Examkin

Question

Difficulty: HardHigh Availability and Disaster Recovery Design

A pharmaceutical manufacturing company is designing a critical supply chain tracking and validation application on AWS. The application tier runs on Amazon EC2 instances across three Availability Zones in the primary region eu-west-1 and three Availability Zones in the secondary region us-east-1. The application requires a relational database backend and needs to initiate outbound connections to external public regulatory APIs for compliance verification.

The system architecture must meet a Recovery Time Objective (RTO) of 5 minutes and a Recovery Point Objective (RPO) of 30 seconds. Additionally, outbound connection capability to the external APIs must remain highly available even during a single Availability Zone outage within a region. Private microservices within the architecture also require private DNS name resolution across the VPCs in both regions.

Which TWO solutions should a solutions architect implement to meet these requirements?

  1. Deploy an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in us-east-1. Configure Amazon Route 53 active-passive failover routing policies using application health checks to manage DNS failover.Answer
  2. Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions, and configure private subnet route tables to route outbound internet traffic through the NAT Gateway in the same Availability Zone.Answer
  3. C
    Deploy a single NAT Gateway in the primary Availability Zone of each region's VPC, and configure the private subnet route tables across all Availability Zones to route outbound internet traffic through this single NAT Gateway.
  4. D
    Create a Route 53 Private Hosted Zone for private microservices in the primary VPC, but do not associate this hosted zone with the secondary VPC to prevent DNS resolution conflicts during a regional failover.
  5. E
    Deploy an Amazon RDS Multi-AZ DB cluster in eu-west-1, and configure the application to route read-heavy traffic to the standby instance located in the secondary Availability Zone to reduce load on the primary DB instance.
  6. F
    Configure a Pilot Light disaster recovery strategy by using AWS Backup to copy daily database snapshots from eu-west-1 to us-east-1, and deploy CloudFormation templates to launch the secondary infrastructure only when an outage occurs.

Answer

To satisfy the RTO and RPO constraints, the database must be replicated to the secondary region with minimal lag and fail over quickly, which is achieved by deploying an Amazon Aurora Global Database across eu-west-1 and us-east-1 and configuring Route 53 active-passive failover. To satisfy the outbound high-availability requirement during a single Availability Zone outage, a NAT Gateway must be provisioned in each Availability Zone of the VPCs in both regions, and route tables must be updated to route traffic through the local zone's NAT Gateway.
Deploying Amazon Aurora Global Database ensures storage-level replication with lag under 1 second, meeting the 30-second RPO, and supports promotion of the secondary cluster in less than 1 minute, meeting the 5-minute RTO. Route 53 active-passive failover routing handles client redirection. Deploying a NAT Gateway in each Availability Zone ensures that outbound connectivity to external APIs is zone-independent, meaning an outage in one zone does not impact the outbound capabilities of the remaining healthy zones.

Step-by-Step Solution

1
Analyze RTO and RPO requirements to determine database strategy.
An RPO of 30 seconds requires real-time or near-real-time replication. Amazon Aurora Global Database uses storage-level replication with lag under 1 second, and its promotion time is under 1 minute, which fits the RTO of 5 minutes.
Standard backup-and-restore or Pilot Light strategies take too long to restore databases and copy snapshots, failing the target metrics.
2
Select routing mechanism for client traffic failover.
Configure Amazon Route 53 active-passive failover routing policies using application health checks.
This automatically redirects inbound client traffic to the secondary region if the primary region's application endpoints fail, helping achieve the 5-minute RTO.
3
Design highly available outbound network path.
Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions and update private subnet route tables to route outbound traffic through their respective local zone's NAT Gateway.
Sharing a single NAT Gateway across multiple Availability Zones introduces a single point of failure. If the hosting zone fails, all other zones lose outbound internet access.

Key Concept

Designing multi-region architectures with strict RTO and RPO limits requires databases with near-instantaneous cross-region replication (like Aurora Global Database) and automated client routing, combined with zone-independent outbound paths (NAT Gateways in each Availability Zone) to avoid cross-AZ dependency failures.
Estimated Time:3m 0s
Rate this question

Topics

High Availability and Disaster Recovery Design

More questions from this topic