

Accepted Answer

Use failover routing policy: create two alias records for the same name (primary and failover) and associate health checks with the primary record.. Route 53 failover routing policy is designed for active-passive failover scenarios. By creating two alias records (primary and secondary) for the same DNS name and associating a health check with the primary record, Route 53 automatically directs traffic to the secondary region if the primary health check fails. This meets the requirement of automatic failover without manual intervention.

Answer

Use latency-based routing with one record per region and no health checks.

Answer

Use weighted routing and manually change the weights during incidents.

Answer

Create a single alias record only for the primary region and rely on client-side DNS retries.

Question 12

An order-processing system publishes an event whenever a payment succeeds. Three downstream services (inventory, shipping, and analytics) must react independently. Analytics sometimes has high latency, but order processing must not be blocked. What is the best AWS approach to decouple these consumers?

Accepted Answer

Publish payment events to SNS (or EventBridge) and let each downstream service consume independently (for example, via SQS queues or other async targets).. Option B is correct because Amazon SNS (or EventBridge) enables asynchronous, fan-out messaging where a single payment-success event is published once and delivered independently to multiple downstream services (inventory, shipping, analytics) via SQS queues or other targets. This decouples the producer from consumer latency—analytics can take its time without blocking order processing—and ensures each consumer processes the event at its own pace, meeting the requirement for independent, non-blocking reactions.

Answer

Have order processing call each service synchronously via HTTPS and retry on failures.

Answer

Store events in a single relational database table and let consumers poll continuously for new rows.

Answer

Send events directly from the producer to each consumer EC2 instance using SSH tunnels.

Question 13

A consumer application reads from an Amazon SQS queue. Some messages have an invalid format and always fail processing. They are retried repeatedly and consume consumer capacity. What is the best way to prevent these "poison pill" messages from blocking normal processing?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount.. Option B is correct because a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount allows messages that repeatedly fail processing to be moved to a separate queue after a specified number of receive attempts. This prevents poison pill messages from being retried indefinitely, freeing consumer capacity for valid messages. Amazon SQS automatically redirects messages to the DLQ once the maxReceiveCount threshold is exceeded, ensuring normal processing is not blocked.

Answer

Enable long polling and increase the maximum message retention to 30 days.

Answer

Switch the queue to FIFO and disable retries in the consumer code.

Answer

Delete the main queue and recreate it after every failure.

Question 14

An event consumer sometimes processes the same SQS message more than once due to timeouts and retries. The consumer must ensure the payment is not charged twice. What design choice best addresses this requirement?

Accepted Answer

Make the payment operation idempotent by using an idempotency key and skipping side effects when the key indicates the payment already succeeded.. Option B is correct because making the payment operation idempotent using an idempotency key ensures that even if the same SQS message is processed multiple times due to timeouts and retries, the payment will only be charged once. The consumer checks the idempotency key before executing the payment; if the key indicates the payment already succeeded, the consumer skips the side effect. This pattern directly addresses the requirement of not charging twice without relying on SQS's at-least-once delivery guarantee.

Answer

Assume messages are processed exactly once because SQS uses durable storage.

Answer

Increase the consumer visibility timeout to several days so messages are not redelivered.

Answer

Delete the message immediately even if processing fails validation.

Question 15

A company needs an Amazon RDS database that automatically fails over to a standby when the primary DB instance becomes unavailable. Which approach best meets the requirement with minimal operational effort?

Accepted Answer

Deploy the DB as a Multi-AZ DB instance so AWS maintains a synchronous standby in another Availability Zone and performs automated failover.. Option B is correct because Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone. When the primary DB instance fails, AWS handles the automatic failover to the standby with zero manual intervention, meeting the requirement with minimal operational effort.

Answer

Keep the DB as a single-AZ instance and implement a manual process to promote a standby when needed.

Answer

Enable versioned backups only, and restore the database each time the primary instance becomes unavailable.

Answer

Replicate the database to another region and switch clients to the secondary region using manual DNS changes.