SOA-C03 - Reliability and Business Continuity (22% of the exam) - Section 2.4

Design fault-tolerant systems using Multi-AZ deployments, redundancy across Availability Zones and stateless design.

Design fault-tolerant architectures by spreading compute and Amazon RDS Multi-AZ deployments across Availability Zones with no shared single points of failure. Recognise that stateless application tiers are required to allow Auto Scaling to replace instances without data loss.

Multi-AZ deploymentsAvailability ZonesAmazon RDS Multi-AZStateless design

Practice question for this objective

Free sampleReliability and Business Continuitymedium

An Auto Scaling group is meant to spread its instances across three Availability Zones for fault tolerance, but after a recent zone impairment and recovery the group ended up with most instances concentrated in one Availability Zone. The team wants the group to keep capacity spread roughly evenly across its Availability Zones on its own, so the loss of one zone removes only about a third of capacity. Which property of the Auto Scaling group provides this behaviour?

  • AThe group's cooldown period, which after each scaling activity holds the new distribution in place long enough for the zones to settle into an even spread over time.
  • BAvailability Zone balancing built into the group, which launches new instances in the zones with the fewest instances and rebalances to restore an even spread across the configured zones. Correct
  • CThe group's health check grace period, which once lengthened lets instances start in under-used Availability Zones before they are evaluated and counted toward the spread.
  • DThe group's termination policy set to OldestInstance, which by always removing the oldest instances gradually shifts the population toward a balanced distribution across the zones.
Rely on Auto Scaling's built-in Availability Zone balancing to keep instances spread evenly across zones so single-zone loss removes only its share of capacity. An Auto Scaling group attempts to distribute instances evenly across the Availability Zones enabled for it, launching into the zone with the fewest instances and rebalancing when zones become skewed, which means after a zone recovers the group works back toward an even spread so that any single Availability Zone holds only a proportional fraction of total capacity.

Why A is wrong: A cooldown only spaces out scaling actions; it has no role in balancing instances across zones, so a skewed distribution would simply persist.

Why B is correct: Auto Scaling inherently favours the least-populated zone on launch and rebalances across zones, so the group restores an even spread and one zone loss removes only its share of capacity.

Why C is wrong: The grace period delays health evaluation after launch and says nothing about which zone an instance lands in, so it cannot even out a zone skew.

Why D is wrong: A termination policy decides which instance to remove on scale-in, not how to distribute launches, so choosing OldestInstance does not drive an even cross-zone spread.

See more SOA-C03 practice questions, answers explained.

Exam traps in Reliability and Business Continuity

Answers that look right on this material and are not. Each one is a distractor from a different question in the SOA-C03 bank for this domain.

  • Enable sticky sessions on the Application Load Balancer target group so each user is pinned to the same instance that holds their in-memory session for the life of the session.

    Why it is wrong: Stickiness keeps state on one instance, which is tempting because logins persist while it lives, but the session is still lost the moment that instance or its zone fails.

  • Create an Amazon RDS read replica of the PostgreSQL instance in the second Availability Zone and point the application at the replica endpoint if the primary becomes unreachable.

    Why it is wrong: A read replica serves reads and needs a manual promotion to accept writes, so it provides neither automatic failover nor the unchanged write endpoint the requirement demands.

  • Create a cross-Region read replica of the instance in a second Region so traffic can shift there if the primary Availability Zone becomes unreachable.

    Why it is wrong: A cross-Region read replica is for disaster recovery across Regions and needs a manual promote and endpoint change, so it does not give automatic in-Region failover for a single zone loss.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.