Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A global e-commerce firm is designing a new online transaction processing (OLTP) ledger system that must operate across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The ledger requires a relational database that can handle high-rate write transactions in the primary region, support local read operations with sub-second latency in both regions to serve real-time analytics dashboards, and support a disaster recovery plan with a Recovery Point Objective (RPO) of under 2 seconds and a Recovery Time Objective (RTO) of under 10 minutes. Additionally, compliance requirements dictate that all data must be encrypted at rest using customer managed keys (CMKs) in AWS Key Management Service (AWS KMS). Which database and storage strategy meets these requirements with the lowest operational overhead?

  1. Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Replicas in both regions to scale read operations, and enable Aurora Auto Scaling for the replicas. Encrypt the database clusters at rest using customer managed keys (CMKs) in AWS KMS created in each respective region.Answer
  2. B
    Deploy an Amazon RDS for PostgreSQL database in us-east-1 with Multi-AZ deployment enabled, and create a cross-region read replica in us-west-2. Route read queries to the Multi-AZ standby instance in us-east-1 during peak traffic to scale read capacity. Encrypt the database using customer managed keys (CMKs) in AWS KMS.
  3. C
    Deploy a single-region Amazon Aurora PostgreSQL database in us-east-1. Configure hourly database snapshots, encrypt them using a customer managed key in AWS KMS, and copy the snapshots to us-west-2. In the event of a disaster, restore the database from the latest copied snapshot in us-west-2.
  4. D
    Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Encrypt the primary cluster using the default AWS-managed KMS key for Amazon RDS. Modify the key policy of this AWS-managed key to grant replication permissions to the secondary region.

Answer

Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, configuring Aurora Replicas with Auto Scaling in both regions, and encrypting clusters using customer managed keys (CMKs) in each respective region.
Deploying an Amazon Aurora PostgreSQL global database is the optimal choice. It natively replicates database updates to the secondary region at the storage layer with minimal lag, ensuring an RPO of under 2 seconds. In the event of a disaster, the secondary cluster can be promoted to a standalone cluster in under 10 minutes, satisfying the RTO target. Readers in both regions can handle local dashboard queries, and Aurora Auto Scaling handles dynamic scaling. For security, encrypting both clusters with region-specific customer managed keys complies with the KMS architecture rules.

Step-by-Step Solution

1
Evaluate the disaster recovery requirements.
An RPO under 2 seconds and RTO under 10 minutes require active replication at the storage level rather than backups. Amazon Aurora Global Database uses storage-based replication with latency typically under 1 second and recovery times under 1 minute.
Traditional backup-and-restore or snapshot copy methods fail to meet the tight RPO constraint.
2
Evaluate read scaling requirements across both regions.
Aurora Replicas must be configured in both us-east-1 and us-west-2, and Aurora Auto Scaling must be enabled to dynamically handle load spikes.
This offloads read operations from the writer instance and serves local dashboards with sub-second latency.
3
Address the encryption requirement with customer managed keys (CMKs).
Create unique KMS CMKs in both us-east-1 and us-west-2, and configure the primary and secondary clusters to encrypt at rest using their local region's key.
AWS KMS keys are region-specific, and default AWS-managed keys cannot have their policies modified for cross-region configurations.

Key Concept

Amazon Aurora Global Database replication, read scaling with replicas, and multi-region encryption using customer managed keys.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic