DOP-C02 Practice Question 35: Pilot Light RTO RPO Selection

The four strategies trade cost against recovery time in a fixed order, and the requirements pick one out. The one-minute RPO rules out anything snapshot-based and calls for continuous replication: Aurora global database replicates "with typical latency of under a second" and can promote a secondary "in less than one minute." With pilot light, "your core infrastructure is always available and you always have the option to quickly provision a full scale production environment by switching on and scaling out your application servers", which fits a 30-minute RTO and the team's willingness to scale out. And because pilot light "minimizes the ongoing cost of disaster recovery by minimizing the active resources", it is the cheapest option that still clears both targets.

Option B cannot meet either number reliably. Fifteen-minute snapshot copies give a 15-minute RPO at best, and the whitepaper notes that without a standing environment, restoring and redeploying "will lead to increased recovery times and possibly exceed your RTO"; plus the stem forbids a from-scratch redeploy.

Option C meets the targets but costs more every day for no additional benefit here. The distinction is that "pilot light cannot process requests without additional action taken first, whereas warm standby can handle traffic (at reduced capacity levels) immediately", an always-on application tier the business has not asked and is not willing to pay for.

Option D is the most expensive and most complex approach of the four. It is justified when recovery time must be near zero; against a 30-minute RTO it buys nothing that pilot light does not already deliver, while adding multi-Region write-consistency design.

Reference: Disaster recovery options in the cloud