Disaster recovery strategies: SAA-C03 study notes and practice questions
What to know about Disaster recovery strategies for the SAA-C03 exam, from the Design Resilient Architectures domain (26% of the exam guide), then 2 free questions to test it. Part of the SAA-C03 study guide.
Disaster recovery questions nearly always give an RPO (how much data you can lose, measured in time) and an RTO (how long you can be down). Your job is to pick the cheapest strategy that meets both.
The four strategies
Strategy
What runs in the recovery Region
Typical RPO / RTO
Cost
Backup and restore
Nothing; backups are copied there
Hours / hours to a day
Lowest
Pilot light
Data is replicated live; core services exist but compute is off or not deployed
Live data replication: Aurora Global Database (typically under a second of lag, managed failover to a secondary Region), DynamoDB global tables (active-active), RDS cross-Region read replicas.
Fast infrastructure: CloudFormation or other infrastructure as code so the recovery stack can be built quickly; AMIs copied to the recovery Region.
Traffic switch: Route 53 failover routing with health checks, or Global Accelerator.
AWS Elastic Disaster Recovery continuously replicates servers (on premises or EC2) into a low-cost staging area and launches them in minutes when needed. A strong answer for lifting existing servers into a pilot-light style setup.
How to read the numbers
An RPO of hours with an RTO of a day: backup and restore, as long as backups run at least as often as the RPO.
An RPO of seconds to minutes: data must be replicated continuously, so backup and restore is out.
An RTO of minutes: the infrastructure must already be running (warm standby) or be launched automatically from replicated data.
“No downtime” or users in both Regions all the time: active/active.
Common traps
Over-engineering. Active/active for a 24-hour RTO fails “most cost-effective”.
Backup frequency vs RPO. A daily backup can lose up to 24 hours, so it can’t meet a 4-hour RPO.
Forgetting the data tier. Copying AMIs to another Region is no help if the database isn’t there too.
A company runs an internal reporting application on Amazon EC2 with an Amazon RDS for MySQL database in one AWS Region.
For a Regional disaster, the business accepts up to 8 hours of data loss and up to 24 hours to restore service in a second Region.
The application is used only during office hours, and the company wants the lowest-cost disaster recovery strategy that meets these targets.
Which approach should a solutions architect recommend?
Choose one answer.
AA. Use AWS Backup every 4 hours for the instances and database, copy each backup to the second Region, and rebuild from templates in a disaster.
BB. Use AWS Backup to back up the instances and database once a day, copy each backup to the second Region, and rebuild from templates in a disaster.
CC. Run a cross-Region read replica of the database in the second Region, keep AMIs copied there, and launch the application servers in a disaster.
DD. Run a scaled-down copy of the full application in the second Region with a cross-Region read replica, and scale it up in a disaster.
Show the answer and explanation
Answer: A
A. Right: Correct. Backup and restore is the cheapest strategy because nothing runs in the second Region until it is needed. A 4-hour schedule keeps data loss well inside 8 hours, and rebuilding from templates and backups fits within a 24-hour recovery time. Learn more: Backup plan options and configuration (opens in a new tab)
B. Wrong: This is the same low-cost strategy, but a daily schedule means a disaster just before the next backup loses almost 24 hours of data. That breaks the 8-hour limit. AWS Backup can run as often as every hour, so a shorter schedule fixes it. Learn more: Backup plan options and configuration (opens in a new tab)
C. Wrong: This is a pilot light design. Continuous replication gives a much smaller data loss and faster recovery than needed, but the company pays for a database instance running all the time. With 8-hour and 24-hour targets, backups are enough. Learn more: Disaster recovery options in the cloud (opens in a new tab)
D. Wrong: This is warm standby. It can take traffic almost at once, but it keeps servers and a database running in the second Region all the time, which costs more than pilot light. The generous targets do not justify it. Learn more: Disaster recovery options in the cloud (opens in a new tab)
Explanation
Disaster recovery strategies trade cost against recovery point and recovery time. With an 8-hour RPO and a 24-hour RTO, backup and restore is enough, as long as backups run often enough: a daily schedule could lose up to 24 hours of data, while every 4 hours stays within the limit. Pilot light and warm standby recover faster but pay for resources that run all the time.
A payments company runs an Amazon Aurora MySQL cluster in eu-west-2.
A new regulation requires that, if the whole Region becomes unavailable, the database can be running in eu-central-1 within 10 minutes and lose no more than 5 seconds of committed transactions. Replication must not add noticeable load to the primary cluster, and the small operations team wants the LEAST operational overhead.
Which solution meets these requirements?
Choose one answer.
AA. Use AWS Backup with continuous backups for the cluster, and a rule that copies a recovery point to a vault in eu-central-1 every hour.
BB. Add two Aurora Replicas in other Availability Zones of eu-west-2, and rely on Aurora's automatic failover to promote one of them.
CC. Add eu-central-1 to an Aurora global database as a secondary cluster, and run a global database failover if eu-west-2 is lost.
DD. Run AWS DMS ongoing replication from the cluster to a separate Aurora cluster in eu-central-1, and repoint the application after an outage.
Show the answer and explanation
Answer: C
A. Wrong: Cross-Region copies of continuous backups are periodic snapshots, so up to an hour of transactions could be lost, far beyond 5 seconds. Restoring a cluster from a snapshot also takes time. Aurora global database replicates continuously instead. Learn more: Copying continuous backups (opens in a new tab)
B. Wrong: Aurora Replicas give fast failover when an instance or Availability Zone fails, but they are all in eu-west-2. If the whole Region is unavailable, they go down with it. A secondary cluster in another Region is needed. Learn more: Replication with Amazon Aurora (opens in a new tab)
C. Right: Correct. A global database replicates at the storage layer with lag typically under a second and little impact on the primary. In a Regional outage, a failover promotes the eu-central-1 cluster to take writes, a managed step that fits the 10-minute target. Learn more: Using Amazon Aurora Global Database (opens in a new tab)
Aurora global database uses dedicated, storage-level replication to secondary Regions with latency typically under a second and little performance impact on the primary cluster. If the primary Region fails, a global database failover promotes a secondary cluster. Backups copied between Regions give a much larger RPO, same-Region replicas do not survive a Regional outage, and DMS adds load and operational work.
The secondary cluster in eu-central-1 stays about a second behind, and a global database failover promotes it if eu-west-2 is lost.
Want more on Disaster recovery strategies? The 5 full-length practice sets have 10 more Disaster recovery strategies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →