Examkin

Question

Difficulty: Very hardEnhancing Reliability and Disaster Recovery

A financial services firm runs a core banking microservice platform across two AWS accounts in an AWS Organization: Account A hosts the Production environment in the eu-west-1 Region, and Account B hosts the Disaster Recovery (DR) environment in the eu-central-1 Region. The application tier runs on Amazon ECS tasks on AWS Fargate in private subnets, resolving local services using a Route 53 Private Hosted Zone (PHZ) (service.internal) hosted in Account A. Database access is managed via an Amazon Aurora PostgreSQL Global Database, with the primary cluster in Account A and the secondary cluster in Account B. Currently, outbound internet access for the ECS tasks in both regions is routed through a single NAT Gateway located in a single public subnet within each region's VPC. The firm wants to enhance the architecture to achieve a recovery time objective (RTO) of under 15 minutes and a recovery point objective (RPO) of under 1 minute during a regional outage. Which TWO actions should the Solutions Architect implement to enhance reliability and automate disaster recovery failover?

  1. Authorize the association of the Route 53 Private Hosted Zone in Account A with the VPC in Account B using the AWS CLI or SDK, and then associate the VPC in Account B. Configure a Route 53 failover routing policy for the private database DNS record, linked to Route 53 health checks that monitor regional database health via CloudWatch alarms.Answer
  2. Deploy NAT Gateways in multiple Availability Zones within both the primary and recovery VPCs, and update the private subnet route tables in each Availability Zone to route outbound internet traffic through the NAT Gateway in the same Availability Zone.Answer
  3. C
    Create a duplicate Private Hosted Zone with the same domain name in Account B, and configure a cross-Region Transit Gateway peering connection to allow the secondary VPC to perform recursive DNS lookups against Account A's Route 53 Inbound Resolver Endpoints.
  4. D
    Configure Route 53 HTTP health checks targeting the private IP addresses of the Aurora database endpoints in both VPCs, and set the evaluate target health parameter to true on the primary database alias record to trigger automated failover.
  5. E
    Enable cross-account replication of the AWS-managed KMS key for Amazon RDS (aws/rds) from Account A to Account B to ensure that the secondary Aurora cluster can decrypt the shared database storage volumes during failover.
  6. F
    Transition the disaster recovery strategy to a Pilot Light pattern by shutting down the ECS Fargate tasks in the recovery region and only deploying them using AWS CloudFormation templates once the primary region experiences a failover event.

Answer

Authorize and associate the Private Hosted Zone in the primary account with the recovery VPC, utilizing CloudWatch alarms for Route 53 private failover routing, and deploy redundant NAT Gateways per Availability Zone to remove single points of failure.
To successfully failover the DNS record of private resources such as Aurora database endpoints across accounts and regions, the Private Hosted Zone in the primary account must be authorized and associated with the recovery VPC in the destination account. Since Route 53 health checks cannot directly probe internal, private IP addresses within a VPC, they must be associated with CloudWatch alarms that monitor regional database metrics. Furthermore, ensuring that outbound internet routing is redundant across all Availability Zones by using a dedicated NAT Gateway per zone ensures high availability for the ECS tasks and any egress communications during a failover event.

Step-by-Step Solution

1
Establish cross-account VPC association for the Route 53 Private Hosted Zone (PHZ) from Account A to Account B.
Allows Fargate tasks in the recovery VPC in Account B to query the shared service.internal namespace locally.
VPC association authorization must be created in Account A and accepted in Account B using the AWS CLI or SDK to resolve internal records across accounts.
2
Link Route 53 health checks to CloudWatch alarms monitoring regional database availability.
Enables DNS failover fail-over for private records inside a VPC that cannot be reached directly by public Route 53 endpoints.
Since Aurora private IP addresses are unreachable from the public Route 53 edge health checkers, a CloudWatch alarm acts as the status intermediary.
3
Deploy multiple NAT Gateways (one per Availability Zone) in the public subnets of both VPCs, and configure private subnet route tables to use the NAT Gateway in their respective Availability Zone.
Eliminates single points of failure for outbound traffic routing to external systems or cross-region replication endpoints.
A single NAT Gateway per VPC creates a vulnerability where an Availability Zone outage could disrupt egress traffic for all other zones.

Key Concept

Disaster recovery failover automation and egress reliability in multi-account, multi-region hybrid DNS architectures
Rate this question

Topics

Enhancing Reliability and Disaster Recovery