How Does Route 53 Enable Automated Failover to a DR Region?

SOA-C03 By islever Editorial Last updated

Configure domains, DNS services, and content delivery. Implement highly available and resilient environments.

Short answer

A Attach a Route 53 health check to the primary record and configure a failover routing policy with the us-west-2 record as the secondary.

Question

A retail company runs its primary ecommerce web application in the us-east-1 AWS Region with a fully configured disaster recovery (DR) environment in the us-west-2 Region. The company requires automatic failover to the DR environment if the primary environment becomes unhealthy.
How should the company configure Amazon Route 53 to enable automated failover between the primary and DR environments?
  1. Create a Route 53 health check that monitors the primary web application endpoint. Configure a failover routing policy with primary and secondary records that point to the respective primary and secondary environments. Set the primary record with the health check association. Configure the secondary record as the failover record. Correct Answer
  2. Create two Route 53 latency-based routing records. Point one routing record at each environment. Configure Amazon CloudWatch alarms to monitor the primary environment. Use an Amazon EventBridge rule to update the latency routing weights when the primary environment becomes unhealthy.
  3. Configure a Route 53 geolocation routing policy that directs all global traffic to the primary Region by default. Set up Route 53 DNS Firewall rules to detect application failures and automatically update the geolocation routing to redirect traffic to the secondary Region.
  4. Deploy Route 53 Resolver DNS Firewall rule groups in both Regions. Configure Amazon CloudWatch alarms to monitor the primary environment. Use Amazon EventBridge rules to trigger DNS Firewall actions that redirect queries to the DR environment when failures occur.

Key Takeaways

The exam tests whether you know that Route 53 failover routing ties a health-checked primary record to a standby secondary record — the trap is choosing designs that require custom EventBridge automation to rewrite DNS.

Amazon Route 53 failover routing with a health check on the primary record is the native way to achieve automatic active-passive DNS failover between us-east-1 and us-west-2. This page confirms option A and explains why CloudWatch/EventBridge-driven alternatives are not true Route 53 failover.

Common mistake: Many candidates pick the latency-based option because it mentions health monitoring and automation, but latency routing optimizes for lowest latency and does not perform active-passive failover; updating weights via EventBridge is manual orchestration, not Route 53 failover.

Expert Analysis

Why the Answer Is Correct

Route 53 failover routing is purpose-built for active-passive DR: the primary record is associated with a health check, and Route 53 answers with the secondary record whenever that health check is unhealthy. In this scenario the health check monitors the us-east-1 ecommerce endpoint, and the us-west-2 record is marked as the secondary failover record. The switch is automatic and requires no Lambda, EventBridge rule, or human intervention. This is exactly the configuration described in option A and confirmed by the community comment from Bad_Mat, who notes you should "use a failover routing policy with an associated Route 53 health check" on the primary record.

Why the Other Options Are Wrong

Option B uses latency-based records plus CloudWatch alarms and EventBridge to change weights; latency routing selects the lowest-latency Region, not a standby, and weight updates are custom orchestration rather than built-in failover. Option C proposes geolocation routing plus Route 53 DNS Firewall, but geolocation routes by the resolver's location, not by application health, and DNS Firewall filters outbound DNS queries rather than controlling public hosted-zone answers. Option D misuses Route 53 Resolver DNS Firewall, which protects VPC outbound DNS traffic and cannot redirect public queries to a DR Region when an application fails. None of these options provides the deterministic, health-check-driven answer switching that the requirement demands.

Community Comment Notes

Bad_Mat's comment aligns directly with the correct design, describing a failover routing policy with a health check on the primary record and explicitly concluding that "The correct choice is A." No commenter argues for the latency, geolocation, or DNS Firewall designs. The comment is a useful confirmation that the simple failover-policy pattern is what the exam expects, rather than an automation-heavy workaround.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for automatic Route 53 failover between Regions, scan for a health check attached to the primary record plus a failover routing policy with a secondary record. Reject any answer that relies on CloudWatch alarms or EventBridge rules to rewrite DNS, because those add moving parts that Route 53 failover does not require.

Frequently Asked Questions

Why is a latency-based routing policy with EventBridge weight updates wrong for DR failover?

Latency routing sends users to the lowest-latency Region, not a standby, and changing weights through EventBridge is custom automation rather than Route 53's built-in failover behavior.

Can Route 53 Resolver DNS Firewall redirect public traffic to us-west-2 during an outage?

No. Resolver DNS Firewall filters outbound DNS queries from VPCs; it does not control answers for a public hosted zone or perform health-based failover.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Bad_Mat 👍 1 Answered A
    To set up automated DNS failover in Amazon Route 53, you should use a failover routing policy with an associated Route 53 health check on the primary record.The correct choice is A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide