Examkin

Question

Difficulty: MediumDatabase and Storage Strategy

A financial technology startup is designing a new transaction auditing system (OLTP and Object storage workloads) that must span two AWS accounts: a Production account and a dedicated Security account. The architecture must satisfy the following requirements:

* For the OLTP database, support dynamic read scaling to handle unpredictable query spikes, and implement a cross-region disaster recovery (DR) strategy with a Recovery Point Objective (RPO) of under 1 minute and a Recovery Time Objective (RTO) of under 5 minutes.
* For object storage, centralize AWS CloudTrail logs from the Production account into an Amazon S3 bucket in the Security account.

Which database and storage design meets these requirements?

  1. Deploy an Amazon Aurora Global Database with the primary cluster in the active region and a secondary cluster in the recovery region. Configure Aurora Auto Scaling for the primary cluster's reader instances to handle query spikes. In the Security account, configure an S3 bucket with a bucket policy that grants permission to the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject operations, and enable CloudTrail in the Production account to write logs to this bucket.Answer
  2. B
    Deploy an Amazon RDS for PostgreSQL database with a Multi-AZ deployment in the primary region, and configure the application to route read queries to the standby replica during traffic spikes. Set up AWS Backup copy jobs to replicate database snapshots to the recovery region. In the Security account, configure the S3 bucket policy to allow the Production account's root user to manage CloudTrail logging.
  3. C
    Deploy a single-region Amazon Aurora PostgreSQL database with Aurora Replicas and Auto Scaling. Meet the disaster recovery requirements by implementing a Pilot Light strategy that replicates S3-based database backups to the recovery region and spins up a minimal database instance only during failover events. In the Security account, encrypt the S3 bucket using the default AWS-managed KMS key (aws/s3) and configure its key policy to allow cross-account access from the Production account.
  4. D
    Deploy an Amazon Aurora Global Database with the primary cluster in the active region and a secondary cluster in the recovery region. In the Security account, configure the centralized S3 bucket for CloudTrail logs but omit the CloudTrail service principal from the bucket policy, relying on an IAM policy in the Production account to grant cross-account write permissions. Configure a read replica in the secondary region and manually promote it during a failover event.

Answer

Deploy an Amazon Aurora Global Database with replica auto-scaling for read performance and cross-region DR, and configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the CloudTrail service principal.
Deploying an Amazon Aurora Global Database provides local read scaling via Aurora Replicas and handles cross-region disaster recovery with sub-minute RPO. Configuring the S3 bucket policy in the Security account to grant access to the CloudTrail service principal is the required way to enable secure cross-account log collection.

Step-by-Step Solution

1
Evaluate the OLTP database scalability and disaster recovery (DR) requirements.
Identify that Amazon Aurora Global Database provides the necessary cross-region replication latency (seconds) to meet the RPO < 1 minute and RTO < 5 minutes requirements, while Aurora Auto Scaling can dynamically add read replicas to handle spike loads.
RDS Multi-AZ standby instances are offline and cannot serve reads, and backup-based copy methods fail to meet the low RTO/RPO targets.
2
Evaluate the S3 bucket policy requirements for cross-account logging.
Determine that the S3 bucket policy in the Security account must explicitly trust the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject operations.
CloudTrail is a service principal that writes logs directly to the target bucket. Relying on client IAM policies is insufficient for cross-account ingestion because the service requires direct bucket-level authorization.
3
Analyze KMS key and encryption constraints for cross-account S3 buckets.
Determine that default AWS-managed KMS keys (such as aws/s3) cannot be shared across AWS accounts because their key policies cannot be modified.
Cross-account decryption or write access requires customer managed keys (CMKs) with custom key policies that explicitly delegate access to external account identities.

Key Concept

Designing database and storage solutions that support read scaling, cross-region DR RTO/RPO targets, and cross-account S3 logging constraints.
Estimated Time:2m 0s
Rate this question

Topics

Database and Storage Strategy

More questions from this topic