A 911 CAD system requires an RTO of minutes and near-zero RPO across Regions. A team proposes pilot light only. What should the architect recommend?
Select an answer to reveal the explanation.
Short Explanation
Pilot light is a night-light—you still need time to flip breakers and warm the building. 911 CAD that must be up in minutes with almost no data loss needs warm standby or true multi-site with continuous replication. Weekly Glacier restores or a single AZ are non-starters for that bar.
Full Explanation
A 911 CAD system with an RTO of minutes and near-zero RPO cannot rely on pilot light alone. Pilot light keeps only a minimal core in the standby Region and requires substantial provisioning during failover, which typically cannot meet minute-level RTO with near-zero data loss. Architects should reject pilot light for those objectives and select warm standby or multi-site active-active with continuous replication and proven failover drills that match public-safety timelines.
Accepting pilot light because any cross-Region AMI copy meets minute RTO and near-zero RPO by definition confuses image availability with running, replicated capacity and continuous data protection. Backup and restore from weekly Glacier archives as the sole DR strategy for CAD implies hours-to-days of recovery and large RPO. Running CAD only in a single AZ simplifies scripting while guaranteeing AZ failure takes the system down.
Exam caveat: map DR patterns to RTO/RPO—backup/restore (hours+), pilot light (tens of minutes to hours), warm standby (minutes), multi-site active-active (near-zero)—and never claim AMI copy alone equals near-zero RPO. Operational check: define CAD RTO/RPO in writing, choose warm standby or active-active accordingly, measure failover in a game day, and verify replication lag stays inside the near-zero RPO window.