Vital-records systems must stay readable if the primary Region fails. The county accepts active-passive cost and wants DNS to shift traffic when the primary is unhealthy. Which design fits?
Select an answer to reveal the explanation.
Short Explanation
Keep a warm spare Region for vital records and let health-checked DNS flip the sign when the primary goes dark. That’s classic active-passive reliability.
Full Explanation
Vital-records systems that must stay readable if the primary Region fails, under an active-passive cost posture, fit a multi-Region design with replication and Route 53 health-based failover DNS. That combination shifts citizens to the secondary when the primary is unhealthy without funding full active-active writes. Active-active writes in both Regions with no conflict strategy and no health-based DNS invite data conflicts and weak cutover. Single-Region deployment with longer RTO and no secondary stack fails the readability requirement on Region loss. Piloting a secondary Region but keeping DNS pinned to the primary even when health checks fail wastes the secondary. Exam caveat: active-passive RPO depends on replication lag; promote read replicas or restore procedures must be explicit in the runbook. Operational check: fail primary health checks in a drill, confirm DNS failover, read vital records from the secondary, and measure lag against RPO. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.