Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A logistics enterprise is designing a new global fleet-tracking platform. The platform must support two main data requirements:

1. A real-time NoSQL telemetry ingestion store for GPS coordinates from 200,000 active delivery vehicles, sustaining 20,000 writes/sec with sub-millisecond latency. The store must support multi-region disaster recovery with a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 15 minutes.
2. An object store for raw daily telemetry log files (averaging 500 GB/day). These files must be accessible by an external auditor's AWS account.

All data must be encrypted at rest. Which database and storage strategy meets these requirements with the lowest operational complexity?

  1. Deploy Amazon DynamoDB global tables with replica tables in the secondary region. For the log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK). Grant the auditor's AWS account cross-account access by updating both the S3 bucket policy and the CMK key policy to allow the auditor's IAM principal read permissions.Answer
  2. B
    Deploy Amazon DynamoDB global tables with replica tables in the secondary region. For the log files, create an Amazon S3 bucket encrypted with the default AWS-managed KMS key (aws/s3). Configure the S3 bucket policy to allow the auditor's AWS account read permissions.
  3. C
    Deploy a single-region Amazon DynamoDB table in the primary region, and configure an AWS Lambda function triggered by DynamoDB Streams to export changes to Amazon S3. Set up S3 Cross-Region Replication (CRR) to replicate the DynamoDB backups to the secondary region. For log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) and share it via a cross-account bucket policy and CMK key policy.
  4. D
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ deployment to store the telemetry data, directing the read-heavy dashboard queries to the standby instance in the secondary Availability Zone to scale read performance. For the log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) and share it via a cross-account bucket policy and CMK key policy.

Answer

Deploy Amazon DynamoDB global tables with replica tables in the secondary region. For the log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK). Grant the auditor's AWS account cross-account access by updating both the S3 bucket policy and the CMK key policy to allow the auditor's IAM principal read permissions.
The correct strategy uses Amazon DynamoDB global tables to meet the high write throughput NoSQL requirement with low-latency cross-region replication for RTO/RPO targets. It uses Amazon S3 for log file storage and encrypts it with a Customer Managed Key (CMK). By updating both the S3 bucket policy and the CMK key policy, the external auditor's AWS account is granted the necessary permissions to read and decrypt the log files.

Step-by-Step Solution

1
Select the appropriate database engine and replication strategy for the real-time NoSQL fleet tracking data.
Choose Amazon DynamoDB global tables.
DynamoDB is a NoSQL store capable of handling 20,000 writes/sec with sub-millisecond latency. Global tables replicate data automatically across regions, achieving RPO < 1 second and RTO < 15 minutes.
2
Select the appropriate storage service for raw telemetry log files.
Choose Amazon S3.
S3 is the optimal object store for daily telemetry files (500 GB/day) and offers robust cross-account sharing capabilities.
3
Configure encryption and cross-account access for the S3 bucket.
Use an AWS KMS Customer Managed Key (CMK) and update its key policy along with the S3 bucket policy.
AWS-managed KMS keys (like aws/s3) cannot be shared across accounts. A Customer Managed Key must be used so its key policy can be modified to trust the auditor's AWS account, in addition to configuring the S3 bucket policy.

Key Concept

Selecting multi-region NoSQL databases for low RTO/RPO and configuring cross-account access with Customer Managed Keys.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic