Examkin

Question

Difficulty: MediumDatabase and Storage Strategy

A financial services company is designing a new multi-region payment processing system with the following database and storage requirements:

1. An OLTP database workload that requires a Recovery Point Objective (RPO) of less than 11 second and a Recovery Time Objective (RTO) of less than 11 minute across two AWS regions. The read traffic is highly dynamic and spikes unpredictably.
2. A centralized audit logging storage solution where application logs from multiple AWS accounts must be consolidated into a single S3 bucket in a dedicated security account. The logs must be encrypted at rest, and the encryption key must support cross-account access delegation.

Which two configurations should the Solutions Architect select to meet these requirements?

  1. Configure an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the recovery region. Enable Aurora Replica Auto Scaling for the reader instances in both regions to scale dynamically based on CPU utilization.Answer
  2. Configure the central S3 bucket in the security account to use Server-Side Encryption with AWS KMS (SSE-KMS) utilizing a customer managed key. Update both the KMS key policy and the S3 bucket policy to allow cross-account write access from the application accounts.Answer
  3. C
    Deploy a Multi-AZ Amazon RDS PostgreSQL DB instance and scale the read capacity during peak traffic spikes by directing read queries to the passive standby instance in the secondary Availability Zone.
  4. D
    Encrypt the central S3 bucket in the security account using the default AWS-managed KMS key (aws/s3) and update the key policy to grant the external application accounts permissions to perform KMS cryptographic operations.
  5. E
    Implement a pilot light disaster recovery strategy by configuring AWS Backup to take database snapshots every 66 hours, replicating them to the secondary region, and automating DB instance restoration to achieve the target recovery objectives.

Answer

The correct configurations are: setting up an Amazon Aurora Global Database with Aurora Replica Auto Scaling for read scaling, and using a customer managed key with SSE-KMS for the centralized S3 bucket while updating both the KMS key policy and the S3 bucket policy.
Amazon Aurora Global Database replication lag is typically less than 11 second, satisfying the RPO target of less than 11 second, and failover can be completed within 11 minute, satisfying the RTO target. Auto Scaling reader instances dynamically handle read spikes in both the primary and secondary regions. For the central S3 logging bucket, AWS-managed keys (aws/s3) do not support cross-account access delegation because their key policies cannot be customized. Using a customer managed KMS key allows policy modification to delegate cross-account access, and updating the key policy along with the S3 bucket policy enables cross-account write access.

Step-by-Step Solution

1
Evaluate the database tier requirements for RPO (<1< 1 s), RTO (<1< 1 m), and cross-region availability.
Identify that Amazon Aurora Global Database provides sub-second replication lag and fast region failover, meeting the RPO/RTO goals.
A replication-based global database is required because snapshot replication or active-passive setups with long recovery processes cannot meet these sub-second RPO and low RTO requirements.
2
Determine the database read scaling design.
Configure Aurora Replica Auto Scaling to handle dynamic and unpredictable read spikes.
This scales reader instances horizontally in both regions, whereas standard RDS standby replica instances remain passive and cannot scale or serve read traffic.
3
Select the correct encryption key type for the cross-account S3 logging destination.
Choose an AWS KMS customer managed key (CMK) and configure both the KMS key policy and S3 bucket policy.
Default AWS-managed keys (aws/s3) do not support policy modification and cannot be shared across accounts, meaning only customer managed keys allow cross-account delegation.

Key Concept

Designing highly available, low-latency database architectures using Amazon Aurora Global Database for multi-region replication and implementing cross-account resource encryption using S3 and AWS KMS customer managed keys.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic