AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 62
Question 610
An SaaS platform alarms only when EC2 CPU exceeds 90%. Customers experience checkout errors while CPU stays at 25% because a third-party authorization dependency is down. Which monitoring design gives meaningful availability signals?
- Raise the EC2 CPU threshold to 100% and keep all other metrics disabled.
- Add CloudWatch alarms for user-facing error rates, request latency and critical dependency failure indicators, with actionable thresholds.
- Monitor the size of the AMI file in S3 as the sole availability indicator.
- Only alert when the next monthly billing invoice increases.
Explanation
Correct Answer
B:Service-level failures can occur independently of host CPU; monitoring must observe the business request path and its dependencies.
Incorrect Answers
A:Changing a utilization threshold still misses failures at low CPU.
C:An image artifact's size does not report live checkout success or authorization latency.
D:Billing data cannot provide timely incident detection for broken customer transactions.
Question 611
Independent metrics for HTTP errors and transient dependency failures are producing hundreds of single-minute notifications during brief failover events. Operators want an alarm that pages only when correlated symptoms persist. Which feature helps?
- Set every alarm period to one second and page on any one error event.
- Delete the error-rate metrics and keep only daily cost data.
- Use CloudWatch composite alarms and sustained underlying metric conditions to represent the correlated incident.
- Enable an EC2 placement group to merge unrelated CloudWatch alarms automatically.
Explanation
Correct Answer
C:A composite alarm can combine existing alarm states, while sensible evaluation periods suppress single-sample noise.
Incorrect Answers
A:Finer periods and no correlation typically increase, rather than reduce, transient alarm noise.
B:Removing service-level signals hides real incidents instead of modeling their severity.
D:Placement groups affect instance placement, not alarm-state correlation.
Question 612
A CloudWatch alarm automatically restarts a production application host after any brief CPU spike. During a throughput peak it repeatedly restarts healthy capacity and prolongs the outage. Which remediation approach is safer?
- Keep an unconditional restart on every high-CPU datapoint and remove the cooldown.
- Grant the restart automation root permissions in every account to bypass safety checks.
- Turn off all application metrics so the restart workflow never receives an alarm.
- Use a validated remediation workflow with guard conditions, cooldowns and health confirmation, separating scaling pressure from host failure.
Explanation
Correct Answer
D:Automated recovery must verify the failure mode; a CPU spike may warrant autoscaling rather than repeated restarts.
Incorrect Answers
A:That makes thrashing more likely while load remains high.
B:Excess privilege cannot distinguish legitimate load from a failed instance and broadens blast radius.
C:Suppressing alerts prevents remediation and observability instead of correcting trigger logic.
Question 613
A DR plan relocates an application from Region A to Region B. The central incident dashboard and paging integration are hosted only in Region A and can become unreachable during a regional failure. Which operating design closes the gap?
- Aggregate essential cross-Region signals and maintain incident notifications through independently reachable monitoring and paging paths.
- Keep the dashboard in Region A because CloudWatch metrics are automatically globally identical and available everywhere.
- Increase Region A's dashboard refresh rate while leaving the only notification endpoint there.
- Replace the Region B paging integration with a local EC2 CPU graph from Region A.
Explanation
Correct Answer
A:A recovery Region cannot rely exclusively on the failed Region's dashboard to reveal whether failover has succeeded or requires intervention.
Incorrect Answers
B:CloudWatch resources and metric namespaces are regionally scoped and cross-Region observability needs deliberate design.
C:Faster refresh has no value when its regional control path is inaccessible.
D:A single source-Region host metric cannot show recovery service health after regional loss.
Question 614
An active-passive DR plan needs 1,200 vCPUs of EC2 capacity in its standby Region immediately after failover. A dry run provisions only 64 vCPUs before an On-Demand quota error. What should happen before declaring the plan ready?
- Assume primary-Region service quota increases automatically transfer to every standby Region.
- Review standby-Region quotas and request the required increases, then run a realistic capacity provisioning drill.
- Reduce the DNS TTL while leaving the 64-vCPU quota and required deployment size unchanged.
- Replace every application health check with a cost budget alarm.
Explanation
Correct Answer
B:Service quotas can be Region- and instance-family-specific; a theoretical template cannot guarantee the permitted fleet size.
Incorrect Answers
A:Quota allowances are not universally inherited across Regions and must be checked where DR launches.
C:DNS settings do not grant EC2 capacity quota or ensure the intended fleet can launch.
D:Budget signals do not remove the explicit API quota rejection during scale-out.
Question 615
A DR stack's infrastructure template references a private AMI and a container image that exist only in the primary Region. The standby Region has sufficient quotas, but recovery launches fail with missing-image errors. Which fix is appropriate?
- Assign the same primary Region AMI ID to Region B in the template without copying the image.
- Enable cross-Region ECR replication for container images while leaving the private EC2 AMI absent from the standby Region.
- Copy or replicate required deployable images and artifacts to the standby Region and test their deployment references.
- Change the HealthCheckGracePeriod of the standby Auto Scaling group to zero.
Explanation
Correct Answer
C:AMI IDs and regional image repositories are not automatically portable; all recovery artifacts must exist where they are launched.
Incorrect Answers
A:AMI identifiers are Region-scoped and cannot stand in for absent standby artifacts.
B:ECR replication can prepare regional container images, but a deployment that also starts EC2 instances with a private AMI cannot recover until that AMI is copied and the template references a valid destination-Region image ID.
D:Health-check timing does not solve an image-not-found failure before the instance is running.
Question 616
After a cross-Region application image recovery, new workers fail to connect to encrypted databases and external services. Code and AMIs were copied, but secrets, environment configuration and destination KMS permissions were not. What should the DR plan include?
- Copy the production DNS records again and ignore secret and key errors.
- Disable KMS on the recovered database as a shortcut to avoid key policy work.
- Copy secret values into an encrypted S3 bucket in the standby Region but leave the workloads pointing at old Secrets Manager ARNs and without destination key permissions.
- Recreate or replicate the required secrets/configuration in the recovery Region and explicitly authorize supported destination KMS keys and roles.
Explanation
Correct Answer
D:Application binaries alone cannot supply missing credentials or cryptographic access in the Region used for recovery.
Incorrect Answers
A:DNS can route clients but does not supply encryption-key grants or application credentials.
B:Disabling or circumventing encryption can violate compliance and may not be supported for the existing encrypted state.
C:A copied encrypted object is not automatically a valid regional Secrets Manager reference or an authorized KMS decrypt path. Recovery configurations, role permissions, regional secret identifiers and keys must all be prepared.
Question 617
A company tests disaster recovery by successfully validating its CloudFormation template, but never provisions the standby fleet or performs DNS cutover under load. The RTO commitment is fifteen minutes. What evidence is still necessary?
- Execute an end-to-end recovery drill including real capacity, data restoration, network paths, DNS cutover and measured user availability.
- Mark the design fully validated because a template without syntax errors is guaranteed to meet any RTO.
- Audit only the CloudFormation stack parameter names and omit traffic testing.
- Increase all CloudFormation stack timeout values and assume that improves measured RTO.
Explanation
Correct Answer
A:Syntax validation proves only template structure. RTO depends on actual deployment, dependent services and traffic restoration duration.
Incorrect Answers
B:An accepted template says nothing about service quotas, recovery-time operations or application health.
C:Parameter checks cannot expose a slow data restore or failed routing after cutover.
D:Larger allowed timeouts may postpone failure but do not necessarily accelerate recovery.
Question 618
A DR runbook manually creates EC2 instances with different package versions and undocumented security-group settings in the recovery Region. Rebuild attempts yield inconsistent application behavior. What design improves reproducibility?
- Let operators install the latest unpinned packages during every recovery event.
- Publish versioned AMIs or signed container images and provision the fleet from tested infrastructure-as-code templates.
- Save only console screenshots and rely on memory for required dependency versions.
- Increase the standby VPC CIDR block size without capturing instance or service configuration.
Explanation
Correct Answer
B:Immutable versioned artifacts and declarative infrastructure let engineers rebuild a known configuration rather than manually reconstructing each host.
Incorrect Answers
A:Unpinned versions increase configuration drift and make it difficult to reproduce a tested state.
C:Screenshots do not provide executable, validated infrastructure or package pinning.
D:More address space cannot correct inconsistent images and security policies.
Question 619
An Auto Scaling fleet rebuilds application servers after an AZ outage, but the only customer cart state resides on the terminated hosts' local filesystems. Which redesign stops compute replacement from losing durable transactions?
- Raise the minimum Auto Scaling group size while keeping each customer's cart only on one individual server.
- Increase the instance root-volume IOPS without copying the carts to durable shared storage.
- Externalize durable application state to an appropriately resilient managed database or object store, keeping workers stateless.
- Add another launch template version but leave session data on the same ephemeral worker filesystem.
Explanation
Correct Answer
C:Replacing immutable compute is safe only when transactions and session state survive independently of discarded instances.
Incorrect Answers
A:More stateless capacity does not replicate the data stored on a specific failed instance.
B:Faster local disk cannot preserve data if the owning instance is lost and no replica exists.
D:Image versions alone do not relocate state outside the failure domain.
Question 620
A newly built AMI passes image creation but produces HTTP 500 responses. The deployment pipeline is about to promote it to every Region's standby Auto Scaling group. What prevents turning a local defect into a DR-wide outage?
- Promote every AMI to all Regions immediately to keep fleet versions synchronized regardless of health.
- Delete the prior AMI before testing the replacement to prevent configuration drift.
- Treat an AMI checksum match as proof that its services will return healthy HTTP responses.
- Gate promotion on canary and workload health tests, retaining the last known-good immutable image for rollback.
Explanation
Correct Answer
D:A tested health gate limits propagation of an invalid artifact; successful image creation does not establish application correctness.
Incorrect Answers
A:Global consistency of an unhealthy image increases the incident blast radius.
B:Removing known-good images eliminates the simplest recovery option if the candidate fails.
C:Checksums establish artifact integrity, not runtime behavior or compatibility with external dependencies.
