Examkin

Question

Difficulty: Very hardDatabase and Storage Strategy

A financial organization is designing a new global relational Online Transaction Processing (OLTP) application. The application will be deployed in a primary AWS Region (us-east-1) and must maintain a read-only reporting environment in a secondary AWS Region (us-west-2). The reporting environment must handle dynamic, high-load reporting queries and scale automatically. The disaster recovery KPIs require a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 1 minute for a regional outage. All data at rest must be encrypted, and an audit team operating in a separate AWS account must be granted permissions to read and verify the encryption metadata. Which two database and storage configurations should the solutions architect select to meet these requirements?

  1. Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and configure Aurora Auto Scaling for the reader instances in the secondary region.Answer
  2. Create a Customer Managed Key (CMK) in AWS KMS in the primary account, configure its key policy to delegate read permissions to the audit account's IAM principal, and encrypt the database clusters using this key.Answer
  3. C
    Deploy an Amazon RDS for PostgreSQL Multi-AZ instance in us-east-1, and configure the standby instance in the secondary Availability Zone to serve reporting read traffic during peak periods.
  4. D
    Encrypt the database clusters using the AWS-managed KMS key (aws/rds) in the primary account, and modify the key policy to delegate access to the audit account's IAM roles.
  5. E
    Configure Amazon RDS for PostgreSQL in us-east-1 with daily snapshot replication to us-west-2, and use an AWS Lambda function to automatically restore the snapshot to a new DB instance during a regional failover.

Answer

Deploying an Amazon Aurora Global Database with a secondary cluster in us-west-2 using Aurora Auto Scaling for read replica scaling, combined with encrypting the database using a Customer Managed Key (CMK) in AWS KMS configured to allow cross-account access.
Deploying an Amazon Aurora Global Database provides sub-second replication latency (satisfying the RPO constraint) and permits rapid regional failovers under a minute (satisfying the RTO constraint). Additionally, Aurora reader instances can scale dynamically using Aurora Auto Scaling to support heavy query loads. Using a Customer Managed Key (CMK) allows customizing the key policy to delegate read permissions to the audit team's separate AWS account, which is impossible with AWS-managed keys.

Step-by-Step Solution

1
Analyze disaster recovery requirements.
The RPO < 1 second and RTO < 1 minute necessitate a highly resilient, cross-region replication architecture with minimal lag and rapid failover support, which points to Amazon Aurora Global Database rather than snapshot replication.
Traditional backup/restore and snapshot replication methods introduce significant delay, exceeding the RPO/RTO targets.
2
Address read scalability in the secondary region.
Identify that the secondary region's database must serve read traffic and scale dynamically. Aurora reader instances support Aurora Auto Scaling, whereas RDS Multi-AZ standbys cannot serve read queries.
RDS standby instances in Multi-AZ are purely passive failover targets, whereas Aurora replicas are active read endpoints.
3
Assess security and encryption key sharing restrictions.
Evaluate AWS KMS key types for cross-account delegation. Confirm that a Customer Managed Key (CMK) is required to configure a custom key policy that allows IAM principals in the audit account to access the key metadata.
AWS-managed KMS keys (like aws/rds) do not support modifications to their key policies and cannot be used for cross-account operations.

Key Concept

Selecting the optimal database replication architecture to meet strict RTO/RPO limits and configuring secure, cross-account encryption sharing.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic