Design for New Solutions

Choosing a Disaster Recovery Strategy

Every disaster recovery decision is a negotiation between how much downtime the business will tolerate, how much data it can afford to lose, and how much it will pay to stand still. The four strategies form a ladder, and each rung buys you a shorter recovery at a higher standing cost. Your job in an exam scenario is to read the stated recovery objectives and pick the cheapest rung that meets them.

Exam tip. Read the numbers before the services. A scenario stating a recovery time objective of several hours is not asking for active active, however impressive that sounds, because the cheapest strategy that meets the objective is always the intended answer.

Designing the Data Layer Across Regions

Getting compute into a second Region is straightforward, and the data layer is where multi Region designs actually get decided. The real question is whether the second Region needs to accept writes, because read only replication is a well trodden path while multi active writing forces you to confront conflicts. Each AWS data service answers that question differently, and mixing them without noticing is how designs end up with inconsistent recovery points.

Exam tip. When a scenario says users in several continents must write with low latency, that is pointing at multi active storage such as global tables. When it says the second Region is only for recovery, a global database or read replica is cheaper and simpler, and both are valid answers to very different questions.

Queues, Topics, Streams and Event Buses

Decoupling questions are usually decided by one detail in the scenario: how many consumers need the message, and whether anyone needs to read it twice. A queue hands each message to one worker and then deletes it, a topic fans the same message out immediately, a stream keeps records so several consumers can read them independently, and an event bus routes on the content of the event. Picking the wrong one is rarely fatal but it is always more code than it needed to be.

Exam tip. Look for the word replay or the phrase multiple independent consumers. Those point to a stream rather than a queue. If the scenario instead says new subscribers keep needing to be added without touching the producer, that is EventBridge or SNS.

Key Management: KMS, CloudHSM and Where Keys Live

Nearly every AWS service can encrypt at rest, so the design question is never whether to encrypt but who controls the key and where it is allowed to be used. KMS is the default because it is integrated everywhere and its key policy is a genuine access control. CloudHSM exists for the narrower cases where a regulator, or your own risk position, requires single tenant hardware that AWS staff cannot operate.

Exam tip. If a question involves an encrypted resource that cannot be used in another account or Region, suspect the key before you suspect IAM. The fix is usually a key policy grant, a multi Region key, or re encrypting with a key that exists at the destination.

Choosing Compute for a New Workload

The compute decision is mostly about how much of the operating system you actually need to own. Lambda gives you none of it and charges only while your code runs, containers on Fargate give you the runtime without the nodes, and EC2 gives you everything including the responsibility. The exam rewards choosing the least infrastructure that satisfies the constraints in the scenario, then justifying anything heavier by a real requirement.

Exam tip. Requirements that mention a process running for hours, a specific kernel module, or a licence bound to a physical core are ruling Lambda out on purpose. Without one of those signals, the serverless option is usually the intended answer.

Choosing the Right Database for the Access Pattern

AWS deliberately offers many database engines because one engine forced onto every access pattern is how systems end up slow and expensive at the same time. The professional exam expects you to read the access pattern out of the scenario, relational joins and transactions, key lookups at scale, full text search, time series, or graph traversal, and then name the engine that was built for it. Migration questions add a second consideration: how much application change the team can absorb.

Exam tip. Phrases such as flexible ad hoc reporting, needs joins, or strong transactional consistency point to relational. Phrases such as single digit millisecond lookups by key, unpredictable scale, or no schema point to DynamoDB. The scenario almost always contains one of these giveaways.

Object, Block and File Storage in a New Design

Storage choices are usually decided by how the application expects to reach the data rather than by cost. Software that opens a file handle needs a file system, software that needs a raw device needs block storage, and anything written to be cloud native should be reaching for object storage. Getting this backwards produces designs that work but carry an unnecessary server just to translate between the two worlds.

Exam tip. When a scenario mentions legacy software that cannot be modified and needs a shared drive, the answer is EFS or FSx depending on the operating system, never S3 with a translation layer. When the application is being written now, S3 is almost always the intended answer.

Load Balancing, Routing and the Edge

Traffic reaches a well designed system through several layers, and each layer answers a different question. DNS decides which Region or endpoint a user is sent to, the edge decides whether the request even reaches your infrastructure, and the load balancer decides which target handles it. Exam scenarios usually turn on one specific capability, such as static IP addresses, header based routing, or failover between Regions.

Exam tip. DNS based failover is limited by resolver caching and record time to live, so if a scenario demands failover faster than DNS can propagate, the intended answer is Global Accelerator rather than a Route 53 failover record.

Designing Auto Scaling That Actually Works

Auto Scaling looks simple until the first real traffic spike, when you discover that the instances take four minutes to become useful and the metric you scaled on lags the problem by another two. A working design chooses a metric that leads demand, shortens the time to readiness, and makes sure that removing an instance does not lose anything. The exam tests whether you understand those three failure modes rather than the console settings.

Exam tip. If a scenario says the application is slow for the first minutes of a spike, the answer is rarely a lower scaling threshold. Look for warm pools, a leading metric such as queue depth, or scheduled scaling for a known event.

Deploying Infrastructure Across Many Accounts

At professional scale, infrastructure as code is less about writing templates and more about how a change reaches sixty accounts safely. CloudFormation StackSets and the Organizations integration are the mechanism the exam expects, with Service Catalog as the way to let other teams deploy approved patterns without holding the permissions those patterns require. The recurring theme is that the pipeline holds the permissions, not the people.

Exam tip. When a scenario needs the same baseline in every current and future account, look for StackSets targeting an organizational unit with automatic deployment enabled. An answer that runs a template per account, however scripted, is the distractor.

Layered Network Security in a New Architecture

Network security in AWS is a stack of controls with different jobs, and answering a question means knowing which layer the requirement lives at. Security groups and network ACLs handle who may reach what inside the VPC, endpoints decide whether traffic leaves the AWS network at all, and WAF, Shield and Network Firewall handle what arrives from outside or leaves toward the internet. Designs get into trouble when one layer is asked to do another layer's job.

Exam tip. A requirement to block one specific IP range is a network ACL question, because security groups cannot express a deny. A requirement to block a pattern in HTTP requests is a WAF question. Match the layer to the wording before comparing services.

1. Which mechanism should be used to grant the temporary permission?

• A. Create a KMS grant for decrypt only, constrained to the encryption context, and retire it when the job completescorrect
• B. Add a statement to the key policy allowing the principal to decrypt, and remove it when the job finishes
• C. Attach an IAM policy allowing kms:Decrypt on all keys to the role the job assumes, since the key policy delegates to IAM
• D. Create a second KMS key for the job and re encrypt the objects with it before the job starts

Grants exist for exactly this shape of permission: temporary, programmatic, narrowly scoped and independently revocable. A grant names a principal and a specific set of operations, can be constrained so that it applies only when a particular encryption context is present, and is retired when the work is done, all without touching the key policy that sits under change control. That combination is what makes grants the tool AWS services themselves use when acting on your behalf. Editing the key policy for each job means a change control cycle for every run and a policy that accumulates stale statements when someone forgets to remove one. An identity policy allowing decryption on all keys is far broader than the requirement, and on its own it does not grant cross account key access anyway, since the key policy must also allow it. Creating a second key and re encrypting the data is an expensive and disruptive way to express a temporary permission, and it leaves you with another key to manage.

2. Which disaster recovery strategy fits these objectives at the lowest cost?

• A. Multi site active active, with the application serving traffic from both Regions at all times
• B. Warm standby, running a scaled down but fully functional copy of the stack in the second Region
• C. Pilot light, keeping data continuously replicated into the second Region while the application tier stays switched off until it is neededcorrect
• D. Backup and restore, taking daily backups and copying them to the second Region

Work the two numbers separately, because they constrain different parts of the design. The one hour recovery point is about data, and it rules out daily backups immediately: restoring last night's copy can lose far more than an hour of changes, so backup and restore fails on the objective even though it is the cheapest option on the list. Continuous replication of the data layer satisfies the recovery point, and with four hours to play with there is ample time to start the application tier from images and templates, which is what pilot light means. Warm standby would also meet both objectives comfortably, and that is what makes it tempting, but it means paying to run a working copy of the stack around the clock for a recovery window that does not require it. Active active is the most expensive answer on the list and buys a recovery time far shorter than the business asked for. The discipline being tested is picking the cheapest option that still clears the bar, not the strongest one available.

3. Which storage approach is most appropriate?

• A. S3 Intelligent-Tiering, which moves objects between access tiers automatically based on observed usage without retrieval charges for the automatic tierscorrect
• B. S3 Standard for everything, since the access pattern cannot be predicted
• C. A lifecycle rule moving objects to S3 Standard-Infrequent Access after 30 days and to S3 Glacier Flexible Retrieval after 90 days
• D. S3 Glacier Instant Retrieval for everything, since it offers immediate access at archive pricing

Intelligent-Tiering was built for precisely the situation where the access pattern is genuinely unknown: it observes each object and moves it between access tiers automatically, and the tiers it uses automatically carry no retrieval charge, so an object that unexpectedly becomes hot again does not generate a surprise bill or a delay. Standard for everything is safe and simple, and it is the answer if you must never think about tiering, but it means paying the highest storage rate for the large fraction of objects that go dormant. A fixed lifecycle rule assumes the pattern the stem says nobody can predict, and moving objects into a class with a retrieval delay directly violates the requirement that a requested document is available immediately. Glacier Instant Retrieval does provide immediate access at a lower storage price, but it carries a retrieval charge and a minimum storage duration, so applying it to objects that are read constantly for months would cost more than Standard, not less.