Examkin

Question

Difficulty: MediumEnhancing Reliability and Disaster Recovery

A gaming company has a telemetry platform deployed across two AWS accounts: Account A holds the primary application tier (Application Load Balancer (ALB) and Amazon EC2 instances in us-east-1) and Account B holds the disaster recovery warm standby tier (ALB and EC2 instances in us-west-2). The database layer is an Amazon Aurora Global Database spanning both Regions. The company's private internal network resolution uses a Route 53 Private Hosted Zone (PHZ) hosted in Account A.

During a simulated outage of the us-east-1 Region, internal services in Account B were unable to resolve the database and application endpoints, and Route 53 failed to automatically redirect internal client traffic to the secondary ALB. Additionally, the Solutions Architect must ensure outbound traffic from the secondary application tier in us-west-2 has redundant paths to the internet to prevent single-AZ failures from blocking replication or telemetry collection.

Which TWO steps should the Solutions Architect take to resolve these issues and ensure reliable multi-region failover? (Select TWO.)

  1. Associate the Private Hosted Zone in Account A with the VPC in Account B. Authorize the cross-account association from Account A, and then associate the VPC in Account B using the AWS CLI or SDK.Answer
  2. Configure Route 53 failover routing records for the Application Load Balancer endpoints within the Private Hosted Zone. Associate the primary record with a Route 53 health check that monitors the primary application, and enable Evaluate Target Health.Answer
  3. C
    Create a duplicate Route 53 Private Hosted Zone with the exact same domain name in Account B, associate it with the VPC in Account B, and configure duplicate DNS records pointing to the local resources in us-west-2.
  4. D
    Configure the Route 53 failover records using a 0-second TTL and remove all health check associations to allow clients to query the secondary ALB immediately upon connection timeout.
  5. E
    Deploy a single NAT Gateway in a public subnet of the us-west-2 VPC, and configure the route tables of all private subnets to point to it, optimizing cost during warm standby mode.

Answer

Authorize and associate the Private Hosted Zone from Account A with the VPC in Account B, and configure Route 53 failover routing records for the Application Load Balancers with active health checks.
The correct actions involve configuring cross-account Private Hosted Zone association to allow the secondary VPC to resolve database and application endpoints, and configuring Route 53 failover routing with active health checks or Evaluate Target Health to automatically redirect traffic. Because Private Hosted Zones are isolated to the associated VPCs, the VPC in Account B must be associated with the Private Hosted Zone in Account A to perform lookup queries. Furthermore, Route 53 relies on health checks to determine the state of the primary endpoint; without health checks, DNS queries remain directed to the primary region even during an outage.

Step-by-Step Solution

1
Authorize cross-account association of the Private Hosted Zone.
Allows Account B to associate its VPC with Account A's Private Hosted Zone.
Solves the internal DNS name resolution issue in the warm standby VPC during failover.
2
Configure Route 53 failover records with health checks.
Enables automatic traffic redirection during primary Region degradation.
Ensures RTO targets are met by automatically failing over DNS queries to the secondary ALB.

Key Concept

Disaster recovery failover routing and cross-account DNS resolution in multi-region environments.
Rate this question

Topics

Enhancing Reliability and Disaster Recovery