Question 240
An e-commerce platform has two regional application deployments and uses Route 53 health-check failover. After a successful switch, customers see authentication loops because session signing keys differ between Regions. Which non-data dependency must be coordinated?
- Increase DNS TTL so clients use the old primary Region longer even though its application is unavailable.
- Delete the secondary Region’s application identity configuration and rely on anonymous access.
- Replicate only application binaries and database records to the second Region while keeping signing secrets unique and incompatible.
- Provision compatible regional session signing material and authorization configuration through a controlled secrets/key distribution workflow.
Explanation
Correct Answer
D:Application traffic can fail after DNS routing if authentication keys and runtime security configuration are not recoverable in the target Region.
Incorrect Answers
A:Longer cached answers can delay failover and does not resolve mismatched regional session keys.
B:Removing authentication would violate the service’s access-control requirement.
C:Identical business data does not enable verification of tokens signed under a different Region’s unshared secret or key pair.
Question 241
A multi-Region payment system has producers writing order events to a queue in each Region. During an outage, the failover region may receive retries of already accepted orders. The business must not charge a card twice. Which business-continuity safeguard is essential?
- Increase both queue retention periods and assume longer storage alone provides cross-Region exactly-once billing.
- Use a globally coordinated idempotency key and durable transaction state to suppress duplicate processing across failover.
- Assume SQS standard queues deliver every message exactly once so duplicate payment authorization is impossible.
- Use SQS FIFO deduplication in one Region as the only guarantee and ignore retries arriving in the other Region after failover.
Explanation
Correct Answer
B:Regional failover and at-least-once delivery can replay requests; a shared idempotency decision prevents duplicate financial side effects.
Incorrect Answers
A:Retention preserves messages but cannot enforce an idempotency decision at the payment system.
C:Standard queues provide at-least-once delivery, requiring consumer idempotency for sensitive side effects.
D:FIFO deduplication windows are bounded and per-queue, not a globally durable payment idempotency boundary.
Question 242
A distributed RDS application has read replicas in a separate Region but developers plan to treat their asynchronous copy as an instantly consistent source for all last-second writes after a primary failure. What design reality must the recovery plan address?
- Add more read replica instances in the secondary Region but omit any measurement of lag between primary commits and replica apply.
- Measure Route 53 failover DNS TTLs alone and assume they bound missing unreplicated database transactions.
- Define an RPO that accounts for replica lag and use actual replication-lag measurements to decide whether the secondary data is safe to promote.
- Assume every RDS cross-Region replica is synchronized synchronously with the writer for all supported engines.
Explanation
Correct Answer
C:Asynchronous regional read replicas can lag behind primary commits, exposing a window of unreplicated writes.
Incorrect Answers
A:Extra replicas do not transform asynchronous propagation into a guaranteed zero-RPO replication protocol.
B:DNS convergence is a traffic-routing time factor; it does not quantify replication lag or recover missing writes.
D:Cross-Region asynchronous replication does not universally guarantee zero unreplicated transactions.
Question 243
A tax reporting workload has a 60-minute RTO and five-minute RPO. Its second Region already receives ongoing copies of the critical data tier but deliberately runs no web or application fleet before an outage. On recovery, IaC launches application compute, scales it and switches traffic. The budget forbids even a small always-on application fleet. Which disaster-recovery pattern is described?
- Warm standby with a continuously running small but functional application tier in the recovery Region.
- Pilot light with continuously maintained core data and identity dependencies, and application infrastructure launched and scaled at recovery.
- Active-active production with full traffic distributed to both Regions continuously.
- Backup and restore using only weekly backups, without any continuously updated core data or infrastructure.
Explanation
Correct Answer
B:A pilot light preserves a minimal always-ready core, commonly data and critical dependencies, while noncore application capacity is built or started after a disaster.
Incorrect Answers
A:Warm standby requires a smaller running functional copy of the application. The stated Region has only core dependencies, so it is not warm standby.
C:Active-active would maintain both Regions serving production traffic, which contradicts the no-running-application-fleet and spend limits.
D:Traditional backup and restore does not continuously replicate the critical data tier and typically involves a longer restoration sequence.
Question 244
A cloud service has Aurora Global Database replicas in two Regions. After a full primary outage, operators must promote a secondary with no reachable original writer. They are concerned about the operational difference between planned switchover and emergency promotion. Which action applies?
- Attempt a healthy-primary switchover that requires an unavailable primary to cooperate in a synchronized handoff.
- Configure a read-only Aurora global secondary reader endpoint as if it were an already writable primary, skipping the emergency promotion operation.
- Delete the secondary regional cluster and rebuild from backups even though a usable replica already exists.
- Use the documented Aurora Global Database failover procedure for an unhealthy primary, review potential lag/data loss and update dependent endpoints.
Explanation
Correct Answer
D:An emergency failover handles unavailable writer regions and carries recovery/RPO risks distinct from a synchronized planned switchover.
Incorrect Answers
A:A planned switchover is not the same operation as emergency failover with an unreachable writer.
B:The read-only cluster must undergo supported failover/promotion and application endpoint changes before accepting primary writes.
C:Destroying the warm replica throws away recovery capability and unnecessarily extends the outage.
Question 245
An organization stores compliance documents in S3 and replicates them to another Region. The team wants client request routing to use the healthy bucket even if one regional S3 endpoint becomes unavailable. The data replication is already tested. Which global routing feature is appropriate?
- Use S3 Multi-Region Access Points with validated regional bucket assignments and explicit failover routing controls.
- Point all clients to one fixed regional bucket name and assume it automatically changes Regions on outage.
- Use Route 53 weighted DNS records that still target only the original regional S3 bucket endpoint, with no healthy second-region bucket route.
- Create additional S3 bucket access points within the same impaired Region and assume their aliases provide cross-Region failover.
Explanation
Correct Answer
A:A global S3 access point can steer requests among available regional buckets when failover is correctly configured.
Incorrect Answers
B:A static regional address does not provide application-level global bucket failover.
C:Weighting one available target cannot direct S3 clients to another healthy replica without a configured second destination and routing state.
D:Regional S3 access points do not substitute for a supported Multi-Region Access Point route over both replicated buckets.
Question 246
A customer-facing application has a replicated secondary-region workload, but during a failure DNS clients continue using cached answers for the primary Region. Operators need quicker controlled traffic movement and a design that does not rely solely on recursive resolver TTL behavior. What should they consider?
- Evaluate AWS Global Accelerator with eligible regional endpoints and health-based routing, plus application retry and state continuity testing.
- Increase all DNS record TTLs to seven days because cache persistence makes failover immediate.
- Disable health checks for both Regions so clients continue trying the original endpoint indefinitely.
- Decrease the TTL on a standard Route 53 failover record but assume recursive resolvers and active client connections always immediately re-route.
Explanation
Correct Answer
A:Global Accelerator routes via stable anycast addresses toward healthy endpoints rather than depending entirely on cached DNS answer replacement.
Incorrect Answers
B:Longer caching can prolong use of a failed regional endpoint.
C:Suppressing endpoint health information prevents the required reroute to a functioning region.
D:A lower DNS TTL can improve new lookup convergence but cannot guarantee controlled instant failover when clients cache answers or keep existing sessions.
Question 247
A bank’s recovery exercises test region-wide data restoration, but the separate AWS KMS key needed to decrypt backups was not copied or recreated in the standby account. A KMS key in the failed Region cannot be reached. Which failure dependency must be resolved?
- Maintain access to suitable recovery-region KMS key material and permissions for re-encrypted backups, and test decryption during isolated recovery.
- Copy backup ciphertext to the recovery Region but retain encryption under a KMS key unavailable outside the failed Region.
- Grant every EC2 instance unrestricted S3 GetObject on the archive, ignoring KMS authorization.
- Share only the source-region KMS key alias with the standby account and assume a key alias stores portable decryption material.
Explanation
Correct Answer
A:Encrypted recovery points are unusable when the required key remains in an unavailable Region; destination key design is part of DR readiness.
Incorrect Answers
B:A copied encrypted snapshot remains unusable without an independently accessible recovery-region key and matching authorization.
C:Object permissions alone cannot decrypt data protected with an unavailable KMS key.
D:Key aliases name keys; they do not duplicate or provide independently usable key material in a failed-Region isolation scenario.
Question 248
A microservice accepts asynchronous payment settlement tasks into an SQS queue. Its secondary Region has replicated databases but no regional queue or event replay plan, so accepted tasks in the failed Region cannot be recovered or replayed. What must be added to the DR design?
- Replicate only the payment database to the standby Region and treat the original regional SQS queue as automatically mirrored by that database replication.
- Increase source queue visibility timeout and assume this copies messages across Regions for recovery.
- Design an explicit durable regional task replication or recovery/replay strategy with idempotent settlement before claiming regional RPO/RTO compliance.
- Use a longer SQS message retention period in the primary Region without a cross-Region copy, recovery or replay mechanism.
Explanation
Correct Answer
C:Database replication does not independently preserve pending queue messages; recovery must account for accepted but unprocessed transactions.
Incorrect Answers
A:Database state replication does not move pending queue messages or guarantee that accepted settlement tasks can be recovered or replayed.
B:Visibility timeout controls in-flight redelivery timing, not cross-Region message durability.
D:Longer retention cannot restore accepted messages if the only region containing the queue becomes unavailable.
Question 249
A workload in account A needs to decrypt a narrowly defined set of objects encrypted with a customer-managed AWS KMS key owned by account B. Both accounts are under the same organization. Which permission model makes the cross-account decrypt operation possible without opening broad access?
- Grant the cross-account principal kms:Decrypt in account A and add an S3 bucket policy, but leave the key policy in account B restricted to B identities.
- Allow the AWS Organization root principal broad use of the key, relying on organization membership rather than restricting the designated decrypting role.
- Allow account A's designated principal in account B's KMS key policy, and grant that principal the necessary kms:Decrypt permission in its identity policy.
- Create a KMS grant in account A using its own key ARN while the target objects remain encrypted with the unrelated key in B.
Explanation
Correct Answer
C:A cross-account KMS key policy or suitably scoped grant enables the other account, and the caller's IAM permissions must also authorize the operation, with conditions scoped to the intended resource flow.
Incorrect Answers
A:KMS key resource-policy authorization in the owning account remains a necessary part of cross-account usage; neither caller identity permission nor S3 policy substitutes for it.
B:The broad principal scope exceeds the requested narrow key access and can permit unintended use when combined with identity grants. Target the approved role and operations.
D:A grant applies to its specific KMS key; it cannot authorize decryption of ciphertext under a distinct key in another account.
Question 250
A CloudFront distribution must serve private S3 origin objects without making the bucket publicly readable. The application is migrating away from older origin access identity configurations. Which modern origin access mechanism should the team adopt?
- Configure CloudFront Origin Access Control with signed origin requests and a scoped S3 bucket policy permitting the distribution.
- Configure an S3 bucket policy for the CloudFront service principal but omit the distribution-specific SourceArn condition and origin signing.
- Keep the legacy Origin Access Identity (OAI) and assume it is the current preferred mechanism for every new S3 origin.
- Require CloudFront signed viewer URLs only while leaving the S3 origin bucket directly accessible to authorized public identities.
Explanation
Correct Answer
A:OAC provides an appropriate CloudFront-to-private-S3 authorization path without enabling public S3 object access.
Incorrect Answers
B:CloudFront OAC requires appropriately signed origin requests and a scoped policy; a broad service-principal statement alone is insufficiently constrained.
C:OAI is the older pattern; OAC adds modern origin-request signing and broader supported configurations for a migration away from OAI.
D:Viewer authorization does not enforce private origin access. Direct S3 requests can bypass CloudFront unless the bucket policy limits origin access via OAC.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests