Examkin

Question

Difficulty: Very hardDatabase and Storage Strategy

A global logistics provider is designing a high-volume, multi-region track-and-trace system. The application consists of an OLTP database for package lifecycle events and an object storage component for proof-of-delivery signature images. The system must run across us-west-2 as the primary region and us-east-1 as the secondary region. The business requires a Recovery Time Objective (RTO) of less than 5 minutes and a Recovery Point Objective (RPO) of less than 10 seconds for all components. The security team mandates encryption at rest using AWS KMS Customer Managed Keys (CMKs). A separate audit account must have direct access to read database logs and S3 bucket access logs for compliance verification.

Which database and storage configurations should a solutions architect recommend to satisfy these requirements? (Select TWO.)

  1. Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1, using regional KMS Customer Managed Keys for cluster encryption. Configure Aurora Auto Scaling for replicas in the secondary region to handle read traffic spikes.Answer
  2. Configure an Amazon S3 bucket in us-west-2 with S3 cross-region replication (CRR) to a destination bucket in us-east-1. Encrypt both buckets using regional KMS Customer Managed Keys, and configure a cross-account key policy and bucket policy that grants the auditing account read access to S3 server access logs.Answer
  3. C
    Deploy a Multi-AZ Amazon RDS for PostgreSQL instance in us-west-2 with cross-region read replicas in us-east-1. Configure the RDS Multi-AZ standby instance in us-west-2 to serve local read traffic to minimize read latency, and rely on RDS automated cross-region failover to meet the RTO.
  4. D
    Configure Amazon S3 cross-region replication between the two buckets using AWS KMS AWS-managed keys (aws/s3) to simplify key management. Use the default S3 bucket policy to grant cross-account read access to the audit account.
  5. E
    Deploy an Amazon Aurora PostgreSQL DB cluster in us-west-2 and configure an AWS Lambda-based scheduled snapshot copy to us-east-1 every hour. In the event of a primary region failure, restore the DB cluster from the copied snapshot in us-east-1.
  6. F
    Configure the Amazon S3 bucket in us-west-2 to write server access logs directly to a bucket in the centralized audit account. Set the destination bucket policy in the audit account to allow write access to cloudtrail.amazonaws.com as the primary service principal while denying all other principals.

Answer

The correct architecture consists of deploying an Amazon Aurora Global Database encrypted with regional Customer Managed Keys (CMKs) and configuring Aurora Auto Scaling in the secondary region, combined with Amazon S3 cross-region replication encrypted with regional Customer Managed Keys and configuring cross-account permissions for log auditing.
The correct solution leverages Amazon Aurora Global Database to achieve the required sub-second replication latency (RPO) and quick failover (RTO), and supports replica auto-scaling in the secondary region to handle read traffic. It uses S3 cross-region replication for object storage. Crucially, it utilizes KMS Customer Managed Keys (CMKs) to enable cross-account policy delegation, allowing the centralized audit account to access the required logs.

Step-by-Step Solution

1
Analyze RTO/RPO and scaling requirements for the OLTP workload.
Amazon Aurora Global Database provides replication latency under 1 second (meeting the RPO of less than 10 seconds) and promotion in under 5 minutes (meeting the RTO). Aurora Replicas support horizontal read scaling.
This establishes why RDS Multi-AZ with cross-region read replicas or snapshot copies fail to meet the service level agreements.
2
Evaluate key management and cross-account access requirements for auditing.
AWS KMS Customer Managed Keys (CMKs) are required because their key policies can be modified to grant cross-account read access, whereas AWS-managed keys (aws/s3 or aws/rds) cannot be modified or shared.
This addresses the security compliance mandate for cross-account log auditing.
3
Verify S3 replication and logging mechanisms.
S3 cross-region replication (CRR) copies objects asynchronously. S3 server access logs are delivered by the Log Delivery group, requiring correct bucket and key policies for cross-account access.
This avoids misconfiguring the bucket policy for CloudTrail instead of S3 logging.

Key Concept

Designing multi-region database and storage architectures that meet strict RTO/RPO targets, leverage KMS Customer Managed Keys for cross-account access, and scale read workloads.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic