Lesson 3 of 6 · 11 min
Domain 2 — Design resilient architectures
The 26% domain: availability targets, decoupling, and matching a recovery strategy to RTO and RPO.
RTO and RPO decide the answer
Recovery Time Objective is the maximum acceptable downtime. Recovery Point Objective is the maximum acceptable data loss, measured in time. Almost every disaster recovery question gives you one or both, and the numbers pick the strategy.
An RPO of zero rules out anything asynchronous — you need synchronous replication. An RTO in minutes rules out restoring from backup. An RTO of hours and a tolerance for a day of loss means backup and restore is the correct, and cheapest, answer.
The four DR strategies
| Strategy | RTO | RPO | Cost | What runs in the second Region |
|---|---|---|---|---|
| Backup and restore | Hours | Hours | Lowest | Nothing — data only |
| Pilot light | Tens of minutes | Minutes | Low | Core data replicating, compute switched off |
| Warm standby | Minutes | Seconds | Medium | A scaled-down but running copy |
| Multi-site active-active | Near zero | Near zero | Highest | Full capacity serving traffic |
Availability within a Region
The baseline pattern is an Auto Scaling group across at least two AZs behind a load balancer, with a Multi-AZ database. If a proposed design puts anything in a single AZ and the question mentions high availability, that option is wrong.
Health checks matter as much as redundancy. A load balancer health check that only confirms the port is open will keep sending traffic to a process that has lost its database connection — the exam expects an application-level check.
Decoupling and statelessness
State on an instance is what breaks scaling and failover — the instance cannot be replaced without losing something. Sessions belong in DynamoDB or ElastiCache, uploads in S3, and shared files on EFS.
Queues absorb failure. If a scenario describes a spike overwhelming a backend, or one component's outage taking down another, the answer involves SQS between them, with a dead-letter queue for messages that repeatedly fail.
Worth remembering
- RTO is how long you can be down; RPO is how much data you can lose.
- The four DR strategies map directly onto cost and recovery time.
- Statelessness is what makes horizontal scaling and failover work at all.
Test it now
Resilience scenarios and DR sizing are core medium-bank material.