Design Resilient Architectures 5 Flashcards

A company runs a multi-tier web application on AWS. The application database is a single Amazon RDS MySQL instance. During a recent DR drill, the team discovered that restoring from automated backups took 45 minutes, exceeding their RTO of 15 minutes. Which solution best meets the RTO requirement with minimal cost increase?

Answer: Enable RDS Multi-AZ deployment and use the standby instance for failover

RDS Multi-AZ maintains a synchronous standby replica in a different AZ. Failover is automatic and typically completes in 1–2 minutes, well within the 15-minute RTO. The standby is not used for reads, keeping costs lower than a full read replica in a separate region. Read replicas use asynchronous replication and require manual promotion, which adds time. DMS is designed for migrations, not HA failover.

An e-commerce platform processes orders through an Amazon SQS queue consumed by an Auto Scaling group of EC2 workers. During peak sales events, messages accumulate faster than workers can process them. After scaling out, some orders are processed twice, causing duplicate charges. What is the root cause and the correct fix?

Answer: The SQS visibility timeout is shorter than the order processing time; increase the visibility timeout to match the maximum processing duration

When the visibility timeout expires before a worker finishes processing, SQS makes the message visible again, allowing another worker to pick it up and causing duplicate processing. Increasing the visibility timeout to exceed the maximum processing time prevents this. FIFO queues help with ordering and deduplication but the core issue here is timeout expiry during scale-out, not queue type. Workers should already be deleting messages, and cooldown periods affect scaling speed, not duplicate delivery.

A financial services company needs a globally distributed application that can survive the complete loss of an entire AWS Region. Data must be consistent across Regions and writes must succeed even during a regional outage. Which database approach satisfies both requirements?

Answer: Amazon DynamoDB Global Tables with multi-active writes enabled across all Regions

DynamoDB Global Tables provide a multi-active (active-active) architecture where writes can be accepted in any Region and are replicated globally with eventual consistency. This satisfies both the regional-failure survivability and the requirement that writes succeed during an outage. Aurora Global Database has a single primary Region for writes; a failover requires promoting a secondary (adding RTO). RDS cross-Region read replicas require manual promotion. ElastiCache is a caching layer, not a durable transactional database.

A company hosts a REST API on Amazon API Gateway backed by AWS Lambda. During a major product launch, Lambda concurrency limits are hit and customers receive 429 throttling errors. The team wants to smooth traffic spikes without losing requests. Which architectural change best addresses this?

Answer: Place an Amazon SQS queue between API Gateway and Lambda using a Lambda trigger, and return a 202 Accepted response to clients

Inserting an SQS queue decouples the API from Lambda processing. API Gateway writes requests to SQS immediately and returns 202 Accepted, so no requests are lost. Lambda then processes messages at its own pace. Increasing reserved concurrency helps but still has account-level limits and cannot absorb instantaneous spikes above those limits. API Gateway caching only helps for identical GET requests. ALB does not remove the Lambda concurrency constraint.

A startup runs its entire workload in a single AWS Availability Zone to minimize data transfer costs. An AZ outage causes a 4-hour service disruption. Management now requires an architecture that tolerates AZ failures with an RTO under 5 minutes and no data loss (RPO = 0). Which combination meets these requirements at the lowest additional cost?

Answer: Deploy EC2 instances in two AZs behind an Application Load Balancer; use Amazon RDS Multi-AZ for the database

An ALB distributes traffic across EC2 instances in multiple AZs and automatically routes around a failed AZ within seconds, satisfying the 5-minute RTO. RDS Multi-AZ maintains a synchronous standby with automatic failover in 1–2 minutes and zero data loss (RPO = 0). Read replicas use asynchronous replication and require manual promotion, so they cannot guarantee RPO = 0. AWS Backup restore takes tens of minutes. Elastic Disaster Recovery adds cost for continuous replication and is designed for Region-level DR.

A microservices application on Amazon ECS (Fargate) uses synchronous HTTP calls between services. When the payment service becomes slow, connection pools in upstream services fill up and the entire application degrades. Which resilience pattern, implemented in AWS, directly prevents this cascading failure?

Answer: Implement a circuit breaker in AWS App Mesh using outlier detection on the payment service virtual node

AWS App Mesh supports outlier detection (circuit breaker behavior) on virtual nodes. When the payment service exceeds error or latency thresholds, App Mesh automatically stops routing traffic to unhealthy endpoints, preventing upstream services from blocking on slow connections. CloudFront caches content but does not implement circuit breaking for backend failures. Increasing Fargate resources may reduce latency but does not prevent cascading failures if the service is still slow. Converting to SQS would change the fundamental synchronous contract, which may not be feasible for payment flows requiring immediate responses.