Based on the SAA-C03 exam guideReport an error
This week covered three topics: "how do you endure failure, how do you recover from disaster, and how do you move workloads." On the surface they look separate, but the three converge on one question — "what is the worst this system must survive, and how much will you spend to survive it." Is it a single-AZ failure or a whole-region blackout? Can you not lose even one second of data, or is an hour tolerable? Is what blocks the move downtime or bandwidth? Reading these constraints precisely and mapping them to the right-cost tool is the essence of SAA Domain 2 (Resilience). This article compresses the week's core into a decision tree, then burns that mapping into muscle memory with the kind of compound scenarios the real exam throws at you.
Every decision this week ultimately sits on three axes.
First, the blast radius of failure sets the isolation level. If you must stay up even when one AZ dies, that's Multi-AZ (synchronous replication within the same region, RPO 0). If you must survive even a whole-region blackout, that's Multi-Region (asynchronous replication, DR). "Multi-AZ is not DR" was the week's biggest trap — Day 1's 2021 us-east-1 incident showed that "a region, too, is a failure unit."
Second, RTO and RPO set the DR tier and the cost. RPO (data you can afford to lose) is decided by the replication method; RTO (tolerable downtime) is decided by how ready your compute is. The smaller both get, the higher you climb toward the expensive end of the DR spectrum (Backup-Restore → Pilot Light → Warm Standby → Active-Active). Day 2's core point was that "a design exceeding the required resilience is itself a waste" — for loose RTO/RPO, a cheap tier is enough.
Third, the kind of constraint sets the tool. Where to send traffic is solved by Route 53 routing policies (Day 3); how to move a workload is solved by migration tools (Day 4). For low DB downtime it's DMS+CDC, for low bandwidth on large files it's Snow vs. DataSync, and for server relocation the tool is MGN.
| Comparison | Left | Right | Deciding criterion |
|---|---|---|---|
| Multi-AZ vs. Multi-Region | HA (synchronous, RPO 0) | DR (asynchronous) | Blast radius (AZ or region) |
| Aurora Global vs. Cross-Region RR | Single writer, promotion in minutes | Asynchronous read replica | Promotion speed, dedicated replication infrastructure |
| DynamoDB Global Tables vs. Aurora Global | Multi-region simultaneous writes (AP) | Single-region writes (consistency) | Number of writable regions |
| Pilot Light vs. Warm Standby | App OFF, DB replicating | Scaled-down full stack ON | Compute readiness |
| DMS vs. MGN | DB data (CDC) | Whole server (block) | Unit being moved |
| MGN vs. DRS | One-time migration | Continuous DR | Purpose (relocation or recovery) |
| DataSync vs. Storage Gateway | Migration/replication (one-time or periodic) | Permanent hybrid cache | Temporary or permanent |
| Snow vs. DataSync | Offline (insufficient network) | Online (sufficient bandwidth) | Transfer time = line speed × data volume |
| Alias vs. CNAME | Root domain OK, free | Not allowed at zone apex | Zone apex constraint |
| Latency vs. Geolocation | Fastest region | User location (regulation, language) | Speed or location |
💡 Related theory: Beneath all these comparisons lies the CAP/PACELC we saw on Day 1. In Multi-Region, choosing "simultaneous writes across regions" (DynamoDB Global Tables) is the AP choice — conceding consistency to gain availability; choosing "writes in one region only" (Aurora Global) preserves consistency but pays the procedural RTO of failover. The 4 DR tiers, too, are ultimately CAP translated into business language: trading cost against "how fast and how accurately you recover during a partition or failure." This is exactly why resilience design is solved by reasoning rather than memorization — it's a consistent logic that weighs cost against endurance on top of the fundamental constraints of distributed systems.
⚠️ Pitfall: Here are the week's four recurring traps bundled together. ① Mistaking Multi-AZ for DR — an AZ is isolation within the same region, so it's powerless against a regional failure. ② Confusing RTO with RPO — they are independent axes, so the scenario "RPO is loose but RTO is tight" is common. ③ CNAME on a root domain — impossible due to the zone apex constraint; Alias is the answer. ④ Keeping backups in the same account as production — the hand that deleted production deletes the backups too (Code Spaces). The instant you spot any of these four, you should reflexively filter out the wrong answers.
[ Multi-Region DR + Migration, Integrated ]
┌─ Region A (Primary, production) ───────────┐
│ Route 53 Alias(example.com) → CloudFront │
│ → ALB → ECS(Auto Scaling, multi-AZ) │
│ → Aurora Global Writer (RPO ~1s) │
│ S3 (Standard, 3+ AZ) ──CRR──▶ Region B │
│ AWS Backup → Vault Lock(WORM) + separate │
│ account │
└────────────────────────────────────────────┘
│ asynchronous replication
▼
┌─ Region B (DR, Warm Standby) ──────────────┐
│ ALB(always on) → ECS(scaled down, │
│ scale up on failure) │
│ Aurora Global Reader (minutes to promote │
│ on failure) │
└────────────────────────────────────────────┘
Route 53 Failover/ARC: Primary unhealthy → Secondary
(Health Check + ARC Readiness continuously verify readiness)
[ Migration inbound paths ]
On-prem DB(Oracle) ─SCT+DMS(CDC)─▶ Aurora
On-prem 200 VMs ─MGN(block replication)─▶ EC2
On-prem files(NFS) ─DataSync(ample bandwidth)─▶ S3
Petabytes offline ─Snowball Edge Cluster─▶ S3
This single diagram contains every concept of the week — Multi-AZ HA (multi-AZ ECS), Multi-Region DR (Aurora Global + CRR), the Warm Standby tier, Route 53 Alias/Failover/ARC, immutable backups, and the four migration paths. The exam's compound questions usually peel off one piece of this picture and ask "what should you choose here."
📚 Case study: Netflix's chaos engineering, which we saw on Day 2, is the final piece that turns this integrated architecture from "a document into a verified system." No matter how meticulously you draw it, until you actually kill Region A you can't know whether Region B's ECS truly scales up, whether Aurora promotion truly finishes in a minute, or whether ARC Readiness truly catches a shortfall. The week's operational philosophy — "a backup you haven't tested is not a backup, and a DR you haven't drilled is not DR" — is what breathes life into this picture. The reason SAA is an architect certification is precisely that it asks not for a mere list of services but for the judgment to make "does this design truly endure" verifiable.
Click a choice to reveal the answer and explanation.
Question 1
A global fintech must keep serving even during a whole-region failure, with an RTO of 30 seconds and RPO near 0. Cost is secondary. What is the most appropriate architecture?
Question 2
A company is designing DR for an internal reporting system with an RTO of 12 hours and RPO of 6 hours, minimizing cost. What is the appropriate strategy?
Question 3
A game company wants to run player inventory across 5 regions worldwide as a low-latency NoSQL that is read and written in all regions simultaneously. What is the appropriate service?
Question 4
A research institution must move 200 TB of data from a remote, low-bandwidth region to S3. Over the network it would take months. What is the appropriate method?
Question 5
A company wants to connect the root domain shop.com to a CloudFront distribution, but the CNAME setting is rejected. What is the correct solution?
Question 6
A SaaS wants to route worldwide users to the region with the lowest network latency. What is the appropriate Route 53 policy?
Question 7
A financial company needs backups to be tamper-proof for regulatory compliance, so that not even the root user can delete them within the retention period. What is the appropriate control?
Question 8
A team wants to permanently relocate 200 VMs from an on-premises data center to AWS EC2 without code changes. What is the appropriate tool?
Question 9
A company wants to lower DR cost while continuously replicating data to another region and keeping app servers normally off, then booting them quickly on failure. What is the combination of this strategy and the service that automates it?
Question 10
An architect wants to switch regional traffic immediately and explicitly, without relying on health checks, during failover in a multi-region Active-Active setup, while continuously verifying the secondary region's readiness. What is the appropriate tool?
Question 11
A company wants to move an Oracle database to Aurora PostgreSQL, minimizing downtime to within a few minutes. But after the migration starts, CDC can't catch up with the changes. What is the combination of the correct approach and the root cause of the problem?
Question 12
A company needs RDS writes to be uninterrupted with RPO 0 even during a single-AZ failure, and at the same time needs the service to continue in another region even during a whole-region us-east-1 failure. What is the most appropriate combination?