Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A digital content provider is designing a new subscription management platform to handle global membership renewals and payments. The platform's workload type is a relational Online Transaction Processing (OLTP) database. The database must sustain high-volume transactional writes in the primary region (us-east-1), scale to handle up to 100,000 read requests per second globally, and support a disaster recovery strategy with a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 1 minute in a secondary region (us-west-2). All database storage at rest must be encrypted using a customer managed key (CMK) owned by a centralized security account to comply with regulatory auditing requirements.

Which two database and encryption configurations should the Solutions Architect select to meet these requirements? (Select TWO.)

  1. Configure an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Create Aurora Replicas in both regions and configure Aurora Auto Scaling to dynamically scale read capacity based on CPU utilization.Answer
  2. In the centralized security account, create an AWS KMS multi-Region customer managed key (CMK) with a key policy that allows the database service roles in both the primary and secondary regions to perform cryptographic operations. Replicate the CMK from us-east-1 to us-west-2 and configure the database clusters to use these keys.Answer
  3. C
    Deploy Amazon RDS for PostgreSQL with a Multi-AZ deployment in us-east-1, and configure a cross-Region read replica in us-west-2. Route read traffic to the standby instance of the Multi-AZ deployment in us-east-1 during peak hours to offload query processing from the primary instance.
  4. D
    Configure a single-Region Amazon Aurora PostgreSQL database cluster in us-east-1. Set up an AWS Backup plan to replicate database cluster snapshots to us-west-2 every hour, and configure an AWS Lambda function to restore the cluster in us-west-2 if a failover is initiated.
  5. E
    Encrypt the database clusters using the AWS-managed KMS key for Amazon RDS (aws/rds) in the primary account, and attach a resource-based policy to the AWS-managed key that grants cross-account decrypt and encrypt permissions to the central security account.

Answer

Configuring an Amazon Aurora PostgreSQL Global Database with Aurora Replicas and Aurora Auto Scaling, along with utilizing an AWS KMS multi-Region customer managed key (CMK) from the centralized security account replicated to the secondary region.
To meet the low-latency global read scaling (100,000 reads/sec) and near-zero RPO/RTO disaster recovery requirements, the architect must choose Amazon Aurora Global Database, which offers cross-Region physical replication with lag typically under 1 second and dynamic read scaling via Aurora Replicas and Aurora Auto Scaling. For central security management, configuring a multi-Region AWS KMS customer managed key (CMK) in the central security account and replicating it to the secondary region enables cross-account, cross-Region encryption of the database cluster with consistent key material.

Step-by-Step Solution

1
Evaluate the read scaling and database replication requirements for OLTP workload.
Identify that Amazon Aurora Global Database satisfies the cross-region performance, providing RPO under 1 second and RTO under 1 minute, while enabling reader instances in the secondary region to handle global read workloads.
Standard RDS Multi-AZ deployments do not support read traffic on standby instances, and snapshot replication is too slow to meet the RPO/RTO constraints.
2
Assess the encryption and centralized key management requirements.
Determine that a multi-Region Customer Managed Key (CMK) owned by the central security account should be used, with its key policy allowing access to the database service roles.
AWS-managed keys (e.g., aws/rds) cannot have their policies modified for cross-account access, and separate single-Region customer managed keys require re-encryption or complex configuration for global clusters.

Key Concept

Architecting multi-region relational databases using Amazon Aurora Global Database for low RTO/RPO disaster recovery and global read scaling, integrated with AWS KMS multi-Region customer managed keys for centralized cross-account encryption.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic