SAP-C02 Practice Question 37: Regional Failover Control Plane
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 4 · question 7 of 10
An insurer runs an active-passive workload in us-east-1 and eu-west-1, with Amazon Route 53 failover records and an HTTP health check against a /health endpoint deciding where traffic goes. Two incidents have now been reviewed.
In the first, a Regional impairment degraded the application while /health kept returning HTTP 200, so the health check never failed and traffic was never moved. In the second, an automatic failover did fire, but the standby Region had a service quota set too low to absorb production traffic and collapsed within minutes.
The remediation must give operators a deliberate, manual way to shift traffic whose control path is designed to keep working while a Region is impaired, must make it impossible to end up with both replicas serving or both replicas switched off, and must continuously verify that the standby's quotas, capacity, and routing configuration are ready to take the full load before anyone needs them.
What should the solutions architect implement?
Show answer and explanation
Answer:
Each clause of the remediation maps onto one ARC capability. Routing controls are simple on/off switches that fail traffic over between Regions, and AWS describes them as extremely reliable precisely so that operators can still flip them while a Region is impaired; that is the whole point of separating the recovery control path from the application being recovered. Safety rules are the guardrails: you can define a rule so that, for example, exactly one replica is enabled at a time, which makes both-on and both-off states impossible. Readiness checks continually monitor AWS resource quotas, capacity, and network routing policies across the replicas and warn when something has drifted out of a state that can absorb failover traffic, the exact gap that caused the second incident.
Option A only refines the signal that already failed. The first incident happened because the endpoint reported healthy while the Region was degraded; combining several such checks and polling them faster does not change that, and it does nothing about standby capacity or about both Regions ending up active.
Option B builds an automation whose dependencies overlap with the failure. The alarm, the Lambda function, and the record update all have to succeed during the impairment, there is no guardrail against a half-applied change, and it still ignores standby readiness.
Option C gives fast, DNS-free traffic shifting, which is a genuine strength, but the control action is again a script the team writes and operates. Global Accelerator has no equivalent of safety rules and no readiness checking, so two of the three requirements go unmet.
Reference: What is ARC?