Examkin

Question

Difficulty: MediumDatabase and Storage Strategy

A company is designing a new transactional invoicing application (OLTP workload) that requires high-performance write operations and must dynamically scale read traffic to handle seasonal audits. The architecture requires a Recovery Point Objective (RPO) of under 1 minute and a Recovery Time Objective (RTO) of under 5 minutes. Additionally, database backups must be securely shared with and copied to a separate, centralized security AWS account. Which database and storage strategy meets these requirements?

  1. Deploy Amazon Aurora PostgreSQL with Aurora Auto Scaling enabled to adjust the number of Aurora Replicas based on CPU utilization. Encrypt the database using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). Share the KMS key and the Aurora database cluster snapshot with the security AWS account, allowing the security account to copy the encrypted snapshot using its own KMS key.Answer
  2. B
    Deploy Amazon RDS for PostgreSQL with a Multi-AZ deployment. Direct auditing read traffic to the standby instance in the secondary Availability Zone during peak audit periods. Encrypt the database using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS), and share the key and snapshots with the security AWS account.
  3. C
    Deploy Amazon Aurora PostgreSQL with Aurora Auto Scaling enabled to adjust the number of Aurora Replicas based on CPU utilization. Encrypt the database using the default AWS-managed KMS key for Amazon RDS (aws/rds). Share the database snapshots directly with the security AWS account to allow cross-account copies.
  4. D
    Deploy a single-instance Amazon RDS for PostgreSQL database. Schedule hourly automated snapshots and configure AWS Backup to replicate these snapshots to the security AWS account. During audits, spin up a read replica from the last snapshot in the primary account to serve the read traffic.

Answer

The strategy using Amazon Aurora PostgreSQL with Aurora Auto Scaling and a Customer Managed Key (CMK) for cross-account snapshot sharing.
Deploying Amazon Aurora PostgreSQL with Aurora Replicas and Auto Scaling satisfies the dynamic read-scaling requirement and ensures an RTO of under 5 minutes through automatic failover (typically completed in under 30 seconds). Since the database is encrypted with a Customer Managed Key (CMK), the key policy can be modified to grant the external security account permissions to decrypt and copy the shared snapshots, satisfying the security and RPO/RTO constraints.

Step-by-Step Solution

1
Analyze the high availability and read-scaling requirements.
The RPO under 1 minute and RTO under 5 minutes require a database engine with rapid failover and minimal replication lag. Aurora PostgreSQL meets this with sub-30-second failovers. To scale read traffic dynamically, Aurora Replicas with Auto Scaling can scale horizontal capacity in response to dynamic workloads.
This determines the optimal database deployment mode and engine choice.
2
Evaluate the encryption and cross-account backup requirements.
To copy encrypted database snapshots to another AWS account, a Customer Managed Key (CMK) must be used. Default AWS-managed KMS keys (such as aws/rds) cannot be shared across accounts as their key policies cannot be modified.
This addresses the security and compliance requirements for centralized auditing storage.

Key Concept

Cross-account snapshot sharing with Customer Managed Keys and dynamic read-scaling with Amazon Aurora
Estimated Time:2m 0s
Rate this question

Topics

Database and Storage Strategy

More questions from this topic