Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 2 discussion

C. https://docs.aws.amazon.com/apigateway/latest/developerguide/dns-failover.html

The best solution to give the API the ability to fail over to a different AWS Region would be option C: C. Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a failover record. Enable target health monitoring. Convert the DynamoDB tables to global tables. This solution involves deploying a new API Gateway API and Lambda functions in another region. The company should also convert the DynamoDB tables to global tables to enable cross-region replication of the data. Then, the company should change the Route 53 DNS record to a failover record and enable target health monitoring to automatically route traffic to the new region in the event of a failure or outage in the primary region.

Failover routing policy – Use when you want to configure active-passive failover.

The solution that will meet these requirements is option C: Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a failover record. Enable target health monitoring. Convert the DynamoDB tables to global tables. This solution will allow the API to failover to a different region, by using Route 53 failover record. The failover record will direct traffic to the primary API endpoint (the one in the primary region) as long as it is healthy. If the primary endpoint becomes unavailable, traffic will be directed to the secondary endpoint (the one in the secondary region). Additionally, by converting the DynamoDB tables to global tables, the data will be available in both regions, which is required for the failover scenario. Target health monitoring can be used to monitor the health of the API Gateway, and when it is determined that the primary endpoint is unavailable, the traffic will be directed to the secondary endpoint.

I also agree with C. But not sure why not B, B is actually pretty good option. No, that I have experience in this specific case; what I normally see is Active/Standby. But option B sounds good because, in theory, we need to have both regions running the current code (Lambda) and if an outage happens we are sure both work, and we don't have stale config/code in the failover region. Sometimes multi-answer does not return the best endpoint for the use case, so that could be something against this solution.

The answer is B. A: There is no Route 53, so it cannot be switched in the event of a failure. C: It's good to change to a failover record, but compared to other questions, there is no step to add a DNS record answer, so you can't switch to a new region. D: The global function is meaningless. B: A health check is additionally set, and failover is possible because the corresponding records are not returned in the event of a region failure. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring.html

Not A. "edge-optimized API endpoint" make use of CloudFront to optimize global each, however API Gateway instance is deployed in a single region thus no ability to fail over to a different AWS Region Not B. "Route 53 DNS record to a multivalue" implements a active-active scenario, while we are requested to have fail over Not D. I am not aware of "global function" also "Route 53 DNS record to a multivalue" is not the best fit (see above) Thus C. is correct has it come with all the required pieces

Option A - Does not provide a way to fail over to a new region but rather a way for API gateway to respond from the region closest to the client Option B - Does not provide a way to fail over to a new region because when the main region is healthy name resolution will provide 2 possible regions to connect to Option C - Provides a way to fail over to a new region through the use of a Route 53 failover record and health monitoring and deployment in another region Option D - Does not provide a way to fail over to a new region because when the main region is healthy name resolution will provide 2 possible regions to connect to

To achieve automatic failover for the weather API, the company should deploy a duplicate API Gateway and Lambda functions in a secondary AWS region, then configure a Route 53 failover record that points to both endpoints. This failover record, combined with health checks, will automatically redirect traffic to the secondary region if the primary one fails. Additionally, converting DynamoDB tables to global tables ensures data availability in both regions, allowing the secondary API to function seamlessly during a failover.

D. Deploy a new API Gateway API in a new Region. Change the Lambda functions to global functions. Change the Route 53 DNS record to a multivalue answer. Add both API Gateway APIs to the answer. Enable target health monitoring. Convert the DynamoDB tables to global tables.

The changes of A and C are too much, breaking the original security design. B is wrong because answer B doesn't mention deny SCP on root level is changed. Allow on OU will not win because when allow and deny the same service, explicit deny always wins for the sake of security concerns.

C, failover health

C, failover record, this is the typical failover configuration on route53. Be careful, chatgpt suggests the option B "multivalue answer"

Choosing C cause you want the API GW and Lambda functions work as a combination behind the DNS with failover, can think of Route53 here as a CDN provider like Cloudflare

C is correct

failover is required

C is correct.