Design Resilient Architectures

Designing for Failure: Zones, Replicas and Decoupling

Resilience on this exam is mostly about knowing what fails together. Zonal resources fail with their Availability Zone, regional services do not, and anything stateful on a single instance is a single point of failure.

Exam tip. Learn the four DR strategies as an ordered list. Most disaster recovery questions are really asking you to match an RTO and a budget to one of these four rows.

Knowing When Something Has Broken

The exam expects you to pick the right telemetry source for a question. Each service answers a different question, and the wrong answers are usually the other three.

Exam tip. Match the verb: performing badly is CloudWatch, who did it is CloudTrail, what traffic flowed is Flow Logs, where the latency is is X-Ray.

What Fails Together, and How to Stop It Mattering

Availability design is mostly about knowing what shares a fate. Once you can say which components fail together, the right answer usually names itself.

Exam tip. Ask what the failure boundary is in the scenario. The correct answer is almost always the next boundary out.

Queues, Topics, Streams and Buses: Which One and Why

AWS has four ways to move messages between components, and the exam distinguishes them by delivery semantics rather than by size.

Exam tip. Replay and multiple independent readers is the phrase that rules out SQS and selects Kinesis.

What Actually Has to Change to Survive a Region

Multi-Region is not one decision. It is a set of them, and the exam usually tests whether you know which pieces are Regional and therefore need a twin.

Exam tip. Quotas and KMS keys are the two pieces people forget. Both make a failover fail at exactly the wrong moment.

1. A web tier runs on EC2 instances in a single Availability Zone behind an Application Load Balancer. Which change most improves resilience to an Availability Zone failure?

• A. Increase the instance size in the existing Availability Zone
• B. Enable detailed CloudWatch monitoring on the instances
• C. Attach a second elastic IP address to each instance
• D. Run instances in an Auto Scaling group spanning at least two Availability Zonescorrect

Spreading an Auto Scaling group across multiple Availability Zones means the loss of one zone leaves healthy capacity in another, and the load balancer stops routing to the failed zone. A bigger instance, more monitoring, or extra addresses all stay inside the single zone that could fail.

2. Which deployment approach exposes a new version to a small percentage of traffic while watching metrics before proceeding?

• A. Immutable replacement of the whole fleet
• B. Canary deploymentcorrect
• C. Blue/green with an instant cutover
• D. All-at-once deployment

A canary sends a small slice of traffic to the new version so problems surface with limited blast radius. Blue/green switches everything at once, and the other two replace the fleet without a graduated exposure.

3. A Lambda function processing events from an SQS queue occasionally fails on malformed input. Which configuration prevents those events from being lost while keeping the pipeline moving?

• A. Disable the event source mapping during failures
• B. Configure a dead-letter queue or on-failure destination for the failed eventscorrect
• C. Increase the function's memory allocation
• D. Set the function's reserved concurrency to zero

A dead-letter queue or failure destination captures events the function could not process so they can be examined and replayed. Memory affects performance, zero reserved concurrency stops the function from running at all, and disabling the mapping halts processing entirely.