Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A multinational financial services company is designing the database and storage strategy for a new critical payment clearing platform. The platform has the following workloads and requirements:

- A highly transactional OLTP ledger that requires a multi-AZ deployment in the primary region, horizontal scaling of read capacity during peak hours, and a cross-region disaster recovery (DR) site in a secondary region with an RPO of less than 1 second and RTO under 1 minute.
- A massive archive of regulatory audit reports stored as object storage. These objects must be encrypted at rest. The reports must be accessible by an auditing application running in an external AWS account owned by a third-party regulator. The regulator requires full control over the rotation of the encryption keys and who has access to the key policies.

Which two of the following database and storage configurations will meet these requirements? (Select TWO.)

  1. Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Use Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas in the primary region.Answer
  2. Store the regulatory audit reports in an Amazon S3 bucket. Encrypt the bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant decrypt permissions to the external auditing account's IAM role.Answer
  3. C
    Deploy Amazon RDS for PostgreSQL with a Multi-AZ deployment across three Availability Zones. Configure the standby instances to serve read traffic and apply Auto Scaling to the standby instances to handle read spikes.
  4. D
    Configure daily database snapshot replication to the secondary region. In the event of a disaster, restore the database from the replicated snapshot in the secondary region using a Pilot Light strategy.
  5. E
    Store the regulatory audit reports in an Amazon S3 bucket. Encrypt the bucket using the AWS managed key (aws/s3) for S3, and configure an S3 bucket policy that permits cross-account access to the external regulator's IAM role.

Answer

The correct configurations are to deploy Amazon Aurora PostgreSQL Global Database with Aurora Auto Scaling in the primary region, and to store the regulatory audit reports in an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) where the key policy is modified to grant access to the external regulator's account.
Deploying Amazon Aurora PostgreSQL Global Database meets the OLTP requirements. The replication lag to the secondary region is typically under 1 second (meeting the RPO of < 1 second), and failover can be completed within 1 minute. Aurora Auto Scaling dynamically adjusts the number of Aurora Replicas to scale read capacity. For the storage requirement, using Amazon S3 with a Customer Managed Key (CMK) allows the company to share the key with the external regulator's account and permits modifying the key policy. This gives the regulator control over key rotation and access policies while keeping the reports secure.

Step-by-Step Solution

1
Analyze the OLTP database requirements: multi-AZ, read scaling, RPO < 1s, and RTO < 1m across regions.
Identify that Amazon Aurora Global Database provides physical replication with sub-second replication lag (RPO < 1s) and supports promotion of the secondary region within 1 minute (RTO < 1m). Aurora Auto Scaling allows horizontal scaling of read replicas.
Standard RDS Multi-AZ cannot serve read traffic from standby instances, and backup restoration patterns (like Pilot Light) cannot meet the low RTO/RPO requirements.
2
Analyze the security and cross-account access requirements for regulatory audit reports: object storage, encryption, external account access, and key rotation control.
Identify that Amazon S3 is the optimal object storage solution. To allow cross-account access to encrypted data, a Customer Managed Key (CMK) in AWS KMS must be used.
AWS-managed KMS keys (like aws/s3) do not allow modifications to their key policies and cannot be shared across accounts.

Key Concept

Selecting the optimal database and storage architecture to meet specific scaling, recovery (RPO/RTO), and cross-account access control requirements using AWS services like Amazon Aurora, S3, and KMS.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic