4 of the 8 questions we have for this objective, shown with the answer and the reasoning.
Design a strategy to meet reliability requirements
Pembroke Learning runs a content management system on Linux Amazon EC2 instances in an Auto Scaling group across three Availability Zones. All instances must read and write the same uploaded media files at the same time through a POSIX file system, and the file storage must stay available if one Availability Zone fails. The team does not want to manage storage servers.
Which storage option should the solutions architect choose?
- AAn Amazon EFS Regional file system with a mount target in each Availability Zone.EFS is a fully managed NFS file system that many Linux instances can mount concurrently. Regional file systems store data redundantly across multiple Availability Zones, and a mount target in each zone lets instances keep accessing the file system if one zone fails.
- BAn Amazon EBS Provisioned IOPS volume with Multi-Attach enabled, attached to all instances.EBS volumes exist in a single Availability Zone, Multi-Attach is limited to instances in that zone, and it requires a cluster-aware file system.
- CAn Amazon FSx for Windows File Server Single-AZ file system.FSx for Windows File Server serves SMB clients, and a Single-AZ deployment does not survive the loss of its zone.
- DInstance store volumes on each instance synchronized with rsync every minute.Instance store data is lost when an instance stops or fails, and a custom sync job is not a shared file system and creates conflicts.
Why: Choosing a managed service that is highly available by design removes the need to build replication or clustering. Amazon EFS provides shared POSIX file storage for Linux with automatic multi-AZ durability and availability when you create a Regional file system rather than a One Zone file system. The deciding constraints are concurrent access from instances in several zones, survival of a zone failure, and no storage servers to manage. EBS and FSx Single-AZ options are tied to one zone, and instance store is ephemeral.
Design a strategy to meet reliability requirements
Strathmere Bank runs its payments application active/passive in us-east-1 and us-west-2, with an Aurora global database. After an incident in which automated health checks flipped traffic back and forth between Regions, the bank decided that Regional failover must be an explicit operator decision. The failover mechanism must keep working even if the AWS Management Console or a Regional control plane is impaired, and a safeguard must prevent operators from accidentally turning off traffic to both Regions at the same time.
Which solution meets these requirements?
- ACreate Amazon Route 53 failover records with health checks on the ALB in each Region and lower the health check failure threshold to 1.Automated health checks are what caused traffic flapping. Making them more sensitive increases the problem and does not make failover an operator decision.
- BWrite a runbook that edits the Route 53 record values in the console to point to the standby Region during an incident.Editing records uses the Route 53 control plane and the console, which the bank wants to avoid depending on, and nothing prevents an operator from removing both Regions.
- CUse Amazon Application Recovery Controller routing controls attached to Route 53 health checks on failover records for each Region, add an assertion safety rule requiring at least one routing control to be on, and have operators change routing control states through the highly available cluster data plane endpoints.Routing controls are simple on and off switches that operators flip to move traffic, implemented through Route 53 health checks. The cluster offers redundant data plane endpoints in several Regions, so changes work even when the console or a control plane is impaired, and safety rules block states such as both Regions off.
- DPlace both Regional ALBs behind AWS Global Accelerator and let endpoint health checks move traffic automatically.Global Accelerator health-based failover is automatic, which conflicts with the requirement for an explicit operator decision, and it offers no rule preventing both endpoints from being disabled.
Why: For critical applications, many organizations prefer human-initiated Regional failover so that partial or flapping signals do not move traffic unnecessarily. Amazon Application Recovery Controller routing controls provide that switch: each control maps to a Route 53 health check, and changing its state through the cluster's data plane endpoints redirects DNS answers without relying on control plane or console availability. Safety rules enforce invariants such as keeping at least one Region on. The distractors either rely on automatic health decisions or on control plane edits during the incident.
Design a strategy to meet reliability requirements
Corriemont Films streams licensed content that, by contract, must be served to viewers in Europe only from its stack in eu-west-1 and to all other viewers from its stack in us-east-1. Some viewers connect from IP addresses that Amazon Route 53 cannot map to any geographic location. Every viewer must receive a DNS answer for watch.corriemont.example.
How should the solutions architect configure Route 53?
- ACreate latency-based records for eu-west-1 and us-east-1.Latency routing chooses the Region with the lowest network latency, which can send European viewers to us-east-1, breaking the licensing contract.
- BCreate a geolocation record for the continent Europe pointing to eu-west-1 and a geolocation record for the Default location pointing to us-east-1.Geolocation routing answers based on where the viewer's DNS query originates. The Default record catches all locations not explicitly configured, including addresses that cannot be mapped, so every viewer gets an answer.
- CCreate geolocation records for Europe and North America only.Without a Default record, viewers from other continents or from unmapped IP addresses receive no answer.
- DCreate weighted records that send 50 percent of queries to each Region.Weighted routing distributes queries by ratio without regard to viewer location, so it cannot enforce the regional licensing rule.
Why: Geolocation routing is the Route 53 policy for location-based requirements such as content licensing, localization or data restrictions. Records can target a continent, country or US state, and a Default record answers for any location without a specific record and for addresses that cannot be geolocated. Latency and weighted routing optimize for performance or distribution, not for where the user is. Forgetting the Default record is the most common mistake with geolocation routing.
Design a strategy to meet reliability requirements
Larchmont Credit runs a loan-status API on AWS Lambda that connects to an Amazon Aurora MySQL cluster with one writer and two readers. During a recent writer failover, the API returned errors for several minutes even though Aurora completed the failover in about 30 seconds, because cached DNS answers kept pointing to the old writer and thousands of new connections then hit the new writer at once. The company wants failovers to be as transparent to the application as possible without rewriting its database access code.
Which solution should the solutions architect recommend?
- AAdd two more Aurora Replicas so that more failover targets are available.Aurora already had replicas to promote. More failover targets do not fix client DNS caching or the flood of new connections.
- BLower the time to live of the cluster endpoint DNS record in Amazon Route 53 to 1 second.Aurora cluster endpoints are managed by AWS and their TTL cannot be changed by the customer, and client-side caching would still not prevent the connection storm.
- CReplace the cluster with an Aurora Serverless v2 cluster in a single Availability Zone.Serverless v2 changes how capacity scales, not how clients reconnect after failover, and a single-zone design reduces availability.
- DCreate an Amazon RDS Proxy for the cluster, store the database credentials in AWS Secrets Manager, and point the Lambda functions at the proxy endpoint.RDS Proxy pools and reuses connections and tracks the cluster topology itself, so during a failover it connects to the new writer without depending on client DNS caching. Applications keep connecting to the same proxy endpoint, which reduces failover disruption and prevents connection storms.
Why: Operating a highly available database includes making failovers transparent to clients, not just to the database. Amazon RDS Proxy sits between the application and the database, keeps a warm connection pool, and follows writer changes internally, so applications do not have to wait for DNS updates and do not stampede the new writer. It is especially useful with Lambda, where many short-lived function instances open connections. The distractors adjust things that either cannot be changed or do not affect client behavior during failover.