Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A financial services firm is designing a new real-time fraud detection and transaction ledger system that spans two AWS regions under different AWS accounts. The system must support an OLTP write ingest rate of 5000050{}000 transactions per second. The real-time fraud detection engine requires sub-millisecond read latency. The system must meet a Disaster Recovery (DR) objective of a Recovery Time Objective (RTO\text{RTO}) of less than 1010 minutes and a Recovery Point Objective (RPO\text{RPO}) of less than 11 minute. Transaction logs must be archived in a centralized security account for 77 years, where cross-account auditing roles require access to decrypt the data. Which two configurations should the solutions architect choose to meet these requirements?

  1. Configure Amazon DynamoDB global tables across both regions with DynamoDB Accelerator (DAX) to ingest transactions and serve the fraud checking engine with sub-millisecond latency.Answer
  2. Enable DynamoDB Streams to trigger an AWS Lambda function that archives transaction logs to an Amazon S3 bucket in the centralized account, encrypting the data with a Customer Managed Key (CMK) configured with a cross-account key policy.Answer
  3. C
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ deployment, and configure the fraud checking engine to query the passive standby instance in the secondary Availability Zone to achieve read scaling.
  4. D
    Schedule an AWS Backup rule to perform automated database snapshots every 6 hours and copy them to the disaster recovery region, utilizing this snapshot replication to achieve the target RPO.
  5. E
    Encrypt the database and target S3 buckets using AWS-managed KMS keys, modifying the default key policies to grant the cross-account auditing role permission to decrypt the data.

Answer

The correct configurations are to use Amazon DynamoDB global tables with DynamoDB Accelerator (DAX) for transactional ingest and real-time reads, and to use DynamoDB Streams with AWS Lambda to archive transaction logs to Amazon S3 using a Customer Managed Key (CMK) with a cross-account key policy.
Utilizing Amazon DynamoDB global tables with DynamoDB Accelerator (DAX) provides the required multi-region replication for RTO/RPO objectives and sub-millisecond read caching. Leveraging DynamoDB Streams with AWS Lambda to archive to Amazon S3 using a Customer Managed Key (CMK) permits cross-account decryption permissions through policy modification.

Step-by-Step Solution

1
Analyze the read latency and throughput needs for fraud detection.
Using DynamoDB global tables with DAX satisfies the 5000050{}000 transactions per second write throughput and provides sub-millisecond read latency.
Standard database reads or RDS Multi-AZ deployments cannot guarantee sub-millisecond latency under high write contention without memory-based caching.
2
Evaluate the RTO and RPO requirements against the database replication strategy.
DynamoDB global tables offer active-active replication with an RPO of less than 1 second, fully satisfying the requirement of an RPO of less than 1 minute and RTO of less than 10 minutes.
Periodic snapshot-based backups are unable to meet near-zero data loss requirements.
3
Assess the encryption and access policy configuration for cross-account log access.
Deploy S3 storage integrated with a Customer Managed Key (CMK) configured to allow cross-account decrypt operations.
AWS-managed KMS keys are restricted and cannot be shared cross-account or customized with custom trust policies.

Key Concept

Designing cross-account storage and database replication strategies while satisfying strict recovery point objectives (RPO), read latency requirements, and key management permissions.
Estimated Time:3m 0s
Rate this question

Topics

Database and Storage Strategy

More questions from this topic