CCNA Resilient Cloud Solutions Questions

DAX is a fully managed, in-memory caching service placed in front of DynamoDB, returning cached items with microsecond latency. By writing through and caching the frequently read flash-sale items, it absorbs the burst of read traffic before it reaches the table, which directly reduces consumed read capacity units and throttling events. This requires no costly rearchitecture or constantly adjusting provisioned throughput, making it the most appropriate solution for unpredictable read spikes.

This is the correct approach. An Application Load Balancer is a regional service; by enabling subnets in at least two Availability Zones, you create redundant ALB nodes. The ALB performs health checks and automatically routes traffic to healthy EC2 instances across both AZs. Cross-zone load balancing ensures each instance receives an equal share of requests, so the architecture tolerates an AZ failure and even an instance failure without manual intervention.

Route 53 health checks associated with the latency records let DNS stop returning the failed Region's endpoints, redirecting users to a healthy Region. Without this, latency records would continue resolving to the unavailable Region, defeating the active-active resilience requirement.

ALB security policies terminate TLS at the load balancer and enforce the minimum protocol version and cipher suite list, satisfying the TLS 1.2 requirement without modifying each EC2 instance. This centralises enforcement at the single ingress point.

Launching EC2 instances in at least two Availability Zones is the foundational principle for highly available web server fleets. Availability Zones are physically separate data centers with independent power, cooling, and networking, so a failure in one AZ does not affect the other. Combined with a load balancer that spans those same AZs, traffic automatically continues to be served by healthy instances if one AZ loses capacity. This design eliminates the single-AZ dependency and is a core requirement for fault-tolerant compute tiers.

An Application Load Balancer with sticky sessions is the correct solution because it operates at Layer 7 and can inspect HTTP/HTTPS traffic. ALB uses either the AWSALB cookie with a configurable duration or an application-controlled cookie to send all requests from the same client session to the same EC2 instance. This preserves in-memory session state, which is exactly what a stateful application requires.

This configuration uses the ALB's per-target request count as a scaling metric, so Auto Scaling continuously adjusts the EC2 fleet to keep that value near the chosen target. The ALB target group integration ensures newly launched instances are immediately registered to receive traffic, and the policy can scale both out and in based on real observed load. It is designed for variable workloads like critical web apps and responds faster and more accurately than scheduled or simple scaling policies.

By configuring the Auto Scaling group to span multiple Availability Zones and enabling cross-zone load balancing on the ALB, the application can survive an entire AZ failure. If one AZ becomes unavailable, the ALB routes traffic only to the remaining healthy targets, while the ASG automatically launches replacement instances in the other AZs to maintain capacity. Cross-zone load balancing ensures that traffic is distributed evenly across all instances, even when one AZ has fewer instances. This design provides both redundancy and optimal utilization.

Reserved concurrency sets a hard upper limit on the number of simultaneous executions for a specific function and, more importantly, guarantees that this amount of capacity is reserved exclusively for that function from the account's total concurrency pool. This prevents other functions from exhausting the shared pool and ensures the critical function can always handle its peak load without being throttled. It also makes the function's behavior predictable during traffic spikes, because the reserved capacity is always available for that function's invocations.

A Cross-Region Read Replica uses Amazon RDS's asynchronous replication to continuously apply transactions from the primary DB instance to a replica in a different AWS Region. This typically achieves an RPO in the low seconds (usually 1–5 seconds) and a short RTO by promoting the replica to a standalone primary via the console or API. Because replication is ongoing, it minimizes data loss far more effectively than any interval-based snapshot strategy.

A lifecycle hook pauses the Auto Scaling termination process by moving the instance into the 'terminating:wait' state, giving you a configurable period to perform custom actions before the instance is finally terminated. An in-instance script or agent can monitor and gracefully drain active user sessions, commit any required state, and then call complete-lifecycle-action with the appropriate lifecycle hook token to signal that termination may proceed. This is the only option that actually holds the termination process itself and coordinates with application-level work rather than merely affecting network connections or scaling timers.

AWS WAF is a web application firewall that filters and monitors HTTP(S) requests using rules for IP reputation, geographic origin, URI patterns, SQL injection, and cross-site scripting. Its rate-based rules automatically block IPs that exceed configured request thresholds, making it effective against HTTP floods and the low-and-slow application-layer DDoS attacks that target web endpoints. WAF integrates with CloudFront, Application Load Balancer, and API Gateway, allowing it to enforce Web ACLs at the edge or origin.

An ECS service with a task definition and a multi-AZ placement strategy is the correct pattern because the service scheduler continuously maintains the desired count, automatically replacing tasks that fail, become unhealthy, or lose connectivity. Distributing tasks across multiple Availability Zones ensures the service remains available even if an entire AZ goes down, as the remaining AZs still host task copies. Service Auto Scaling independently adjusts the desired count based on CloudWatch metrics or target tracking, providing elasticity and capacity management without sacrificing the resilience built into the service model.

The Correct answer: The `ContinueUpdateRollback` API or the AWS Management Console action is specifically designed for stacks stuck in `UPDATE_ROLLBACK_FAILED`. It resumes the rollback from the point where it failed, skips resources that were already successfully rolled back, and can optionally skip resources you explicitly specify. This recovers the stack to its last known good state with minimal disruption, and it is the only built-in mechanism that directly resolves this status.

The Resource does not include the bucket ARN, so bucket-level operations like ListBucket are not denied.

A blue/green deployment creates a fresh set of green instances beside the original blue instances, and traffic is shifted to the green fleet only after it successfully passes the configured health checks. If the green instances fail, CodeDeploy can keep the blue fleet available and immediately route traffic back to it, giving you a deterministic rollback path that does not require re-deploying the old revision. This directly solves the problem in the question, because the old instances remain running and intact until the new ones are proven healthy, making rollback both possible and rapid.

This is the correct pattern because SQS itself owns the retry and dead-letter behavior when Lambda consumes from a queue. A redrive policy with maxReceiveCount: 3 instructs SQS to allow a message to be received up to three times; if the Lambda function fails to process it each time, SQS automatically moves the message to the configured dead-letter queue. This is a native, serverless-friendly mechanism that avoids unnecessary compute and precisely matches the requirement for '3 retries before a DLQ'.

Security group names in EC2 are case-sensitive, and CloudFormation's lookup by name uses an exact, literal string match against the security groups within the specified VPC. If you reference a group by name and the template contains a typo, wrong case, or an unintended trailing space, the API returns no matching group, which CloudFormation reports as a 'security group not found' error. This is the most frequent root cause in practice because names like 'web-SG' and 'web-sg' are considered distinct, and the error message often appears immediately after a small edit or a manual copy-paste from a different source.

A pilot light strategy keeps a minimal core, such as the RDS instance, running in the DR Region via a cross-Region read replica while other services remain off. The read replica provides continuous asynchronous replication, so a promotion on failover can complete in roughly 15 minutes, and automated backups in the DR Region give point-in-time restore support. Since the database is already warm and data is being copied, the worst-case data loss stays within the 1-hour RPO.

When you reference a launch template by name in an Auto Scaling group's LaunchTemplateSpecification, CloudFormation and the Auto Scaling API require that the launch template already exists in the same account and Region. If the name is misspelled, or the launch template was created under a different account/Region or never created, the API returns an error indicating the launch template parameter is invalid or not found. The error message in the output is consistent with this cause, as it specifically flags the launch template name reference, not the AMI, key pair, or IAM permissions.

Deploying an RDS DB instance in a Multi-AZ configuration creates a synchronous standby in a different Availability Zone and enables automatic failover. RDS monitors the primary instance and, if a failure is detected, automatically switches the endpoint to the standby, typically in 60–120 seconds. This is the standard RDS pattern for high availability within a single region.

Pod Disruption Budgets (PDBs) constrain voluntary disruptions such as node drains during cluster upgrades, node-group updates, or Cluster Autoscaler scale-in by specifying minAvailable or maxUnavailable for a pod selector. During a voluntary disruption, the Kubernetes eviction API rejects requests that would cause the number of available pods to fall below the budget. PDBs do not protect against involuntary failures like an EC2 instance crash, so they are a complement, not a substitute, for multi-AZ node deployment.

In CodeDeploy's ECS blue/green deployment, the green target group's health checks are the gating mechanism for traffic shifting. If the health check path, port, or interval is misconfigured, the green tasks are marked unhealthy even though the containerized application is running normally, so CodeDeploy never receives the signal that the green fleet is ready. As a result, the listener remains pointed at the blue target group, and the deployment times out waiting for a healthy green target.

Deploying across multiple Availability Zones (AZs) is the primary AWS design pattern for high availability because each AZ is an independent failure domain with separate power, cooling, and networking. By placing resources (e.g., application servers behind an Application Load Balancer, and a Multi-AZ database) in at least two AZs, the workload can continue serving traffic if one AZ suffers an outage, as the load balancer automatically routes requests only to healthy instances in the remaining AZs. This approach directly satisfies the requirement for fault tolerance, and when combined with Auto Scaling, it also provides capacity to absorb increased load in the surviving AZs.

Deploying across multiple Availability Zones (AZs) provides infrastructure-level fault isolation because each AZ has independent power, cooling, and network access. This architecture ensures that an outage in one AZ does not take down the entire workload, supporting a higher availability SLA. For example, running EC2 instances in two or more AZs with an Application Load Balancer allows traffic to continue to healthy AZs even if one becomes isolated.

A 503 status code from the health check endpoint indicates that the target instance is reachable at the HTTP layer, but the application logic serving the root path '/' is returning a Service Unavailable error. Elastic Load Balancing requires a 2xx or 3xx response for the health check to mark the instance healthy; any 4xx or 5xx status counts as unhealthy. Verify that the web server or application is configured to serve '/' with a 200 OK during normal operation and that there are no authentication, redirect, or maintenance-mode rules that cause a 503 on that specific path. This is the correct troubleshooting step because the health check is working as designed—it is detecting an application-level failure.

ECS Service Connect provides a resilient service mesh that simplifies inter-service communication by giving each service a stable DNS name and managing traffic distribution at the application layer. It enables fine-grained traffic splitting, automatic retries, and connection draining, which collectively reduce latency and improve reliability between microservices. This is a direct remedy for latency caused by inefficient service-to-service calls, as it optimizes the network path and avoids overloading individual task instances.

Using a process-only health check (e.g., checking that the PID exists) means the ECS/ALB considers the container healthy whenever the runtime is alive, regardless of whether the app can actually serve HTTP traffic. As a result, intermittent 500 errors caused by a hung worker, exhausted connection pool, or an unhandled exception inside request handling remain invisible to the health check, so the task stays in service and keeps receiving traffic. A valid health check should send a real request to the application's endpoint and verify the response code.

Scaling consumers on ApproximateNumberOfMessagesVisible directly matches fleet capacity to the actual backlog, so added workers drain the queue during peaks and terminate when it empties. This satisfies the latency constraint without over-provisioning, since capacity tracks demand rather than a fixed schedule or CPU proxy.

If the instance security group does not allow inbound traffic from the ALB's security group on the health-check port, the ALB's TCP or HTTP health-check probes are silently dropped. Because the instance never completes the health-check handshake, the target fails the required number of consecutive checks and the ALB marks it unhealthy. This is a classic misconfiguration that often appears right after adding the ALB, and it also blocks normal client traffic routed by the load balancer.

The AWS Batch job definition includes a `timeout` field that sets the maximum duration a job attempt is allowed to run before Batch forcibly terminates it as a timeout. Increasing this value to 3600 seconds (60 minutes) directly accommodates longer video processing tasks, preventing premature termination when the workload legitimately needs more than the current limit. This is the intended control for adjusting how long Batch permits a single job attempt to execute.

In a target group's health-check settings, increasing the interval spaces out probe requests, while increasing the unhealthy threshold demands more consecutive failures before an instance is marked unhealthy. Together, these settings build a longer smoothing window: sporadic errors such as brief 503s during a rolling deploy or dependency hiccup will not immediately cause a healthy instance to be replaced. The instance remains in service and in rotation until the failures are sustained over an extended period, which is exactly the desired behavior when the goal is to reduce replacement churn. The trade-off is that genuinely dead instances take longer to detect, but that is acceptable in many critical applications that favor stability over instantaneous failover.

IRSA associates a Kubernetes ServiceAccount with an IAM role by annotating the ServiceAccount with the role ARN and configuring an OIDC trust policy. A projected service account token is exchanged via STS AssumeRoleWithWebIdentity for short-lived AWS credentials, and the AWS SDK automatically reads AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE. This gives each microservice a distinct IAM role with scoped permissions and no long-lived keys stored in the cluster.

Amazon CloudFront is a global content delivery network that terminates connections at edge locations and can be configured with multiple origins, including an origin group where the primary origin's failure triggers automatic failover to a secondary origin. This origin failover is initiated when the primary returns specific HTTP error codes or fails connection attempts, making it a key component for routing requests to a healthy Region. Additionally, edge caching shields the origin and improves performance, which is essential for a globally resilient application.

An Auto Scaling group configured across multiple Availability Zones automatically distributes instances among those AZs and enforces the desired capacity by replacing any instance that fails its health checks. This provides both high availability and operational automation: if an entire AZ becomes impaired, the ASG launches replacement instances in the remaining healthy AZs, and it also performs capacity rebalancing when AZs become imbalanced. Combined with an Elastic Load Balancer, this is the standard AWS pattern for building a fault-tolerant, self-healing application tier.

EBS volumes are network-attached block storage that exist independently of the EC2 instance lifecycle, so when an instance terminates the volume can be detached and reattached to a replacement instance. Data written to an EBS volume survives Auto Scaling scale-in as long as the volume's DeleteOnTermination attribute is set to false and the application writes to that mount point. This approach makes application state durable across instance replacements without requiring a distributed storage architecture or application code changes, because the application still sees a standard block device.

This statement uses an explicit Deny on all s3:* actions, conditioned on aws:SecureTransport being false. Any request made to the bucket over plain HTTP is therefore blocked regardless of the principal or whether an Allow policy exists; HTTPS requests are not affected by this Deny. The effect is to require TLS for every S3 API operation on the bucket.

RDS cross-region automated backups continuously copy automated backups and applicable transaction logs from the source DB instance to a destination AWS Region without manual intervention. This allows the database to be restored to a specific point in time, or to the latest restorable time, in the secondary region, making recovery from a regional outage repeatable and largely automated. Because the backups are managed by RDS and restored through the standard restore workflow, this option directly supports automated cross-region recovery.

RDS does not natively perform cross-region automatic failover to a read replica. You must implement custom health monitoring, for example using Route 53 health checks or a Lambda function, to detect primary DB instance or AZ failure; upon detection, the automation invokes PromoteReadReplica to convert the replica into a standalone primary and then updates application DNS or database endpoints to redirect traffic. This is the only way to achieve the stated automated failover objective.

A cross-Region read replica in RDS for MySQL, MariaDB, or PostgreSQL uses engine-native asynchronous replication to continuously stream changes from the primary in the source Region to a replica instance in the secondary Region. During a failover, you simply promote the replica, which stops replication and makes it a standalone primary database; promotion typically completes in minutes, giving you an RTO in minutes and an RPO of only seconds (or sub-second in low-write workloads). Because replication is ongoing rather than backup-based, this option gives the lowest RPO and RTO among the choices and is the correct DR strategy for cross-Region recovery.

Enabling detailed CloudWatch metrics on the ALB provides high-frequency measurements such as TargetResponseTime, RequestCount, and TargetConnectionErrorCount, and analyzing ALB access logs offers per-request timestamps, target processing time, request time, client IP, and target status codes. This combination yields a historical, request-level view of latency from the client through the ALB to the target without adding any agents or scripts to the EC2 instances. It also lets you filter for slow requests, group by URL or target, and determine whether delay occurs in the ALB-to-target hop or in the target application itself.

Multi-AZ maintains a synchronous standby in a different Availability Zone and automatically fails over to it when the primary's hardware fails, satisfying the stem's automatic recovery requirement. A single-AZ instance would remain unavailable until AWS or manual intervention restored it.

Latency routing directs users to the Region with the lowest measured latency, satisfying the nearest-healthy-endpoint requirement. Route 53 latency records support health checks, so unhealthy endpoints are excluded automatically. Unlike geolocation, which maps users by geography, latency uses actual network performance between resolver and endpoint.

The policy grants s3:PutObject only when the s3:x-amz-server-side-encryption request header is exactly AES256. In S3, that header value maps to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Consequently, any object uploaded must be encrypted with SSE-S3, and uploads using no encryption or any other encryption method are denied.

A dead-letter queue (DLQ) captures messages that remain unprocessed after multiple attempts, preserving them for later analysis or manual intervention, while Auto Scaling based on SQS queue depth dynamically adjusts the number of consumers to match incoming load. This combination ensures that spikes in traffic are handled by adding more processing capacity, and messages that cannot be processed are not permanently lost, providing both reliability and scalability.

The health check interval (30 seconds) and failure threshold (2) mean it takes up to 60 seconds to mark a task unhealthy. During deployments, the rolling update may temporarily have only 1 healthy task (minimum 50% of 2 = 1), and if that task becomes unhealthy, HealthyHostCount drops to 0.

AWS DRS provides continuous block-level replication from source servers to a low-cost staging area in the AWS target Region, capturing every data change and maintaining a nearly synchronous copy. On failover, DRS automatically launches EC2 instances from the most recent consistent recovery point, achieving an RPO of seconds (well under the required 1 minute) and an RTO that can be measured in minutes. This directly meets the stated DR requirements, making it the correct choice.

S3 Versioning must be enabled on both the source and destination buckets because S3 Cross-Region Replication (CRR) requires versioned buckets to function. Versioning allows every object version, including overwrites and delete markers, to be captured and replicated, ensuring a complete and recoverable history in the DR Region. Without versioning, CRR cannot replicate updates or track deletes consistently, and the RPO guarantee would be unattainable.

After a Multi-AZ failover, the RDS DNS record for the writer endpoint is updated to point to the new primary instance, but an application that caches DNS resolutions continues sending write connections to the old IP. That old IP belongs to the former primary, which is now promoted to standby (or replaced) and will not accept write connections, so all new database requests fail until the TTL expires or the application is restarted. This directly causes the five-minute outage because the application never re-resolves the endpoint until the cached entry times out.

No operator action is required because DynamoDB global tables are designed to tolerate temporary partition failures and network interruptions by persisting replication metadata and resuming from the correct point in the replication stream once connectivity is restored. Each write is durably committed in the source region first, and then the service replays it to other replicas with de-duplication and ordering, so the system automatically reconciles the data across regions. This resilience is a core feature, so no manual intervention is necessary.

A Multi-AZ failover promotes the standby instance to primary and updates the RDS DNS record to the new primary's IP, but existing connections are not preserved. Because the old primary is no longer reachable, active TCP sessions and open database connections are dropped, forcing client applications to re-establish them. Applications must reconnect to the same CNAME endpoint—ideally with retry/backoff logic—to transparently recover once DNS propagation completes. This is the expected and documented behavior.

When an ECS service is configured with a load balancer, ECS uses the target group health check to determine task health. If a task fails the health check, ECS will stop the task and start a new one. Specifying the target group ARN in the service definition is required for ECS to monitor and replace unhealthy tasks. Without this, ECS does not know which target group to use for health checks.

Predictive scaling uses the Auto Scaling group's historical load data with machine learning to forecast future demand, generating scheduled scaling actions before the predicted load arrives. By pairing it with dynamic scaling (target tracking or step), you cover both the expected trend and real-time deviations, ensuring that instances are already available before traffic peaks. This proactive capacity prevents the healthy host count from ever collapsing to zero, unlike purely reactive policies that still have to wait for alarms and instance startup.

On-demand instantly scales to handle spikes.

The correct solution is to attach an Auto Scaling policy to the SQS queue depth metric (e.g., ApproximateNumberOfMessagesVisible) and configure the backend workers as an Auto Scaling group. As the number of available messages grows, the policy launches additional EC2 workers to increase aggregate polling and processing throughput; as the queue drains, it terminates excess workers. This directly ties compute capacity to the ingested message volume, which is the standard pattern for decoupled, event-driven autoscaling with SQS.

AWS Global Accelerator uses static anycast IPs at AWS edge locations to route traffic over the AWS global network to endpoint groups, which can contain NLB or ALB endpoints in multiple Availability Zones. It performs health checks and weight-based traffic distribution across endpoints, so incoming TCP/UDP connections are deliberately distributed across AZs rather than being resolved once by DNS. This edge-to-backbone path also improves latency while keeping the same IP addresses during failover.

Setting a dead-letter queue (DLQ) on the SQS queue ensures that messages which exhaust their retry attempts are preserved for later inspection, while assigning reserved concurrency of 1 to the Lambda function caps the maximum number of concurrent invocations to exactly one. This hard limit prevents Lambda from scaling out to hundreds of executions when the downstream service is slow or failing, because the SQS event source mapping can only invoke one function at a time, thereby throttling the rate of calls to the downstream service. As a result, the downstream service receives at most one in‑flight request, avoiding overload and allowing it to recover gracefully. The queue‑level DLQ captures messages that ultimately fail after all retries, so no data is lost while the concurrency limit protects the bottleneck.

Conditional writes use attribute-based conditions (e.g., version numbers or timestamps) to ensure a write only succeeds if the item hasn't changed since the last read, preventing blind overwrites. Since DynamoDB global tables use last-writer-wins by default, application-level conflict resolution—such as storing version metadata and retrying with reconciliation logic—gives you control over which update wins. This approach aligns with DynamoDB's recommended pattern for multi-region applications that require strong consistency for business-critical updates.

No additional step is needed because RDS Multi-AZ is designed to handle automatic failover entirely within the managed service. When the primary instance becomes unavailable (due to hardware failure, AZ outage, or even a patching event), RDS automatically promotes the standby in the other Availability Zone and updates the DNS endpoint to point to the new primary within minutes. Applications using the existing RDS endpoint will reconnect automatically once the DNS change propagates, without requiring any manual intervention or external tooling. This is the inherent advantage of a Multi-AZ deployment for high availability.

Amazon EFS is a regional, elastic, fully managed NFS file system that is accessible from all Availability Zones in the region. It supports the ReadWriteMany access mode, allowing multiple pods across different nodes and AZs to share the same file system simultaneously. EFS integrates with the EKS CSI driver and provides strong consistency and durability, making it an ideal persistent storage solution for stateful applications deployed on EKS.

Aurora Global Database is the correct DR choice because it uses dedicated storage-level replication across regions with a typical RPO of sub-second and an RTO of under 1 minute when you promote a secondary region. The primary and secondary remain fully readable during normal operation, and promotion is a single API call with automatic DNS update, giving the best RTO/RPO among the options.

This ensures even distribution across all instances in all AZs.

Placing tasks in multiple Availability Zones is a core high-availability strategy because each AZ is an isolated, independent failure domain. The ECS service scheduler spreads tasks across the chosen subnets, so when one AZ is impacted by an outage, the tasks in the other AZs continue serving traffic and the service can still meet its desired count. This addresses resilience by ensuring no single infrastructure failure can take down the entire service.

Amazon EC2 Auto Scaling is the service that continuously monitors the health of EC2 instances using EC2 status checks and, when configured, Elastic Load Balancing health checks. If an instance fails these checks, Auto Scaling automatically terminates it and launches a replacement instance to maintain the desired or minimum fleet size. This health-based replacement is an inherent capability of an Auto Scaling group, making it the correct answer for automatically replacing unhealthy instances.

Disabling sticky sessions on the ALB is a necessary precondition for a horizontally scalable, fault-tolerant design. With stickiness off, the ALB can route any request to any healthy target, so if an instance fails, the next request can be served by a different instance — assuming the session state is stored externally (for example, in ElastiCache or DynamoDB). This makes the application effectively stateless at the instance level, which also allows Auto Scaling to add or remove instances without worrying about breaking client sessions on a particular host.

Enabling S3 Versioning is the correct first-line protection because it retains every version of an object, including the original, whenever an overwrite (PUT) or delete (DELETE) occurs. With versioning, an overwritten object's previous version is preserved as a non-current version, and a DELETE action only inserts a deletemarker, leaving all prior versions intact. You can recover accidental changes by simply fetching a previous version, making it the foundational mechanism that enables other features like lifecycle rules, MFA Delete, and point-in-time restores.

A 503 response from the ALB health check means the target instance accepted the TCP connection and returned an HTTP response, but the response status code was not a success (2xx/3xx). If the health check path is '/health' and the application does not define that route, the web server returns a 503 error because no handler matches the request. To resolve this, the health check path must be changed to an existing endpoint or the application must implement an endpoint that returns 200 OK on '/health'.

Latency-based routing policy uses AWS-measured round-trip time data to direct each user to the endpoint that offers the fastest response, and it supports health checks on each record. When the primary endpoint fails its health check, Route 53 automatically selects the next lowest-latency healthy endpoint, providing seamless active-passive failover without manual intervention. This combination of performance optimization and health-aware failover makes it the correct choice for an application with multiple regional endpoints.

Conditional writes enable optimistic concurrency by allowing the application to assert a precondition—such as an item version or updated timestamp—before the write commits. If the condition evaluates to false because another concurrent write modified the item, DynamoDB rejects the request without overwriting, forcing the application to re-read and retry. This prevents silent data loss from last-writer-wins and is the appropriate DynamoDB-native way to enforce a safe update workflow in a multi-region setup.

The Lambda event source mapping for an SQS queue governs message deletion: it only deletes a message after the function returns a success response. By ensuring the mapping does not delete messages on failure (which is the standard behavior unless the function reports success), the failed message remains in the source queue. On subsequent polls, the event source mapping receives it again and invokes the function, giving the desired retry behavior. This is the correct way to let Lambda retry processing of a failed message.

Calling the UpdateStack API (or the update operation in the console) on a stack in CREATE_FAILED state is the correct recovery path. CloudFormation only re-evaluates the resources that depend on the changed parameter, so the failed RDS instance is created while already-created resources remain untouched and no downtime is introduced. Any other approach either destroys existing resources or is not applicable to a creation failure.

DynamoDB global tables create a fully managed, multi-Region, multi-master replicated database using DynamoDB Streams and a backend replication engine. Changes made in any replica table are replicated to all other selected Regions with sub-second latency, enabling active-active failover: if one Region fails, traffic can be redirected to a remaining Region with minimal or zero downtime. This architecture directly addresses the requirement for low-latency access and resilience to Regional outages, making it the correct answer.

Failover routing is the correct choice because it explicitly pairs a primary record with a secondary record and uses Route 53 health checks to decide which to return. When the health check for the primary endpoint fails, Route 53 automatically returns the secondary record's value. This works in an active-passive configuration and gives the deterministic failover behavior the company requires.

When the ALB forwards a request to a healthy EC2 instance, the target must send a complete, valid HTTP response within the configured timeout. If the application logic crashes, the process closes the socket, or the web server returns a malformed response, the ALB cannot construct a valid HTTP response for the client and surfaces as a 502 Bad Gateway. Thus, a faulty or crashed application is the direct underlying cause of a 502 error.