Examkin

Question

Difficulty: Very hardEnhancing Reliability and Disaster Recovery

An enterprise runs a multi-tier financial transaction system across two AWS accounts in an AWS Organization: Account A (Application) and Account B (Data).

In Account A, the application tier is deployed on Amazon EC2 instances in an Auto Scaling group behind an internal Application Load Balancer (ALB) across three Availability Zones in a primary VPC (VPC-App) in us-east-1. Outbound internet traffic to external payment processing endpoints is routed through a single NAT Gateway located in us-east-1a.
In Account B, database transactions are managed by an Amazon Aurora PostgreSQL Global Database. The primary cluster is in us-east-1 (VPC-Data), and a secondary read-only cluster is in us-east-2 (VPC-DR).
The application in VPC-App (Account A) queries the database in VPC-Data (Account B) using a private domain db.internal.corp. The Private Hosted Zone (PHZ) for db.internal.corp is created and hosted in Account B.

A recent Availability Zone outage in us-east-1a degraded the NAT Gateway, causing payment processing to fail. During the subsequent recovery attempt, operator confusion between managed and unplanned global database failovers delayed database promotion to us-east-2 by over 30 minutes. Additionally, recovery EC2 instances provisioned in us-east-2 failed to resolve the database's private domain db.internal.corp.

To prevent future outages, a Solutions Architect must design a disaster recovery (DR) and resiliency strategy that achieves a Recovery Time Objective (RTO) of 10 minutes and a Recovery Point Objective (RPO) of 1 minute. The secondary application tier in us-east-2 must remain dormant or at minimal capacity until a failover is declared.

Which set of actions should the Solutions Architect implement to satisfy these requirements?

  1. A
    Deploy a single NAT Gateway in VPC-App to minimize runtime costs, routing traffic from all private subnets to it. In Account B, share the db.internal.corp Private Hosted Zone with Account A using AWS Resource Access Manager (RAM). During a us-east-1 outage, execute a managed failover of the Aurora Global Database to us-east-2 to ensure zero data loss. Maintain a pilot light DR pattern in us-east-2, restoring the database from Daily Amazon S3 backups when a failover is required.
  2. Deploy a NAT Gateway in each Availability Zone of VPC-App and update subnet routing tables accordingly. In Account B, authorize the association of the db.internal.corp Private Hosted Zone with VPC-App and the recovery VPC in us-east-2 using the AWS CLI or SDK; accept the associations in Account A. During a us-east-1 outage, perform an unplanned failover of the Aurora Global Database to promote the us-east-2 secondary cluster. Implement a warm standby DR pattern in us-east-2 with Auto Scaling groups running at minimal capacity, shifting traffic using Route 53 Application Recovery Controller routing controls.Answer
  3. C
    Maintain the single NAT Gateway in us-east-1a. Associate the db.internal.corp Private Hosted Zone in Account B with the shared AWS Transit Gateway to enable automatic DNS resolution in Account A. During an outage, initiate an unplanned failover of the Aurora Global Database to us-east-2. Implement a warm standby in us-east-2, using Route 53 active-active failover with public Route 53 health checks configured to query the private IP addresses of the application EC2 instances directly.
  4. D
    Deploy a NAT Gateway in each Availability Zone of VPC-App. In Account B, share the db.internal.corp Private Hosted Zone with Account A using AWS Resource Access Manager (RAM). During a us-east-1 outage, perform a managed failover of the Aurora Global Database to us-east-2. Configure a pilot light DR pattern in us-east-2, keeping all EC2 instances stopped, and use Route 53 failover records linked to CloudWatch alarms in us-east-1 that monitor the primary Aurora database cluster's status.

Answer

Deploy a NAT Gateway in each Availability Zone of VPC-App, establish cross-account Private Hosted Zone associations using Route 53 VPC association authorizations, promote the secondary Aurora cluster via unplanned failover during an outage, and use a warm standby pattern in the recovery region managed by Route 53 Application Recovery Controller routing controls.
The correct option addresses all design flaws of the existing architecture: it establishes NAT Gateway redundancy by deploying a gateway in each Availability Zone of VPC-App; it correctly authorizes and accepts cross-account Private Hosted Zone associations so that the recovery environment in us-east-2 can resolve the database domain; it implements an unplanned failover of the Aurora Global Database to bypass the unreachable primary region; and it uses a warm standby pattern with Route 53 Application Recovery Controller routing controls to quickly and deterministically redirect traffic within the 10-minute RTO constraint.

Step-by-Step Solution

1
Ensure NAT Gateway redundancy by deploying a NAT Gateway in each Availability Zone of VPC-App and pointing each private subnet's route table to its local NAT Gateway.
Outbound egress traffic to external payment processors remains highly available and resilient to any single Availability Zone outage.
The original design had a single NAT Gateway in us-east-1a, representing a single point of failure that caused payment processing to fail when us-east-1a went offline.
2
Configure cross-account Private Hosted Zone (PHZ) association for db.internal.corp by calling create-vpc-association-authorization in Account B for VPC-App and VPC-DR (Account A), and then calling associate-vpc-with-hosted-zone in Account A.
Application EC2 instances in VPC-App (us-east-1) and VPC-DR (us-east-2) in Account A can successfully resolve the db.internal.corp domain name to the private database endpoints.
Route 53 Private Hosted Zones cannot be shared across accounts using AWS Resource Access Manager (RAM) or Transit Gateways. A direct cross-account VPC association is required.
3
Perform an unplanned failover of the Amazon Aurora PostgreSQL Global Database to promote the secondary read-only cluster in us-east-2 to primary.
The secondary cluster in us-east-2 is promoted to writeable primary status, enabling application writes in the recovery region.
A managed failover requires the primary cluster in us-east-1 to be healthy and reachable to synchronize state. During an active outage where the primary region is degraded, only an unplanned failover (failover-global-cluster) is possible to recover within the RTO.
4
Implement a warm standby recovery strategy in us-east-2 with Auto Scaling groups pre-configured at minimal scale, and use Route 53 Application Recovery Controller (ARC) routing controls to fail over traffic.
Traffic is shifted to us-east-2, and application capacity scales up quickly to handle the production load within the 10-minute RTO limit.
A pilot light pattern relying on database restores or stopped instances takes too long to launch and bootstrap, failing the 10-minute RTO. ARC routing controls provide deterministic, rapid failover during regional outages without relying on regional Route 53 health check resolvers in the degraded region.

Key Concept

Disaster Recovery pattern selection, cross-account Private Hosted Zone association, NAT Gateway multi-AZ redundancy, and Aurora Global Database unplanned failover mechanics.
Estimated Time:4m 0s
Rate this question

Topics

Enhancing Reliability and Disaster Recovery