SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create health checks, then create primary failover record, then create secondary failover record, then test failover.

  Why this is correct

  This order is correct because Amazon Route 53 health checks must exist before you can create failover routing records, since each failover record references a health check ID in its configuration. After the health check is created, the primary failover record (SetIdentifier: primary, routing policy: FAILOVER) is defined first as the active endpoint, followed by the secondary failover record (SetIdentifier: secondary) as the standby. Finally, testing failover by simulating an endpoint failure validates that DNS responses switch from the primary to the secondary record only when both are fully configured.

• ✗

  Create primary failover record, then create health checks, then create secondary failover record, then test failover.

  Why it's wrong here

  This order is invalid because you cannot create a primary failover record without first having a health check available to associate with it. In the Route 53 console or API, a failover routing policy record requires a HealthCheckId parameter; if you attempt to create it before the health check exists, the request fails with an InvalidInput or MissingHealthCheck error. Even if the record could be created, the health check must be provisioned and associated before it can monitor the primary endpoint, so creating the primary record first breaks the dependency chain required for proper failover routing.

• ✗

  Create health checks, then create secondary failover record, then create primary failover record, then test failover.

  Why it's wrong here

  This order is incorrect because although health checks are created first, the secondary failover record should not be created before the primary record; the primary record is the active one and must be defined first for proper failover configuration.

• ✗

  Create health checks, then create primary failover record, then test failover, then create secondary failover record.

  Why it's wrong here

  This order fails because testing failover before creating the secondary failover record cannot demonstrate the expected DNS behavior, as there is no redundant endpoint to route traffic to when the primary health check fails. While creating the primary record after the health check is valid, the test step will only show queries continuing to answer with the primary record (or returning no failover response) because the secondary record is absent. Additionally, creating the secondary record after testing would require re-running the test entirely, since only with both records present can Route 53 actually switch the active DNS answer based on the health check status.

Go deeper

Related to this question