DR strategies, RTO/RPO and Elastic Disaster Recovery: SAP-C03 study notes and practice questions
What to know about DR strategies, RTO/RPO and Elastic Disaster Recovery for the SAP-C03 exam, from the Resilience, Migration, and Business Continuity domain (15% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
DR questions state a recovery time objective (how long until service is back) and recovery point objective (how much data loss is acceptable), and often a budget. Pick the cheapest strategy that meets both.
The four strategies
Strategy
Typical RTO / RPO
Standing in the recovery Region
Cost
Backup and restore
Hours / hours
Backups only; rebuild with IaC
Lowest
Pilot light
Tens of minutes / minutes or less
Data replicated live; core services ready but compute off or at minimum
Low
Warm standby
Minutes / seconds
A scaled-down, fully working copy taking (or able to take) traffic; scale up on failover
Medium
Multi-site active/active
Near zero / near zero
Full capacity serving traffic in each Region
Highest
RPO is set by how data is replicated; RTO is set by how much is already running plus how fast you can switch traffic.
Replication that sets RPO
Data
Low-RPO option
Aurora
Aurora Global Database: storage-level replication with RPO typically about a second; managed failover or switchover
RDS
Cross-Region read replica (promote on failover) or cross-Region automated backup replication (higher RPO)
DynamoDB
Global tables (active/active); point-in-time recovery for corruption
S3
Cross-Region Replication, with Replication Time Control for a predictable time
Replication protects against Region loss but also copies corruption and deletion, so keep point-in-time backups as well. See backup protection.
AWS Elastic Disaster Recovery (DRS)
An agent continuously replicates server disks at block level from on-premises, other clouds or another AWS Region into a low-cost staging area (small replication servers and inexpensive EBS volumes) in the recovery Region.
RPO in seconds, RTO in minutes: on recovery, DRS launches full-size instances from the latest or an earlier point-in-time snapshot, which helps recover from ransomware.
Drills launch recovery instances without disrupting replication; failback replicates back to the source after the event.
Cost is far below a running warm standby because only staging resources run until you recover.
Automating recovery
Keep infrastructure in CloudFormation or CDK so the recovery Region can be built or scaled on demand; keep AMIs, container images (ECR replication) and secrets replicated; and script failover with Systems Manager Automation runbooks or ARC Region switch plans. See multi-Region failover.
How to choose
Scenario wording
Pick
“RTO 24 hours, RPO 12 hours, lowest cost”
Backup and restore with cross-Region AWS Backup copies
“RTO 30 minutes, RPO 1 minute, low cost”
Pilot light, or Elastic Disaster Recovery for server fleets
“RTO a few minutes, must serve some traffic immediately”
Warm standby
“Zero downtime, users in several continents”
Multi-site active/active
“On-premises servers, recover in AWS within minutes”
Elastic Disaster Recovery
Common traps
Active/active for a modest RTO on a tight budget.
Read replicas or global tables as the only protection against bad writes.
Backup and restore when the RPO is seconds.
Forgetting the non-data pieces: AMIs, images, secrets, DNS, quotas in the recovery Region.
A manufacturer runs its ERP system on 40 virtual machines in a VMware data center. The disaster recovery requirement is a recovery time objective of four hours and a recovery point objective of 15 minutes, and the finance team will not fund a second copy of the full environment running all the time.
The ERP system must be recoverable in an AWS Region when the data center is lost, and the recovery must be rehearsed without disrupting production.
Which solution meets these requirements at the LOWEST cost?
Choose one answer.
AA. Copy the nightly backups of the virtual machines to a bucket in the recovery Region, and restore them from those copies after a disaster.
BB. Use AWS Elastic Disaster Recovery to replicate the 40 machines continuously to a staging area in the recovery Region. Launch recovery instances during a disaster and run scheduled drills.
CC. Run a full copy of the ERP environment in the recovery Region at all times, with the same instance sizes and databases as production, so that failover is nearly instant.
DD. Build a second data center in the recovery Region with a leased circuit, and keep the spare hardware powered on so that the team can restore onto it.
Show the answer and explanation
Answer: B
A. Wrong: Nightly copies leave up to a day of data at risk, which breaks the 15-minute recovery point objective. Restoring the environment from scratch also takes longer than the four-hour target allows.
B. Right: Correct. Continuous replication keeps data within the 15-minute point, and recovery instances launch from the staging copies within the four-hour target. Only the replication staging resources run until a disaster, and drills run without touching production.
C. Wrong: The duplicate environment meets the targets, but running it all the time is the full cost the finance team will not fund. The option is more than the objectives require.
D. Wrong: Leased hardware and a circuit in a second site are fixed costs that the AWS recovery options avoid. The option also does not rehearse recovery in the cloud.
Explanation
Elastic Disaster Recovery meets the 15-minute and four-hour targets with continuous replication and only staging resources running until a disaster, and it supports drills. Nightly copies miss the recovery point, while a full standby environment or a leased second site costs more than the objectives need.
A payment processor runs its ledger on an Amazon Aurora PostgreSQL database in one Region, with the web and API tiers in the same Region. The recovery requirements are a recovery point of about one minute and a recovery time of 15 minutes, and the business wants the second Region ready to take over with a tested, controlled switch.
The operations team does not want to depend on manual steps in a DNS zone, and DNS answers cached by clients must not delay the switch.
Which TWO designs meet these requirements? (Choose two.)
Choose two answers.
AA. Take an Aurora snapshot every day and copy it to the second Region, then restore a new cluster from the latest copy when a disaster is declared.
BB. Use an Aurora Global Database with a secondary cluster in the second Region, and promote the secondary cluster with a global database failover when the primary Region fails.
CC. Replicate the database to the second Region with a self-managed logical replication setup on EC2 instances, and have an engineer promote the replica by hand during an outage.
DD. Put the web and API tiers behind AWS Global Accelerator with an endpoint group in each Region, and switch traffic by setting the primary Region's traffic dial to 0 percent.
EE. Change the DNS record for the application by hand in the public hosted zone when an outage starts, and set the record's time to live to one day to reduce the load on the DNS servers.
Show the answer and explanation
Answers: B, D
A. Wrong: A daily snapshot leaves up to a day of ledger changes at risk, and restoring a cluster takes longer than the 15-minute target. The option misses both recovery objectives.
B. Right: Correct. Aurora Global Database replicates the ledger to the second Region with low replication lag, and managed failover promotes the secondary within the recovery time target. The database side of the switch needs no manual data copy.
C. Wrong: The manual promotion and the self-managed replication add steps and failure modes that the operations team wants to avoid. The option also does not offer a tested, controlled switch.
D. Right: Correct. Global Accelerator gives clients static anycast addresses, so moving traffic between Regions does not depend on DNS records or cached answers. Changing the traffic dial is a deliberate action that the team can test and that takes effect quickly.
E. Wrong: A one-day time to live means clients keep the old answer for up to a day after the change, which breaks the requirement on cached answers. The manual DNS edit is also what the operations team wants to avoid.
Explanation
An Aurora Global Database meets the one-minute recovery point, and its failover promotes the secondary within the recovery time. Global Accelerator traffic dials move clients between Regions without DNS edits or caching delays. Daily snapshots, self-managed replication and a long time-to-live DNS change each miss a requirement.
Want more on DR strategies, RTO/RPO and Elastic Disaster Recovery? The 5 full-length practice sets have 7 more DR strategies, RTO/RPO and Elastic Disaster Recovery questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study DR strategies, RTO/RPO and Elastic Disaster Recovery