A manufacturer runs an ordering system on RDS PostgreSQL and EC2 in eu-central-1 needing RTO under 2 hours, RPO under 15 minutes, and low standby cost. Full active-active is too expensive. Which disaster recovery control meets these business requirements for this workload?
Select an answer to reveal the explanation.
Short Explanation
You need the pilot flame lit so the furnace roars fast without heating two houses. Pilot light keeps tiny replicas syncing for quick scale-up inside your RTO.
Full Explanation
Pilot light is correct because a cross-Region RDS replica provides continuous asynchronous replication with typical lag of seconds to minutes, satisfying RPO under 15 minutes, while Route 53 failover plus prebuilt AMIs, infrastructure as code and runbooks allow EC2 capacity and database promotion in the recovery Region well under 2 hours with only replica storage and minimal resources running, meeting low standby cost without full active-active expense. Warm standby with active replica and always-running EC2 in the recovery Region technically meets RTO and RPO and is widely used for critical workloads, but it fails the low-cost constraint by concept because continuously running compute incurs significantly higher standby spend than pilot light. Frequent backup and restore with cross-Region snapshot copy is a sound low-cost pattern that can meet RPO when snapshot frequency is high, but it fails RTO by concept because restore, validation, VPC and EC2 provisioning, and DNS cutover for a manufacturing ordering system introduce variable delays that risk exceeding 2 hours at scale. Multi-AZ with synchronous standby inside eu-central-1 is best practice for high availability and meets fast failover for AZ failure, but it fails disaster recovery by concept because it provides no protection against Region-wide impairment without cross-Region data and DNS. For exams, remember that Multi-AZ addresses availability while cross-Region replica plus DNS addresses disaster recovery, and pilot light versus warm standby is differentiated primarily by how much compute runs continuously. Practically, verify CloudWatch ReplicaLag stays well below 15 minutes and conduct a game-day failover measuring promotion plus Route 53 and EC2 scale-out time to prove RTO under 2 hours.