mediummultiple choiceObjective-mapped

A company hosts a public API using two AWS regions behind a single custom domain. Route 53 is configured with latency-based routing and health checks. During a regional outage, application metrics confirm the primary API is unhealthy, but clients still resolve to the primary region for most requests. Which DNS configuration change will most directly ensure automatic failover to the secondary region when the primary fails?

Question 1mediummultiple choice
Full question →

A company hosts a public API using two AWS regions behind a single custom domain. Route 53 is configured with latency-based routing and health checks. During a regional outage, application metrics confirm the primary API is unhealthy, but clients still resolve to the primary region for most requests. Which DNS configuration change will most directly ensure automatic failover to the secondary region when the primary fails?

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

A

Distractor review

Change the record type to A/AAAA alias with an active-active routing policy so both regions always receive equal traffic.

Active-active routing is intended to split traffic across regions regardless of health. It does not provide the required behavior of preferring the secondary only when the primary health check fails.

B

Best answer

Switch to Route 53 failover routing: configure the primary record with the primary health check and the secondary record with the secondary failover health check.

Failover routing is designed for disaster recovery-style behavior using health checks. Route 53 returns the primary record when its health check is passing, and it automatically switches resolution to the secondary record when the primary health check fails. This directly matches the requirement that clients should mostly move to the secondary region during a primary regional outage.

C

Distractor review

Keep latency-based routing but shorten the health check interval to 5 seconds.

Shorter health check intervals may speed detection, but latency-based routing does not implement deterministic primary/secondary selection during outages. Depending on routing behavior and cached DNS responses, clients can still receive answers that favor the primary region.

D

Distractor review

Use geolocation routing so requests from each country route to the nearest region.

Geolocation routing chooses targets based on user location, not service health. It can continue routing to the unhealthy primary region if it still appears “nearest” for many clients.

Common exam trap

Common exam trap: authentication is not authorization

Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.

Technical deep dive

How to think about this question

This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.

KKey Concepts to Remember

  • Authentication checks who the user is.
  • Authorization controls what the user is allowed to do after login.
  • Privilege levels affect access to EXEC and configuration commands.
  • AAA, TACACS+ and RADIUS can separate login success from command access.

TExam Day Tips

  • Do not assume successful login means full administrative access.
  • Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
  • Separate login problems from permission problems before choosing the answer.

Related practice questions

Related SAA-C03 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Switch to Route 53 failover routing: configure the primary record with the primary health check and the secondary record with the secondary failover health check. — Latency-based routing is not an outage-driven primary/secondary failover mechanism. Even with health checks, latency routing can still provide primary answers for many clients and does not guarantee a clean failover decision model. To ensure automatic failover during a primary regional outage, use Route 53 failover routing with explicit primary and secondary records tied to health checks. Route 53 will resolve to the primary while healthy, and switch to the secondary when the primary fails, which best satisfies the stated requirement. A) Active-active sends traffic to both regions even when the primary is unhealthy, which does not ensure failover. C) Reducing the health check interval changes detection speed but not the routing policy’s selection model. D) Geolocation ignores health status and is not a failover strategy.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.

Discussion

Loading comments…

Sign in to join the discussion.