Examkin

Question

Difficulty: MediumEnhancing Reliability and Disaster Recovery

A financial services company has a transaction auditing application hosted on Amazon EC2 instances across three Availability Zones in the us-east-1 Region. The instances are in private subnets and send audit logs to external regulatory endpoints via a single NAT Gateway located in the us-east-1a subnet. The application uses a multi-AZ Amazon RDS PostgreSQL database. The company is establishing a disaster recovery (DR) site in the us-west-2 Region with a target Recovery Time Objective (RTO) of 10 minutes and a Recovery Point Objective (RPO) of 1 minute.

During a recent local network impairment in us-east-1a, the auditing application lost outbound connectivity to the external regulatory endpoints across all Availability Zones. Additionally, during a DR simulation, automatic failover to the secondary region did not trigger when the primary region became degraded because the Route 53 DNS records lacked active health monitoring.

Which set of actions will resolve the outbound connectivity issue and ensure a reliable automated failover to the secondary region within the target RTO and RPO?

  1. A
    Deploy a single NAT Gateway in a shared services VPC and configure Transit Gateway peering to route outbound traffic from all Availability Zones in the primary VPC. Set up Amazon RDS cross-region replication to the secondary region. Configure Route 53 using simple routing policies with a Time to Live (TTL) of 0 seconds pointing to both Application Load Balancers.
  2. B
    Configure a single NAT Instance in one of the private subnets to serve as a backup route for the other subnets to provide redundancy. Configure an Amazon RDS cross-region read replica in the secondary region. Create Route 53 failover records pointing to the primary and secondary regions, but omit Route 53 health checks to prevent false failover triggers.
  3. Deploy a NAT Gateway in each of the three Availability Zones in the primary region, and update the private subnet route tables to direct outbound traffic through the local NAT Gateway. Configure an Amazon RDS cross-region read replica in the secondary region. Create Route 53 failover routing records pointing to the primary and secondary Application Load Balancers, and associate the primary record with a Route 53 health check configured to monitor the primary endpoint.Answer
  4. D
    Deploy a NAT Gateway in each of the three Availability Zones in the primary region, and update the private subnet route tables to direct outbound traffic through the local NAT Gateway. Configure AWS Backup to take hourly snapshots of the database and copy them to the secondary region. Create Route 53 failover routing records pointing to both regions, associating the primary record with a Route 53 health check.

Answer

Deploy a NAT Gateway in each Availability Zone of the primary region to ensure local internet egress redundancy. Replicate the database using an Amazon RDS cross-region read replica to meet the 1-minute RPO, and configure Route 53 failover routing with a health check on the primary record to enable automated failover to the secondary region.
Deploying a NAT Gateway in each Availability Zone ensures high availability for outbound traffic. Using an Amazon RDS cross-region read replica supports a Recovery Point Objective (RPO) of under one minute due to near-real-time asynchronous replication. Associating the primary Route 53 failover record with an active health check enables automatic DNS failover to the disaster recovery region when the primary region is degraded.

Step-by-Step Solution

1
Analyze outbound internet connectivity requirements for the primary region.
Identify that relying on a single NAT Gateway in one Availability Zone (AZ) creates a single point of failure. To achieve high reliability, a NAT Gateway must be deployed in each AZ, with route tables updated to route local private subnet traffic through the local zone's NAT Gateway.
Ensures that an outage in one AZ does not disrupt outbound traffic originating from the other healthy AZs.
2
Evaluate the database replication strategy against RTO and RPO requirements.
A target RPO of 1 minute requires active database replication. An Amazon RDS cross-region read replica replicates data asynchronously, typically with a lag of seconds, satisfying the 1-minute RPO. Backup snapshot copying (hourly) is insufficient as it yields an RPO of 1 hour.
Determines the appropriate replication method to meet business continuity and data loss constraints.
3
Configure DNS routing and automated failover for disaster recovery.
Use Route 53 failover routing policy with a primary record pointing to the primary ALB and a secondary record pointing to the recovery region's ALB. Associate the primary record with a Route 53 health check.
Route 53 requires an active health check associated with the failover record to automatically detect a regional degradation and shift traffic to the recovery endpoint.

Key Concept

Deploying redundant NAT Gateways per Availability Zone prevents outbound single points of failure. Implementing cross-region read replicas satisfies low RPO requirements, and pairing Route 53 failover routing with active health checks enables automated multi-region disaster recovery failover.
Rate this question

Topics

Enhancing Reliability and Disaster Recovery