SAP-C03 practice question: Resilience assessment and testing (Resilience Hub, Fault Injection Service) (2 of 2)
Resilience, Migration, and Business Continuity A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A streaming service's recommendation API runs on EC2 instances in three Availability Zones behind an Application Load Balancer. The team wants to prove in production that the API keeps serving users when one zone's instances become unreachable, and that load balancer traffic can be moved away from an impaired zone.
Each test must affect only one zone at a time and must stop automatically if a CloudWatch alarm on customer errors goes into the ALARM state. The team also wants the zonal traffic shift tested on a regular schedule, not just once.
Which TWO designs meet these requirements? (Choose two.)
Choose two answers.
AA. Write a script that terminates random production instances across all three zones every hour, and have the on-call engineer watch the dashboards and stop the script by hand if needed.
BB. Run the experiment only in the staging account, which has no real customer traffic, and count the staging results as proof for production.
CC. Create an AWS Fault Injection Service experiment template that disrupts network connectivity for the subnets in one zone, with the customer error alarm set as the experiment's stop condition.
DD. Turn on zonal autoshift for the load balancer, and configure its practice runs with the customer error alarm as the outcome alarm, so that ARC shifts traffic away from one zone each week.
EE. Turn off cross-zone load balancing on the target group, and have an engineer deregister one zone's instances during a monthly maintenance window while watching the error dashboards.
Show the answer and explanation
Answers: C, D
A. Wrong: Random termination across all zones is not limited to one zone, and it has no automatic stop condition. The manual stop is slow compared with the agreed threshold.
B. Wrong: Staging has no production traffic or production-scale data, so it cannot prove what happens in production. The option does not meet the requirement to test production instances.
C. Right: Correct. The template limits the fault to one zone's subnets, so the instances there become unreachable while the other zones keep serving. The stop condition ends the experiment automatically when the error alarm fires.
D. Right: Correct. Practice runs regularly shift the load balancer's traffic away from one zone for a short period, which proves the shift works on a schedule. ARC ends a practice run when its outcome alarm fires, which gives the automatic stop. Learn more: Zonal autoshift in ARC (opens in a new tab)
E. Wrong: Deregistering one zone's targets does move traffic away from it, but the test depends on an engineer watching dashboards. There is no automatic stop when customer errors rise.
Explanation
A FIS experiment scoped to one zone's subnets, with the error alarm as its stop condition, proves the API survives the zone failure. Zonal autoshift practice runs shift traffic away from one zone every week and end when the outcome alarm fires. A random termination script, a staging-only test and a manual deregistration each miss the scope, the automatic stop or the production need.
Want more on Resilience assessment and testing (Resilience Hub, Fault Injection Service)? The 5 full-length practice sets have 6 more Resilience assessment and testing (Resilience Hub, Fault Injection Service) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →