Examkin

Question

Difficulty: Very hardDatabase and Storage Strategy

A company is designing a new global relational Online Transaction Processing (OLTP) application. The application will be deployed in a primary AWS Region (us-east-1) and a secondary AWS Region (us-west-2). The database must support a local write latency of less than 20 ms in the primary region, and a read latency of less than 5 ms in both regions. The disaster recovery strategy must achieve a Recovery Time Objective (RTO) of less than 1 minute and a Recovery Point Objective (RPO) of less than 2 seconds. Additionally, all database storage must be encrypted at rest using encryption keys that support automatic rotation and can be shared with a central auditing AWS account.

Which database and storage strategy meets these requirements with the lowest operational overhead?

  1. A
    Deploy Amazon RDS for PostgreSQL in us-east-1 in a Multi-AZ deployment. Create a cross-region read replica in us-west-2. Configure the standby instance of the us-east-1 Multi-AZ deployment to serve local read traffic to meet the read latency target. Encrypt the database instances using the default AWS managed key (aws/rds), and update its key policy to grant access to the central auditing AWS account.
  2. B
    Deploy Amazon Aurora PostgreSQL in us-east-1. Set up an AWS Database Migration Service (DMS) task with Change Data Capture (CDC) to replicate data to a separate Aurora cluster in us-west-2. Encrypt the database clusters in both regions using the default AWS managed key (aws/rds), and update the key policy to grant cross-account decryption permissions to the central auditing account.
  3. Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Enable Aurora Auto Scaling for readers in both clusters. Encrypt the database clusters using an AWS KMS customer managed key, and configure its key policy to delegate access to the central auditing account.Answer
  4. D
    Deploy Amazon RDS for PostgreSQL in us-east-1 in a Multi-AZ deployment. Replicate DB snapshots hourly to us-west-2. In the event of a primary region disaster, use AWS CloudFormation to restore the database in us-west-2 from the latest replicated snapshot. Encrypt the database using an AWS KMS customer managed key, and delegate access to the central auditing account via its key policy.

Answer

Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Enable Aurora Auto Scaling for readers in both clusters. Encrypt the database clusters using an AWS KMS customer managed key, and configure its key policy to delegate access to the central auditing account.
The correct strategy utilizes Amazon Aurora Global Database to achieve low-latency cross-region replication (RPO < 2 seconds) and rapid failover capabilities (RTO < 1 minute). To scale reads dynamically and maintain latency under 5 ms, Aurora Auto Scaling is used to adjust reader replica counts. For security compliance, a Customer Managed Key (CMK) in AWS KMS is required because its key policy can be modified to delegate cross-account access to the central auditing account, whereas AWS managed keys cannot be shared cross-account.

Step-by-Step Solution

1
Evaluate the disaster recovery requirements (RPO < 2 seconds, RTO < 1 minute).
Identify that standard backup-and-restore or snapshot replication strategies are insufficient, and native database replication (such as Amazon Aurora Global Database) is required to meet these targets.
Ensures the selected replication mechanism satisfies the near-zero data loss and rapid recovery time requirements.
2
Assess the read latency constraint of less than 5 ms in both regions under dynamic traffic.
Recognize that read replicas with auto-scaling are needed to scale read capacity horizontally. Standby instances in RDS Multi-AZ deployments do not support read traffic.
Guarantees read requests are served locally in each region within the latency threshold, scaling dynamically as load changes.
3
Evaluate key management options in AWS KMS for database storage encryption at rest.
Determine that an AWS KMS customer managed key must be used instead of an AWS managed key.
AWS managed keys cannot be modified and do not support cross-account sharing, which is required to delegate decrypt access to the central auditing account.

Key Concept

Designing multi-region database replication, read scaling, and access control policies using Amazon Aurora Global Database and AWS KMS Customer Managed Keys.
Estimated Time:3m 0s
Rate this question

Topics

Database and Storage Strategy

More questions from this topic