Question 90
A finance system permits 24 hours of recovery time and 12 hours of data loss after a regional disaster. The workload is rarely used, and the business prioritizes low standby expense over immediate failover. Which disaster-recovery model best matches these constraints?
- Use backup-and-restore with tested cross-Region recovery procedures and a backup schedule meeting the stated RPO.
- Operate a fully active dual-Region application fleet with synchronous client traffic even though recovery objectives allow an economical day-long restore.
- Use a warm standby with continually operating secondary application servers and database compute without comparing cost against tested backup-and-restore.
- Keep daily backups only in the primary Region and configure Route 53 failover DNS without building an off-Region recovery target.
Explanation
Correct Answer
A:Backup-and-restore minimizes continuously running standby compute and can meet relatively relaxed RTO and RPO requirements when recovery tests validate timing.
Incorrect Answers
B:Active-active may improve availability but incurs unnecessary standby and operational expense relative to proven cross-Region backup/restore for this low-priority workload.
C:Warm standby can achieve tighter RTOs but carries baseline running expense that conflicts with this unusually relaxed RTO and cost priority.
D:Failover records cannot restore the workload after a complete Region outage without recoverable backups and an actual secondary deployment plan.
Question 91
A workload has RTO of 30 minutes, and operations already keeps a small secondary-region database instance receiving frequent replicated updates. During a DR exercise, the team discovers the application stack is stored only as undocumented manual console settings. Which improvement most directly makes recovery repeatable?
- Increase source database snapshot retention and assume that longer retention guarantees the manually recreated secondary application will meet the 30-minute RTO.
- Deploy a secondary-region database snapshot retention policy but continue restoring networking, identity, application and load-balancing resources manually.
- Capture AMIs of current primary instances but leave security groups, load balancing, IAM and route cutover as undocumented console procedures.
- Capture the secondary application infrastructure in IaC and rehearse deployment, database promotion and cutover against the RTO.
Explanation
Correct Answer
D:Infrastructure-as-code plus timed promotion and routing drills make full-stack recovery reproducible and expose dependencies that would break the deadline.
Incorrect Answers
A:More snapshots do not automate application fleet, networking, secrets and promotion procedures; infrastructure as code and tested recovery drills address the missing evidence.
B:A longer DB history cannot shorten unpredictable app and dependency setup; use version-controlled IaC with timed full-stack failover rehearsal.
C:Images alone omit the other resource dependencies and still require manual reconstruction, so they do not establish a repeatable end-to-end secondary application stack.
Question 92
A multi-account organization requires backups of critical EBS volumes and RDS databases to remain recoverable even if a compromised workload administrator deletes source resources. The business specifies retention and cross-account isolation. What is the strongest foundation?
- Enable AWS Backup vault retention only in the workload account while leaving privileged workload administrators able to manage the only backup location.
- Copy RDS and EBS backups to a separate account but permit source administrators to delete or prematurely expire those recovery points through broad access.
- Use AWS Backup with appropriately configured cross-account backup copies into a protected backup account and immutable retention controls where supported.
- Copy all backup recovery points into a member-owned vault that trusts the same compromised workload administrators with deletion and key-disabling rights.
Explanation
Correct Answer
C:Centralized backup policies and isolated copies reduce source-account blast radius; supported vault lock retention prevents premature destructive changes.
Incorrect Answers
A:Local retention may help but does not establish the required isolation from a compromised source account; independent cross-account recovery copies are necessary.
B:Cross-account copies alone are not sufficient if their permissions/retention allow the same compromised identity to destroy protected recovery data.
D:A shared administrative blast radius defeats the required isolation; cross-account copies need independent account, key and immutable retention controls.
Question 93
A public website has replicated application state in two AWS Regions. Primary-region health failures should move new clients to a healthy secondary endpoint; the team understands that existing TCP sessions are not migrated by DNS. Which routing design matches this disaster-response requirement?
- Use Route 53 latency-based routing to both Regions without health evaluation and assume an unhealthy primary endpoint is removed automatically.
- Configure Route 53 failover records with suitable health checks and appropriate DNS TTL and application retry behavior.
- Use a weighted primary/secondary DNS record with 100% weight on the primary but configure no health check for the primary target.
- Set low TTLs on static primary A records while omitting failover policy and a monitored secondary alias record.
Explanation
Correct Answer
B:Health-based DNS failover can direct new lookups to a secondary endpoint when the primary is unhealthy; tests must account for resolver caching.
Incorrect Answers
A:Latency routing without suitable health checks does not safely withdraw an unhealthy endpoint; the request is primary/secondary failover with health evaluation.
C:Weight alone does not identify regional failure or automatically remove the impaired primary endpoint as failover records with health checks do.
D:Shorter caches can help responsiveness, but a static primary record still lacks the health-aware failover mechanism and known secondary target.
Question 94
A stateful order application uses a Multi-AZ database but stores recently accepted order IDs only on instance-local disks in two app servers. AZ failovers are rare, yet recent orders disappear when an app node is replaced. Which architectural change removes the documented data-loss path?
- Persist accepted order state to durable shared storage or the database before acknowledging it, and make app instances replaceable.
- Copy the two application server local order-ID files to a shared volume once nightly but acknowledge customer orders immediately on local disk during the day.
- Enable ALB session stickiness so users continue sending writes to one application instance storing each order ID on local disk.
- Use ALB application-based session stickiness for order sessions but continue acknowledging orders before saving them outside the local instance store.
Explanation
Correct Answer
A:The lost state resides on ephemeral app-host disks, so durable commit before acknowledgment is required independently of database Multi-AZ availability.
Incorrect Answers
B:Daily copying leaves accepted but not durably replicated order IDs exposed to instance replacement; durable commit must precede acknowledgment.
C:Stickiness is routing affinity rather than durable state; the node can still be lost and its previously acknowledged orders vanish.
D:Sticky traffic is not persistent state; if the EC2 instance is replaced, its acknowledged but uncommitted order IDs remain lost.
Question 95
A health-care records portal uses Amazon Aurora in one Region with cross-Region replicas. The board requires a measured maximum recovery-point gap; operators currently assume replication implies zero data loss. What should an architect add to the design before claiming compliance?
- Increase replica size in the standby Region but keep no measurements of replication lag during peak write workloads.
- Treat reported cluster availability as proof that each committed primary transaction is instantly visible in the replica.
- Monitor actual cross-Region replication lag and run failure exercises that compare committed data with the stated RPO.
- Use a time-based health check for the secondary API endpoint as the sole measurement of database replication RPO.
Explanation
Correct Answer
C:Asynchronous replication can lag, so measured replication delay and realistic failover tests are needed to substantiate the recovery-point objective.
Incorrect Answers
A:Extra capacity can help in some cases but does not prove the actual cross-Region recovery-point gap, particularly during changing load.
B:Availability is different from data freshness; asynchronous replication may lag despite both clusters being operational.
D:API health checks do not report the age of committed data replicated to the secondary cluster. Monitor and test replication lag.
Question 96
A legal document service protects objects with S3 Cross-Region Replication. Audit teams need a measurable target for replicating eligible newly created objects and warnings when replication breaches its expected window. Which capability should be evaluated?
- Enable replication metrics and use their observed latency as if they carried the S3 RTC service-level replication-time target without configuring RTC.
- Run S3 Batch Replication nightly and count completed jobs as evidence every new object was replicated within the latency window.
- Enable S3 Replication Time Control for eligible replication rules, monitor its replication metrics, and subscribe to supported replication-time event notifications.
- Enable S3 Inventory in the destination and interpret an object listed the following day as proof it reached the bucket within minutes.
Explanation
Correct Answer
C:RTC adds a documented time-based replication objective with CloudWatch operational evidence and event notifications, unlike best-effort replication without RTC controls.
Incorrect Answers
A:Ordinary metrics provide visibility but not the specified Replication Time Control supported completion behavior for eligible new objects.
B:Batch jobs can copy selected objects, but their completion does not measure the live replication-time target of eligible newly created objects.
D:A daily inventory cannot establish minute-scale replication lag or emit the requested RTC threshold notifications.
Question 97
A media streaming workload has complete S3 data copies in another Region, but an outage drill fails because IAM roles, certificates and infrastructure stacks were never prepared there. Data restoration alone meets RPO but not RTO. What needs to change?
- Prestage or reproducibly deploy regional infrastructure, identity, certificates and routing prerequisites and test a timed recovery runbook.
- Increase S3 replication speed while keeping recovery-region IAM roles, certificates and application infrastructure undefined.
- Retain application launch scripts only on the primary Region EC2 instances and plan to read them after regional isolation.
- Configure Route 53 failover records before testing whether the standby TLS endpoints and service identities can actually start.
Explanation
Correct Answer
A:Disaster recovery covers the whole application dependency graph; missing regional identity and configuration can dominate time to restore service.
Incorrect Answers
B:Faster data availability does not restore the missing application/control-plane prerequisites that caused the RTO failure.
C:Recovery dependencies cannot reside exclusively on affected resources. Templates, secrets and credentials must be available independently.
D:DNS can route customers to a destination but cannot bootstrap its unavailable roles, certificates or application stacks.
Question 98
A manufacturing company plans a low-cost disaster-recovery strategy for on-premises VMware servers. Application binaries cannot be rebuilt quickly, and the company requires bootable copies on EC2 in a recovery Region with continuous source replication. Which AWS option fits?
- Evaluate AWS Elastic Disaster Recovery with continuous block-level replication and rehearse recovery launches and failback.
- Use AWS Application Migration Service as a continuously replicating recovery mechanism while omitting the disaster-specific recovery runbook and failback controls.
- Create monthly AMI exports and restore them on demand, assuming monthly copies satisfy a continuous source replication requirement.
- Replicate only VMware configuration metadata and recreate each server operating system manually in the outage Region.
Explanation
Correct Answer
A:Elastic Disaster Recovery protects supported source servers through continuous replication and orchestrated recovery into AWS with tested recovery points.
Incorrect Answers
B:MGN specializes in rehosting cutover; Elastic Disaster Recovery supplies ongoing DR replication and recovery operations for this requirement.
C:Periodic offline images do not continuously replicate changing server data or provide the low-RPO bootable recovery workflow.
D:Metadata alone does not preserve bootable application and OS disks; continuous block replication and exercised recovery launch are needed.
Question 99
An online banking application is deployed active-passive across two Regions. The secondary application has adequate compute and replicated data, but operators worry they could promote both regions as writers during a network partition. Which additional design concern is critical?
- Enable writes independently in both Regions after a network partition and rely on DNS health routing to prevent overlapping writer ownership.
- Allow operators to promote the passive database but omit a mechanism to revoke or fence the original primary writer.
- Increase replica node count in both Regions and assume redundant compute prevents concurrent-primary election.
- Use a tested single-writer failover and fencing procedure that prevents split-brain writes during regional promotion.
Explanation
Correct Answer
D:Preventing simultaneous independent writers preserves transaction integrity when health signals disagree or network partitions isolate the Regions.
Incorrect Answers
A:DNS routing does not guarantee exclusive database writer authority, especially under cached answers and partition conditions.
B:Without fencing, the recovered old primary can continue accepting writes after secondary promotion, creating split-brain transactions.
C:Replica counts influence capacity and local availability, not distributed exclusive writer ownership during regional partitions.
Question 100
An AWS Organization has already enabled AWS Backup cross-account copy. A workload-account plan copies customer-managed-KMS-encrypted RDS recovery points into a security-account vault. A test copy fails AccessDenied: the source role can initiate CopyFromBackupVault, but the destination vault has no inbound-copy permission and the source encryption key is not usable by the copy principal. Which configuration corrects this specific failure?
- Increase the backup source vault retention period and retry, keeping the destination vault resource policy and KMS permissions unchanged.
- Authorize backup:CopyIntoBackupVault in the destination vault resource policy for the permitted source, provide compatible source customer-managed KMS key access and eligible destination encryption permissions, then retest the copy.
- Enable S3 Block Public Access on the workload data lake and assume it grants AWS Backup cross-account vault copy and KMS decrypt permission.
- Create another backup plan in the source account with the same roles and destination policy omissions, expecting a different schedule to fix AccessDenied.
Explanation
Correct Answer
B:Cross-account backup copy requires destination-vault CopyInto permissions and cryptographic access to encrypted source backups and eligible destination keying; the revised trust permits the job without broad access.
Incorrect Answers
A:Retention changes do not authorize an inter-account copy into the target vault or unlock the source KMS key for the copy workflow.
C:S3 Block Public Access is an object access control unrelated to the required AWS Backup vault policy and KMS-copy permissions.
D:A schedule change cannot satisfy missing resource-policy and key authorizations; the original copy failure would remain.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests