Examkin

Question

Difficulty: MediumDatabase and Storage Strategy

A solutions architect is designing the database strategy for a new online ticketing application (OLTP workload). The application requires a relational database backend that can handle a high rate of transactions. The architecture must achieve a Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of less than 5 seconds in the event of an Availability Zone outage. Additionally, the system must scale its read capacity dynamically to handle sudden spikes in query volume. The security policy mandates that database encryption keys must be managed in a centralized security AWS account. Which design strategy meets these requirements?

  1. Deploy an Amazon Aurora PostgreSQL DB cluster with Auto Scaling Aurora Replicas, and encrypt the cluster using an AWS KMS Customer Managed Key (CMK) that is created in the centralized security account and shared with the application account.Answer
  2. B
    Deploy an Amazon RDS for PostgreSQL DB instance in a Multi-AZ deployment, configure the application to route read traffic to the Multi-AZ standby replica to scale capacity during peak events, and encrypt the database with an AWS KMS Customer Managed Key (CMK) shared from the centralized security account.
  3. C
    Deploy an Amazon Aurora PostgreSQL DB cluster with Auto Scaling Aurora Replicas, encrypt the cluster using the default AWS-managed KMS key (aws/rds) in the application account, and modify the IAM policy of the centralized security account to manage the key.
  4. D
    Deploy an Amazon RDS for PostgreSQL Single-AZ DB instance with automated backups, and copy the snapshots to another AWS Region using an AWS KMS Customer Managed Key (CMK) to achieve high availability and scale reads from the copied snapshots.

Answer

Deploy an Amazon Aurora PostgreSQL DB cluster with Auto Scaling Aurora Replicas, and encrypt the cluster using an AWS KMS Customer Managed Key (CMK) that is created in the centralized security account and shared with the application account.
The correct architecture uses Amazon Aurora PostgreSQL with Auto Scaling Aurora Replicas. Aurora's storage architecture replicates data across multiple Availability Zones, allowing failover in under 30 seconds and minimal RPO. Read capacity is scaled horizontally and dynamically via Aurora Replicas. Using a Customer Managed Key (CMK) created in the centralized security account and shared via key policy changes allows the database to be securely encrypted cross-account.

Step-by-Step Solution

1
Evaluate the database tier requirements for high availability, RTO/RPO, and read scaling.
Amazon Aurora is selected because it replicates data across 3 Availability Zones, supports failover in less than 30 seconds (RTO < 30 seconds, RPO < 5 seconds), and supports horizontal scaling of reads via Auto Scaling Aurora Replicas.
Standard RDS Multi-AZ standby instances do not support read traffic, and a Single-AZ setup cannot meet the tight RTO requirement during an AZ outage.
2
Evaluate the cross-account encryption requirements.
Identify that a Customer Managed Key (CMK) in the centralized security account must be used and shared with the database application account.
AWS-managed KMS keys (e.g., aws/rds) are restricted to their own account and cannot be modified or shared across accounts.

Key Concept

Selecting high-availability database architectures that support dynamic read scaling and cross-account key management in compliance with RTO/RPO objectives.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic