Examkin

Question

Difficulty: MediumDatabase and Storage Strategy

A financial services firm is designing a new customer portal consisting of an online transaction processing (OLTP) database workload for customer account metadata and an Object storage workload for statement PDF reports. The metadata database must support high read volumes that scale dynamically based on demand. The statement reports must be securely archived in Amazon S3. The security team requires that the S3 encryption keys are customer-controlled and can be shared with an external auditing AWS account. Additionally, the system must meet near-zero recovery point objective (RPO) and recovery time objective (RTO) requirements across multiple AWS regions. Which two options should the solutions architect choose to meet these requirements?

  1. Deploy an Amazon Aurora Global Database cluster, configure Aurora Replicas in the primary region, and implement Application Auto Scaling to adjust the replica count based on CPU utilization.Answer
  2. Encrypt the Amazon S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the CMK key policy to grant access to the external auditing AWS account.Answer
  3. C
    Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ standby deployment, and configure the application to route read queries to the standby instance during peak traffic hours.
  4. D
    Encrypt the S3 bucket using an AWS managed KMS key (aws/s3), and modify the AWS managed key policy to allow cross-account access for the external auditing AWS account.
  5. E
    Deploy the database in a single-Region Multi-AZ configuration and establish a Pilot Light disaster recovery strategy in a secondary region to meet the multi-region near-zero RTO and RPO requirements.

Answer

Deploying an Amazon Aurora Global Database cluster combined with Application Auto Scaling for Aurora Replicas, alongside encrypting the Amazon S3 bucket with a Customer Managed KMS Key (CMK) and updating its key policy to delegate cross-account access, satisfies all requirements.
The correct configurations use an Amazon Aurora Global Database with Aurora Replicas scaled dynamically via Application Auto Scaling to support scaling reads, and a Customer Managed KMS Key (CMK) with a key policy modification to allow cross-account access.

Step-by-Step Solution

1
Analyze database scaling and multi-region recovery requirements.
Identify that the database requires dynamic read scaling and near-zero RTO/RPO across multiple regions. Aurora Global Database with Auto Scaling Aurora Replicas fits this pattern.
Aurora Global Database offers cross-region replication lag of typically under 1 second, and Auto Scaling allows replicas to scale based on CPU utilization.
2
Analyze cross-account sharing and encryption requirements.
Identify that the KMS key must be customer-controlled (CMK) and must allow editing key policies to delegate access to external AWS accounts.
AWS managed keys do not support custom key policies and cannot be shared across accounts.
3
Evaluate and eliminate sub-optimal options.
Eliminate options proposing RDS standby instances for read scaling, AWS managed KMS keys for cross-account access, and Pilot Light DR configurations for near-zero RTO/RPO.
These violate standard AWS architectural limitations and the scenario's recovery objectives.

Key Concept

Designing scalable database architectures using Amazon Aurora and designing cross-account encryption sharing strategies using AWS KMS Customer Managed Keys.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic