Question

Difficulty: MediumHigh Availability and Disaster Recovery Design

A healthtech company is designing a multi-region disaster recovery (DR) architecture for a critical patient scheduling portal. The primary workload runs in the us-east-1 Region, and the secondary DR site is in the us-west-2 Region. The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. To minimize ongoing costs, application servers in the secondary region must not run during normal operations. The portal communicates with external medical insurance endpoints, and the architecture must ensure that an Availability Zone (AZ) outage in either region does not disrupt outbound connectivity. Which architecture meets these requirements?

  1. Configure an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy the application tier on Amazon EC2 instances inside Auto Scaling groups across multiple Availability Zones in both regions, setting the desired capacity to zero in us-west-2. Set up Amazon Route 53 with a Failover routing policy and associate it with active application health checks targeting the Application Load Balancer in us-east-1. Deploy a NAT Gateway in each Availability Zone in both regions for outbound traffic routing.Answer
  2. B
    Configure Amazon RDS for PostgreSQL in us-east-1 with cross-region read replication to us-west-2. Deploy the application tier on Amazon EC2 instances inside Auto Scaling groups across multiple Availability Zones in both regions, setting the desired capacity to zero in us-west-2. Set up Amazon Route 53 with a Latency routing policy to handle traffic distribution. Deploy a single NAT Gateway in the public subnet of a single Availability Zone in each region to route outbound traffic.
  3. C
    Configure Amazon Aurora PostgreSQL in us-east-1 and schedule hourly database snapshots copied to us-west-2. Deploy the application tier on Amazon EC2 instances inside Auto Scaling groups in both regions, setting the desired capacity to zero in us-west-2. Configure Amazon Route 53 with a Failover routing policy and active health checks targeting the primary Application Load Balancer. Deploy a NAT Gateway in each Availability Zone in both regions for outbound traffic routing.
  4. D
    Configure an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy the application tier on Amazon EC2 instances inside Auto Scaling groups across multiple Availability Zones in both regions, setting the desired capacity to zero in us-west-2. Set up Amazon Route 53 with a Weighted routing policy, setting the weight for us-east-1 to 100 and us-west-2 to 0. Deploy a NAT Gateway in each Availability Zone in both regions for outbound traffic routing.

Answer

The architecture using an Amazon Aurora PostgreSQL Global Database, Auto Scaling groups with zero desired capacity in the disaster recovery region, Route 53 Failover routing with active health checks, and a NAT Gateway in each Availability Zone in both regions.
The correct architecture uses Amazon Aurora PostgreSQL Global Database, which replicates data within seconds to meet the 5-minute RPO. It configures Route 53 with a Failover routing policy associated with health checks, allowing DNS to fail over automatically to the secondary region within the 15-minute RTO. Cost is minimized by setting the Auto Scaling group capacity in the recovery region to zero, preventing charges for idle compute resources. Finally, deploying a NAT Gateway in each Availability Zone ensures that outbound connectivity to external endpoints is maintained even if one Availability Zone experiences an outage.

Step-by-Step Solution

1
Select the database replication method that meets the 5-minute RPO.
Amazon Aurora PostgreSQL Global Database provides typical cross-region replication latency of less than 1 second, easily meeting the 5-minute RPO, whereas hourly snapshots fail this requirement.
Choosing the correct replication mechanism guarantees that data loss stays within the business-defined RPO during a regional disaster.
2
Configure the DNS failover strategy for active-passive routing.
Amazon Route 53 Failover routing policy combined with health checks targeting the primary region Application Load Balancer (ALB) ensures automatic failover, whereas Weighted routing (100/0) or Latency routing does not provide automatic active-passive failover based on application health.
Automatic failover routing is required to meet the 15-minute RTO without manual intervention.
3
Ensure outbound connectivity resiliency against Availability Zone outages.
Deploying a NAT Gateway in each Availability Zone in both regions ensures that if one zone goes down, instances in the remaining zones can still route outbound traffic through their zone's NAT Gateway.
A single NAT Gateway per region represents a single point of failure that violates the high availability requirement for outbound traffic.

Key Concept

Multi-region active-passive (pilot light/warm standby) disaster recovery design using Amazon Aurora Global Database, Route 53 DNS Failover, and multi-AZ NAT Gateways.
Rate this question