4 of the 6 questions we have for this objective, shown with the answer and the reasoning.
Design reliable and resilient architectures
Mossgiel Healthcare uses AWS Backup in 60 accounts in eu-west-2. Auditors want evidence every month that every Amazon RDS database and DynamoDB table tagged data-class=phi is backed up daily with 35-day retention, and the operations team wants proof that the backups can actually be restored, not just that they exist. The team wants managed features rather than custom scripts.
Which three actions should the solutions architect take? Each correct answer presents part of the solution.
- AUse an AWS Organizations backup policy that assigns resources by the tag data-class=phi to a daily backup rule with 35-day retention.Tag-based resource assignment in an organization backup policy ensures that every tagged resource in every account is included in the required plan.
- BCreate an AWS Backup Audit Manager framework with controls for backup frequency and retention, and generate compliance reports to an S3 bucket.Backup Audit Manager evaluates resources against controls such as minimum frequency and retention and produces reports that auditors can review.
- CCreate AWS Backup restore testing plans that periodically restore selected recovery points of the protected resources and validate the restored resources.Restore testing runs scheduled restores and reports success and duration, which proves recoverability rather than just the existence of recovery points.
- DEnable AWS Config conformance packs for HIPAA in each account to back up the PHI resources.Conformance packs evaluate configuration compliance; they do not create or schedule backups.
- EEnable automated RDS snapshots and DynamoDB point-in-time recovery in each account and export the settings to a spreadsheet monthly.Native backup features work, but a manual monthly spreadsheet is not auditable at scale and does not prove that restores succeed.
Why: An effective backup strategy has three parts: making sure the right resources are protected, proving that protection meets policy, and proving that data can be restored. AWS Backup covers all three with organization backup policies and tag-based assignments, Backup Audit Manager frameworks and reports, and restore testing. Using tags as the selection mechanism means new PHI resources are protected as soon as they are tagged. Config and native snapshots are complementary but do not deliver auditable, organization-wide restore evidence by themselves.
Design reliable and resilient architectures
Pellham Learning runs its course platform on an Amazon Aurora MySQL cluster with a single db.r6g.4xlarge writer in ap-southeast-2. Performance Insights shows that 85% of the load is read queries from student dashboards, which spike to five times normal at the start of each semester and then fall back. Writes are steady and well within the writer's capacity. The company has already scaled the writer up twice and wants a solution that handles future spikes cost-effectively.
What should the solutions architect recommend?
- AScale the writer up to db.r6g.16xlarge so that it can absorb the semester peaks.Scaling up pays for peak capacity all year, has an upper limit, and causes a brief interruption on each resize. It does not use the read-heavy pattern to advantage.
- BAdd Aurora Replicas, point the dashboards at the reader endpoint, and configure Aurora Auto Scaling to add and remove replicas based on reader CPU utilization.Aurora Replicas share the cluster storage, so they scale reads out quickly, and Aurora Auto Scaling adds replicas during semester peaks and removes them afterward, paying only for the capacity needed.
- CCreate an Aurora global database secondary cluster in ap-southeast-1 and send dashboard reads there.A secondary Region adds cross-Region latency and cost for a problem that is local to one Region.
- DShard the database across three Aurora clusters by student ID.Sharding addresses write scaling, which is not the bottleneck, and requires significant application changes.
Why: Choosing between scaling up and scaling out starts with identifying the bottleneck. When the load is mostly reads and the writer has spare write capacity, horizontal read scaling with replicas is cheaper and more elastic than repeatedly enlarging one instance. Aurora Replicas read from the shared cluster volume with typically low replica lag, and the reader endpoint spreads connections across them. Aurora Auto Scaling matches the replica count to demand, which suits a seasonal pattern.
Design reliable and resilient architectures
Kittering Legal has workloads on Amazon EC2 and Amazon EFS in 30 accounts in us-east-1. After a ransomware incident at a peer firm, the board requires that backups be copied to a separate account and a separate Region, that nobody, including the root user of any account, can delete or shorten retention of those copies for seven years, and that backup plans be enforced centrally so that application teams cannot opt out.
Which solution meets these requirements?
- AEnable cross-account backup in AWS Organizations, use an AWS Backup backup policy at the organization level with a rule that copies recovery points to a vault in a dedicated backup-vault account in us-west-2, and apply AWS Backup Vault Lock in compliance mode with a seven-year minimum retention to that vault.Organization backup policies enforce plans in every account, the copy action places recovery points in another account and Region, and Vault Lock in compliance mode cannot be removed or shortened by anyone once the grace period ends.
- BCreate backup plans in each account with copies to a vault in us-west-2 in the same account, and apply Vault Lock in governance mode.Same-account copies are exposed if that account is compromised, plans per account can be changed by application teams, and governance mode can be bypassed by principals with sufficient IAM permissions.
- CWrite EBS snapshots and EFS exports to an S3 bucket in a backup account with S3 Object Lock in governance mode and replicate the bucket to us-west-2.This replaces a managed backup service with custom tooling, and governance mode Object Lock can be overridden by users with the bypass permission, so it does not meet the requirement that nobody can delete.
- DUse Amazon Data Lifecycle Manager policies in each account to copy snapshots cross-Region and attach an SCP that denies ec2:DeleteSnapshot.Data Lifecycle Manager does not cover EFS, SCPs do not apply to the management account, and an SCP can be detached, so retention is not immutable.
Why: A ransomware-resilient backup design separates the backups from the blast radius of the source accounts and makes them immutable. AWS Backup supports copying recovery points to a vault in another account in the organization and in another Region as part of a backup rule, and backup policies in AWS Organizations push those plans to every member account. AWS Backup Vault Lock in compliance mode enforces minimum retention that no user, including root, can change after the cooling-off period. Governance mode and SCPs are useful controls but can be lifted by privileged users.
Design reliable and resilient architectures
Sablewood Ticketing runs a stateless REST API on EC2 instances in an Auto Scaling group behind an Application Load Balancer in us-east-1, with a standby copy of the stack in us-west-2. Twice last quarter, instances hung because of a memory leak, kept passing EC2 status checks, and served errors until an engineer terminated them. During a separate event, the whole us-east-1 stack was unreachable and DNS had to be changed by hand. The company wants both failure types to recover automatically with no human action.
Which solution meets these requirements?
- ASet the Auto Scaling group health check type to ELB with an application health check path on the target group, and create Route 53 failover records with a health check on the us-east-1 endpoint that fails over to us-west-2.ELB health checks let Auto Scaling replace instances that fail the application check even when EC2 status checks pass. Route 53 failover routing with health checks automatically answers with the secondary Region when the primary is unhealthy.
- BEnable EC2 automatic recovery on each instance and use Route 53 weighted records with weights of 100 and 0.Automatic recovery reacts to underlying hardware status check failures, not application hangs. Weighted records with a weight of 0 do not fail over automatically without health checks on the records.
- CCreate a CloudWatch alarm on the ALB HTTPCode_Target_5XX_Count metric that notifies the on-call engineer, and document a runbook for Regional failover.Alarms that page a person still require human action, which the company wants to eliminate.
- DReplace the ALB with AWS Global Accelerator in front of both Regions and keep the Auto Scaling group on EC2 health checks.Global Accelerator can fail over between Regions, but with EC2 health checks the Auto Scaling group would still keep hung instances that pass status checks.
Why: Automatic recovery should be designed at each layer. At the instance layer, an Auto Scaling group that uses ELB health checks replaces instances that fail an application-level check, which catches hangs that EC2 status checks miss. At the Regional layer, Route 53 failover routing with health checks, or another health-aware global entry point, shifts traffic to a standby Region without a person editing DNS. Monitoring that pages an engineer is useful but is not self-healing.