Disaster Recovery practice questions

A company needs a Disaster Recovery (DR) strategy with an RTO of 30 minutes and an RPO of 15 minutes. They want to minimize costs while having a scaled-down version of their core environment always running in a second region. Which DR strategy should they use?

Trap 1: Backup and Restore.

Backup and Restore is the most cost-effective but slowest DR strategy. It involves restoring backups after a disaster occurs, which can take hours or days. This would fail to meet the 30-minute RTO requirement, as provisioning new infrastructure and restoring large datasets from backups cannot typically be completed within that aggressive time window.

Trap 2: Pilot Light.

In a Pilot Light strategy, only the most critical core elements (like the database) are kept running and up-to-date in the DR region. Other resources, like application servers, are provisioned only during a disaster. While faster than Backup and Restore, it often takes longer than 30 minutes to scale and configure the full environment.

Trap 3: Multi-site Active-Active.

Multi-site Active-Active involves running the full production environment in two or more regions simultaneously and splitting traffic between them. This provides the lowest RTO and RPO (near zero) but is the most expensive strategy because you are paying for full duplicate infrastructure at all times, which does not align with the goal of minimizing costs.

A
Backup and Restore.
Why it fails: Backup and Restore is the most cost-effective but slowest DR strategy. It involves restoring backups after a disaster occurs, which can take hours or days. This would fail to meet the 30-minute RTO requirement, as provisioning new infrastructure and restoring large datasets from backups cannot typically be completed within that aggressive time window.
B
Pilot Light.
Why it fails: In a Pilot Light strategy, only the most critical core elements (like the database) are kept running and up-to-date in the DR region. Other resources, like application servers, are provisioned only during a disaster. While faster than Backup and Restore, it often takes longer than 30 minutes to scale and configure the full environment.
C
Warm Standby.
Warm Standby keeps a minimized version of the full environment running in the second region. This ensures that the application is always ready to handle traffic, and only needs to be scaled up to meet production loads during a failover. This strategy easily fits the 30-minute RTO and 15-minute RPO requirements while remaining cost-conscious.
D
Multi-site Active-Active.
Why it fails: Multi-site Active-Active involves running the full production environment in two or more regions simultaneously and splitting traffic between them. This provides the lowest RTO and RPO (near zero) but is the most expensive strategy because you are paying for full duplicate infrastructure at all times, which does not align with the goal of minimizing costs.

Question 2hardmulti select

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

Trap 1: Configure Amazon S3 Intelligent-Tiering to automatically move…

S3 Intelligent-Tiering optimizes storage costs by moving objects between access tiers based on access patterns, but it does not provide data protection mechanisms against accidental deletion, malicious overwrites, or complete regional service interruptions.

Trap 2: Attach a resource-based bucket policy that explicitly denies all…

Denying delete requests via bucket policy prevents standard data maintenance and lifecycle operations, and relying solely on root account privileges violates AWS security best practices regarding least privilege access control for daily operational tasks.

Trap 3: Enable S3 Object Lock in governance mode with a fixed retention…

S3 Object Lock governance mode prevents users from changing or deleting object versions, but it can be bypassed by users with specific administrative permissions unless compliance mode is used, and it does not provide multi-region disaster recovery capabilities.

A
Enable S3 Versioning on the bucket and configure MFA Delete to prevent accidental or malicious deletion of object versions.
S3 Versioning preserves every version of every object, ensuring deleted or overwritten files can be easily restored. Multi-Factor Authentication Delete adds an extra layer of authorization security, requiring physical or virtual MFA tokens for permanent deletion operations.
B
Configure Amazon S3 Intelligent-Tiering to automatically move infrequently accessed video assets to lower-cost storage tiers.
Why it fails: S3 Intelligent-Tiering optimizes storage costs by moving objects between access tiers based on access patterns, but it does not provide data protection mechanisms against accidental deletion, malicious overwrites, or complete regional service interruptions.
C
Implement S3 Cross-Region Replication to asynchronously copy all video assets to an S3 bucket in a different AWS Region.
S3 Cross-Region Replication creates automated, low-latency asynchronous copies of data across geographically separated AWS Regions, ensuring high availability and business continuity in the event of a localized or widespread regional disaster affecting the primary bucket.
D
Attach a resource-based bucket policy that explicitly denies all delete object requests from any IAM user except the root account.
Why it fails: Denying delete requests via bucket policy prevents standard data maintenance and lifecycle operations, and relying solely on root account privileges violates AWS security best practices regarding least privilege access control for daily operational tasks.
E
Enable S3 Object Lock in governance mode with a fixed retention period of 30 days for all uploaded video files.
Why it fails: S3 Object Lock governance mode prevents users from changing or deleting object versions, but it can be bypassed by users with specific administrative permissions unless compliance mode is used, and it does not provide multi-region disaster recovery capabilities.

Question 3mediummultiple choice

A financial services company is hosting a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a major outage. The database tier uses Amazon Aurora Global Databases. Which solution provides the most resilient multi-Region architecture with automated failover?

Trap 1: Configure an Application Load Balancer in a single Region with EC2…

A single Region architecture creates a single point of failure if the entire AWS Region suffers an outage. Standard Aurora databases lack cross-region replication capabilities required for high availability across geographical boundaries during catastrophic regional failures.

Trap 2: Use Amazon Route 53 with weighted routing policies to distribute…

Weighted routing does not perform automated health checks to reroute traffic away from a failed Region instantly. Hourly RDS snapshots introduce a high RPO and manual intervention is required to restore databases, which violates critical resiliency requirements.

Trap 3: Set up an AWS Global Accelerator standard accelerator with endpoint…

While AWS Global Accelerator and DynamoDB global tables offer high availability, the scenario specifies an Amazon Aurora relational database tier rather than DynamoDB, making this architecture incompatible with the existing relational database requirements of the application.

A
Configure an Application Load Balancer in a single Region with EC2 instances distributed across multiple Availability Zones, and back the application with a standard Aurora MySQL database instance.
Why it fails: A single Region architecture creates a single point of failure if the entire AWS Region suffers an outage. Standard Aurora databases lack cross-region replication capabilities required for high availability across geographical boundaries during catastrophic regional failures.
B
Use Amazon Route 53 with weighted routing policies to distribute traffic between two AWS Regions, and configure standard cross-region database replication using Amazon RDS snapshots taken every hour.
Why it fails: Weighted routing does not perform automated health checks to reroute traffic away from a failed Region instantly. Hourly RDS snapshots introduce a high RPO and manual intervention is required to restore databases, which violates critical resiliency requirements.
C
Deploy the application stack across two AWS Regions, use Amazon Route 53 with active-passive failover and automated health checks, and configure Amazon Aurora Global Databases with cross-region replication.
Route 53 active-passive routing with health checks automatically detects regional failures and redirects user traffic to the secondary Region. Aurora Global Databases provide low-latency cross-region replication and fast failover capabilities to ensure uninterrupted application availability.
D
Set up an AWS Global Accelerator standard accelerator with endpoint groups in two AWS Regions, and use Amazon DynamoDB global tables with local secondary indexes for data storage.
Why it fails: While AWS Global Accelerator and DynamoDB global tables offer high availability, the scenario specifies an Amazon Aurora relational database tier rather than DynamoDB, making this architecture incompatible with the existing relational database requirements of the application.

Question 4mediummultiple choice

A solutions architect is designing a mission-critical web application that runs on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a catastrophic failure. The RPO must be near zero, and the RTO must be less than 15 minutes. Which disaster recovery strategy should the architect implement?

Trap 1: Implement a backup and restore strategy using automated daily…

Automated daily EBS snapshots copied to another region result in an RPO of up to 24 hours and a high RTO due to time required for infrastructure rebuilding. This strategy is completely inadequate for workloads demanding near-zero RPO and rapid recovery times.

Trap 2: Deploy a pilot light strategy by maintaining a minimal footprint of…

A pilot light strategy keeps critical components running in a secondary region while scaling up compute only during a disaster. While it reduces costs, the RTO typically exceeds 15 minutes because deploying and configuring application servers takes significant time.

Trap 3: Set up a warm standby architecture running a scaled-down version of…

A warm standby architecture keeps a scaled-down version of the application running constantly, allowing faster scaling than pilot light. However, scaling up the fleet and warming caches can still exceed a tight 15-minute RTO during an unexpected regional outage.

A
Implement a backup and restore strategy using automated daily Amazon EBS snapshots copied to a secondary AWS Region.
Why it fails: Automated daily EBS snapshots copied to another region result in an RPO of up to 24 hours and a high RTO due to time required for infrastructure rebuilding. This strategy is completely inadequate for workloads demanding near-zero RPO and rapid recovery times.
B
Deploy a pilot light strategy by maintaining a minimal footprint of core database and configuration services in a secondary Region.
Why it fails: A pilot light strategy keeps critical components running in a secondary region while scaling up compute only during a disaster. While it reduces costs, the RTO typically exceeds 15 minutes because deploying and configuring application servers takes significant time.
C
Configure a multi-site active-active deployment spanning two AWS Regions with continuous data replication and Route 53 health checks.
Running active workloads across two regions with continuous data replication ensures that traffic can be rerouted instantly upon failure. Route 53 health checks monitor endpoint availability, delivering an RTO of under 15 minutes and minimal RPO.
D
Set up a warm standby architecture running a scaled-down version of the entire application stack in a secondary Region.
Why it fails: A warm standby architecture keeps a scaled-down version of the application running constantly, allowing faster scaling than pilot light. However, scaling up the fleet and warming caches can still exceed a tight 15-minute RTO during an unexpected regional outage.

Question 5hardmulti select

A financial application stores data in Amazon Aurora. The architecture must survive a regional outage. Which TWO steps should the architect take to meet this requirement?

Trap 1: Enable Aurora Multi-AZ deployment in the primary region.

Multi-AZ deployment ensures high availability within a single region by protecting against AZ failures. However, it does not provide protection against a full AWS region failure. Regional disaster recovery requires cross-region replication strategies to ensure data availability should the primary geographic site become completely unreachable or suffer degradation.

Trap 2: Schedule daily Amazon RDS snapshots and copy them to an S3 bucket…

Storing snapshots in the same region as the database does not protect against a regional failure. If the entire region goes offline, the snapshots stored there are inaccessible. Snapshots must be copied to a different region to satisfy cross-region disaster recovery requirements and ensure data is eventually recoverable.

Trap 3: Enable Performance Insights on all Aurora instances.

Performance Insights is a database performance tuning and monitoring tool. It provides visibility into database load and query performance but plays no role in high availability or disaster recovery. Monitoring and resilience are distinct architectural concerns that require different sets of services and configuration settings to address effectively.

A
Enable Aurora Multi-AZ deployment in the primary region.
Why it fails: Multi-AZ deployment ensures high availability within a single region by protecting against AZ failures. However, it does not provide protection against a full AWS region failure. Regional disaster recovery requires cross-region replication strategies to ensure data availability should the primary geographic site become completely unreachable or suffer degradation.
B
Create an Aurora Global Database with a secondary region.
Aurora Global Database is specifically designed for regional disaster recovery. It uses dedicated infrastructure to replicate data to secondary regions with minimal latency, typically under one second. This configuration allows for rapid promotion of a secondary region to read-write status in the event of a primary regional failure.
C
Schedule daily Amazon RDS snapshots and copy them to an S3 bucket in the same region.
Why it fails: Storing snapshots in the same region as the database does not protect against a regional failure. If the entire region goes offline, the snapshots stored there are inaccessible. Snapshots must be copied to a different region to satisfy cross-region disaster recovery requirements and ensure data is eventually recoverable.
D
Promote the secondary region to primary if the primary region becomes unavailable.
Promoting a secondary region is the critical step in regional failover for Aurora Global Database. When the primary region fails, the secondary database can be promoted to standalone status for full read-write capabilities. This manual or automated switch allows the application to resume operations in a healthy, separate geographic location.
E
Enable Performance Insights on all Aurora instances.
Why it fails: Performance Insights is a database performance tuning and monitoring tool. It provides visibility into database load and query performance but plays no role in high availability or disaster recovery. Monitoring and resilience are distinct architectural concerns that require different sets of services and configuration settings to address effectively.

Question 6hardmultiple choice

A mission-critical application requires a recovery time objective (RTO) of near-zero. Which disaster recovery strategy should the architect implement?

Trap 1: Backup and Restore.

Backup and Restore has a high RTO because it involves re-provisioning infrastructure and restoring data from backups, which takes significant time. It is generally the least expensive but also the slowest recovery method, making it unsuitable for applications that require near-zero downtime or high levels of service availability during a failure.

Trap 2: Pilot Light.

The Pilot Light strategy involves keeping a minimal version of the environment running in a secondary region. While it is faster than Backup and Restore, it still requires time to scale up the infrastructure and reconfigure services before traffic can be directed to the secondary region, resulting in a higher RTO.

Trap 3: Warm Standby.

Warm Standby maintains a scaled-down version of the full environment in the secondary region. It is faster than Pilot Light but still requires time to scale the capacity to match production levels before it can handle full traffic loads. This delay results in an RTO that is higher than the near-zero requirement.

A
Backup and Restore.
Why it fails: Backup and Restore has a high RTO because it involves re-provisioning infrastructure and restoring data from backups, which takes significant time. It is generally the least expensive but also the slowest recovery method, making it unsuitable for applications that require near-zero downtime or high levels of service availability during a failure.
B
Pilot Light.
Why it fails: The Pilot Light strategy involves keeping a minimal version of the environment running in a secondary region. While it is faster than Backup and Restore, it still requires time to scale up the infrastructure and reconfigure services before traffic can be directed to the secondary region, resulting in a higher RTO.
C
Warm Standby.
Why it fails: Warm Standby maintains a scaled-down version of the full environment in the secondary region. It is faster than Pilot Light but still requires time to scale the capacity to match production levels before it can handle full traffic loads. This delay results in an RTO that is higher than the near-zero requirement.
D
Multi-Site Active-Active.
The Multi-Site Active-Active approach runs the application in multiple regions simultaneously. Because both regions are already handling production traffic, a failure in one region does not require scaling or recovery time; traffic is simply routed to the remaining active region, resulting in the lowest possible RTO for the application.

Question 7hardmultiple choice

An enterprise financial application stores critical transaction records in Amazon Aurora MySQL. The company requires a cross-Region disaster recovery strategy with a Recovery Point Objective of less than 1 minute and a Recovery Time Objective of less than 5 minutes. Which architecture achieves this?

Trap 1: Take daily automated snapshots of the primary Aurora database and…

Daily snapshots result in a Recovery Point Objective of up to 24 hours, which drastically misses the strict requirement of less than 1 minute. Furthermore, restoring databases from snapshots takes significant time, violating the fast Recovery Time Objective.

Trap 2: Configure standard MySQL asynchronous replication from an Amazon…

Self-managed MySQL on EC2 with asynchronous replication cannot meet a sub-one-minute RPO or sub-five-minute RTO, since failover requires manual promotion and DNS changes. It is tempting because EC2-hosted MySQL suits lift-and-shift migrations or workloads needing engine versions Aurora does not offer.

Trap 3: Deploy a multi-AZ Aurora cluster and use AWS Database Migration…

Multi-AZ Aurora replicates only within one Region, and DMS continuous replication adds latency exceeding the one-minute RPO while still requiring manual cutover. It is tempting because DMS suits ongoing heterogeneous migrations or replicating into analytics stores, not rapid cross-Region failover.

A
Take daily automated snapshots of the primary Aurora database and copy the snapshot to a secondary AWS Region.
Why it fails: Daily snapshots result in a Recovery Point Objective of up to 24 hours, which drastically misses the strict requirement of less than 1 minute. Furthermore, restoring databases from snapshots takes significant time, violating the fast Recovery Time Objective.
B
Implement Amazon Aurora Global Databases with a primary writer Region and a cross-Region reader Region.
Aurora Global Database replicates committed writes to a secondary Region with typical latency under one second, meeting the sub-one-minute RPO. Promoting the secondary reader to writer completes in under a minute, satisfying the five-minute RTO for cross-Region disaster recovery.
C
Configure standard MySQL asynchronous replication from an Amazon EC2 instance running MySQL in one Region to another.
Why it fails: Self-managed MySQL on EC2 with asynchronous replication cannot meet a sub-one-minute RPO or sub-five-minute RTO, since failover requires manual promotion and DNS changes. It is tempting because EC2-hosted MySQL suits lift-and-shift migrations or workloads needing engine versions Aurora does not offer.
D
Deploy a multi-AZ Aurora cluster and use AWS Database Migration Service for continuous replication to another Region.
Why it fails: Multi-AZ Aurora replicates only within one Region, and DMS continuous replication adds latency exceeding the one-minute RPO while still requiring manual cutover. It is tempting because DMS suits ongoing heterogeneous migrations or replicating into analytics stores, not rapid cross-Region failover.