Amazon AWS Certified Solutions Architect Associate SAA-C03 Availability Fault Isolation and Operational Resilience Practice Test

 

Topic 09 covers availability fault isolation and operational resilience for the AWS Certified Solutions Architect – Associate certification. These original practice questions apply the verified SAA-C03 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

A production API runs on one EC2 instance. A host failure currently takes the entire service offline. Which change removes the instance as a single point of failure?

1. Use resilient AZ-local egress, commonly a NAT gateway in each AZ with each private subnet routed to its local gateway.
2. Distribute application capacity across multiple Availability Zones.
3. Run multiple application instances in an Auto Scaling group.
4. Use Amazon RDS Proxy where supported.
5. Register healthy load-balancer targets in multiple Availability Zones.

Correct Answer: C

 

Correct Answer

Answer C is correct because An Auto Scaling group maintains multiple replaceable instances and can replace failed capacity automatically. This directly satisfies the decisive requirement in the scenario: multiple replaceable instances.

Incorrect Answers

Answer A is incorrect because AZ-local egress avoids one cross-AZ NAT gateway becoming the shared failure point for all private subnets. It can be useful in other designs, but it does not satisfy the decisive requirement here: multiple replaceable instances.

Answer B is incorrect because Multi-AZ placement prevents one AZ failure from removing all application compute capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: multiple replaceable instances.

Answer D is incorrect because RDS Proxy pools and reuses database connections, helping protect relational databases from connection storms from highly concurrent clients. It can be useful in other designs, but it does not satisfy the decisive requirement here: multiple replaceable instances.

Answer E is incorrect because Multi-AZ target placement gives the load balancer surviving application targets when one AZ loses capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: multiple replaceable instances.

 

Question 2

All application instances are in one Availability Zone even though the Region has several AZs. Which change addresses an AZ failure?

1. Run multiple application instances in an Auto Scaling group.
2. Use Amazon RDS Proxy where supported.
3. Register healthy load-balancer targets in multiple Availability Zones.
4. Distribute application capacity across multiple Availability Zones.
5. Use resilient AZ-local egress, commonly a NAT gateway in each AZ with each private subnet routed to its local gateway.

Correct Answer: D

 

Correct Answer

Answer D is correct because Multi-AZ placement prevents one AZ failure from removing all application compute capacity. This directly satisfies the decisive requirement in the scenario: distribute across AZs.

Incorrect Answers

Answer A is incorrect because An Auto Scaling group maintains multiple replaceable instances and can replace failed capacity automatically. It can be useful in other designs, but it does not satisfy the decisive requirement here: distribute across AZs.

Answer B is incorrect because RDS Proxy pools and reuses database connections, helping protect relational databases from connection storms from highly concurrent clients. It can be useful in other designs, but it does not satisfy the decisive requirement here: distribute across AZs.

Answer C is incorrect because Multi-AZ target placement gives the load balancer surviving application targets when one AZ loses capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: distribute across AZs.

Answer E is incorrect because AZ-local egress avoids one cross-AZ NAT gateway becoming the shared failure point for all private subnets. It can be useful in other designs, but it does not satisfy the decisive requirement here: distribute across AZs.

 

Question 3

An ALB has healthy targets only in one AZ. Which design change improves target fault isolation?

1. Distribute application capacity across multiple Availability Zones.
2. Register healthy load-balancer targets in multiple Availability Zones.
3. Run multiple application instances in an Auto Scaling group.
4. Use Amazon RDS Proxy where supported.
5. Use resilient AZ-local egress, commonly a NAT gateway in each AZ with each private subnet routed to its local gateway.

Correct Answer: B

 

Correct Answer

Answer B is correct because Multi-AZ target placement gives the load balancer surviving application targets when one AZ loses capacity. This directly satisfies the decisive requirement in the scenario: healthy targets in multiple AZs.

Incorrect Answers

Answer A is incorrect because Multi-AZ placement prevents one AZ failure from removing all application compute capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: healthy targets in multiple AZs.

Answer C is incorrect because An Auto Scaling group maintains multiple replaceable instances and can replace failed capacity automatically. It can be useful in other designs, but it does not satisfy the decisive requirement here: healthy targets in multiple AZs.

Answer D is incorrect because RDS Proxy pools and reuses database connections, helping protect relational databases from connection storms from highly concurrent clients. It can be useful in other designs, but it does not satisfy the decisive requirement here: healthy targets in multiple AZs.

Answer E is incorrect because AZ-local egress avoids one cross-AZ NAT gateway becoming the shared failure point for all private subnets. It can be useful in other designs, but it does not satisfy the decisive requirement here: healthy targets in multiple AZs.

 

Question 4

Private subnets in three AZs all route outbound traffic through one NAT gateway in a single AZ. Which architecture removes that shared outbound failure point?

1. Run multiple application instances in an Auto Scaling group.
2. Use resilient AZ-local egress, commonly a NAT gateway in each AZ with each private subnet routed to its local gateway.
3. Distribute application capacity across multiple Availability Zones.
4. Register healthy load-balancer targets in multiple Availability Zones.
5. Use Amazon RDS Proxy where supported.

Correct Answer: B

 

Correct Answer

Answer B is correct because AZ-local egress avoids one cross-AZ NAT gateway becoming the shared failure point for all private subnets. This directly satisfies the decisive requirement in the scenario: AZ-local resilient egress.

Incorrect Answers

Answer A is incorrect because An Auto Scaling group maintains multiple replaceable instances and can replace failed capacity automatically. It can be useful in other designs, but it does not satisfy the decisive requirement here: AZ-local resilient egress.

Answer C is incorrect because Multi-AZ placement prevents one AZ failure from removing all application compute capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: AZ-local resilient egress.

Answer D is incorrect because Multi-AZ target placement gives the load balancer surviving application targets when one AZ loses capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: AZ-local resilient egress.

Answer E is incorrect because RDS Proxy pools and reuses database connections, helping protect relational databases from connection storms from highly concurrent clients. It can be useful in other designs, but it does not satisfy the decisive requirement here: AZ-local resilient egress.

 

Question 5

Thousands of Lambda functions connect directly to an RDS database and connection spikes exhaust the database during bursts. Which service can reduce the connection bottleneck?

1. Register healthy load-balancer targets in multiple Availability Zones.
2. Use resilient AZ-local egress, commonly a NAT gateway in each AZ with each private subnet routed to its local gateway.
3. Use Amazon RDS Proxy where supported.
4. Distribute application capacity across multiple Availability Zones.
5. Run multiple application instances in an Auto Scaling group.

Correct Answer: C

 

Correct Answer

Answer C is correct because RDS Proxy pools and reuses database connections, helping protect relational databases from connection storms from highly concurrent clients. This directly satisfies the decisive requirement in the scenario: managed connection proxy.

Incorrect Answers

Answer A is incorrect because Multi-AZ target placement gives the load balancer surviving application targets when one AZ loses capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection proxy.

Answer B is incorrect because AZ-local egress avoids one cross-AZ NAT gateway becoming the shared failure point for all private subnets. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection proxy.

Answer D is incorrect because Multi-AZ placement prevents one AZ failure from removing all application compute capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection proxy.

Answer E is incorrect because An Auto Scaling group maintains multiple replaceable instances and can replace failed capacity automatically. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection proxy.

 

Question 6

A public endpoint has primary and standby deployments. DNS should answer with the standby only when the primary health check fails. Which Route 53 policy fits?

1. Use Route 53 failover routing with health evaluation.
2. Review and, where appropriate, lower the DNS TTL while accounting for resolver caching behavior.
3. Use health-aware active-active routing such as latency or weighted records with health checks.
4. Use Route 53 latency-based routing with health checks.
5. Configure an Elastic Load Balancing target health check that reflects application readiness.

Correct Answer: A

 

Correct Answer

Answer A is correct because Failover routing is designed for primary/secondary active-passive DNS behavior tied to resource health. This directly satisfies the decisive requirement in the scenario: active-passive failover.

Incorrect Answers

Answer B is incorrect because DNS clients and recursive resolvers can continue using cached answers until their TTL expires. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive failover.

Answer C is incorrect because Active-active DNS can return any healthy endpoint and stop including endpoints that fail health evaluation. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive failover.

Answer D is incorrect because Latency routing can select the regional endpoint with the best measured latency while excluding unhealthy records. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive failover.

Answer E is incorrect because Target health checks remove failing targets from request distribution while healthy targets remain available. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive failover.

 

Question 7

Two Regions actively serve traffic and unhealthy endpoints should stop receiving DNS answers. Which Route 53 design is appropriate?

1. Use Route 53 failover routing with health evaluation.
2. Use health-aware active-active routing such as latency or weighted records with health checks.
3. Review and, where appropriate, lower the DNS TTL while accounting for resolver caching behavior.
4. Configure an Elastic Load Balancing target health check that reflects application readiness.
5. Use Route 53 latency-based routing with health checks.

Correct Answer: B

 

Correct Answer

Answer B is correct because Active-active DNS can return any healthy endpoint and stop including endpoints that fail health evaluation. This directly satisfies the decisive requirement in the scenario: active-active health-aware routing.

Incorrect Answers

Answer A is incorrect because Failover routing is designed for primary/secondary active-passive DNS behavior tied to resource health. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-active health-aware routing.

Answer C is incorrect because DNS clients and recursive resolvers can continue using cached answers until their TTL expires. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-active health-aware routing.

Answer D is incorrect because Target health checks remove failing targets from request distribution while healthy targets remain available. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-active health-aware routing.

Answer E is incorrect because Latency routing can select the regional endpoint with the best measured latency while excluding unhealthy records. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-active health-aware routing.

 

Question 8

An ALB continues sending requests to one application target that returns 500 responses. Which configuration should remove that target from service automatically?

1. Use Route 53 latency-based routing with health checks.
2. Configure an Elastic Load Balancing target health check that reflects application readiness.
3. Review and, where appropriate, lower the DNS TTL while accounting for resolver caching behavior.
4. Use Route 53 failover routing with health evaluation.
5. Use health-aware active-active routing such as latency or weighted records with health checks.

Correct Answer: B

 

Correct Answer

Answer B is correct because Target health checks remove failing targets from request distribution while healthy targets remain available. This directly satisfies the decisive requirement in the scenario: load-balancer health check.

Incorrect Answers

Answer A is incorrect because Latency routing can select the regional endpoint with the best measured latency while excluding unhealthy records. It can be useful in other designs, but it does not satisfy the decisive requirement here: load-balancer health check.

Answer C is incorrect because DNS clients and recursive resolvers can continue using cached answers until their TTL expires. It can be useful in other designs, but it does not satisfy the decisive requirement here: load-balancer health check.

Answer D is incorrect because Failover routing is designed for primary/secondary active-passive DNS behavior tied to resource health. It can be useful in other designs, but it does not satisfy the decisive requirement here: load-balancer health check.

Answer E is incorrect because Active-active DNS can return any healthy endpoint and stop including endpoints that fail health evaluation. It can be useful in other designs, but it does not satisfy the decisive requirement here: load-balancer health check.

 

Question 9

Users should be directed to the lowest-latency healthy regional endpoint. Which Route 53 routing approach best matches the requirement?

1. Use Route 53 failover routing with health evaluation.
2. Use health-aware active-active routing such as latency or weighted records with health checks.
3. Use Route 53 latency-based routing with health checks.
4. Review and, where appropriate, lower the DNS TTL while accounting for resolver caching behavior.
5. Configure an Elastic Load Balancing target health check that reflects application readiness.

Correct Answer: C

 

Correct Answer

Answer C is correct because Latency routing can select the regional endpoint with the best measured latency while excluding unhealthy records. This directly satisfies the decisive requirement in the scenario: latency routing with health evaluation.

Incorrect Answers

Answer A is incorrect because Failover routing is designed for primary/secondary active-passive DNS behavior tied to resource health. It can be useful in other designs, but it does not satisfy the decisive requirement here: latency routing with health evaluation.

Answer B is incorrect because Active-active DNS can return any healthy endpoint and stop including endpoints that fail health evaluation. It can be useful in other designs, but it does not satisfy the decisive requirement here: latency routing with health evaluation.

Answer D is incorrect because DNS clients and recursive resolvers can continue using cached answers until their TTL expires. It can be useful in other designs, but it does not satisfy the decisive requirement here: latency routing with health evaluation.

Answer E is incorrect because Target health checks remove failing targets from request distribution while healthy targets remain available. It can be useful in other designs, but it does not satisfy the decisive requirement here: latency routing with health evaluation.

 

Question 10

A failover test shows clients continue using an old DNS answer long after the primary endpoint is withdrawn. Which DNS property should be reviewed first?

1. Review and, where appropriate, lower the DNS TTL while accounting for resolver caching behavior.
2. Use health-aware active-active routing such as latency or weighted records with health checks.
3. Use Route 53 latency-based routing with health checks.
4. Configure an Elastic Load Balancing target health check that reflects application readiness.
5. Use Route 53 failover routing with health evaluation.

Correct Answer: A

 

Correct Answer

Answer A is correct because DNS clients and recursive resolvers can continue using cached answers until their TTL expires. This directly satisfies the decisive requirement in the scenario: record TTL and caching.

Incorrect Answers

Answer B is incorrect because Active-active DNS can return any healthy endpoint and stop including endpoints that fail health evaluation. It can be useful in other designs, but it does not satisfy the decisive requirement here: record TTL and caching.

Answer C is incorrect because Latency routing can select the regional endpoint with the best measured latency while excluding unhealthy records. It can be useful in other designs, but it does not satisfy the decisive requirement here: record TTL and caching.

Answer D is incorrect because Target health checks remove failing targets from request distribution while healthy targets remain available. It can be useful in other designs, but it does not satisfy the decisive requirement here: record TTL and caching.

Answer E is incorrect because Failover routing is designed for primary/secondary active-passive DNS behavior tied to resource health. It can be useful in other designs, but it does not satisfy the decisive requirement here: record TTL and caching.

 

Question 11

A frontend allows 30 seconds for a request, but it calls three services sequentially and each also waits 30 seconds before timing out. Which design issue should be corrected?

1. Store required session or coordination state in a redundant external data service.
2. Use a circuit breaker around the failing dependency.
3. Allocate an explicit end-to-end timeout budget and shorter downstream timeouts.
4. Use exponential backoff with jitter.
5. Define and validate the quorum and consistency model for the required failure modes.

Correct Answer: C

 

Correct Answer

Answer C is correct because Nested dependencies must fail within the caller’s overall latency budget so one slow service does not consume the entire request window. This directly satisfies the decisive requirement in the scenario: allocate shorter dependency timeouts.

Incorrect Answers

Answer A is incorrect because External replicated state lets application nodes remain replaceable without one node holding the only active state. It can be useful in other designs, but it does not satisfy the decisive requirement here: allocate shorter dependency timeouts.

Answer B is incorrect because A circuit breaker stops repeatedly calling a known-failing dependency for a period and allows controlled probing of recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: allocate shorter dependency timeouts.

Answer D is incorrect because Backoff reduces retry frequency and jitter desynchronizes clients so a recovering dependency is not hit by a coordinated retry spike. It can be useful in other designs, but it does not satisfy the decisive requirement here: allocate shorter dependency timeouts.

Answer E is incorrect because A distributed datastore’s availability and write safety depend on explicit quorum and consistency assumptions during partitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: allocate shorter dependency timeouts.

 

Question 12

A dependency briefly returns 503 and all clients retry immediately at the same fixed interval, creating another spike. Which retry design is safer?

1. Use a circuit breaker around the failing dependency.
2. Use exponential backoff with jitter.
3. Store required session or coordination state in a redundant external data service.
4. Define and validate the quorum and consistency model for the required failure modes.
5. Allocate an explicit end-to-end timeout budget and shorter downstream timeouts.

Correct Answer: B

 

Correct Answer

Answer B is correct because Backoff reduces retry frequency and jitter desynchronizes clients so a recovering dependency is not hit by a coordinated retry spike. This directly satisfies the decisive requirement in the scenario: exponential backoff with jitter.

Incorrect Answers

Answer A is incorrect because A circuit breaker stops repeatedly calling a known-failing dependency for a period and allows controlled probing of recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: exponential backoff with jitter.

Answer C is incorrect because External replicated state lets application nodes remain replaceable without one node holding the only active state. It can be useful in other designs, but it does not satisfy the decisive requirement here: exponential backoff with jitter.

Answer D is incorrect because A distributed datastore’s availability and write safety depend on explicit quorum and consistency assumptions during partitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: exponential backoff with jitter.

Answer E is incorrect because Nested dependencies must fail within the caller’s overall latency budget so one slow service does not consume the entire request window. It can be useful in other designs, but it does not satisfy the decisive requirement here: exponential backoff with jitter.

 

Question 13

A recommendation service is down and every request waits until timeout before falling back, consuming all worker threads. Which resilience pattern should open after repeated failures?

1. Store required session or coordination state in a redundant external data service.
2. Allocate an explicit end-to-end timeout budget and shorter downstream timeouts.
3. Use a circuit breaker around the failing dependency.
4. Use exponential backoff with jitter.
5. Define and validate the quorum and consistency model for the required failure modes.

Correct Answer: C

 

Correct Answer

Answer C is correct because A circuit breaker stops repeatedly calling a known-failing dependency for a period and allows controlled probing of recovery. This directly satisfies the decisive requirement in the scenario: circuit breaker.

Incorrect Answers

Answer A is incorrect because External replicated state lets application nodes remain replaceable without one node holding the only active state. It can be useful in other designs, but it does not satisfy the decisive requirement here: circuit breaker.

Answer B is incorrect because Nested dependencies must fail within the caller’s overall latency budget so one slow service does not consume the entire request window. It can be useful in other designs, but it does not satisfy the decisive requirement here: circuit breaker.

Answer D is incorrect because Backoff reduces retry frequency and jitter desynchronizes clients so a recovering dependency is not hit by a coordinated retry spike. It can be useful in other designs, but it does not satisfy the decisive requirement here: circuit breaker.

Answer E is incorrect because A distributed datastore’s availability and write safety depend on explicit quorum and consistency assumptions during partitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: circuit breaker.

 

Question 14

A service stores all active session state on one node, so losing that node logs out every user. Which change improves resilience?

1. Store required session or coordination state in a redundant external data service.
2. Use exponential backoff with jitter.
3. Allocate an explicit end-to-end timeout budget and shorter downstream timeouts.
4. Define and validate the quorum and consistency model for the required failure modes.
5. Use a circuit breaker around the failing dependency.

Correct Answer: A

 

Correct Answer

Answer A is correct because External replicated state lets application nodes remain replaceable without one node holding the only active state. This directly satisfies the decisive requirement in the scenario: external redundant state.

Incorrect Answers

Answer B is incorrect because Backoff reduces retry frequency and jitter desynchronizes clients so a recovering dependency is not hit by a coordinated retry spike. It can be useful in other designs, but it does not satisfy the decisive requirement here: external redundant state.

Answer C is incorrect because Nested dependencies must fail within the caller’s overall latency budget so one slow service does not consume the entire request window. It can be useful in other designs, but it does not satisfy the decisive requirement here: external redundant state.

Answer D is incorrect because A distributed datastore’s availability and write safety depend on explicit quorum and consistency assumptions during partitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: external redundant state.

Answer E is incorrect because A circuit breaker stops repeatedly calling a known-failing dependency for a period and allows controlled probing of recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: external redundant state.

 

Question 15

A distributed datastore uses three nodes but the application treats one reachable node as sufficient for writes even during a partition. Which architectural concern must be evaluated?

1. Use a circuit breaker around the failing dependency.
2. Store required session or coordination state in a redundant external data service.
3. Use exponential backoff with jitter.
4. Allocate an explicit end-to-end timeout budget and shorter downstream timeouts.
5. Define and validate the quorum and consistency model for the required failure modes.

Correct Answer: E

 

Correct Answer

Answer E is correct because A distributed datastore’s availability and write safety depend on explicit quorum and consistency assumptions during partitions. This directly satisfies the decisive requirement in the scenario: quorum and consistency assumptions.

Incorrect Answers

Answer A is incorrect because A circuit breaker stops repeatedly calling a known-failing dependency for a period and allows controlled probing of recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: quorum and consistency assumptions.

Answer B is incorrect because External replicated state lets application nodes remain replaceable without one node holding the only active state. It can be useful in other designs, but it does not satisfy the decisive requirement here: quorum and consistency assumptions.

Answer C is incorrect because Backoff reduces retry frequency and jitter desynchronizes clients so a recovering dependency is not hit by a coordinated retry spike. It can be useful in other designs, but it does not satisfy the decisive requirement here: quorum and consistency assumptions.

Answer D is incorrect because Nested dependencies must fail within the caller’s overall latency budget so one slow service does not consume the entire request window. It can be useful in other designs, but it does not satisfy the decisive requirement here: quorum and consistency assumptions.

 

Question 16

A fleet has accumulated manual changes and identical servers now behave differently. Which deployment practice best prevents further drift?

1. Use resource/configuration drift detection against the approved infrastructure definition.
2. Use controlled rolling replacement such as an Auto Scaling instance refresh.
3. Define the environment as code using a service such as AWS CloudFormation.
4. Use immutable infrastructure built from versioned machine or container images.
5. Use health-gated deployment with automatic rollback to the last known good version.

Correct Answer: D

 

Correct Answer

Answer D is correct because Immutable replacement avoids accumulating manual in-place differences across long-lived hosts. This directly satisfies the decisive requirement in the scenario: immutable versioned images.

Incorrect Answers

Answer A is incorrect because Drift detection identifies resources whose current configuration no longer matches the declared template. It can be useful in other designs, but it does not satisfy the decisive requirement here: immutable versioned images.

Answer B is incorrect because Rolling replacement can introduce a new launch template or AMI while honoring minimum healthy capacity constraints. It can be useful in other designs, but it does not satisfy the decisive requirement here: immutable versioned images.

Answer C is incorrect because Infrastructure as code enables repeatable reviewed reconstruction of resources from source-controlled definitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: immutable versioned images.

Answer E is incorrect because Rollback prevents a bad release from continuing once objective health signals show it is unsafe. It can be useful in other designs, but it does not satisfy the decisive requirement here: immutable versioned images.

 

Question 17

A Region must be rebuildable after accidental deletion using reviewed source-controlled definitions. Which capability is most important?

1. Use resource/configuration drift detection against the approved infrastructure definition.
2. Use controlled rolling replacement such as an Auto Scaling instance refresh.
3. Use health-gated deployment with automatic rollback to the last known good version.
4. Use immutable infrastructure built from versioned machine or container images.
5. Define the environment as code using a service such as AWS CloudFormation.

Correct Answer: E

 

Correct Answer

Answer E is correct because Infrastructure as code enables repeatable reviewed reconstruction of resources from source-controlled definitions. This directly satisfies the decisive requirement in the scenario: infrastructure as code.

Incorrect Answers

Answer A is incorrect because Drift detection identifies resources whose current configuration no longer matches the declared template. It can be useful in other designs, but it does not satisfy the decisive requirement here: infrastructure as code.

Answer B is incorrect because Rolling replacement can introduce a new launch template or AMI while honoring minimum healthy capacity constraints. It can be useful in other designs, but it does not satisfy the decisive requirement here: infrastructure as code.

Answer C is incorrect because Rollback prevents a bad release from continuing once objective health signals show it is unsafe. It can be useful in other designs, but it does not satisfy the decisive requirement here: infrastructure as code.

Answer D is incorrect because Immutable replacement avoids accumulating manual in-place differences across long-lived hosts. It can be useful in other designs, but it does not satisfy the decisive requirement here: infrastructure as code.

 

Question 18

An Auto Scaling group must roll out a new AMI while preserving minimum healthy capacity. Which deployment mechanism fits?

1. Use health-gated deployment with automatic rollback to the last known good version.
2. Define the environment as code using a service such as AWS CloudFormation.
3. Use resource/configuration drift detection against the approved infrastructure definition.
4. Use immutable infrastructure built from versioned machine or container images.
5. Use controlled rolling replacement such as an Auto Scaling instance refresh.

Correct Answer: E

 

Correct Answer

Answer E is correct because Rolling replacement can introduce a new launch template or AMI while honoring minimum healthy capacity constraints. This directly satisfies the decisive requirement in the scenario: instance refresh or rolling replacement.

Incorrect Answers

Answer A is incorrect because Rollback prevents a bad release from continuing once objective health signals show it is unsafe. It can be useful in other designs, but it does not satisfy the decisive requirement here: instance refresh or rolling replacement.

Answer B is incorrect because Infrastructure as code enables repeatable reviewed reconstruction of resources from source-controlled definitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: instance refresh or rolling replacement.

Answer C is incorrect because Drift detection identifies resources whose current configuration no longer matches the declared template. It can be useful in other designs, but it does not satisfy the decisive requirement here: instance refresh or rolling replacement.

Answer D is incorrect because Immutable replacement avoids accumulating manual in-place differences across long-lived hosts. It can be useful in other designs, but it does not satisfy the decisive requirement here: instance refresh or rolling replacement.

 

Question 19

A new release causes health checks to fail on half the fleet. Which deployment behavior should be designed before rollout?

1. Define the environment as code using a service such as AWS CloudFormation.
2. Use controlled rolling replacement such as an Auto Scaling instance refresh.
3. Use resource/configuration drift detection against the approved infrastructure definition.
4. Use health-gated deployment with automatic rollback to the last known good version.
5. Use immutable infrastructure built from versioned machine or container images.

Correct Answer: D

 

Correct Answer

Answer D is correct because Rollback prevents a bad release from continuing once objective health signals show it is unsafe. This directly satisfies the decisive requirement in the scenario: automatic rollback to last known good version.

Incorrect Answers

Answer A is incorrect because Infrastructure as code enables repeatable reviewed reconstruction of resources from source-controlled definitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: automatic rollback to last known good version.

Answer B is incorrect because Rolling replacement can introduce a new launch template or AMI while honoring minimum healthy capacity constraints. It can be useful in other designs, but it does not satisfy the decisive requirement here: automatic rollback to last known good version.

Answer C is incorrect because Drift detection identifies resources whose current configuration no longer matches the declared template. It can be useful in other designs, but it does not satisfy the decisive requirement here: automatic rollback to last known good version.

Answer E is incorrect because Immutable replacement avoids accumulating manual in-place differences across long-lived hosts. It can be useful in other designs, but it does not satisfy the decisive requirement here: automatic rollback to last known good version.

 

Question 20

Engineers want to detect manual resource changes that diverge from the approved template. Which control should be added?

1. Define the environment as code using a service such as AWS CloudFormation.
2. Use health-gated deployment with automatic rollback to the last known good version.
3. Use resource/configuration drift detection against the approved infrastructure definition.
4. Use immutable infrastructure built from versioned machine or container images.
5. Use controlled rolling replacement such as an Auto Scaling instance refresh.

Correct Answer: C

 

Correct Answer

Answer C is correct because Drift detection identifies resources whose current configuration no longer matches the declared template. This directly satisfies the decisive requirement in the scenario: drift detection.

Incorrect Answers

Answer A is incorrect because Infrastructure as code enables repeatable reviewed reconstruction of resources from source-controlled definitions. It can be useful in other designs, but it does not satisfy the decisive requirement here: drift detection.

Answer B is incorrect because Rollback prevents a bad release from continuing once objective health signals show it is unsafe. It can be useful in other designs, but it does not satisfy the decisive requirement here: drift detection.

Answer D is incorrect because Immutable replacement avoids accumulating manual in-place differences across long-lived hosts. It can be useful in other designs, but it does not satisfy the decisive requirement here: drift detection.

Answer E is incorrect because Rolling replacement can introduce a new launch template or AMI while honoring minimum healthy capacity constraints. It can be useful in other designs, but it does not satisfy the decisive requirement here: drift detection.

 

Question 21

The business cares whether customers can complete checkout, not only whether servers respond to ping. Which availability signal is most meaningful?

1. Monitor saturation of the bounded resource and alarm before the hard limit.
2. Measure an end-to-end business transaction such as successful checkout.
3. Track an appropriate high percentile such as p95 or p99 latency.
4. Track and alarm on application request error rate.
5. Use distributed tracing such as AWS X-Ray where supported.

Correct Answer: B

 

Correct Answer

Answer B is correct because A business transaction verifies the user-visible outcome across all dependencies rather than only host reachability. This directly satisfies the decisive requirement in the scenario: synthetic or real checkout success.

Incorrect Answers

Answer A is incorrect because Saturation metrics show remaining headroom and can warn before a finite pool or quota causes user-visible failures. It can be useful in other designs, but it does not satisfy the decisive requirement here: synthetic or real checkout success.

Answer C is incorrect because High percentiles expose tail latency that can be hidden by a stable average. It can be useful in other designs, but it does not satisfy the decisive requirement here: synthetic or real checkout success.

Answer D is incorrect because Error rate directly measures failed requests even when infrastructure utilization appears normal. It can be useful in other designs, but it does not satisfy the decisive requirement here: synthetic or real checkout success.

Answer E is incorrect because Tracing correlates a request across services and shows latency and errors at each dependency. It can be useful in other designs, but it does not satisfy the decisive requirement here: synthetic or real checkout success.

 

Question 22

Average latency is stable, but a small set of users report very slow requests. Which metric is more useful than the average?

1. Track and alarm on application request error rate.
2. Track an appropriate high percentile such as p95 or p99 latency.
3. Monitor saturation of the bounded resource and alarm before the hard limit.
4. Use distributed tracing such as AWS X-Ray where supported.
5. Measure an end-to-end business transaction such as successful checkout.

Correct Answer: B

 

Correct Answer

Answer B is correct because High percentiles expose tail latency that can be hidden by a stable average. This directly satisfies the decisive requirement in the scenario: high percentile latency.

Incorrect Answers

Answer A is incorrect because Error rate directly measures failed requests even when infrastructure utilization appears normal. It can be useful in other designs, but it does not satisfy the decisive requirement here: high percentile latency.

Answer C is incorrect because Saturation metrics show remaining headroom and can warn before a finite pool or quota causes user-visible failures. It can be useful in other designs, but it does not satisfy the decisive requirement here: high percentile latency.

Answer D is incorrect because Tracing correlates a request across services and shows latency and errors at each dependency. It can be useful in other designs, but it does not satisfy the decisive requirement here: high percentile latency.

Answer E is incorrect because A business transaction verifies the user-visible outcome across all dependencies rather than only host reachability. It can be useful in other designs, but it does not satisfy the decisive requirement here: high percentile latency.

 

Question 23

A service sometimes returns errors while CPU and memory remain normal. Which direct signal should be alarmed?

1. Measure an end-to-end business transaction such as successful checkout.
2. Monitor saturation of the bounded resource and alarm before the hard limit.
3. Track an appropriate high percentile such as p95 or p99 latency.
4. Use distributed tracing such as AWS X-Ray where supported.
5. Track and alarm on application request error rate.

Correct Answer: E

 

Correct Answer

Answer E is correct because Error rate directly measures failed requests even when infrastructure utilization appears normal. This directly satisfies the decisive requirement in the scenario: application error rate.

Incorrect Answers

Answer A is incorrect because A business transaction verifies the user-visible outcome across all dependencies rather than only host reachability. It can be useful in other designs, but it does not satisfy the decisive requirement here: application error rate.

Answer B is incorrect because Saturation metrics show remaining headroom and can warn before a finite pool or quota causes user-visible failures. It can be useful in other designs, but it does not satisfy the decisive requirement here: application error rate.

Answer C is incorrect because High percentiles expose tail latency that can be hidden by a stable average. It can be useful in other designs, but it does not satisfy the decisive requirement here: application error rate.

Answer D is incorrect because Tracing correlates a request across services and shows latency and errors at each dependency. It can be useful in other designs, but it does not satisfy the decisive requirement here: application error rate.

 

Question 24

A user request crosses six microservices and is intermittently slow. Which evidence best shows where time is spent across dependencies?

1. Track an appropriate high percentile such as p95 or p99 latency.
2. Measure an end-to-end business transaction such as successful checkout.
3. Track and alarm on application request error rate.
4. Use distributed tracing such as AWS X-Ray where supported.
5. Monitor saturation of the bounded resource and alarm before the hard limit.

Correct Answer: D

 

Correct Answer

Answer D is correct because Tracing correlates a request across services and shows latency and errors at each dependency. This directly satisfies the decisive requirement in the scenario: distributed tracing.

Incorrect Answers

Answer A is incorrect because High percentiles expose tail latency that can be hidden by a stable average. It can be useful in other designs, but it does not satisfy the decisive requirement here: distributed tracing.

Answer B is incorrect because A business transaction verifies the user-visible outcome across all dependencies rather than only host reachability. It can be useful in other designs, but it does not satisfy the decisive requirement here: distributed tracing.

Answer C is incorrect because Error rate directly measures failed requests even when infrastructure utilization appears normal. It can be useful in other designs, but it does not satisfy the decisive requirement here: distributed tracing.

Answer E is incorrect because Saturation metrics show remaining headroom and can warn before a finite pool or quota causes user-visible failures. It can be useful in other designs, but it does not satisfy the decisive requirement here: distributed tracing.

 

Question 25

Requests begin failing only when a connection pool reaches its maximum. Which type of metric should alert before failure?

1. Use distributed tracing such as AWS X-Ray where supported.
2. Measure an end-to-end business transaction such as successful checkout.
3. Monitor saturation of the bounded resource and alarm before the hard limit.
4. Track and alarm on application request error rate.
5. Track an appropriate high percentile such as p95 or p99 latency.

Correct Answer: C

 

Correct Answer

Answer C is correct because Saturation metrics show remaining headroom and can warn before a finite pool or quota causes user-visible failures. This directly satisfies the decisive requirement in the scenario: saturation metric.

Incorrect Answers

Answer A is incorrect because Tracing correlates a request across services and shows latency and errors at each dependency. It can be useful in other designs, but it does not satisfy the decisive requirement here: saturation metric.

Answer B is incorrect because A business transaction verifies the user-visible outcome across all dependencies rather than only host reachability. It can be useful in other designs, but it does not satisfy the decisive requirement here: saturation metric.

Answer D is incorrect because Error rate directly measures failed requests even when infrastructure utilization appears normal. It can be useful in other designs, but it does not satisfy the decisive requirement here: saturation metric.

Answer E is incorrect because High percentiles expose tail latency that can be hidden by a stable average. It can be useful in other designs, but it does not satisfy the decisive requirement here: saturation metric.

 

Question 26

A legacy application cannot be modified this quarter but must survive a host failure. Which first resilience improvement is most practical?

1. Use a managed database proxy or pool such as RDS Proxy where supported.
2. Migrate to a compatible managed database service when requirements allow.
3. Run redundant application instances behind a health-aware load balancer when the software supports multiple nodes.
4. Move the shared files to a managed shared file service such as Amazon EFS when protocol requirements match.
5. Deploy an active-passive topology that respects the application’s single-writer constraint.

Correct Answer: C

 

Correct Answer

Answer C is correct because Redundant replaceable instances improve host resilience without requiring a deep application rewrite. This directly satisfies the decisive requirement in the scenario: run redundant replaceable instances where supported.

Incorrect Answers

Answer A is incorrect because Connection pooling reduces connection churn and can help applications recover more gracefully around database failover. It can be useful in other designs, but it does not satisfy the decisive requirement here: run redundant replaceable instances where supported.

Answer B is incorrect because Managed database services reduce customer responsibility for host replacement, patching, backups, and many availability operations. It can be useful in other designs, but it does not satisfy the decisive requirement here: run redundant replaceable instances where supported.

Answer D is incorrect because A shared managed file system removes one application host as the only holder of required files. It can be useful in other designs, but it does not satisfy the decisive requirement here: run redundant replaceable instances where supported.

Answer E is incorrect because Active-passive keeps a prepared standby while avoiding unsupported simultaneous writers. It can be useful in other designs, but it does not satisfy the decisive requirement here: run redundant replaceable instances where supported.

 

Question 27

Two legacy application nodes require the same POSIX files and fail when files are stored on one node only. Which change removes that node dependency?

1. Deploy an active-passive topology that respects the application’s single-writer constraint.
2. Use a managed database proxy or pool such as RDS Proxy where supported.
3. Run redundant application instances behind a health-aware load balancer when the software supports multiple nodes.
4. Move the shared files to a managed shared file service such as Amazon EFS when protocol requirements match.
5. Migrate to a compatible managed database service when requirements allow.

Correct Answer: D

 

Correct Answer

Answer D is correct because A shared managed file system removes one application host as the only holder of required files. This directly satisfies the decisive requirement in the scenario: managed shared file service.

Incorrect Answers

Answer A is incorrect because Active-passive keeps a prepared standby while avoiding unsupported simultaneous writers. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed shared file service.

Answer B is incorrect because Connection pooling reduces connection churn and can help applications recover more gracefully around database failover. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed shared file service.

Answer C is incorrect because Redundant replaceable instances improve host resilience without requiring a deep application rewrite. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed shared file service.

Answer E is incorrect because Managed database services reduce customer responsibility for host replacement, patching, backups, and many availability operations. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed shared file service.

 

Question 28

A legacy application opens thousands of short database connections and the database hits its connection ceiling during failover. Which addition can reduce connection churn?

1. Move the shared files to a managed shared file service such as Amazon EFS when protocol requirements match.
2. Use a managed database proxy or pool such as RDS Proxy where supported.
3. Run redundant application instances behind a health-aware load balancer when the software supports multiple nodes.
4. Deploy an active-passive topology that respects the application’s single-writer constraint.
5. Migrate to a compatible managed database service when requirements allow.

Correct Answer: B

 

Correct Answer

Answer B is correct because Connection pooling reduces connection churn and can help applications recover more gracefully around database failover. This directly satisfies the decisive requirement in the scenario: managed connection pooling proxy.

Incorrect Answers

Answer A is incorrect because A shared managed file system removes one application host as the only holder of required files. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection pooling proxy.

Answer C is incorrect because Redundant replaceable instances improve host resilience without requiring a deep application rewrite. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection pooling proxy.

Answer D is incorrect because Active-passive keeps a prepared standby while avoiding unsupported simultaneous writers. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection pooling proxy.

Answer E is incorrect because Managed database services reduce customer responsibility for host replacement, patching, backups, and many availability operations. It can be useful in other designs, but it does not satisfy the decisive requirement here: managed connection pooling proxy.

 

Question 29

A stateful commercial service supports only one active writer but can run a standby copy. Which topology matches the software constraint?

1. Migrate to a compatible managed database service when requirements allow.
2. Run redundant application instances behind a health-aware load balancer when the software supports multiple nodes.
3. Move the shared files to a managed shared file service such as Amazon EFS when protocol requirements match.
4. Deploy an active-passive topology that respects the application’s single-writer constraint.
5. Use a managed database proxy or pool such as RDS Proxy where supported.

Correct Answer: D

 

Correct Answer

Answer D is correct because Active-passive keeps a prepared standby while avoiding unsupported simultaneous writers. This directly satisfies the decisive requirement in the scenario: active-passive service.

Incorrect Answers

Answer A is incorrect because Managed database services reduce customer responsibility for host replacement, patching, backups, and many availability operations. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive service.

Answer B is incorrect because Redundant replaceable instances improve host resilience without requiring a deep application rewrite. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive service.

Answer C is incorrect because A shared managed file system removes one application host as the only holder of required files. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive service.

Answer E is incorrect because Connection pooling reduces connection churn and can help applications recover more gracefully around database failover. It can be useful in other designs, but it does not satisfy the decisive requirement here: active-passive service.

 

Question 30

A legacy self-managed database is consuming significant operational effort and a compatible managed engine now supports the required features. Which long-term direction improves operational resilience?

1. Run redundant application instances behind a health-aware load balancer when the software supports multiple nodes.
2. Deploy an active-passive topology that respects the application’s single-writer constraint.
3. Move the shared files to a managed shared file service such as Amazon EFS when protocol requirements match.
4. Use a managed database proxy or pool such as RDS Proxy where supported.
5. Migrate to a compatible managed database service when requirements allow.

Correct Answer: E

 

Correct Answer

Answer E is correct because Managed database services reduce customer responsibility for host replacement, patching, backups, and many availability operations. This directly satisfies the decisive requirement in the scenario: migrate to managed database.

Incorrect Answers

Answer A is incorrect because Redundant replaceable instances improve host resilience without requiring a deep application rewrite. It can be useful in other designs, but it does not satisfy the decisive requirement here: migrate to managed database.

Answer B is incorrect because Active-passive keeps a prepared standby while avoiding unsupported simultaneous writers. It can be useful in other designs, but it does not satisfy the decisive requirement here: migrate to managed database.

Answer C is incorrect because A shared managed file system removes one application host as the only holder of required files. It can be useful in other designs, but it does not satisfy the decisive requirement here: migrate to managed database.

Answer D is incorrect because Connection pooling reduces connection churn and can help applications recover more gracefully around database failover. It can be useful in other designs, but it does not satisfy the decisive requirement here: migrate to managed database.

 

Question 31

An application normally uses 80% of the fleet in each of two AZs. If one AZ fails, the surviving AZ cannot carry the full load. What capacity decision is required?

1. Maintain enough capacity headroom so the remaining failure domain can carry the required load.
2. Define dependency-aware recovery order with readiness checks between layers.
3. Use capacity diversification or Capacity Reservations where the workload truly requires assured EC2 capacity.
4. Review and pre-adjust relevant AWS Service Quotas in the recovery Region.
5. Use admission control, throttling, and retry backoff while the dependency recovers.

Correct Answer: A

 

Correct Answer

Answer A is correct because Failure tolerance requires capacity planning for the expected load after a component or AZ is removed. This directly satisfies the decisive requirement in the scenario: maintain sufficient failure headroom.

Incorrect Answers

Answer B is incorrect because A recovery sequence must restore required dependencies before starting components that depend on them. It can be useful in other designs, but it does not satisfy the decisive requirement here: maintain sufficient failure headroom.

Answer C is incorrect because Diversifying acceptable instance types or reserving required capacity reduces the risk that one scarce type is unavailable during recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: maintain sufficient failure headroom.

Answer D is incorrect because Correct templates still fail if the account or Region lacks quota for the resources the recovery plan must create. It can be useful in other designs, but it does not satisfy the decisive requirement here: maintain sufficient failure headroom.

Answer E is incorrect because Controlled demand prevents a newly restored dependency from being overwhelmed before it regains full capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: maintain sufficient failure headroom.

 

Question 32

A regional recovery test fails because the target Region cannot launch enough resources even though templates are correct. What should be checked in advance?

1. Use capacity diversification or Capacity Reservations where the workload truly requires assured EC2 capacity.
2. Use admission control, throttling, and retry backoff while the dependency recovers.
3. Define dependency-aware recovery order with readiness checks between layers.
4. Maintain enough capacity headroom so the remaining failure domain can carry the required load.
5. Review and pre-adjust relevant AWS Service Quotas in the recovery Region.

Correct Answer: E

 

Correct Answer

Answer E is correct because Correct templates still fail if the account or Region lacks quota for the resources the recovery plan must create. This directly satisfies the decisive requirement in the scenario: service quotas.

Incorrect Answers

Answer A is incorrect because Diversifying acceptable instance types or reserving required capacity reduces the risk that one scarce type is unavailable during recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: service quotas.

Answer B is incorrect because Controlled demand prevents a newly restored dependency from being overwhelmed before it regains full capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: service quotas.

Answer C is incorrect because A recovery sequence must restore required dependencies before starting components that depend on them. It can be useful in other designs, but it does not satisfy the decisive requirement here: service quotas.

Answer D is incorrect because Failure tolerance requires capacity planning for the expected load after a component or AZ is removed. It can be useful in other designs, but it does not satisfy the decisive requirement here: service quotas.

 

Question 33

During dependency recovery, callers immediately flood the restored endpoint and push it back into failure. Which control helps preserve recovery capacity?

1. Define dependency-aware recovery order with readiness checks between layers.
2. Use capacity diversification or Capacity Reservations where the workload truly requires assured EC2 capacity.
3. Review and pre-adjust relevant AWS Service Quotas in the recovery Region.
4. Maintain enough capacity headroom so the remaining failure domain can carry the required load.
5. Use admission control, throttling, and retry backoff while the dependency recovers.

Correct Answer: E

 

Correct Answer

Answer E is correct because Controlled demand prevents a newly restored dependency from being overwhelmed before it regains full capacity. This directly satisfies the decisive requirement in the scenario: throttle and back off callers.

Incorrect Answers

Answer A is incorrect because A recovery sequence must restore required dependencies before starting components that depend on them. It can be useful in other designs, but it does not satisfy the decisive requirement here: throttle and back off callers.

Answer B is incorrect because Diversifying acceptable instance types or reserving required capacity reduces the risk that one scarce type is unavailable during recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: throttle and back off callers.

Answer C is incorrect because Correct templates still fail if the account or Region lacks quota for the resources the recovery plan must create. It can be useful in other designs, but it does not satisfy the decisive requirement here: throttle and back off callers.

Answer D is incorrect because Failure tolerance requires capacity planning for the expected load after a component or AZ is removed. It can be useful in other designs, but it does not satisfy the decisive requirement here: throttle and back off callers.

 

Question 34

A critical EC2 workload requires a specific scarce instance type during an AZ disruption. Which planning approach reduces capacity risk?

1. Review and pre-adjust relevant AWS Service Quotas in the recovery Region.
2. Maintain enough capacity headroom so the remaining failure domain can carry the required load.
3. Define dependency-aware recovery order with readiness checks between layers.
4. Use admission control, throttling, and retry backoff while the dependency recovers.
5. Use capacity diversification or Capacity Reservations where the workload truly requires assured EC2 capacity.

Correct Answer: E

 

Correct Answer

Answer E is correct because Diversifying acceptable instance types or reserving required capacity reduces the risk that one scarce type is unavailable during recovery. This directly satisfies the decisive requirement in the scenario: diversify or reserve capacity.

Incorrect Answers

Answer A is incorrect because Correct templates still fail if the account or Region lacks quota for the resources the recovery plan must create. It can be useful in other designs, but it does not satisfy the decisive requirement here: diversify or reserve capacity.

Answer B is incorrect because Failure tolerance requires capacity planning for the expected load after a component or AZ is removed. It can be useful in other designs, but it does not satisfy the decisive requirement here: diversify or reserve capacity.

Answer C is incorrect because A recovery sequence must restore required dependencies before starting components that depend on them. It can be useful in other designs, but it does not satisfy the decisive requirement here: diversify or reserve capacity.

Answer D is incorrect because Controlled demand prevents a newly restored dependency from being overwhelmed before it regains full capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: diversify or reserve capacity.

 

Question 35

A restore runbook starts application servers before DNS, identity, and database dependencies are ready, causing repeated failed deployments. What should the runbook define?

1. Maintain enough capacity headroom so the remaining failure domain can carry the required load.
2. Use capacity diversification or Capacity Reservations where the workload truly requires assured EC2 capacity.
3. Use admission control, throttling, and retry backoff while the dependency recovers.
4. Define dependency-aware recovery order with readiness checks between layers.
5. Review and pre-adjust relevant AWS Service Quotas in the recovery Region.

Correct Answer: D

 

Correct Answer

Answer D is correct because A recovery sequence must restore required dependencies before starting components that depend on them. This directly satisfies the decisive requirement in the scenario: explicit recovery sequence and readiness gates.

Incorrect Answers

Answer A is incorrect because Failure tolerance requires capacity planning for the expected load after a component or AZ is removed. It can be useful in other designs, but it does not satisfy the decisive requirement here: explicit recovery sequence and readiness gates.

Answer B is incorrect because Diversifying acceptable instance types or reserving required capacity reduces the risk that one scarce type is unavailable during recovery. It can be useful in other designs, but it does not satisfy the decisive requirement here: explicit recovery sequence and readiness gates.

Answer C is incorrect because Controlled demand prevents a newly restored dependency from being overwhelmed before it regains full capacity. It can be useful in other designs, but it does not satisfy the decisive requirement here: explicit recovery sequence and readiness gates.

Answer E is incorrect because Correct templates still fail if the account or Region lacks quota for the resources the recovery plan must create. It can be useful in other designs, but it does not satisfy the decisive requirement here: explicit recovery sequence and readiness gates.