An international logistics enterprise is designing a high-throughput, low-latency package … — AWS Certified Solutions Architect - Professional

An international logistics enterprise is designing a high-throughput, low-latency package tracking and telemetry pipeline. The system must ingest over $1.5\text{ million}$ small, unstructured JSON telemetry updates per second (NoSQL write-heavy workload) with ingestion latency under $10\text{ ms}$ . The database tier must span a primary region (`us-east-1`) and a disaster recovery region (`us-west-2`).

The design must meet the following constraints:
- Telemetry queries for the active tracking dashboard must resolve with sub-millisecond latency (microsecond range) for the most recent status of any package.
- Historical telemetry must be archived to an Amazon S3 bucket in a dedicated compliance AWS account within $24\text{ hours}$ and retained for $7\text{ years}$ .
- RPO must be less than $1\text{ second}$ and RTO must be less than $1\text{ minute}$ for both the data store and ingestion layers.
- Data transferred to the compliance account must be encrypted at rest using KMS Customer Managed Keys (CMKs) to support cross-account access.
- Minimize administrative overhead and avoid provisioning self-managed EC2 instances.

Which TWO options should the solutions architect select to design the database and storage strategy to satisfy these requirements? (Select TWO.)

Configure Amazon DynamoDB Global Tables spanning `us-east-1` and `us-west-2` with write-capacity auto-scaling to ingest vehicle telemetry, and enable DynamoDB Accelerator (DAX) clusters in both regions to serve dashboard queries. Use DynamoDB Streams to trigger AWS Lambda functions to batch and write data to the compliance account's S3 bucket.Answer
B
Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in `us-east-1` with read replicas in `us-west-2` to handle read traffic. Assumes that the Multi-AZ standby instances can dynamically scale query loads to achieve sub-millisecond latencies during peak hours.
Create an S3 bucket in the compliance account with a bucket policy permitting cross-account write actions from the primary account's Lambda execution role. Configure the S3 bucket to encrypt objects using a Customer Managed Key (CMK) created in the compliance account, with a key policy granting the primary account's role permissions for `kms:GenerateDataKey` and `kms:Decrypt`.Answer
D
Create an S3 bucket in the compliance account, and configure cross-account S3 Replication from the primary account's S3 bucket. Encrypt the destination bucket using the default AWS managed key (`aws/s3`) in the compliance account to simplify key management and minimize administrative overhead.
E
Deploy Amazon ElastiCache for Memcached with Multi-AZ replication enabled across both regions to cache query results for the tracking dashboard. Configure Memcached snapshots to be written directly to the primary S3 bucket and replication rules to copy them to the compliance account.

Answer

The correct architecture uses Amazon DynamoDB Global Tables with DynamoDB Accelerator (DAX) clusters in both regions to meet the latency, RPO, and RTO constraints. It uses DynamoDB Streams and AWS Lambda to write data to the compliance account. The destination compliance S3 bucket must utilize a Customer Managed Key (CMK) in the compliance account, with its key policy configured to allow the primary account's Lambda execution role to perform `kms:GenerateDataKey` and `kms:Decrypt` operations.

The correct strategy combines Amazon DynamoDB Global Tables with DynamoDB Accelerator (DAX) to provide the required scale, RPO, and RTO, while ensuring microsecond read query times. Writing to the compliance account S3 bucket requires using a customer-managed KMS key in the compliance account, with a custom key policy granting access to the primary account's write principal, as AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

Analyze the ingestion volume and latency constraints to select the primary database engine.

Select Amazon DynamoDB Global Tables instead of relational databases like RDS PostgreSQL.

DynamoDB easily handles millions of unstructured write operations per second with single-digit millisecond latency. Global Tables replicate writes cross-region within sub-second intervals, meeting the RPO of less than 1 second, whereas RDS PostgreSQL requires complex scaling for this volume.

Select the appropriate caching mechanism to support microsecond-latency dashboard queries.

Enable DynamoDB Accelerator (DAX) clusters in both active regions.

DAX is an in-memory cache purpose-built for DynamoDB that reduces query latencies to microseconds, whereas ElastiCache for Memcached lacks built-in integration, replication, and persistence features required for this scenario.

Formulate the cross-account archiving pipeline to Amazon S3.

Enable DynamoDB Streams to capture changes and trigger AWS Lambda functions to batch and write files to S3.

This serverless design minimizes administrative overhead and eliminates the need to provision or manage EC2 instances for data transfer.

Select the encryption strategy using Customer Managed Keys (CMKs) to secure cross-account S3 uploads.

Create a Customer Managed Key (CMK) in the compliance account and configure its key policy to allow access to the primary account's Lambda execution role.

AWS-managed KMS keys do not support policy modifications for cross-account access. Only customer-managed keys (CMKs) allow editing key policies to permit cross-account usage.

Key Concept

Designing highly scalable, multi-region database and cross-account secure storage pipelines using DynamoDB Global Tables, DAX, serverless processing, and KMS customer-managed key policies.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic