SAP-C02 - Design for New Solutions (29% of the exam) - Section 2.2

Design business continuity for a new workload with automated data and database replication and Amazon Route 53 routing to sustain availability across Availability Zones and Regions.

Design business continuity for a new workload using cross-Region data replication, Aurora global database, and Amazon Route 53 failover routing to sustain availability when an Availability Zone or Region becomes unavailable. Distinguish active-active from active-passive topologies and the data consistency trade-offs each introduces.

Amazon Route 53Cross-Region replicationAurora global databaseFailover routing

Practice question for this objective

Free sampleDesign for New Solutionshard

A logistics company is designing a new stateless order-intake service in a single Region inside its AWS Organization. The tier runs on Amazon EC2 behind an Application Load Balancer with a relational database, and a new reliability standard requires the whole service to survive the loss of one Availability Zone automatically, with no manual intervention and the lowest practical operational overhead. The workload has no cross-Region or global latency requirement, so the architects want only in-Region changes. Which THREE design choices together make the service withstand a single Availability Zone failure? Select THREE.

ASpread the EC2 Auto Scaling group across at least three subnets in different Availability Zones and register the targets with the Application Load Balancer in those same zones. Correct
BDeploy the relational database as an Amazon RDS Multi-AZ instance so a standby in a second Availability Zone takes over automatically when the primary's zone is impaired. Correct
CEnable the Application Load Balancer in subnets across the same set of Availability Zones so it has healthy nodes to route through if one zone goes offline. Correct
DCreate a cross-Region read replica of the database in a second Region and promote it whenever the primary Availability Zone becomes unhealthy during normal operation.
EPlace the entire Auto Scaling group and the database in one Availability Zone and rely on automated instance recovery to relaunch any instance that fails inside that zone.

Achieve single Availability Zone resilience in-Region by spreading the Auto Scaling group and load balancer across zones and using an RDS Multi-AZ database. In-Region high availability comes from making every tier zone-redundant at once: an Auto Scaling group and Application Load Balancer enabled across multiple Availability Zones keep compute and routing alive in surviving zones, while RDS Multi-AZ fails the database over to a synchronous standby automatically, so one zone's loss never takes the whole service down.

Why A is correct: An Auto Scaling group spanning multiple Availability Zones lets healthy zones keep serving and replace lost capacity automatically if one zone fails, which is the compute element of in-Region resilience.

Why B is correct: RDS Multi-AZ maintains a synchronous standby in another zone and fails over to it automatically with no manual step, removing the database as a single-zone point of failure at low operational overhead.

Why C is correct: An Application Load Balancer is only zonally resilient when enabled in several Availability Zones, so giving it subnets in each zone lets it keep distributing traffic to healthy targets when one zone is lost.

Why D is wrong: A cross-Region replica addresses Regional disaster recovery, not single-zone failure, and promoting it for a routine zonal fault adds latency, cost and manual steps the in-Region requirement explicitly avoids.

Why E is wrong: Concentrating everything in one Availability Zone leaves the service fully exposed to that zone's loss, and instance recovery only restarts a single host, so it cannot survive a whole zone going offline.

See more SAP-C02 practice questions, answers explained.

Exam traps in Design for New Solutions

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAP-C02 bank for this domain.

Trigger an Aurora global database managed unplanned failover that detaches the secondary in ap-northeast-1 and promotes it to a standalone writer, accepting the small replication-lag data gap as the cost of the planned maintenance rotation.
Why it is wrong: Managed unplanned failover is built for an unavailable primary Region and can lose the in-flight replication lag, so it does not guarantee the zero data loss the planned, controlled rotation requires.
Create a Route 53 latency-based record set across both Regional API endpoints so that clients are always routed to whichever Region shows the lowest measured network latency from their own DNS resolver location.
Why it is wrong: Latency routing sends clients to the nearest Region regardless of which holds the database writer, so after a failover it can keep steering write traffic to a Region that is now a read-only secondary.
Keep the existing Route 53 failover records but shorten every health check interval to the minimum and add more endpoints to the check, so a partial dependency failure is detected sooner and DNS shifts traffic to the standby Region automatically.
Why it is wrong: Faster, broader health checks still infer health from probes and cannot guarantee they catch every partial application failure, so this keeps the exact dependency-blind failover behaviour the team wants to replace with a deterministic control.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.