Examkin

Question

Difficulty: HardDatabase and Storage Strategy

An energy management company is designing a new real-time smart grid telemetry platform. The platform collects high-velocity grid telemetry data from millions of smart meters globally. The database layer must store real-time telemetry metadata and be deployed across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The system requires a database recovery time objective (RTO) of less than 1 minute and a recovery point objective (RPO) of less than 1 second. To handle seasonal analytics, the read capacity in both regions must scale horizontally and automatically based on CPU utilization. Additionally, historical telemetry aggregations are exported hourly to an Amazon S3 bucket. An auditing and analytics team working in a separate, dedicated AWS account must be granted direct cross-account access to read these exported files. All S3 objects must be encrypted at rest.

Which two options should the Solutions Architect select to meet these requirements?

  1. Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Auto Scaling on both the primary and secondary clusters to dynamically adjust the number of Aurora Replicas based on CPU utilization.Answer
  2. B
    Deploy an Amazon RDS Multi-AZ DB instance with two standby replicas in different Availability Zones within us-east-1. Configure the application to route read traffic directly to the RDS Multi-AZ standby instances and set up Auto Scaling to scale the standby instances horizontally during peak reporting hours.
  3. Export the historical reports to an Amazon S3 bucket in the primary account. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK). Configure the CMK key policy in the primary account to grant the external analytics IAM role permissions to decrypt, and configure the S3 bucket policy to allow read access from the external account.Answer
  4. D
    Deploy an Amazon RDS for PostgreSQL Multi-AZ DB instance in us-east-1, and configure a cross-region Read Replica in us-west-2 using a pilot light disaster recovery strategy. In the event of a primary region failure, run a script to manually promote the cross-region Read Replica to a primary DB instance.
  5. E
    Export the historical reports to an Amazon S3 bucket encrypted using the default AWS managed key (aws/s3). Modify the default aws/s3 KMS key policy to trust the external AWS account's IAM role, and configure the S3 bucket policy to allow read permissions for the external account.

Answer

Deploy an Amazon Aurora Global Database with Aurora Auto Scaling in us-east-1 and us-west-2, and export historical reports to an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key (CMK), configuring both the key policy and bucket policy to allow cross-account access.
The correct architecture uses Amazon Aurora Global Database to achieve the required sub-second RPO and sub-minute RTO across us-east-1 and us-west-2, with Aurora Auto Scaling handling read capacity dynamically. For cross-account access to S3, using an AWS KMS Customer Managed Key allows the key policy to be modified to delegate decryption rights to the external account, while the S3 bucket policy grants the read permissions.

Step-by-Step Solution

1
Analyze the database disaster recovery requirements (RTO < 1 minute, RPO < 1 second) and scalability needs across regions.
Determine that Amazon Aurora Global Database is required because it replicates data in under 1 second and supports fast failover (< 1 minute), and that Aurora Auto Scaling can scale read replicas dynamically.
Standard RDS replication does not support automated cross-region failover within the required RTO/RPO targets, and standby instances cannot serve read traffic.
2
Analyze the storage encryption and cross-account access requirements.
Determine that an AWS KMS Customer Managed Key (CMK) must be used to encrypt the S3 bucket because AWS-managed keys (aws/s3) cannot be modified to grant cross-account access.
Cross-account access to encrypted S3 objects requires updating both the S3 bucket policy and the KMS key policy to allow the external IAM role to decrypt the data.

Key Concept

Designing multi-region database replication with sub-minute RTO and sub-second RPO using Aurora Global Database, and configuring cross-account access to KMS-encrypted S3 objects using Customer Managed Keys.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic