SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL database with Multi-AZ deployment. The company has a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour for the database. During a recent disaster recovery drill, the solutions architect simulated an Availability Zone failure by terminating all EC2 instances and the primary RDS instance in one AZ. The Auto Scaling group launched new instances in the other AZ, and the RDS Multi-AZ failover completed in about 2 minutes. However, the application remained unavailable for 30 minutes because the new EC2 instances could not connect to the RDS secondary instance. The security groups are configured correctly. The RDS instance is not publicly accessible. What is the MOST likely cause of the connectivity issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is using a hardcoded IP address or an endpoint that points to the old primary RDS instance instead of the RDS DNS name.
The RDS Multi-AZ failover promotes the standby to primary, changing the underlying IP address. If the application uses a hardcoded IP address or an endpoint that points to the old primary, it will fail to connect after failover. The correct approach is to use the RDS DNS name (CNAME) which automatically resolves to the current primary. Option A is incorrect because the stem states the security groups are correctly configured. Option B is incorrect because the failover completed in about 2 minutes, which is within normal Multi-AZ failover time (1-2 minutes). Option C is incorrect because the RDS endpoint DNS record updates quickly (within seconds) after a failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the EC2 instances does not allow outbound traffic to the RDS instance.
Why it's wrong here
The stem states security groups are configured correctly, so this cannot be the cause. Option A is incorrect.
- ✗
The RDS Multi-AZ failover took longer than expected, exceeding the RTO.
Why it's wrong here
The stem states failover completed in about 2 minutes, well within the RTO of 15 minutes. Option B is incorrect.
- ✗
The RDS endpoint DNS record did not update to point to the new primary.
Why it's wrong here
The RDS Multi-AZ failover updates the DNS record almost immediately, usually within seconds. This is not the cause. Option C is incorrect.
- ✓
The application is using a hardcoded IP address or an endpoint that points to the old primary RDS instance instead of the RDS DNS name.
Why this is correct
The application is likely using a hardcoded IP address or an endpoint pointing to the old primary RDS instance instead of the RDS DNS name, which fails after failover. This is the most likely cause. Option D is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.