Courseiva

CCNA Resilient Cloud Questions

43 questions · Resilient Cloud topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A DevOps team is designing a disaster recovery solution for an Amazon RDS for MySQL database. The primary database is in us-east-1, and the recovery point objective (RPO) is 5 minutes, recovery time objective (RTO) is 1 hour. Which solution meets these requirements?

A.Enable Multi-AZ deployment for high availability.
B.Create a cross-Region read replica in the secondary Region.
C.Take manual snapshots and copy them to the secondary Region daily.
D.Configure automated backups with a retention period of 35 days.
AnswerB

A cross-Region read replica uses asynchronous replication to continuously copy changes from the source DB instance to a replica in the secondary Region, keeping data loss typically within 5 minutes. In a disaster, you can promote this replica to a standalone primary instance, which is a fast, reversible operation that meets the 1-hour RTO. This is the only option that both maintains an up-to-date copy in another Region and provides a ready-to-activate target for write traffic.

Why this answer

A cross-Region read replica in the secondary Region meets the RPO of 5 minutes because replication from the primary RDS instance to the read replica is asynchronous but typically completes within seconds to a few minutes, well under the 5-minute threshold. In a disaster, promoting the read replica to a standalone instance can be done manually or automated, and the RTO of 1 hour is achievable because promotion takes only a few minutes, leaving ample time for DNS and application failover. This solution provides a continuous replication stream without manual intervention, unlike snapshot-based approaches.

Exam trap

The trap here is that candidates confuse Multi-AZ (high availability within a Region) with cross-Region disaster recovery, assuming Multi-AZ protects against Regional failures, but it only protects against Availability Zone failures within the same Region.

How to eliminate wrong answers

Option A is wrong because Multi-AZ deployment provides high availability within a single Region (us-east-1) by synchronously replicating to a standby in a different Availability Zone, but it does not protect against a Regional disaster, so it cannot meet the cross-Region recovery requirement. Option C is wrong because taking manual snapshots daily and copying them to the secondary Region results in an RPO of up to 24 hours, far exceeding the required 5 minutes, and the copy operation adds additional latency. Option D is wrong because automated backups with a retention period of 35 days are stored within the same Region and cannot be used for cross-Region recovery; they also do not provide a mechanism to restore in a secondary Region within the required RPO/RTO.

Practice this question →
2
MCQeasy

A company runs a stateless web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer. The operations team needs to ensure that the application remains available if one AZ fails. Which solution is MOST resilient?

A.Configure the Auto Scaling group to launch instances in a single Availability Zone with a desired capacity of 6.
B.Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 4.
C.Configure the Auto Scaling group to launch instances in three Availability Zones with a desired capacity of 3.
D.Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 6, all in one AZ.
AnswerC

Configuring three Availability Zones with a desired capacity of three places one instance in each AZ, so if any single AZ fails, the remaining two instances continue serving traffic, preserving 66% of capacity. The Auto Scaling group will automatically detect the unhealthy instances and launch replacements in other healthy AZs, gradually restoring capacity to the desired level. Because the application is stateless, a load balancer can distribute traffic across the surviving instances, providing high availability with minimal disruption.

Why this answer

Distributing instances across three Availability Zones (AZs) with a desired capacity of 3 ensures that even if one AZ fails, the remaining two AZs still have at least 2 instances running, maintaining service capacity. The Application Load Balancer (ALB) automatically routes traffic away from the failed AZ, and the Auto Scaling group will replace lost instances in the healthy AZs, providing the highest resilience against a single-AZ failure.

Exam trap

The trap here is that candidates often think using two AZs is sufficient for high availability, but the question specifically asks for the 'MOST resilient' solution, and three AZs provide better fault isolation and recovery capacity than two, especially when the desired capacity is low.

How to eliminate wrong answers

Option A is wrong because launching all instances in a single AZ creates a single point of failure; if that AZ fails, all instances are lost and the application becomes unavailable. Option B is wrong because distributing instances across only two AZs with a desired capacity of 4 means that if one AZ fails, the remaining AZ may have only 2 instances (if evenly split), but the total capacity drops by 50%, and the Auto Scaling group cannot launch instances in the failed AZ, potentially leading to insufficient capacity. Option D is wrong because it configures instances in two AZs but places all 6 instances in one AZ, which is functionally identical to a single-AZ deployment and provides no resilience against an AZ failure.

Practice this question →
3
Multi-Selectmedium

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to regional outages. Which THREE steps should the company take to achieve multi-Region resilience? (Choose THREE.)

Select 3 answers
A.Use Amazon CloudFront with multiple origins pointing to each Region's API Gateway.
B.Configure Route 53 with a failover routing policy to direct traffic to the secondary Region if the primary fails.
C.Use DynamoDB global tables to replicate data across Regions.
D.Deploy Lambda@Edge functions to handle requests at edge locations.
E.Deploy a second API Gateway and Lambda function in another Region.
AnswersB, C, E

Route 53 failover routing enables traffic redirection.

Why this answer

Amazon Route 53 with a failover routing policy allows the company to route traffic to a secondary Region when health checks detect a failure in the primary Region. This provides DNS-level failover, which is a fundamental component of multi-Region resilience for HTTP-based applications.

Exam trap

The trap here is that candidates often confuse CloudFront's origin failover capability (which requires manual configuration of origin groups) with automatic multi-Region failover, or they mistakenly believe Lambda@Edge can serve as a full application backend across Regions, when in fact it is limited to edge processing and cannot replace regional Lambda deployments.

Practice this question →
4
MCQmedium

Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?

A.The resource ARN is incorrect; it should be the bucket ARN.
B.The policy only allows the action but does not deny actions that do not meet the condition.
C.The action should be s3:PutEncryptedObject instead of s3:PutObject.
D.The policy uses StringEquals instead of StringNotEquals.
AnswerB

Without an explicit Deny, other policies may allow uploads without encryption.

Why this answer

The IAM policy shown only allows the s3:PutObject action when the encryption condition is met, but it does not include a Deny statement to explicitly block uploads that do not satisfy the condition. In AWS IAM, an Allow statement alone does not prevent actions that fail the condition; it simply grants permission when the condition is true. Without a corresponding Deny, users with other permissions (e.g., from a broader policy) can still upload objects without encryption, as the Allow does not override other effective allows.

Exam trap

The trap here is that candidates assume an Allow statement with a condition implicitly denies requests that don't meet the condition, but AWS IAM requires an explicit Deny to block non-compliant actions.

How to eliminate wrong answers

Option A is wrong because the resource ARN in the policy (arn:aws:s3:::example-bucket/*) is correct for object-level operations like s3:PutObject, which require the object ARN (bucket/*), not just the bucket ARN. Option C is wrong because s3:PutEncryptedObject is not a valid AWS S3 action; the correct action is s3:PutObject, and encryption is enforced via conditions, not a separate action. Option D is wrong because using StringEquals is appropriate here to require the encryption header to equal 'AES256'; StringNotEquals would incorrectly allow uploads that do not specify encryption or specify a different value.

Practice this question →
5
Multi-Selecteasy

A company wants to design a highly available web application using AWS services. The application must be resilient to the failure of an entire AWS Region. Which THREE components should the architecture include? (Choose THREE.)

Select 3 answers
A.An Application Load Balancer (ALB) deployed in one Region.
B.Amazon Route 53 with a failover routing policy.
C.Auto Scaling groups in each Region with appropriate instance types.
D.Amazon EC2 instances in a single Region.
E.Amazon RDS Multi-AZ deployment with a cross-Region read replica.
AnswersB, C, E

Failover routing directs traffic to a secondary Region if the primary fails.

Why this answer

Amazon Route 53 with a failover routing policy is correct because it enables DNS-based health checking and automatic traffic routing to a secondary region when the primary region becomes unavailable. This is essential for cross-region disaster recovery, as Route 53 can monitor endpoint health and update DNS records to direct users to the healthy region, ensuring application availability despite a full region failure.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments (which provide high availability within a single Region) with cross-Region disaster recovery, and they may incorrectly assume that a single-Region ALB or EC2 instances can survive a full Region failure without a multi-Region architecture.

Practice this question →
6
MCQmedium

A company runs a critical application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. The DevOps team needs to ensure that if an entire Availability Zone fails, the application continues to serve traffic without manual intervention. What should the team do?

A.Use an Amazon ECS service auto-scaling policy to automatically replace tasks in the failed AZ.
B.Configure the ALB to enable cross-zone load balancing and enable the ECS service's AZ rebalancing feature.
C.Configure the ECS service to run tasks in at least two Availability Zones and enable the ECS service auto-recovery feature.
D.Set the ECS service's minimum healthy percent to 100 and maximum percent to 200.
AnswerC

Multi-AZ deployment plus auto-recovery ensures resilience.

Why this answer

The ECS service's AZ rebalancing feature automatically redistributes tasks across Availability Zones when an imbalance is detected, such as after an AZ failure. By configuring the service to run tasks in at least two AZs and enabling this feature, the ECS service will automatically launch replacement tasks in the remaining healthy AZs to maintain the desired count, ensuring continued traffic serving without manual intervention.

Exam trap

The trap here is that candidates often confuse auto-scaling (which adjusts capacity based on demand) with AZ rebalancing (which redistributes tasks after an AZ failure), leading them to choose Option A or B, or they mistakenly think deployment configuration settings like minimum/maximum percent (Option D) can handle AZ failures.

How to eliminate wrong answers

Option A is wrong because ECS service auto-scaling policies adjust the desired task count based on metrics like CPU or memory, but they do not automatically replace tasks lost due to an AZ failure; they only scale based on demand, not availability. Option B is wrong because ALB cross-zone load balancing distributes traffic across all AZs but does not replace failed tasks; the ECS service's AZ rebalancing feature is the correct mechanism for task redistribution after an AZ failure. Option D is wrong because setting minimum healthy percent to 100 and maximum percent to 200 controls deployment behavior (e.g., rolling updates) but does not address AZ failure recovery; it prevents task replacement during deployments but does not trigger automatic task redistribution after an AZ outage.

Practice this question →
7
MCQmedium

A company uses Amazon RDS Multi-AZ for disaster recovery. The primary DB instance in us-east-1a fails. What happens next?

A.The standby DB instance in us-east-1b is promoted automatically and the CNAME record is updated
B.The administrator must manually promote the standby instance
C.The primary instance is automatically rebuilt in the same AZ
D.A read replica in us-east-1b is automatically promoted to primary
AnswerA

RDS Multi-AZ performs automatic failover.

Why this answer

RDS Multi-AZ automatically fails over to the standby in a different Availability Zone within minutes. The CNAME record is updated to point to the standby DB instance, so no manual intervention is needed. Option A is correct because this automatic failover and CNAME update occurs.

Option B is wrong because no manual promotion is required. Option C is wrong because the primary is not rebuilt in the same AZ; it fails over to a standby in a different AZ. Option D is wrong because read replicas are not used for Multi-AZ failover; a standby instance is promoted.

Practice this question →
8
MCQeasy

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. To improve resilience, which configuration should be used for the EC2 instances?

A.Use one EC2 instance with a larger instance type
B.Use a single, large EC2 instance in one Availability Zone
C.Use multiple EC2 instances in one Availability Zone with health checks disabled
D.Use multiple EC2 instances across two or more Availability Zones
AnswerD

Provides fault tolerance across AZs.

Why this answer

D is correct because deploying multiple EC2 instances across two or more Availability Zones (AZs) ensures high availability and fault tolerance. If one AZ fails, the Application Load Balancer (ALB) automatically routes traffic to healthy instances in other AZs, maintaining service continuity. This aligns with the AWS Well-Architected Framework's resilience best practices for stateless applications.

Exam trap

The trap here is that candidates may think scaling vertically (larger instance) or using multiple instances in a single AZ is sufficient, but the DOP-C02 exam specifically tests the requirement for multi-AZ deployment to achieve resilience against AZ failures.

How to eliminate wrong answers

Option A is wrong because using a single, larger EC2 instance creates a single point of failure; if that instance fails, the entire application goes down. Option B is wrong because placing a single large instance in one AZ does not protect against AZ-level failures, such as power outages or network disruptions. Option C is wrong because using multiple instances in one AZ with health checks disabled means the ALB cannot detect and route away from failed instances, and a single AZ failure still takes down all instances.

Practice this question →
9
MCQmedium

A company's application runs on Amazon ECS with Fargate launch type. The application must be resilient to an Availability Zone failure. Which configuration should be used?

A.Create an ECS service with tasks distributed across multiple Availability Zones using a spread placement strategy
B.Use an ECS cluster with a cluster placement strategy that prefers the same Availability Zone
C.Define multiple task definitions, one for each Availability Zone
D.Use an ECS service with a single task in one Availability Zone and rely on auto-scaling
AnswerA

Spread strategy across AZs ensures resilience.

Why this answer

ECS services using the Fargate launch type can distribute tasks across multiple Availability Zones (AZs) by defining a spread placement strategy with the 'availabilityZone' dimension. This ensures that if one AZ fails, the tasks in the other AZs continue to serve traffic, providing resilience to an AZ failure. The spread strategy explicitly instructs ECS to place tasks evenly across AZs, which is essential for high availability.

Exam trap

The trap here is that candidates often confuse 'spread placement strategy' with 'binpack' or 'random' strategies, or they assume that simply using multiple subnets automatically distributes tasks without explicitly setting the spread strategy.

How to eliminate wrong answers

Option B is wrong because a cluster placement strategy that prefers the same Availability Zone would concentrate tasks in a single AZ, creating a single point of failure and violating the requirement for AZ resilience. Option C is wrong because defining multiple task definitions, one for each AZ, is unnecessary and does not inherently distribute tasks across AZs; task definitions are templates for containers, not placement mechanisms, and ECS services handle AZ distribution via placement strategies. Option D is wrong because a single task in one AZ cannot provide resilience to an AZ failure—if that AZ fails, the application becomes unavailable, and auto-scaling cannot react quickly enough to prevent downtime during an AZ outage.

Practice this question →
10
Multi-Selectmedium

A company is designing a disaster recovery plan for an application running on AWS. The plan must meet an RTO of 1 hour and an RPO of 15 minutes. Which TWO strategies can achieve these objectives? (Select TWO.)

Select 2 answers
A.Backup and restore using daily snapshots to a different Region
B.Warm standby in a different AWS Region with database replication
C.Cold standby in a different Region with infrastructure deployed on demand
D.Pilot light in a different Region with database replication
E.Multi-AZ deployment in the same Region
AnswersB, D

Can meet RTO 1 hr and RPO 15 min.

Why this answer

(Warm standby) is correct because it maintains a scaled-down but fully functional copy of the production environment in a different AWS Region, with database replication (e.g., Amazon RDS cross-Region read replicas or Aurora Global Database) ensuring an RPO of 15 minutes or less. The standby infrastructure can be scaled up within the 1-hour RTO, as it is already running and configured.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments (which are high availability within a Region) with cross-Region disaster recovery, failing to recognize that Multi-AZ does not protect against a full Regional outage.

Practice this question →
11
Multi-Selecthard

A company is designing a disaster recovery plan for a critical application with an RPO of 15 minutes and RTO of 1 hour. The application runs on EC2 instances with an RDS MySQL database. The primary Region is us-east-1. Which THREE actions should they take to meet the RPO and RTO? (Choose three.)

Select 3 answers
A.Schedule automated AMI backups of EC2 instances every 15 minutes
B.Launch EC2 instances in a single Availability Zone in the secondary Region to reduce costs
C.Configure Route 53 health checks and DNS failover to the secondary Region
D.Create a cross-Region read replica of the RDS MySQL database in us-west-2
E.Use AWS CloudFormation StackSets to deploy identical infrastructure in the secondary Region
AnswersA, C, D

Quick recovery of EC2 instances.

Why this answer

Automated AMI backups of EC2 instances every 15 minutes align with the 15-minute RPO by capturing incremental snapshots of the instance volumes. These AMIs can be used to launch replacement EC2 instances in the secondary Region within the 1-hour RTO, provided the infrastructure is pre-staged. The frequency of 15 minutes ensures that data loss is limited to at most 15 minutes of changes.

Exam trap

The trap here is that candidates often confuse infrastructure-as-code deployment (CloudFormation StackSets) with actual data replication, mistakenly believing that deploying identical infrastructure alone satisfies the RPO, when in fact continuous database replication is required to meet the 15-minute RPO.

Practice this question →
12
MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. During a recent traffic spike, the application became unavailable for 10 minutes. Analysis shows that the ALB's healthy host count dropped to zero because the instances failed health checks due to high CPU load. What is the MOST effective design change to improve resilience during future traffic spikes?

A.Use predictive scaling with a scheduled scaling policy for known peak times.
B.Increase the instance size to handle higher load.
C.Configure step scaling policies based on CPU utilization.
D.Set a higher CPU threshold for health checks.
AnswerA

Predictive scaling anticipates demand and scales out in advance, preventing overload.

Why this answer

Predictive scaling uses historical traffic data to forecast future demand and proactively adjust capacity before a spike occurs. This prevents the CPU from reaching critical levels that cause health check failures, ensuring the ALB always has healthy hosts. Scheduled scaling alone would not adapt to unexpected spikes, but predictive scaling combined with dynamic scaling provides both proactive and reactive resilience.

Exam trap

The trap here is that candidates confuse reactive scaling (step/target tracking) with proactive scaling (predictive/scheduled), assuming any CPU-based policy will suffice, but the question explicitly states the spike caused a drop to zero healthy hosts—meaning reactive scaling was too slow to prevent the outage.

How to eliminate wrong answers

Option B is wrong because simply increasing instance size (vertical scaling) is a single-point-of-failure approach and does not address the root cause of insufficient capacity during spikes; it also increases cost without improving elasticity. Option C is wrong because step scaling policies based on CPU utilization are reactive—they only add instances after CPU is already high, which can lead to a lag that causes health check failures during rapid spikes. Option D is wrong because raising the CPU threshold for health checks masks the underlying performance issue and risks allowing unhealthy instances to serve traffic, degrading user experience and potentially causing cascading failures.

Practice this question →
13
MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application stores session state in an in-memory cache on each instance. During deployment of a new version, users experience session timeouts and errors. Which design change will MOST effectively improve resilience and avoid session loss during deployments?

A.Enable sticky sessions (session affinity) on the ALB.
B.Migrate session state to ElastiCache for Redis.
C.Increase the ALB idle timeout to 600 seconds.
D.Increase the EC2 instance size to handle higher memory.
AnswerB

Offloading session state to ElastiCache makes sessions durable across instance replacements.

Why this answer

Migrating session state from in-memory EC2 instance storage to ElastiCache for Redis decouples session data from individual instances. This ensures that when a new deployment replaces instances, sessions persist independently, preventing timeouts and errors. ElastiCache provides a centralized, highly available session store that survives instance termination and scaling events.

Exam trap

The trap here is that candidates often confuse sticky sessions (which only route traffic consistently) with session persistence (which requires external storage), leading them to choose option A despite it not preserving session data across instance replacements.

How to eliminate wrong answers

Option A is wrong because enabling sticky sessions (session affinity) on the ALB would lock users to a specific instance, but during deployment that instance is terminated and replaced, causing session loss regardless of stickiness. Option C is wrong because increasing the ALB idle timeout to 600 seconds only extends how long the ALB keeps a connection open without data transfer; it does not preserve session state stored in the instance's memory when the instance is replaced. Option D is wrong because increasing the EC2 instance size to handle higher memory does not solve the fundamental problem of session state being ephemeral and lost during instance replacement in a deployment.

Practice this question →
14
MCQhard

A company runs a containerized microservices architecture on Amazon ECS with Fargate. The services communicate via an internal Application Load Balancer. Recently, a new deployment of Service A caused its health checks to fail. The DevOps engineer notices that the old tasks remain running and the service is unavailable. What configuration change would prevent this issue in future deployments?

A.Set the deployment minimum healthy percent to 50 and maximum percent to 100 with a health check grace period
B.Set the deployment circuit breaker to rollback on deployment failure and disable rollback
C.Change the deployment controller from ECS to CodeDeploy for blue/green deployments
D.Set the deployment minimum healthy percent to 0 and maximum percent to 200
AnswerA

With min healthy percent 50 and max percent 100, the ECS rolling deployment will keep half of the existing tasks running while starting replacements at 100% capacity; the deployment only substitutes tasks that pass the health check, so a misconfigured health check in the new task definition will fail the new tasks without ever reducing service capacity below 50%. The health check grace period further shields new tasks from being killed during their initial startup window before the container is ready, preventing a false failure from a slow start. This combination preserves an always-available old task pool until the new tasks are fully verified.

Why this answer

Setting the deployment minimum healthy percent to 50 and maximum percent to 100 ensures that during a rolling update, at least 50% of the tasks remain healthy, and the deployment will not continue if the new tasks fail health checks, preserving service availability. Option B is incorrect because the circuit breaker can roll back on failure, but 'disable rollback' negates that; it's a misconfigured setting. Option C is not a configuration change for this issue; CodeDeploy is a separate service used for blue/green deployments, not a direct fix for health check failures during rolling updates.

Option D is incorrect because setting minimum healthy percent to 0 and maximum percent to 200 allows all old tasks to be stopped before new ones start, causing downtime if health checks fail, as there are no healthy tasks to serve traffic.

Practice this question →
15
MCQhard

A company runs a stateless web application on Amazon ECS with Fargate launch type. The application experiences intermittent traffic spikes. The company wants to ensure that the application can scale automatically and remain resilient to underlying infrastructure failures. Which combination of actions should the DevOps engineer take?

A.Configure a scheduled scaling policy for the Amazon ECS service to add tasks during known peak hours.
B.Launch tasks in a single Availability Zone and use an Application Auto Scaling target tracking policy based on CPU utilization.
C.Configure a step scaling policy for the Amazon ECS service and increase the task memory size.
D.Configure an Application Auto Scaling target tracking policy based on memory utilization and enable Amazon ECS service auto-recovery.
AnswerD

An Application Auto Scaling target tracking policy with memory utilization as the metric dynamically scales out tasks when memory pressure increases and scales in when it subsides, providing immediate response to unpredictable workload spikes. Amazon ECS service auto-recovery, enabled through service health checks and automatic task replacement, ensures that any tasks that fail or become unhealthy are automatically restarted, maintaining desired availability. Together, these mechanisms deliver both elasticity—scaling with real-time demand—and resilience—self-healing from task or infrastructure failures—for the stateless web application.

Why this answer

It combines Application Auto Scaling target tracking based on memory utilization, which is a relevant metric for a stateless web application to handle traffic spikes, with Amazon ECS service auto-recovery, which automatically replaces unhealthy tasks to ensure resilience against underlying infrastructure failures. This approach provides both automatic scaling and fault tolerance without manual intervention.

Exam trap

The trap here is that candidates often assume CPU utilization is the only valid scaling metric for web applications, but memory utilization can be more appropriate for stateless workloads, and they may overlook the critical need for service auto-recovery to handle infrastructure failures in Fargate.

How to eliminate wrong answers

Option A is wrong because scheduled scaling is reactive to known peak hours but cannot handle intermittent, unpredictable traffic spikes, and it does not address resilience to infrastructure failures. Option B is wrong because launching tasks in a single Availability Zone creates a single point of failure, violating resilience best practices, and while target tracking based on CPU utilization can scale, it does not provide auto-recovery for failed tasks. Option C is wrong because step scaling policies can be effective, but increasing task memory size does not directly improve scaling or resilience; it may reduce the need for scaling but does not automate recovery from failures.

Practice this question →
16
MCQhard

A company is designing a multi-Region disaster recovery strategy for a stateless web application. The application runs on EC2 instances in an Auto Scaling group behind an ALB in us-east-1. The recovery point objective (RPO) is 15 minutes and recovery time objective (RTO) is 30 minutes. The application data is stored in Amazon RDS for PostgreSQL. Which combination of actions should the company take to meet the RPO and RTO?

A.Use RDS cross-Region replication to a standby DB instance in another Region. Maintain a warm standby environment (Auto Scaling group, ALB) in the disaster Region. Configure Route 53 health checks to fail over automatically.
B.Use RDS cross-Region snapshot copy every 15 minutes. In the disaster Region, manually launch a new environment and restore the latest snapshot.
C.Use RDS Multi-AZ in us-east-1. In the disaster Region, keep a standby Auto Scaling group and ALB. On failure, promote the Multi-AZ standby to primary and update DNS.
D.Use RDS read replicas in another Region. On failure, promote the read replica to a standalone instance and update the application.
AnswerA

Cross-Region replication maintains a continuously updated standby database in the DR Region, so the RPO is reduced to the replication lag, which is typically seconds for RDS MySQL/PostgreSQL. The pre-provisioned Auto Scaling group and Application Load Balancer constitute a warm standby that can receive traffic immediately after Route 53 health checks detect a regional impairment and automatically update DNS records to point to the DR endpoint. This combination of async data replication and warm infrastructure is what enables a low RPO and an RTO well under the 30-minute requirement.

Why this answer

It meets both the 15-minute RPO and 30-minute RTO. RDS cross-Region replication provides continuous asynchronous replication with minimal lag, typically well under 15 minutes, ensuring data is nearly up-to-date. The warm standby environment (pre-provisioned Auto Scaling group and ALB) in the disaster Region allows automatic failover via Route 53 health checks, enabling recovery within the 30-minute RTO without manual intervention.

Exam trap

The trap here is confusing Multi-AZ (single-Region HA) with cross-Region DR, leading candidates to choose Option C, which fails to protect against a Regional outage.

How to eliminate wrong answers

Option B is wrong because manual snapshot copies every 15 minutes cannot guarantee a 15-minute RPO due to snapshot creation and transfer delays, and manually launching a new environment and restoring the latest snapshot far exceeds the 30-minute RTO. Option C is wrong because RDS Multi-AZ in us-east-1 provides high availability within a single Region only; it does not replicate data to another Region, so a Regional failure would result in complete data loss and no DR capability. Option D is wrong because promoting a cross-Region read replica to a standalone instance can take several minutes and requires manual DNS updates, which together exceed the 30-minute RTO; also, read replicas may have replication lag that could violate the 15-minute RPO.

Practice this question →
17
MCQhard

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group across three Availability Zones. The instances run a Java application that connects to an Amazon RDS Multi-AZ MySQL database. The application also uses Amazon ElastiCache for Redis for session caching. The company recently experienced a severe outage where the ALB's 5xx error rate spiked to 100% for 45 minutes. The root cause was a combination of a slow-running query on the RDS primary instance and a subsequent failover that caused the application to lose connections to the database. The failover happened because the slow query caused the primary to become unresponsive, triggering a Multi-AZ failover. During the failover, the application's connection pool exhausted, and new connections failed. The application logs show a high rate of 'java.sql.SQLTimeoutException' and 'com.mysql.cj.exceptions.CJCommunicationsException'. The DevOps team needs to implement a long-term solution that minimizes the impact of similar incidents. The solution must be cost-effective and require minimal application changes. Which combination of actions should the DevOps team take?

A.Implement Amazon RDS Proxy to manage database connections and add read replicas to offload read traffic.
B.Use an Auto Scaling policy for EC2 based on RDS connection count and implement a read replica for the primary.
C.Configure Multi-AZ RDS with a synchronous standby and use Amazon RDS for MySQL with enhanced monitoring.
D.Increase the instance size of the RDS primary and enable Performance Insights to identify slow queries.
AnswerA

Amazon RDS Proxy sits between the application and the database, maintaining a warm connection pool that absorbs the spike in connection requests when EC2 instances reconnect during a failover. Because the proxy keeps connections to the RDS instance open and multiplexes client sessions, the primary no longer gets overwhelmed by thousands of short-lived connections. Adding read replicas moves read-heavy queries off the primary, reducing CPU/IO contention that can cause slow queries and cascading failovers. This directly addresses the root cause of connection exhaustion while preserving write consistency on the primary.

Why this answer

Amazon RDS Proxy is the correct solution because it efficiently manages database connection pooling, reducing the likelihood of connection exhaustion during failovers. By maintaining a warm connection pool and automatically reconnecting to the new primary after a Multi-AZ failover, RDS Proxy minimizes application-side connection timeouts and errors like SQLTimeoutException and CJCommunicationsException. Adding read replicas offloads read traffic, reducing the load on the primary and mitigating the risk of slow queries causing unresponsiveness.

This combination requires minimal application changes and is cost-effective compared to scaling the primary instance.

Exam trap

The trap here is that candidates often focus on scaling the database (e.g., increasing instance size or adding read replicas) to fix performance issues, but overlook the critical connection management problem that causes application-level timeouts during failover, which RDS Proxy directly addresses.

How to eliminate wrong answers

Option B is wrong because using an Auto Scaling policy based on RDS connection count does not address the root cause of connection exhaustion during failover; it only scales EC2 instances reactively, which may not prevent timeouts and adds complexity without solving the connection management issue. Option C is wrong because simply configuring Multi-AZ RDS with a synchronous standby and enhanced monitoring does not prevent connection pool exhaustion during failover; the application still needs to manage connections, and enhanced monitoring only provides visibility, not mitigation. Option D is wrong because increasing the instance size of the RDS primary and enabling Performance Insights addresses performance but does not solve the connection management problem during failover; it may delay the issue but does not prevent connection timeouts or exhaustion.

Practice this question →
18
MCQhard

A company runs a stateful web application on EC2 instances behind a Network Load Balancer (NLB) in a single Availability Zone. The application stores session state locally on the instance. The company wants to achieve high availability across multiple AZs with minimal application changes. What should the DevOps engineer do?

A.Add more AZs and configure the NLB with cross-zone load balancing.
B.Replace the NLB with an ALB and use ElastiCache for session storage.
C.Use a Multi-AZ RDS instance to store session state.
D.Replace the NLB with an ALB and enable sticky sessions (session affinity) using the ALB's cookie.
AnswerD

Replacing the NLB with an ALB and enabling sticky sessions via the ALB's load balancer-generated cookie is the correct minimal-change solution. The ALB inserts a stickiness cookie on the first response, and all subsequent requests from that client are routed to the same EC2 instance, preserving the locally stored session state without any application modifications. This leverages the ALB's Layer 7 capabilities to achieve session affinity while keeping the existing web application code unchanged.

Why this answer

Replacing the NLB with an ALB and enabling sticky sessions (session affinity) using the ALB's cookie allows the stateful web application to maintain session state across multiple AZs without modifying the application code. The ALB generates a cookie (AWSALB) that binds a client's session to a specific target instance, ensuring subsequent requests from the same client are routed to the same EC2 instance. This achieves high availability across AZs with minimal changes, as the application continues to store session state locally on the instance.

Exam trap

The trap here is that candidates often assume cross-zone load balancing or adding more AZs inherently solves high availability for stateful applications, but they overlook that session affinity is required to keep a client's requests directed to the same instance when session state is stored locally.

How to eliminate wrong answers

Option A is wrong because adding more AZs and configuring cross-zone load balancing with an NLB does not solve the session state problem; the NLB distributes traffic across instances without session affinity, so a client's requests may be routed to different instances in different AZs, breaking the locally stored session. Option B is wrong because replacing the NLB with an ALB and using ElastiCache for session storage requires application code changes to read/write session data to ElastiCache, which contradicts the requirement for minimal application changes. Option C is wrong because using a Multi-AZ RDS instance for session storage also requires significant application code changes to store and retrieve session data from the database, and it introduces unnecessary complexity and latency for session management.

Practice this question →
19
MCQhard

A company is implementing a disaster recovery strategy for its Amazon Aurora MySQL database. The primary database is in us-west-2. The company requires an RPO of less than 1 minute and an RTO of less than 5 minutes. Which solution meets these requirements?

A.Create a cross-Region read replica in the secondary Region and promote it during failover.
B.Use automated backups and restore to a new DB instance in the secondary Region.
C.Use Amazon Aurora Global Database with a secondary Region cluster.
D.Take manual snapshots of the DB instance and copy them to the secondary Region every hour.
AnswerC

Aurora Global Database replicates data from the primary Region to a secondary cluster using a dedicated storage-based replication channel with typical latency under one second, ensuring an RPO of under one minute. Failover can be initiated either manually or automatically, and a promoted secondary cluster becomes available in minutes without the need to restore from a backup or apply transaction logs. This is the only option that inherently satisfies both the 1-minute RPO and a recovery time objective measured in minutes.

Why this answer

Amazon Aurora Global Database is designed for low-latency cross-Region replication with a typical RPO of 1 second and RTO of 1 minute or less, meeting the <1 minute RPO and <5 minute RTO requirements. It uses a dedicated storage-level replication channel that keeps the secondary cluster fully synchronized without impacting primary performance, and failover involves promoting the secondary cluster to primary in under a minute.

Exam trap

The trap here is that candidates confuse a cross-Region read replica (Option A) with Aurora Global Database, assuming both provide similar failover speed, but the read replica's promotion process is slower and less reliable for meeting strict RTO/RPO targets.

How to eliminate wrong answers

Option A is wrong because a cross-Region read replica for Aurora MySQL uses asynchronous replication with a typical RPO of several seconds to minutes, but the promotion process can take longer than 5 minutes due to the need to apply remaining redo logs and reconfigure endpoints, failing the RTO requirement. Option B is wrong because automated backups are taken once per day (default retention of 1-35 days) and restoring to a new instance in a secondary Region requires copying the backup across Regions, which can take hours and far exceeds both the RPO and RTO limits. Option D is wrong because manual snapshots taken every hour provide an RPO of up to 60 minutes, which violates the <1 minute RPO requirement, and restoring from a snapshot in a secondary Region also takes significantly longer than 5 minutes.

Practice this question →
20
MCQeasy

A company is deploying a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application must be resilient to the failure of an entire Availability Zone. Which design should the company implement?

A.Launch EC2 instances in at least two Availability Zones and place them behind an Application Load Balancer with cross-zone load balancing enabled.
B.Use one EC2 instance in a single Availability Zone behind a Network Load Balancer.
C.Launch EC2 instances in one Availability Zone and use an Application Load Balancer to distribute traffic.
D.Deploy EC2 instances in two Availability Zones but use a single Application Load Balancer in one AZ.
AnswerA

This is the correct approach. An Application Load Balancer is a regional service; by enabling subnets in at least two Availability Zones, you create redundant ALB nodes. The ALB performs health checks and automatically routes traffic to healthy EC2 instances across both AZs. Cross-zone load balancing ensures each instance receives an equal share of requests, so the architecture tolerates an AZ failure and even an instance failure without manual intervention.

Why this answer

Deploying EC2 instances across at least two Availability Zones (AZs) behind an Application Load Balancer (ALB) with cross-zone load balancing enabled ensures that if an entire AZ fails, the ALB can route traffic to healthy instances in the remaining AZs. Cross-zone load balancing allows the ALB to distribute incoming requests evenly across all registered instances in all enabled AZs, which improves fault tolerance and resource utilization. This design meets the requirement for resilience to an AZ failure by eliminating a single point of failure at the AZ level.

Exam trap

The trap here is that candidates often assume that simply placing instances in multiple AZs behind a load balancer is sufficient, but they overlook the critical requirement that the load balancer itself must be deployed across multiple AZs to avoid being a single point of failure.

How to eliminate wrong answers

Option B is wrong because using a single EC2 instance in one AZ behind a Network Load Balancer (NLB) does not provide resilience to an AZ failure; if that AZ goes down, the application becomes unavailable. Option C is wrong because launching EC2 instances in only one AZ behind an ALB still creates a single point of failure at the AZ level; the ALB cannot route traffic to healthy instances if the entire AZ fails. Option D is wrong because deploying EC2 instances in two AZs but using a single ALB in one AZ means the ALB itself is a single point of failure; if that AZ fails, the ALB becomes unavailable, and traffic cannot be distributed to instances in the other AZ.

Practice this question →
21
Multi-Selecteasy

A company wants to design a highly available and fault-tolerant architecture for a stateless web application on AWS. Which TWO actions should they take? (Choose two.)

Select 2 answers
A.Use a single large EC2 instance to simplify management
B.Deploy multiple Application Load Balancers in each AZ
C.Launch EC2 instances in at least two Availability Zones
D.Use an RDS Multi-AZ deployment for the web server fleet
E.Use an Auto Scaling group to replace failed instances automatically
AnswersC, E

Launching EC2 instances in at least two Availability Zones is the foundational principle for highly available web server fleets. Availability Zones are physically separate data centers with independent power, cooling, and networking, so a failure in one AZ does not affect the other. Combined with a load balancer that spans those same AZs, traffic automatically continues to be served by healthy instances if one AZ loses capacity. This design eliminates the single-AZ dependency and is a core requirement for fault-tolerant compute tiers.

Why this answer

To achieve high availability and fault tolerance for a stateless web application, you should deploy EC2 instances in at least two Availability Zones (C) to eliminate a single point of failure, and use an Auto Scaling group (E) to automatically replace failed instances and maintain desired capacity. Option A is incorrect because a single large instance is a single point of failure and does not provide fault tolerance. Option B is incorrect because multiple Application Load Balancers per AZ are unnecessary; a single ALB can route traffic across multiple AZs.

Option D is incorrect because RDS Multi-AZ is a database feature, not for the web server fleet.

Practice this question →
22
MCQeasy

A DevOps engineer is designing a resilient architecture for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional spikes in traffic that cause Lambda function throttling and increased error rates. What is the MOST effective way to improve resilience and reduce throttling?

A.Increase the Lambda function memory to the maximum allowed.
B.Enable DynamoDB auto scaling for the table to handle traffic spikes.
C.Set API Gateway throttling limits to match the expected peak traffic.
D.Reserve concurrency for the Lambda function to ensure it always has available capacity.
AnswerD

Reserved concurrency sets a hard upper limit on the number of simultaneous executions for a specific function and, more importantly, guarantees that this amount of capacity is reserved exclusively for that function from the account's total concurrency pool. This prevents other functions from exhausting the shared pool and ensures the critical function can always handle its peak load without being throttled. It also makes the function's behavior predictable during traffic spikes, because the reserved capacity is always available for that function's invocations.

Why this answer

The stem specifies that traffic spikes cause Lambda function throttling. Reserving concurrency for the Lambda function (Option D) guarantees a dedicated portion of the account-level concurrency limit, preventing other functions from exhausting capacity and directly mitigating throttling. Option B (DynamoDB auto scaling) would only help if the throttling were caused by DynamoDB capacity issues, but the stem makes no mention of database errors.

Option A (increasing memory) does not address concurrency limits, and Option C (API Gateway throttling) can limit incoming requests but does not guarantee that Lambda has capacity to process them.

Exam trap

The trap is to assume that downstream services like DynamoDB are the bottleneck causing Lambda throttling. However, the stem clearly states that traffic spikes directly cause Lambda throttling, indicating that the concurrency limit is the primary constraint.

How to eliminate wrong answers

Option A is wrong because increasing Lambda memory also increases CPU and network allocation, but it does not resolve throttling caused by DynamoDB capacity limits or Lambda concurrency limits; it only improves execution speed for compute-bound functions. Option C is wrong because setting API Gateway throttling limits to match expected peak traffic would cap requests at that level, rejecting legitimate traffic during spikes rather than improving resilience. Option D is wrong because reserving concurrency for the Lambda function guarantees a fixed number of concurrent executions, but if the DynamoDB table lacks sufficient capacity, those executions will still fail due to database throttling, and reserved concurrency can also waste capacity during low traffic.

Practice this question →
23
MCQhard

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

A.The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'
B.The bucket is not versioned, so the policy does not apply to object versions
C.The policy uses Deny, but an Allow policy from another statement overrides it
D.The Deny statement's Resource specifies only the objects, not the bucket itself
AnswerD

The Resource does not include the bucket ARN, so bucket-level operations like ListBucket are not denied.

Why this answer

The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Exam trap

The trap here is that candidates assume a Deny statement on `/*` covers all requests, but they overlook that the bucket ARN itself must be explicitly included to enforce HTTPS on bucket-level operations, not just object operations.

How to eliminate wrong answers

Option A is wrong because `aws:SecureTransport` is correctly spelled with a capital 'S' and capital 'T' — the condition key is case-sensitive and must be exactly `aws:SecureTransport`. Option B is wrong because versioning is irrelevant to enforcing HTTPS; bucket policies apply to all object versions regardless of versioning status, and the Deny statement would still apply to `/*` resources. Option C is wrong because an explicit Deny in a bucket policy always overrides any Allow, regardless of other statements, per IAM policy evaluation logic (Deny is evaluated first and is definitive).

Practice this question →
24
MCQhard

A company uses AWS CloudFormation to deploy infrastructure. The stack creation fails with the error: 'Resource handler returned message: 'The security group does not exist in VPC'.' The template references a security group by name. What is the MOST likely cause?

A.The security group name is misspelled or uses incorrect case
B.The IAM role used for CloudFormation does not have permissions to describe security groups
C.The stack is being created in a Region where the security group does not exist
D.The template uses a parameter that resolves to the default VPC security group
AnswerA

Security group names in EC2 are case-sensitive, and CloudFormation's lookup by name uses an exact, literal string match against the security groups within the specified VPC. If you reference a group by name and the template contains a typo, wrong case, or an unintended trailing space, the API returns no matching group, which CloudFormation reports as a 'security group not found' error. This is the most frequent root cause in practice because names like 'web-SG' and 'web-sg' are considered distinct, and the error message often appears immediately after a small edit or a manual copy-paste from a different source.

Why this answer

The error 'Resource handler returned message: The security group does not exist in VPC' occurs when CloudFormation cannot find a security group with the specified name in the target VPC. The most likely cause is a misspelling or case sensitivity issue (Option A), as CloudFormation matches security group names exactly. While region scoping (Option C) can also cause a similar error, the combination of a name-based reference and the specific error wording points to a name mismatch as the most common issue.

IAM permission errors (Option B) would typically return an authorization error, not a 'does not exist' error. Option D is incorrect because a default VPC security group exists and would not cause this error unless it is missing, which is unlikely.

Exam trap

Candidates often overlook that security group name resolution is case-sensitive and exact. While region scoping can cause a similar error, the most frequent cause is a typo or case mismatch in the security group name referenced in the template.

How to eliminate wrong answers

Option B is wrong because the error message specifically indicates the security group does not exist in the VPC, not a permissions issue; an IAM permissions error would produce a different message such as 'AccessDenied' or 'Unauthorized operation'. Option D is wrong because referencing a parameter that resolves to the default VPC security group would not cause this error; the default security group exists in every VPC and would be found, so the error would not occur unless the VPC itself is missing or the parameter value is invalid.

Practice this question →
25
MCQhard

A company runs a critical application on Amazon ECS with the Fargate launch type. The application is deployed across three Availability Zones. Each service has its own Application Load Balancer. The company wants to implement a blue/green deployment strategy to reduce risk. They currently use AWS CodeDeploy for ECS deployments. During a recent deployment, the company noticed that the new version (green) was not receiving any traffic even after passing all health checks. The CodeDeploy configuration uses a 'Linear10PercentEvery3Minutes' traffic shifting configuration. What is the most likely reason that the green tasks are not receiving traffic?

A.The CodeDeploy deployment group is not associated with the correct ECS service.
B.The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy and not route traffic.
C.The blue target group is still set as the production target group in the load balancer listener.
D.The green tasks are in a different VPC than the load balancer.
AnswerB

In CodeDeploy's ECS blue/green deployment, the green target group's health checks are the gating mechanism for traffic shifting. If the health check path, port, or interval is misconfigured, the green tasks are marked unhealthy even though the containerized application is running normally, so CodeDeploy never receives the signal that the green fleet is ready. As a result, the listener remains pointed at the blue target group, and the deployment times out waiting for a healthy green target.

Why this answer

The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy. With a 'Linear10PercentEvery3Minutes' traffic shifting configuration, CodeDeploy gradually shifts traffic in 10% increments every 3 minutes, but only if the green target group passes health checks. If the health check fails, CodeDeploy stops traffic shifting, leaving the green tasks with zero traffic despite the tasks themselves being healthy.

Exam trap

The trap here is that candidates assume health checks passing on the ECS tasks means traffic will automatically route, but CodeDeploy relies on the target group's health check configuration, not the task's health status, to determine when to shift traffic.

How to eliminate wrong answers

Option A is wrong because if the CodeDeploy deployment group were not associated with the correct ECS service, the deployment would fail entirely or target the wrong service, but the green tasks would still be created and potentially receive traffic if health checks passed. Option C is wrong because CodeDeploy automatically updates the load balancer listener rules to point to the green target group during the traffic shifting process; the blue target group being set as production is the initial state, but CodeDeploy changes it as traffic shifts. Option D is wrong because ECS Fargate tasks and the load balancer must be in the same VPC for the service to function; if they were in different VPCs, the service would not register targets or pass health checks at all, not just fail to receive traffic after health checks pass.

Practice this question →
26
MCQmedium

A company's application uses Amazon SQS to decouple microservices. During peak hours, the SQS queue backlog grows significantly, causing processing delays. The DevOps team wants to reduce latency without increasing costs unnecessarily. What should the team do?

A.Increase the visibility timeout to allow consumers more time to process messages.
B.Use an SQS queue with priority settings to process high-priority messages first.
C.Increase the SQS queue's throughput by requesting a quota increase.
D.Configure Auto Scaling for the consumer fleet based on the ApproximateNumberOfMessagesVisible metric.
AnswerD

Auto Scaling adds consumers as queue depth increases, reducing processing time.

Why this answer

Scaling the consumer fleet based on the ApproximateNumberOfMessagesVisible metric directly addresses the backlog by adding more processing capacity when the queue grows. This approach reduces latency dynamically without incurring unnecessary costs during off-peak hours, as it only scales up when needed. Auto Scaling with SQS metrics is a cost-effective, elastic solution for handling variable workloads.

Exam trap

The trap here is that candidates may confuse SQS's throughput capabilities with consumer-side scaling, assuming that increasing queue throughput (Option C) solves backlog, when in fact SQS already handles high throughput and the bottleneck is the consumer processing rate.

How to eliminate wrong answers

Option A is wrong because increasing the visibility timeout does not reduce backlog; it only gives consumers more time to process a message, which can actually increase latency if consumers fail or take longer, as messages remain hidden longer. Option B is wrong because standard SQS queues do not support priority settings; FIFO queues offer ordering but not priority-based message selection, and SQS has no built-in priority feature. Option C is wrong because SQS queues already offer virtually unlimited throughput by default (up to 3,000 messages per second for FIFO with batching, and unlimited for standard), so requesting a quota increase is unnecessary and does not address consumer-side processing capacity.

Practice this question →
27
MCQmedium

A company runs a critical e-commerce application on Amazon EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The application must be resilient to an Availability Zone (AZ) failure. What is the MOST resilient configuration?

A.Configure the Auto Scaling group to launch instances in a single AZ with a larger instance type.
B.Deploy a single large EC2 instance in one AZ and use an Elastic IP for failover.
C.Use a Network Load Balancer instead of an ALB and deploy instances in two AZs.
D.Configure the Auto Scaling group to span at least three AZs and set the ALB to route traffic to all AZs.
AnswerD

Multi-AZ deployment ensures resilience.

Why this answer

Spanning the Auto Scaling group across at least three Availability Zones (AZs) and routing traffic from the ALB to all AZs ensures that if one AZ fails, the remaining AZs can handle the load without interruption. This configuration leverages the ALB's native cross-zone load balancing and Auto Scaling's ability to maintain desired capacity across multiple AZs, providing fault isolation and high availability for the critical e-commerce application.

Exam trap

The trap here is that candidates often confuse high availability with fault tolerance, mistakenly thinking that a single large instance or a single AZ with a larger instance type provides resilience, when in fact distributing workloads across multiple AZs is the only way to survive an AZ failure without manual intervention.

How to eliminate wrong answers

Option A is wrong because launching instances in a single AZ creates a single point of failure; if that AZ fails, the entire application becomes unavailable regardless of instance size. Option B is wrong because a single large EC2 instance with an Elastic IP for failover is not automated and still relies on manual intervention or additional scripting; it does not provide automatic recovery or load distribution, and the Elastic IP failover does not handle traffic routing at the application layer. Option C is wrong because while a Network Load Balancer (NLB) can distribute traffic across AZs, it operates at Layer 4 and lacks the application-layer features (e.g., path-based routing, host-based routing, HTTP/2 support) required for a typical e-commerce application; replacing the ALB with an NLB would break critical functionality, and the question explicitly requires the most resilient configuration, which includes the ALB's advanced routing capabilities.

Practice this question →
28
Multi-Selectmedium

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers
A.Use DynamoDB on-demand capacity mode for the table.
B.Configure Lambda provisioned concurrency to keep a set number of execution environments warm.
C.Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.
D.Increase the Lambda function timeout to the maximum (15 minutes).
E.Set API Gateway throttling limits to a high value to prevent throttling.
AnswersA, B

On-demand instantly scales to handle spikes.

Why this answer

DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Exam trap

The trap here is that candidates often confuse DynamoDB auto scaling with on-demand capacity, thinking auto scaling can handle sudden spikes as effectively as on-demand, but auto scaling has a lag time and can still throttle during rapid bursts.

Practice this question →
29
MCQmedium

A company runs a web application on AWS that uses Amazon SQS to decouple the frontend from the backend processing. The application experiences sudden spikes in traffic, causing the SQS queue to accumulate a large number of messages. The backend workers are unable to process messages fast enough, leading to increased latency. What solution can the company implement to improve the resilience and scalability of the backend?

A.Reduce the receive message wait time (long polling) to poll the queue more frequently.
B.Increase the visibility timeout of the SQS queue to allow more time for processing.
C.Use an SQS FIFO queue instead of a standard queue to ensure ordered processing.
D.Configure an Auto Scaling group for the backend workers with a scaling policy based on the SQS queue depth.
AnswerD

The correct solution is to attach an Auto Scaling policy to the SQS queue depth metric (e.g., ApproximateNumberOfMessagesVisible) and configure the backend workers as an Auto Scaling group. As the number of available messages grows, the policy launches additional EC2 workers to increase aggregate polling and processing throughput; as the queue drains, it terminates excess workers. This directly ties compute capacity to the ingested message volume, which is the standard pattern for decoupled, event-driven autoscaling with SQS.

Why this answer

Configuring an Auto Scaling group for the backend workers with a scaling policy based on the SQS queue depth (ApproximateNumberOfMessagesVisible) directly addresses the sudden traffic spikes. This approach dynamically adds more worker instances when the queue depth increases, improving processing throughput and reducing latency. It ensures the backend scales in response to demand, enhancing both resilience and scalability.

Exam trap

The trap here is that candidates often confuse operational fixes (like adjusting polling or visibility timeout) with architectural scalability solutions, failing to recognize that only dynamic scaling of compute resources can handle unpredictable traffic spikes.

How to eliminate wrong answers

Option A is wrong because reducing the receive message wait time (long polling) to poll more frequently would increase the number of empty responses and API calls, potentially throttling the workers without improving processing capacity; long polling (wait time up to 20 seconds) is actually more efficient for reducing latency and empty receives. Option B is wrong because increasing the visibility timeout only gives workers more time to process a single message, but does not address the root cause of insufficient worker capacity; it can even cause message processing delays if workers fail and messages become visible again after the timeout. Option C is wrong because using an SQS FIFO queue ensures exactly-once processing and message ordering, but does not improve throughput or scalability; FIFO queues have a lower throughput limit (300 transactions per second without batching) compared to standard queues, which would worsen the backlog during spikes.

Practice this question →
30
MCQhard

A company uses AWS Lambda functions to process events from an Amazon SQS queue. The Lambda function occasionally fails due to a transient downstream service error. The DevOps team wants to ensure that failed messages are not lost and can be retried later. The team also wants to reduce the number of invocations on the downstream service. Which configuration should the team use?

A.Configure a dead-letter queue (DLQ) on the SQS queue and set the Lambda function's reserved concurrency to 1.
B.Configure an Amazon SNS topic as a Lambda destination for failure events and subscribe the SQS queue to it.
C.Configure a dead-letter queue (DLQ) on the Lambda function and set the function's maximum retry attempts to 2.
D.Configure the Lambda function to write failed messages to an Amazon DynamoDB table and set up a scheduled Lambda to retry.
AnswerA

Setting a dead-letter queue (DLQ) on the SQS queue ensures that messages which exhaust their retry attempts are preserved for later inspection, while assigning reserved concurrency of 1 to the Lambda function caps the maximum number of concurrent invocations to exactly one. This hard limit prevents Lambda from scaling out to hundreds of executions when the downstream service is slow or failing, because the SQS event source mapping can only invoke one function at a time, thereby throttling the rate of calls to the downstream service. As a result, the downstream service receives at most one in‑flight request, avoiding overload and allowing it to recover gracefully. The queue‑level DLQ captures messages that ultimately fail after all retries, so no data is lost while the concurrency limit protects the bottleneck.

Why this answer

Configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that exhaust their retries (due to Lambda failures) are preserved for later reprocessing, preventing data loss. Setting the Lambda function's reserved concurrency to 1 throttles the function to a single concurrent invocation, which naturally reduces the rate of downstream service calls and allows the SQS queue's visibility timeout and redrive policy to manage retry timing, thereby reducing pressure on the downstream service.

Exam trap

The trap here is that candidates often confuse a Lambda function's DLQ (which captures invocation records) with an SQS queue's DLQ (which captures the original messages), and they overlook that reserved concurrency is a direct way to throttle invocation rate, not just a capacity planning tool.

How to eliminate wrong answers

Option B is wrong because using an SNS topic as a Lambda destination for failure events and subscribing the SQS queue to it would create an asynchronous loop where failed events are re-sent to the same SQS queue, potentially causing infinite retries without a controlled retry mechanism or throttling to protect the downstream service. Option C is wrong because a dead-letter queue on the Lambda function (via Lambda destinations) only captures invocation records, not the original SQS messages; setting maximum retry attempts to 2 on the Lambda function does not reduce downstream service invocations—it actually increases them by retrying immediately without backoff. Option D is wrong because writing failed messages to DynamoDB and using a scheduled Lambda to retry adds unnecessary complexity and latency, and does not inherently reduce downstream service invocations; it also bypasses SQS's built-in retry and DLQ mechanisms, which are simpler and more reliable for transient failures.

Practice this question →
31
MCQmedium

A company is deploying a stateful application on Amazon EKS. The application requires persistent storage that can be reattached to a new pod if the original pod fails. The cluster spans multiple Availability Zones. Which storage solution provides the BEST resilience and meets these requirements?

A.Amazon S3 bucket with a mountpoint.
B.Amazon EBS with gp3 volume type.
C.EC2 instance store volumes.
D.Amazon EFS file system.
AnswerD

Amazon EFS is a regional, elastic, fully managed NFS file system that is accessible from all Availability Zones in the region. It supports the ReadWriteMany access mode, allowing multiple pods across different nodes and AZs to share the same file system simultaneously. EFS integrates with the EKS CSI driver and provides strong consistency and durability, making it an ideal persistent storage solution for stateful applications deployed on EKS.

Why this answer

Amazon EFS provides a fully managed, regional NFS file system that can be mounted concurrently by multiple pods across different Availability Zones. It is designed for high availability and durability, automatically replicating data across multiple AZs, and supports automatic reattachment to a new pod if the original pod fails, making it the best choice for stateful applications requiring resilient, shared persistent storage on Amazon EKS.

Exam trap

The trap here is that candidates often assume EBS is the default persistent storage for Kubernetes because of its common use with single-node stateful workloads, but they overlook the multi-AZ requirement that makes EBS unsuitable due to its zonal scope, while EFS's regional nature provides the necessary cross-AZ resilience.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a file system; using a mountpoint (e.g., s3fs) introduces POSIX compatibility issues, performance overhead, and does not provide the native file locking or consistent read-after-write semantics required for a stateful application's persistent storage. Option B is wrong because Amazon EBS volumes are tied to a single Availability Zone and cannot be reattached to a pod in a different AZ; if the original pod fails and a replacement pod is scheduled in another AZ, the EBS volume cannot be mounted, breaking resilience across the multi-AZ cluster. Option C is wrong because EC2 instance store volumes are ephemeral and data is lost if the instance stops, terminates, or fails; they do not provide persistent storage that survives pod or node failures.

Practice this question →
32
MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. During a recent failure of one AZ, the application experienced downtime because the Auto Scaling group did not launch new instances quickly enough. What should a DevOps engineer do to improve resilience?

A.Configure the Auto Scaling group to span multiple AZs and enable health checks to replace unhealthy instances.
B.Use a larger AMI to reduce boot times.
C.Increase the instance size of the EC2 instances to handle more traffic.
D.Configure the Auto Scaling group to launch instances in a single AZ with a larger instance count.
AnswerA

Multiple AZs provide high availability and health checks ensure quick replacement.

Why this answer

Configuring the Auto Scaling group to span multiple Availability Zones (AZs) and enabling health checks ensures that if an entire AZ fails, the Auto Scaling group can launch replacement instances in the remaining healthy AZs. The ALB health checks detect unhealthy instances and trigger the Auto Scaling group to replace them, reducing downtime. This approach leverages the fault isolation of multiple AZs and the automatic scaling capabilities of AWS Auto Scaling.

Exam trap

The trap here is that candidates often focus on instance-level improvements (like larger AMIs or instance sizes) instead of architectural resilience across Availability Zones, which is the core requirement for AZ failure scenarios.

How to eliminate wrong answers

Option B is wrong because using a larger AMI would increase boot times, not reduce them, and boot time is not the primary bottleneck in this scenario—the issue is the lack of instances in other AZs. Option C is wrong because increasing instance size handles more traffic per instance but does not address the failure of an entire AZ; if all instances are in the same AZ, they all fail simultaneously. Option D is wrong because launching instances in a single AZ with a larger instance count concentrates all resources in one AZ, making the application vulnerable to a single AZ failure, which is exactly the problem described.

Practice this question →
33
MCQeasy

A company's DevOps team is designing a disaster recovery plan for a critical application. The application runs on EC2 instances with an RDS MySQL database. The Recovery Time Objective (RTO) is 15 minutes, and the Recovery Point Objective (RPO) is 1 hour. Which approach BEST meets these requirements?

A.Use backup and restore with daily snapshots stored in S3 and cross-Region replication.
B.Use a multi-Region application with Route 53 latency-based routing and RDS read replicas in the DR Region.
C.Use a warm standby strategy with a scaled-down copy of the production environment in the DR Region, and replicate data using RDS Multi-AZ with synchronous replication.
D.Use a pilot light strategy with EC2 instances stopped and RDS snapshots copied to the DR Region.
AnswerB

Cross-Region RDS read replicas provide asynchronous replication with an RPO of seconds to minutes, meeting the 1-hour RPO. Promoting a read replica and redirecting traffic via Route 53 can be done within minutes, meeting the 15-minute RTO. This is a valid warm standby configuration.

Why this answer

The best approach for a multi-Region disaster recovery with RTO of 15 minutes and RPO of 1 hour. By deploying the application in multiple regions and using RDS cross-Region read replicas, data is asynchronously replicated with an RPO typically within seconds to minutes, well within 1 hour. In the event of a failure, the read replica can be promoted to a primary instance, and Route 53 routing (preferably failover routing, but latency-based routing can also redirect traffic) can shift traffic to the DR region.

This failover can be completed within a few minutes, meeting the 15-minute RTO. Option A fails because daily snapshots exceed the 1-hour RPO and restore times exceed the RTO. Option C incorrectly relies on RDS Multi-AZ, which is a single-region high-availability feature and does not provide cross-region replication; thus it cannot serve as a disaster recovery solution across regions.

Option D, pilot light with snapshots, has a longer RTO as it requires restoring instances from snapshots and starting them, likely exceeding 15 minutes.

Exam trap

A common trap is to assume that RDS Multi-AZ provides cross-region replication; however Multi-AZ is a high-availability feature within a single region. For cross-region disaster recovery, asynchronous cross-Region read replicas or other cross-region replication methods are required. A warm standby architecture can be combined with cross-region replication, but the key is the replication mechanism, not Multi-AZ.

How to eliminate wrong answers

Option A is wrong because daily snapshots with cross-Region replication result in an RPO of up to 24 hours, far exceeding the 1-hour requirement, and the restore process takes longer than 15 minutes. Option B is wrong because Route 53 latency-based routing is for active-active traffic distribution, not disaster recovery failover, and RDS read replicas are asynchronous, leading to potential data loss and RPO that can exceed 1 hour during a failure. Option D is wrong because a pilot light strategy with stopped EC2 instances and RDS snapshots copied to the DR Region requires provisioning and restoring from snapshots, which typically takes longer than 15 minutes to become fully operational, and the RPO is limited by snapshot frequency.

Practice this question →
34
MCQmedium

A company runs a web application on EC2 instances behind an ALB. To improve resilience, they want to automatically re-register failed instances. Which solution meets this requirement?

A.Set up a CloudWatch alarm to terminate the instance and notify an operator to re-register it.
B.Enable EC2 instance recovery and configure ALB health checks to deregister unhealthy instances.
C.Configure Auto Scaling to launch a new instance on instance failure.
D.Use Route 53 health checks to detect failure and update DNS to remove the instance.
AnswerB

EC2 instance recovery replaces the instance and ALB health checks will automatically re-register it once healthy.

Why this answer

Enabling EC2 instance recovery automatically restarts the instance on a new healthy host if the underlying hardware fails, while ALB health checks detect application-level failures and deregister unhealthy instances from the target group. This combination ensures failed instances are automatically replaced in the load balancer's rotation without manual intervention, meeting the resilience requirement.

Exam trap

The trap here is that candidates confuse EC2 instance recovery (which restarts the instance on a new host) with Auto Scaling's ability to replace instances, but the question specifically asks for re-registering the failed instance, not launching a new one.

How to eliminate wrong answers

Option A is wrong because terminating the instance and notifying an operator to re-register it introduces manual steps and does not automate re-registration; it also lacks automatic recovery. Option C is wrong because Auto Scaling launches a new instance only when the instance is terminated or fails a health check, but it does not automatically re-register the existing failed instance; it replaces it, which may not be desired if the instance can be recovered. Option D is wrong because Route 53 health checks remove the instance from DNS routing, but they do not re-register the instance with the ALB target group; they only affect DNS-level traffic distribution, not the ALB's target group membership.

Practice this question →
35
MCQeasy

A company wants to ensure that its application can recover from an Amazon S3 service disruption. The application reads and writes data to S3. Which strategy should the application implement to achieve resilience?

A.Store all data in a single S3 bucket with versioning enabled
B.Implement application logic to fall back to an S3 bucket in a different Region if the primary bucket is unavailable
C.Enable S3 Cross-Region Replication with automatic failover
D.Use S3 Transfer Acceleration to improve data transfer speed
AnswerB

This pattern gives the application explicit control over failover by first attempting to read from the primary bucket and, on failure (e.g., throttling, regional outage, or S3 service disruption), switching to a pre-created bucket in another Region. It is a common active-passive architecture that avoids reliance on any AWS feature providing automatic DNS-level or data-plane failover. Because the application itself detects the failure, it can also manage consistency, replication lag, and write buffering appropriately. This satisfies the recovery requirement because data availability is maintained as long as at least one Region is operational.

Why this answer

Implementing application logic to fall back to an S3 bucket in a different Region provides resilience against a regional S3 service disruption. S3 buckets are regional resources, so if one Region experiences an outage, the application can redirect reads and writes to a bucket in another Region. This approach requires the application to handle errors from the primary bucket and switch to the secondary bucket, ensuring continued availability without relying on automatic failover mechanisms that may not be instantaneous.

Exam trap

The trap here is that candidates often confuse S3 Cross-Region Replication (CRR) with automatic failover, but CRR is asynchronous and does not provide built-in failover; the application must still implement its own fallback logic to achieve resilience.

How to eliminate wrong answers

Option A is wrong because storing all data in a single S3 bucket with versioning enabled protects against accidental deletion or overwrite, but it does not provide resilience against a regional S3 service disruption, as the bucket is still tied to a single Region. Option C is wrong because S3 Cross-Region Replication (CRR) replicates objects asynchronously to another Region, but it does not include automatic failover; the application must still implement logic to detect the primary bucket's unavailability and switch to the replicated bucket. Option D is wrong because S3 Transfer Acceleration improves data transfer speed over long distances by using AWS edge locations, but it does not provide any resilience or failover capability during a regional S3 service disruption.

Practice this question →
36
Multi-Selectmedium

A company is using AWS CloudFormation to deploy a critical application stack. The company wants to ensure that the stack can be recovered quickly in case of a failure. Which THREE strategies should the company implement? (Choose THREE.)

Select 3 answers
A.Disable rollback on stack creation failure to preserve resources for debugging.
B.Use StackSets to deploy the stack across multiple Regions.
C.Define the entire application in a single CloudFormation template.
D.Use nested stacks to separate components into reusable templates.
E.Use change sets to review changes before updating the stack.
AnswersB, D, E

StackSets enable multi-Region deployment for resilience.

Why this answer

AWS CloudFormation StackSets allow you to deploy stacks across multiple AWS Regions and accounts from a single template, enabling multi-Region disaster recovery. By deploying the critical application stack in multiple Regions, you can quickly fail over to a secondary Region if the primary fails, meeting the requirement for rapid recovery.

Exam trap

The trap here is that candidates often confuse 'recovery' with 'debugging' and select disabling rollback (Option A) thinking it helps preserve resources, but it actually hinders recovery by leaving failed resources in place.

Practice this question →
37
Multi-Selectmedium

A company is designing a resilient architecture for a web application that uses Amazon RDS for MySQL. The application must be able to withstand the loss of an entire AWS Region. Which TWO actions should the company take?

Select 2 answers
A.Use RDS Proxy to pool database connections.
B.Configure automated backups to be copied to another Region.
C.Enable Multi-AZ deployment for the RDS instance.
D.Create a Cross-Region Read Replica.
E.Enable deletion protection on the RDS instance.
AnswersB, D

Allows recovery from backups in another Region.

Why this answer

To withstand the loss of an entire AWS Region, the company must have a disaster recovery strategy that includes cross-region data replication. Option B is correct because copying automated backups to another Region ensures that a recoverable copy of the database exists in a different geographic area, allowing restoration in a separate Region if the primary Region fails. Option D is correct because a Cross-Region Read Replica provides a live, asynchronously replicated copy of the database in another Region, which can be promoted to a standalone primary instance during a regional outage, minimizing recovery time.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which provides high availability within a Region) with cross-region disaster recovery, leading them to incorrectly select Multi-AZ as a solution for regional failure.

Practice this question →
38
MCQmedium

A DevOps team is designing a disaster recovery plan for a production RDS for PostgreSQL database. The RPO must be less than 5 minutes and the RTO less than 1 hour. The database size is 2 TB. Which solution is MOST cost-effective?

A.Enable cross-Region automated backups with a retention period of 1 day
B.Take manual snapshots every 5 minutes and copy them to another Region
C.Use AWS Database Migration Service (DMS) for continuous replication to another Region
D.Create a cross-Region read replica and promote it during disaster
AnswerD

A cross-Region read replica uses asynchronous replication with lag typically under 5 minutes and can be promoted quickly, meeting both RPO and RTO cost-effectively.

Why this answer

The most cost-effective solution that meets the RPO < 5 minutes and RTO < 1 hour for a 2 TB RDS PostgreSQL database. A cross-Region read replica uses asynchronous replication, typically with lag of seconds, ensuring RPO well under 5 minutes. Promoting the replica to a standalone instance takes minutes, satisfying the RTO.

It leverages existing RDS features without additional services like DMS, and the replica instance can be sized smaller than the primary if not used, minimizing cost. Option A (cross-Region automated backups) only copies daily backups, resulting in RPO up to 24 hours, failing the requirement. Option B (manual snapshots every 5 minutes) is impractical and costly.

Option C (DMS continuous replication) meets RPO but incurs extra compute and data transfer costs, making it less cost-effective than a read replica.

Exam trap

Candidates often overlook that cross-Region automated backups do not include transaction logs for point-in-time recovery, so RPO can be up to 24 hours, not minutes.

Practice this question →
39
Multi-Selectmedium

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application stores session data in a shared Amazon ElastiCache for Redis cluster. The operations team reports that during a recent AZ failure, users experienced session loss and application errors. Which combination of actions should the company take to improve resilience and maintain session state during an AZ failure? (Choose TWO.)

Select 2 answers
A.Configure the ALB with cross-zone load balancing enabled and connection draining set to a suitable timeout.
B.Deploy an Auto Scaling group with a dynamic scaling policy that adds instances in the remaining AZs.
C.Enable cluster mode for the ElastiCache for Redis cluster and configure replica nodes in different Availability Zones.
D.Configure the application to use a custom DNS name with a low TTL pointing to the ElastiCache cluster endpoint.
E.Enable Multi-AZ for the ElastiCache cluster to automatically fail over to a replica in another AZ.
AnswersA, C

Cross-zone load balancing on the ALB ensures that incoming traffic is distributed evenly across all registered targets in every Availability Zone, preventing any single AZ from being overloaded and allowing the ALB to continue serving requests even if one AZ is impaired. Connection draining gives in-flight requests a grace period to complete before an instance is deregistered or replaced, avoiding request interruption during rolling updates or failed health checks. Together, these features support seamless instance replacement without dropping active requests, though they do not on their own preserve stored session data — they protect the connection lifecycle while the application layer (e.g., ElastiCache) handles state.

Why this answer

Enabling cross-zone load balancing on the ALB ensures traffic is distributed evenly across all EC2 instances in all AZs, and connection draining with a suitable timeout allows in-flight requests to complete before instances are deregistered, preventing session loss during an AZ failure. Option C is correct because enabling cluster mode for ElastiCache for Redis with replica nodes in different AZs provides automatic sharding and replication, ensuring session data remains available and consistent even if a primary node in one AZ fails. Option E is incorrect because while ElastiCache for Redis supports Multi-AZ with automatic failover, it alone does not guarantee that replica nodes are placed in different Availability Zones for each shard; enabling cluster mode with replicas in different AZs (Option C) provides a more comprehensive solution for maintaining session state during an AZ failure.

Exam trap

Candidates may choose Multi-AZ (Option E) thinking it provides cross-AZ failover for ElastiCache for Redis, which is true. However, Multi-AZ with automatic failover requires replication groups with replicas in different AZs. In a cluster-mode setup, you must explicitly ensure replicas are in different AZs per shard.

Option C directly addresses this by enabling cluster mode and configuring replica nodes in different AZs, making Option C a more complete solution for the given scenario of a shared cluster.

Practice this question →
40
MCQmedium

A company runs a stateful application on EC2 instances. The application stores session data locally. The instances are behind an ALB with sticky sessions enabled. A scaling event terminates an instance, causing loss of session data. How can the company prevent this while maintaining performance?

A.Use Amazon ElastiCache to store session data
B.Use a dedicated EC2 instance for sessions
C.Disable sticky sessions
D.Increase the sticky session duration
AnswerA

ElastiCache provides a resilient, high-performance session store.

Why this answer

Using ElastiCache for session storage externalizes session data, making it resilient to instance termination.

Practice this question →
41
Multi-Selectmedium

A company is building a multi-tier web application on AWS. The application must be resilient to the failure of an entire Availability Zone. The architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL database. Which TWO actions should be taken to achieve this resilience? (Choose two.)

Select 2 answers
A.Configure an RDS read replica in a different Availability Zone.
B.Use a Single-AZ RDS for MySQL database to keep costs low.
C.Place all EC2 instances in the same Availability Zone to reduce cross-AZ data transfer costs.
D.Configure the Auto Scaling group to launch EC2 instances in at least two Availability Zones.
E.Deploy the RDS for MySQL database in a Multi-AZ configuration.
AnswersD, E

Distributing instances across AZs provides high availability for the web tier.

Why this answer

Configuring the Auto Scaling group to launch EC2 instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) can continue serving traffic. This is a fundamental pattern for building AZ-resilient compute tiers. Option E is correct because deploying Amazon RDS for MySQL in a Multi-AZ configuration automatically provisions and maintains a synchronous standby replica in a different AZ, providing automatic failover if the primary DB instance fails, thus ensuring database resilience.

Exam trap

The trap here is that candidates often confuse read replicas (asynchronous, for read scaling) with Multi-AZ deployments (synchronous, for high availability), and mistakenly think placing all resources in one AZ reduces costs without recognizing the critical single point of failure it introduces.

Practice this question →
42
MCQhard

A company runs a containerized microservices application on Amazon EKS. The application includes a critical service that processes real-time financial transactions. This service must be highly available and resilient to node failures. The current setup uses a Deployment with 3 replicas and a ClusterIP service. During a recent node failure, the application experienced a brief period of unavailability. Which action should the DevOps engineer take to improve resilience without changing the underlying infrastructure?

A.Change the service type from ClusterIP to NodePort and configure an external load balancer.
B.Increase the number of replicas to 10 and use a node selector to schedule all pods on the largest instance type.
C.Configure a PodDisruptionBudget with a maxUnavailable of 1, and add pod anti-affinity rules to spread pods across different nodes.
D.Enable HorizontalPodAutoscaler with a target CPU utilization of 50% to automatically scale the Deployment.
AnswerC

A PodDisruptionBudget with maxUnavailable:1 guarantees that at most one Pod is unavailable during voluntary evictions such as node drains, and pod anti-affinity rules (preferably with topologyKey kubernetes.io/hostname) force the scheduler to place replicas on distinct nodes. This means an involuntary node failure can kill only one replica, and the remaining replicas continue to serve traffic. Combined, these mechanisms directly address both failure classes—involuntary hardware failures and voluntary maintenance—by ensuring the application always has at least N-1 replicas available across different failure domains.

Why this answer

A PodDisruptionBudget with maxUnavailable=1 ensures that at most one pod is unavailable during voluntary disruptions, while pod anti-affinity rules force the scheduler to distribute pods across different nodes. This combination prevents a single node failure from taking down all replicas, maintaining service availability without altering the underlying infrastructure.

Exam trap

The trap here is that candidates often confuse scaling (HPA or more replicas) with resilience, failing to realize that without proper pod distribution and disruption budgets, scaling alone cannot prevent downtime from node failures.

How to eliminate wrong answers

Option A is wrong because changing to NodePort with an external load balancer adds network complexity and does not address pod distribution or node failure resilience; the ClusterIP service already provides internal load balancing. Option B is wrong because increasing replicas to 10 and using node selector to pin pods to the largest instance type actually reduces resilience by creating a single point of failure on that node. Option D is wrong because HorizontalPodAutoscaler scales based on CPU utilization, which does not protect against node failures; it may even exacerbate the problem by scaling pods onto the same failing nodes.

Practice this question →
43
MCQhard

A company uses AWS Lambda with Amazon DynamoDB to process orders. During peak hours, the Lambda function sometimes fails with throttling errors from DynamoDB. The system must be resilient and cost-effective. What should a DevOps engineer do?

A.Use Amazon SQS to buffer the requests and have Lambda pull from the queue with a reserved concurrency limit.
B.Increase the DynamoDB provisioned read and write capacity units to a high fixed value.
C.Provision DynamoDB Accelerator (DAX) to cache reads and reduce throttling.
D.Configure DynamoDB auto scaling and implement a dead-letter queue in Lambda to retry failed events.
AnswerD

DynamoDB auto scaling adjusts provisioned capacity based on actual usage, preventing most throttling, but it cannot anticipate sudden one-off spikes because it relies on trends. A Lambda dead-letter queue, combined with the function's built-in retries and exponential backoff, ensures that any event which still fails due to a throttle is safely captured for manual or automated replay rather than silently dropped. This two-tier approach balances elasticity with data durability, which is why it is the recommended solution for unpredictable write spikes.

Why this answer

Configuring DynamoDB auto scaling allows the table to adjust its provisioned capacity based on actual traffic patterns, preventing throttling during peak hours while remaining cost-effective during low usage. Implementing a dead-letter queue (DLQ) in Lambda ensures that failed events (e.g., due to transient throttling) are captured and can be retried or investigated, providing resilience without manual intervention.

Exam trap

The trap here is that candidates may confuse read caching solutions (DAX) or queue-based decoupling (SQS) with the direct need to scale write capacity and handle retries, overlooking the combination of auto scaling and DLQ as the most resilient and cost-effective approach for write-throttling scenarios.

How to eliminate wrong answers

Option A is wrong because using Amazon SQS to buffer requests and having Lambda pull from the queue with a reserved concurrency limit does not directly address DynamoDB throttling; it only controls Lambda concurrency, not the underlying DynamoDB capacity, and could still result in throttling if the database cannot handle the aggregate write volume. Option B is wrong because increasing DynamoDB provisioned read and write capacity units to a high fixed value is not cost-effective; it leads to over-provisioning during off-peak hours and does not adapt to variable traffic, contradicting the requirement for a cost-effective solution. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read operations only; it does not mitigate write throttling errors, which are the primary issue described in the scenario.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Resilient Cloud questions.

Start 20-question session