A retailer runs an Aurora and EKS commerce stack with RTO of one hour and RPO of 15 minutes across Regions. Auditors found restores were never timed and runbooks are untested. Leadership wants repeatable proof of recovery targets. Which disaster recovery testing and validation procedure meets the requirement using Resilience Hub?
Select an answer to reveal the explanation.
Short Explanation
You prove recovery by rehearsing failure on a schedule. Rehearsals turn your runbook from a script into muscle memory you can measure.
Full Explanation
The correct procedure succeeds because it scopes Resilience Hub to the full commerce application covering Aurora and EKS, enforces the one-hour RTO and fifteen-minute RPO as policy, and produces repeatable evidence with scheduled FIS drills plus recovery tests that execute failover, time restoration and measure data loss, directly resolving untested runbooks. The Route 53 health-check with CloudWatch alarms approach fails by concept because monitoring validates routing and thresholds but never injects faults or times full restore, so RTO and RPO remain unproven. The primary-Region drill approach fails by concept because cross-Region resilience requires proving secondary-Region failover, Aurora replication lag and restore, which single-Region execution leaves untested. The on-demand drill before audits approach fails by concept because episodic testing lacks scheduled recurrence and drift detection, so leadership gains no continuous proof of targets. Exam caveat: do not mistake resilience scores or alarms for recovery proof, since only timed execution establishes RTO and RPO attainment. Practical check: schedule FIS scenarios in Resilience Hub, perform cross-Region recovery, capture measured RTO and RPO from Aurora and EKS recovery outputs, and attach results to versioned runbooks for auditors.