Scaling & Reliability

A service depends on a database that goes down for 60 seconds. Which probe configuration behaves correctly?

Readiness controls whether a pod receives traffic; liveness controls whether it gets killed and restarted. Checking a downstream dependency in a liveness probe turns a brief dependency blip into a cluster-wide restart storm.

You have 50M embeddings, need p99 under 50ms, and 95% recall is acceptable. Which vector index do you choose?

Vector index choice is a three-way trade between recall, latency and memory. At tens of millions of vectors with a tight latency budget and tolerance for approximate results, HNSW with quantization is the standard answer: exact search cannot meet the latency, and unquantized HNSW cannot meet the memory budget affordably.

An ecommerce application sends order events to a processing service. During sales events the processing service is overwhelmed and drops orders. Orders for a given customer must be processed in the sequence they were submitted, and no order may be processed twice. Which solution meets these requirements?

Two requirements in the stem, ordering and no duplicates, point at exactly one service. An SQS FIFO queue guarantees first-in-first-out delivery within a message group and provides exactly-once processing through deduplication. A standard queue gives neither.

An Amazon RDS for MySQL database serves a reporting application. Read queries have grown until they slow down writes, and the business separately requires that the database survive the loss of a single Availability Zone with automatic failover. Which combination meets both requirements?

Multi-AZ and read replicas solve different problems and the exam tests whether you conflate them. A Multi-AZ standby is synchronous and cannot serve reads. A read replica is asynchronous and does serve reads. Needing both availability and read scaling means deploying both.

A company runs a business-critical application in one AWS Region. The disaster recovery plan requires a recovery time objective of 10 minutes and a recovery point objective of 1 minute in a second Region. The company wants to avoid paying for a full duplicate of the production fleet. Which disaster recovery strategy should a solutions architect choose?

RTO and RPO in minutes rule out backup and restore and pilot light, because both require standing infrastructure up before traffic can move. Warm standby keeps a scaled-down copy always running, which is what buys minutes instead of hours without paying for a second full fleet.

A web application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Users report being logged out at random. Investigation shows that session data is held in memory on each instance, so a request routed to a different instance loses the session. Which solution fixes this while keeping the web tier horizontally scalable?

Session state held on an instance makes that instance special, which is what breaks scaling and termination. Moving sessions to a shared store such as ElastiCache or DynamoDB makes every instance interchangeable, which is the property the rest of the architecture assumes.

You are asked to back up the cluster state of a cluster where etcd runs as a static Pod on the control plane node. Which approach produces a restorable backup?

Take an etcdctl snapshot save against the etcd endpoint, passing the CA certificate, client certificate and key that etcd is configured with. That one file is the cluster state.

A media company stores original video files in an Amazon S3 bucket in us-east-1. Regulators require that a copy of every new file exists in a second AWS Region within 15 minutes of upload, and that no file can be permanently deleted by mistake. Which TWO actions should a solutions architect take?

Cross-Region Replication copies new objects to a bucket in another Region automatically, and versioning is its prerequisite as well as the control that makes deletion recoverable. The pair answers both halves of the requirement with one dependency between them.

A cluster must be rolled back to an etcd snapshot taken this morning. The control plane is still running. What does the documented restore procedure require?

Stop every API server first, restore the snapshot into a fresh data directory, then start the API servers again. Restoring under a live API server is explicitly warned against.

A team is planning a highly available control plane and must choose between the stacked etcd topology and the external etcd topology. Which statement correctly describes the trade-off?

Stacked etcd runs an etcd member on each control plane node, so losing a node loses both an API server and an etcd member. External etcd separates the two at the cost of twice the hosts.

A nightly batch job renders video segments. The work is split into thousands of independent tasks, any task can be retried safely if it fails, and the job must finish before 06:00 but has no other timing constraint. The company wants to minimise compute cost. Which approach should a solutions architect recommend?

Independent, retryable tasks with a loose deadline is the definition of an interruption-tolerant workload, and that is what Spot Instances are for. Spreading the request across several instance types and Availability Zones is what keeps a Spot fleet from being reclaimed all at once.

A HorizontalPodAutoscaler targeting 70% average CPU never scales, and kubectl describe hpa shows unknown for the current metric. Which TWO conditions would cause this?

CPU-based autoscaling needs a metrics source serving the Metrics API, normally metrics-server, and it needs CPU requests on the Pods' containers, since utilisation is a percentage of the request.

kubectl drain is taking a node out of service and appears to hang, evicting nothing further. A PodDisruptionBudget on the affected app sets minAvailable: 3 and exactly 3 Pods are ready. What is happening?

drain uses the Eviction API, which respects PodDisruptionBudgets. With minAvailable already at the limit, no further eviction is allowed until a replacement Pod becomes ready somewhere else.