Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A global digital advertising agency is designing a new real-time campaign telemetry store (NoSQL workload) and a creative asset repository (Object storage workload) across two AWS Regions: `us-east-1` (primary) and `us-west-2` (disaster recovery). The disaster recovery region is managed under a separate AWS account within the same AWS Organization.

The telemetry store must support active-active writes in both regions with sub-second replication latency, handle semi-structured data, and scale automatically to handle millions of requests per second. The creative asset repository must store large media files with 99.999999999%99.999999999\% durability, replicate assets from `us-east-1` to `us-west-2` automatically, and meet a Recovery Point Objective (RPO) of 15 minutes. All data must be encrypted at rest using Customer Managed Keys (CMKs) to support key rotation and fine-grained access audits.

Which two database and storage strategy options should the solutions architect choose to meet these requirements? (Select TWO.)

  1. Deploy Amazon DynamoDB global tables in `us-east-1` and `us-west-2`, encrypted using customer managed keys (CMKs) created in each region, to handle the campaign telemetry workload.Answer
  2. Configure Amazon S3 Cross-Region Replication (CRR) from the primary bucket in `us-east-1` to a destination bucket in `us-west-2` in the secondary account. Encrypt the source bucket using a customer managed key (CMK) in `us-east-1`, and encrypt the destination bucket using a customer managed key (CMK) in `us-west-2`. Grant the replication IAM role permissions to decrypt with the source CMK and encrypt with the destination CMK.Answer
  3. C
    Deploy Amazon Aurora PostgreSQL with global databases. Configure the primary cluster in `us-east-1` and an Aurora replica in `us-west-2`. Enable Aurora Auto Scaling on both the primary and replica clusters to handle dynamic, active-active write workloads in both regions.
  4. D
    Configure Amazon S3 Cross-Region Replication (CRR) from the primary bucket in `us-east-1` to a destination bucket in `us-west-2` in the secondary account. Encrypt both S3 buckets using the default AWS-managed KMS key (`aws/s3`), and configure the replication IAM role to assume a cross-account IAM role to perform replication.
  5. E
    Store the creative assets in an Amazon S3 bucket in `us-east-1`. Create a daily AWS Backup plan to copy the S3 recovery points to a backup vault in the secondary account in `us-west-2` to meet the RPO and cross-account isolation requirements.

Answer

To satisfy the requirements, the campaign telemetry store should be built on Amazon DynamoDB global tables with customer managed keys in each region, and the creative asset repository should use cross-account Amazon S3 Cross-Region Replication (CRR) with customer managed KMS keys in both regions.
Deploying DynamoDB global tables fulfills the telemetry workload requirements, as it provides a fully managed multi-master NoSQL solution with sub-second replication latency across regions. For the asset repository, configuring S3 Cross-Region Replication (CRR) using customer managed keys (CMKs) in both the source and destination regions satisfies both the 15-minute RPO and the encryption constraints. Because S3 cross-account replication requires the replication role to decrypt in the source account and encrypt in the destination account, CMKs are required since their policies can be updated to delegate cross-account usage permissions.

Step-by-Step Solution

1
Determine the database model and replication design for the campaign telemetry store.
Select Amazon DynamoDB global tables because the workload requires NoSQL capabilities, dynamic schema, multi-region active-active writes with sub-second replication latency, and high scalability.
Amazon DynamoDB global tables provide multi-master replication across AWS regions, enabling low-latency read and write performance globally.
2
Determine the replication strategy for the creative asset object storage.
Select Amazon S3 Cross-Region Replication (CRR) to replicate objects asynchronously from `us-east-1` to the disaster recovery bucket in `us-west-2` within the secondary account.
S3 CRR provides automatic, continuous replication to satisfy RPO requirements under 15 minutes, whereas backup schedules are typically daily or hourly.
3
Evaluate the encryption key requirements for cross-account replication of KMS-encrypted objects.
Select Customer Managed Keys (CMKs) in both the source and destination regions, updating the key policies to permit the source replication role to decrypt the source objects and encrypt the destination objects.
AWS-managed keys (like `aws/s3`) cannot be used for cross-account replication because their key policies are locked and cannot grant cross-account permissions.

Key Concept

Designing multi-region database and object storage architectures with cross-account replication and key policy delegation using KMS customer managed keys.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic