Cutover, Rollback, and Unscored Emerging AI Topics

Weekend cutover is an architecture, not a calendar invite

Landing platforms and modernization seams do not matter if Monday clinics still hit the data-center VIP. Independent SAP-C02 study material by OpenExamPrep treats cutover and rollback as part of accelerating migration: you design rehearsal, traffic shift, data freeze, and fail-back before the change-advisory board approves a weekend window.

Meridian’s binding constraint is a lease exit, not a desire to learn Kubernetes on Saturday at 02:00. A typical wave: forty Windows application servers already replicating with AWS Application Migration Service (MGN) / AWS Transform MGN, a SQL Server that AWS Database Migration Service (AWS DMS) has been loading with change data capture (CDC), and a patient-portal hostname on Amazon Route 53.

Rehearsal versus go-live

AWS’s MGN documentation is operationally specific enough to appear in Professional stems. After servers are Ready for testing, Launch test instances. The source keeps serving customers. AWS calls it crucial to test before cutover and documents a best practice of testing at least two weeks before the planned migration so you can fix issues. Connect with RDP or SSH, run smoke tests in an isolated subnet so a test domain controller does not steal production computer accounts. Revert test tears down test EC2 instances and returns lifecycle status to Ready for testing; replication does not stop. When testers sign off, finalize the test (MGN’s “mark Ready for cutover”) and optionally delete test instances to stop paying for them.

Launch cutover instances is go-live. Quiesce writers, wait until replication lag is near zero, launch cutover instances, shift users, then Finalize cutover only after the bake. Finalize stops replication and removes staging. Revert cutover exists before you finalize. Do not Finalize to “save staging cost” during a rehearsal. Do not treat the first launch as cutover while clinics are still on the source.

DMS-backed databases follow the same idea with different tools: full load plus CDC while the source stays open; a short freeze when CDC latency is near zero; application cut; optional reverse-CDC only if you designed it. Deep DMS mechanics live in the previous chapter. Here you only need the rule: a 30-minute weekend window is a rehearsed freeze, not a first-time export.

Blue/green DNS, weights, TTL, and rollback

For hostname cutover, Amazon Route 53 weighted routing is the usual blue/green or canary control. You create records with the same name and type and different SetIdentifier values. Route 53 sends traffic in proportion to each record’s weight. AWS’s example of a tiny canary is weights 1 and 255 (1/256 of queries to the new target). You can start green at a low weight, watch CloudWatch 5xx and latency, then raise green and lower blue.

Rollback is raise blue and set green to 0, not delete the green record if you still might need it. AWS documents that a weight of 0 stops sending traffic to that resource. Keep at least one nonzero blue weight so the production hostname still has an intended target. If you attach health checks, AWS also documents that when all records with weight greater than 0 are unhealthy, Route 53 considers the zero-weighted records—another reason a “set everything to 0” weekend trick is not a controlled drain. Do not zero the entire group and assume nobody can resolve the name.

Time to live (TTL) is part of rollback math. Clients and recursive resolvers cache answers. The AWS blue/green deployments white paper warns that DNS rollback is only as fast as cache expiry, and that some clients cache aggressively. Lower TTL before the weekend (long enough to propagate), shift weights, and accept that some sessions remain on blue or green until caches die. Pair DNS with health checks on weighted records so an unhealthy green is skipped. Alias records to load balancers still need the load balancer itself to be scaled; Elastic Load Balancing scale-out is not instant—rehearse that too, or request a pre-warm when AWS still offers that operational path for your balancer.

Keep the source environment running through the bake window. Rollback that depends on a decommissioned data center is theater.

A Meridian Saturday 02:00 runbook (teaching sketch)

This table is a teaching sketch, not an AWS SLA. The exam will change the clock. Your job is to keep rehearsal, weighted shift, TTL, and Finalize-last in the design.

Unscored pretest emerging topics (do not affect the score)

Read this subsection as exam-guide emerging content, not as extra Domain 4 weight.

The SAP-C02 exam includes 10 unscored questions that do not affect your score. AWS collects them to evaluate future items. Those 10 are not identified in the test center. Separately, the current exam guide’s Emerging Topics section says you might also see questions on evolving practices that might appear as pretest questions and that questions on these emerging topics are included to evaluate new content and will not affect your exam score.

The named emerging skill group is Design security and responsible AI controls:

• Implementing content filtering and regulatory compliance controls for generative AI (example: Amazon Bedrock Guardrails).
• Implementing access controls for generative and agentic AI applications (example: AgentCore Identity).
• Designing human oversight workflows with approval mechanisms for AI operations (example: AWS Step Functions).

Independent OpenExamPrep labels these unscored / pretest so you can still reason about a stem. They are not a fifth scored domain. They do not change the 750 passing standard. Do not spend the first hour of the exam hunting for which items “do not count”—you cannot know.

Amazon Bedrock Guardrails (content filter pretest)

Amazon Bedrock Guardrails provides configurable safeguards for generative AI applications. AWS documents filters for harmful content categories (hate, insults, sexual, violence, misconduct, and prompt attack), denied topics, word filters, sensitive information (PII block or mask, plus regex), contextual grounding checks (flag RAG answers that are ungrounded or irrelevant), and Automated Reasoning checks against logical rules. You version a guardrail and attach it on model invoke, or you call ApplyGuardrail (and related check APIs) without invoking a foundation model. Traditional AWS WAF rules do not replace prompt-attack detection; WAF looks at HTTP patterns, not natural-language jailbreaks.

Meridian pretest sketch: a clinic chatbot must refuse illegal treatment advice, mask patient identifiers in prompts and completions, and block prompt-injection that tries to dump another patient’s context. The architecture answer is a versioned Bedrock Guardrail on the Bedrock invoke path (plus application logging), not “put WAF on the chatbot URL and skip Guardrails.”

AgentCore Identity (agent access-control pretest)

Amazon Bedrock AgentCore Identity is identity and credential management for AI agents and automated workloads. AWS documents inbound authentication to the agent runtime (IAM SigV4 or JWT bearer tokens—an AgentCore Runtime supports one of those inbound modes at a time) and outbound access to AWS and third-party tools using SigV4, OAuth 2.0, and API keys, with credentials in a token vault. Inbound JWT validation covers issuer, signature, and expiry; Runtime maps the user to a workload identity and issues a workload access token so the agent can call credential providers. Outbound providers include built-in ecosystems (examples AWS lists include Google, GitHub, Slack, Salesforce) and custom OAuth2 servers, including on-behalf-of patterns. Do not store long-lived third-party refresh tokens in application environment variables when the stem is about agent identity.

Human oversight with Step Functions (approval pretest)

AWS’s agentic guidance and the Step Functions human approval tutorial use the callback pattern: a Task with .waitForTaskToken (for example lambda:invoke.waitForTaskToken or sqs:sendMessage.waitForTaskToken) pauses the state machine, delivers $$.Task.Token to an approval application (email, SNS, queue), and resumes only when that application calls SendTaskSuccess or SendTaskFailure. Set TimeoutSeconds (the tutorial example uses a 3600-second state-machine timeout). Reviewers use the approval app, not raw Step Functions APIs. This is the same orchestration service you already use for scored Task 4.4, applied to AI operations that need a human in the loop (for example, a model wants to email a patient or change a schedule).

AWS documents that the AgentCore InvokeHarness Step Functions integration supports request-response only, not wait-for-task-token on that integration itself. The pretest-quality design is: invoke the agent, then a separate callback Task for approval, not a single magic harness state that is also the human wait.

Exam traps

1. Finalize MGN during rehearsal.
2. Setting every weighted record to 0 as a “hard stop” instead of leaving a nonzero blue weight.
3. Ignoring TTL, then promising instant DNS rollback.
4. Treating Bedrock Guardrails, AgentCore Identity, or AI human-approval items as scored Domain 4 weight—or skipping them entirely because they are pretest.
5. Using WAF alone as a prompt-injection control.
6. Inventing an AWS exam pass-rate percentage. AWS does not publish one.