CCNA Resilient Cloud Solutions Questions

Cross-Region RDS read replicas provide asynchronous replication with an RPO of seconds to minutes, meeting the 1-hour RPO. Promoting a read replica and redirecting traffic via Route 53 can be done within minutes, meeting the 15-minute RTO. This is a valid warm standby configuration.

This is the core problem: IAM is default-deny, so this Allow statement only grants the upload when the condition is met; it does nothing to block uploads that fail the condition if another policy grants them. To enforce encryption, you must include an explicit Deny for s3:PutObject without the required encryption condition, because Deny always overrides Allow. Merely adding a condition to an Allow does not constrain other permissions.

Spot Instances reduce cost by up to 90% and are ideal for interruptible workloads. A diversified allocation strategy across multiple Availability Zones reduces the chance of simultaneous interruptions. Storing progress in S3 ensures that if an instance is reclaimed, another instance can resume from the last checkpoint. This combination meets cost, resilience, and progress-preservation requirements.

Retry with exponential backoff is a core resilience pattern that reattempts an operation after an exponentially increasing delay, typically with jitter to avoid synchronized retries, which prevents a thundering herd. It specifically targets transient failures, such as network timeouts, database connection drops, or throttling (e.g., API Gateway 429s or DynamoDB throttling), where the operation may succeed on a subsequent attempt if the original failure was short-lived. This pattern preserves system stability by giving the dependency time to recover and reducing continuous load, and it is widely supported in AWS SDKs and infrastructure.

Deploying the ECS service across multiple subnets with larger CIDR blocks increases the total number of usable private IP addresses in different Availability Zones, allowing additional tasks to be launched. Since each awsvpc-mode task requires an ENI with its own private IP, a larger IP pool directly solves the exhaustion. Using multiple AZs also improves availability by spreading tasks across fault domains, making this the appropriate corrective action.

Amazon ElastiCache for Redis is a fully managed in-memory data store that provides sub-millisecond read/write latencies and is ideal for storing transient session state. It supports replication across Availability Zones and automatic failover, so the session store remains available even if a container task is rescheduled or an Availability Zone fails. Because it is external to the ECS task, the session data persists independently of the container lifecycle, enabling stateless containers and horizontal scaling of the web tier.

Multi-AZ deployment creates a primary DB instance and a standby replica in a different Availability Zone, using synchronous physical replication to keep the standby transactionally consistent. When an AZ failure, network outage, or instance health check failure occurs, Amazon RDS automatically flips the DNS CNAME to the standby within about 60–120 seconds, providing automatic failover without manual intervention. This is the only option that gives the DB instance true high availability with a single endpoint, which is why it is correct.

An Auto Scaling group with a minimum of two instances across two Availability Zones is the most complete solution because it combines horizontal scaling with automated self-healing. The ASG continuously monitors instance health and automatically replaces failed instances, while distributing the workload across two AZs ensures that a single Availability Zone outage does not eliminate all capacity. This is the gold standard for highly available EC2 architectures.

Timeout indicates no response from the web server.

Launching additional EC2 instances in a second Availability Zone and registering them with the NLB target group creates a multi-AZ target fleet, allowing the load balancer to route new connections to healthy instances in the surviving zone when the original zone has an outage. To make this work you must also configure the NLB itself with subnets in at least two AZs so its nodes are geographically distributed; then the target group's health checks automatically remove failed instances and keep the service available. This is the correct architecture for fault tolerance because it eliminates the single AZ as a point of failure and aligns with AWS's region-based resiliency patterns.

Amazon DynamoDB global tables provide a fully managed multi-Region, multi-master replication solution that maintains two or more identical tables across AWS Regions. When a write is issued to any replica, DynamoDB automatically propagates that write to every other region using DynamoDB Streams, with last-writer-wins conflict resolution to reconcile concurrent updates. This makes global tables the appropriate choice for an active-active architecture because each region can accept both reads and writes while providing low-latency access for geographically distributed users. The service handles the replication plumbing, versioning, and conflict resolution internally, eliminating the need for custom code.

A cross-Region read replica continuously replicates asynchronously from us-east-1 to us-west-2, keeping data loss well within the 5-minute RPO. During failover, promoting it to a standalone primary completes in minutes, satisfying the 1-hour RTO without restoring from snapshots.

This pattern gives the application explicit control over failover by first attempting to read from the primary bucket and, on failure (e.g., throttling, regional outage, or S3 service disruption), switching to a pre-created bucket in another Region. It is a common active-passive architecture that avoids reliance on any AWS feature providing automatic DNS-level or data-plane failover. Because the application itself detects the failure, it can also manage consistency, replication lag, and write buffering appropriately. This satisfies the recovery requirement because data availability is maintained as long as at least one Region is operational.

StackSets enable multi-Region deployment for resilience.

Raising the Lambda function's reserved concurrency to 500 is correct because it directly increases the maximum number of simultaneous executions, allowing the SQS event source mapping to scale out beyond the previous limit and process more messages in parallel. With a higher concurrency ceiling, incoming SQS messages are consumed faster, preventing the burst of throttling attempts that occur when the function is already running at its current cap. This aligns with Lambda's SQS scaling model, where the number of active pollers grows with the message volume until the reserved concurrency is exhausted.

Copying automated backups to another Region stores point-in-time snapshots outside the primary Region, so data survives regional failure. It satisfies the requirement to withstand loss of an entire AWS Region by enabling restore of the database in the unaffected Region.

S3 Object Lock with Governance mode applies a Write-Once-Read-Many (WORM) policy that guarantees the backup objects cannot be modified or deleted by any ordinary user—even an account administrator with full S3 access—until the 365-day retention period expires. Governance mode does allow users with the s3:BypassGovernanceRetention permission to override the lock if needed, but a typical backup scenario doesn't grant that to regular IAM roles, so the data remains immutable for the entire year. Pairing this with a lifecycle rule that transitions the objects to S3 Glacier Deep Archive after 30 days satisfies both the need for protection and cost efficiency: the transition preserves Object Lock metadata and the object stays protected through the transition, after which Storage Costs drop to the lowest tier while retention still applies for the remaining 335 days.

A cross-Region read replica uses asynchronous replication with lag typically under 5 minutes and can be promoted quickly, meeting both RPO and RTO cost-effectively.

Cross-zone load balancing on the ALB ensures that incoming traffic is distributed evenly across all registered targets in every Availability Zone, preventing any single AZ from being overloaded and allowing the ALB to continue serving requests even if one AZ is impaired. Connection draining gives in-flight requests a grace period to complete before an instance is deregistered or replaced, avoiding request interruption during rolling updates or failed health checks. Together, these features support seamless instance replacement without dropping active requests, though they do not on their own preserve stored session data — they protect the connection lifecycle while the application layer (e.g., ElastiCache) handles state.

Storing sessions in ElastiCache moves session state off the instance into a shared, low-latency in-memory tier, so any instance behind the ALB can serve subsequent requests and instance termination no longer destroys session data, while preserving performance.

Spreading EC2 instances across at least two Availability Zones means an AZ outage leaves capacity in the surviving zone, so the Auto Scaling group keeps serving traffic behind the ALB. This directly satisfies the requirement to survive failure of an entire Availability Zone.

Circuit breaker pattern monitors calls to a remote service and maintains three states—closed, open, and half-open—progressing to open when failure thresholds are exceeded, at which point subsequent calls fail fast without attempting the network operation. This prevents a failing service from being overwhelmed and stops the same repeated errors from saturating caller resources, thereby breaking the chain of cascading failures and giving the dependency time to recover.

During an RDS Multi-AZ failover, the existing TCP connections to the primary instance are forcibly closed, and the database endpoint's DNS CNAME is updated to point to the new primary. If the application does not implement connection retry with exponential backoff, it will never re-establish those dropped connections, causing an outage even after the failover completes. Retry logic with backoff and jitter is the standard, required practice for any production application using RDS, especially when combined with a connection pool or RDS Proxy.

An Application Load Balancer is a regional, layer-7 service that can route traffic to healthy targets across multiple Availability Zones. By placing EC2 instances in different AZs and registering them in the ALB's target group, the ALB automatically performs health checks and reroutes traffic away from unhealthy instances or entirely failed AZs. This design ensures that if one AZ becomes unavailable, the ALB continues to serve requests using instances in the other AZ. The combination of cross-zone load balancing and health-based target removal makes this the industry-standard resilient architecture.

Enabling versioning on the bucket creates a new version for every object put, overwrite, or delete, so a delete operation only inserts a delete marker that hides old versions rather than purging them; with versioning enabled, you can permanently recover any object version. MFA Delete fortifies this by requiring an MFA code (using root credentials) to permanently delete an object version, suspend versioning, or change the versioning state—thus preventing attackers or accidental admin actions from irreversibly destroying data.

A PodDisruptionBudget with maxUnavailable:1 guarantees that at most one Pod is unavailable during voluntary evictions such as node drains, and pod anti-affinity rules (preferably with topologyKey kubernetes.io/hostname) force the scheduler to place replicas on distinct nodes. This means an involuntary node failure can kill only one replica, and the remaining replicas continue to serve traffic. Combined, these mechanisms directly address both failure classes—involuntary hardware failures and voluntary maintenance—by ensuring the application always has at least N-1 replicas available across different failure domains.

CloudWatch metric filters scan log events for a pattern and publish a numeric metric each time it matches. Counting error-pattern occurrences produces the error count metric that the subsequent math expression and alarm consume to compute the error rate.

Global Accelerator uses two static Anycast IP addresses at AWS edge locations, which are announced from multiple points of presence. It monitors the health of your ALB or NLB endpoints and automatically routes each user's traffic to the closest endpoint that is healthy, using the AWS backbone instead of the public internet. This improves availability by failing over to a healthy endpoint within seconds and improves performance by reducing latency and jitter, but it still depends on the ALB to handle the actual HTTP/HTTPS load balancing.

DynamoDB auto scaling adjusts provisioned capacity based on actual usage, preventing most throttling, but it cannot anticipate sudden one-off spikes because it relies on trends. A Lambda dead-letter queue, combined with the function's built-in retries and exponential backoff, ensures that any event which still fails due to a throttle is safely captured for manual or automated replay rather than silently dropped. This two-tier approach balances elasticity with data durability, which is why it is the recommended solution for unpredictable write spikes.

EC2 Auto Recovery uses a CloudWatch alarm on the StatusCheckFailed_System metric to detect underlying host or network failures. When the alarm triggers, EC2 automatically relaunches the same instance on a new physical host while preserving the instance ID, private and Elastic IP addresses, and attached EBS volumes. This in-place recovery requires the instance to be EBS-backed and in a VPC, making it the correct choice for restoring availability after hardware failure.

Failover routing is the Route 53 policy explicitly designed for active-passive disaster recovery. It lets you mark one record (or record set within a group) as the primary and another as secondary, and associate each with a health check. Route 53 monitors the primary endpoint's health and, when the health check fails after the configured threshold, automatically returns the secondary record's answer for all DNS queries. This deterministic, health-driven promotion of the standby region matches the company's requirement for automatic failover.

An Auto Scaling group with health checks automatically replaces failed EC2 instances by monitoring them using EC2 status checks and optionally Elastic Load Balancing health checks. When an instance is marked unhealthy, the ASC terminates it and launches a new instance in an attempt to maintain the desired capacity, and it does so across multiple Availability Zones to increase resilience. This meets the requirement for automatic replacement based on instance health, and because it is a continuous, managed process, it is the correct solution for keeping critical applications available.

Deploying EC2 instances across two Availability Zones behind an Application Load Balancer provides both fault isolation and active load balancing. The ALB performs health checks, routes traffic only to healthy instances, and can distribute requests across both AZs, so if one entire AZ becomes unavailable, the other continues to serve traffic. This is the standard architecture for achieving regional high availability with an HTTP web application.