Examkin

Question

Difficulty: Very hardDatabase and Storage Strategy

A logistics company is designing a real-time supply chain tracking platform. The platform must ingest high-volume IoT telemetry data from millions of active sensors (write-intensive NoSQL workload, up to 100,000100,000 writes per second) and store historical device logs for regulatory audits (cold object storage, up to 50 TB50\text{ TB} monthly). The tracking data must be queryable by device ID with sub-1010 millisecond latency for the latest 3030 days. Historical logs must be retained for 77 years, encrypted with a key controlled by the security team in a centralized security account, and must be cost-optimized with a retrieval time of under 55 hours for audits. The disaster recovery requirements dictate an RTO of under 1515 minutes and an RPO of under 11 minute for the real-time tracking data. Which of the following database and storage strategies meets these requirements with the lowest cost and complexity?

  1. A
    Deploy a single-region Amazon DynamoDB table to handle the telemetry writes and queries, configuring Time to Live (TTL) to delete records after 30 days. To meet disaster recovery requirements, schedule an AWS Backup job to copy database backups daily to a secondary AWS Region. Use DynamoDB Streams to trigger an AWS Lambda function that writes telemetry logs to an Amazon S3 bucket in the security account. Encrypt the S3 bucket using Server-Side Encryption with AWS KMS (SSE-KMS) using the AWS-managed key (aws/s3) in the security account. Use an S3 Lifecycle policy to transition objects to S3 Glacier Instant Retrieval to minimize storage costs.
  2. B
    Deploy an Amazon RDS for PostgreSQL database in a Multi-AZ deployment to support the telemetry writes and queries, configuring the application to route read queries to the standby instance in the secondary Availability Zone to achieve sub-10 millisecond latency. Enable an AWS Lambda function to query the database daily, export historical data to an Amazon S3 bucket in the logistics account, and delete the exported records from the database. Encrypt the S3 bucket using a customer managed key (CMK) in the security account with proper cross-account access. Configure an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive to optimize storage costs.
  3. Deploy Amazon DynamoDB global tables with replication between two AWS Regions to handle the sensor writes and queries, configuring Time to Live (TTL) to delete records after 30 days. Enable DynamoDB Streams to trigger an AWS Lambda function in the logistics account that writes the telemetry logs to an Amazon S3 bucket located in the centralized security account. Configure the S3 bucket policy in the security account to grant write permissions to the logistics account's Lambda execution role. Encrypt the S3 bucket using Server-Side Encryption with AWS KMS (SSE-KMS) using a customer managed key (CMK) in the security account, ensuring the KMS key policy explicitly permits the logistics account's Lambda role to perform kms:GenerateDataKey and kms:Decrypt. Transition the objects to S3 Glacier Flexible Retrieval after 30 days and delete them after 7 years.Answer
  4. D
    Deploy Amazon DynamoDB global tables with replication between two AWS Regions to handle the sensor writes and queries, configuring Time to Live (TTL) to delete records after 30 days. Configure DynamoDB Streams to trigger an AWS Lambda function in the logistics account that writes telemetry logs to an Amazon S3 bucket located in the centralized security account. Encrypt the S3 bucket using Server-Side Encryption with AWS KMS (SSE-KMS) with a customer managed key (CMK) in the security account, granting the logistics account's Lambda role permissions in the KMS key policy. Do not update the S3 bucket policy in the security account to include the logistics account's Lambda role as a principal, relying instead on the identity-based IAM policy in the logistics account to grant write access. Configure an S3 Lifecycle policy to transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) for 7 years.

Answer

Deploy Amazon DynamoDB global tables with replication between two AWS Regions, use DynamoDB Streams with a Lambda function to write logs to an S3 bucket in the centralized security account with cross-account CMK and bucket policy permissions, and transition the S3 objects to S3 Glacier Flexible Retrieval.
The correct answer leverages Amazon DynamoDB global tables for the high-volume writes and low-latency queries, satisfying the RTO/RPO objectives through cross-region active-active replication. Transitioning historical logs to S3 Glacier Flexible Retrieval minimizes cost and satisfies the 5-hour retrieval SLA. Using a Customer Managed Key (CMK) in the centralized security account and explicitly modifying both the KMS key policy and S3 bucket policy enables secure, cross-account log delivery.

Step-by-Step Solution

1
Select the correct database platform for high-throughput NoSQL telemetry ingestion and low-latency queries.
Amazon DynamoDB is chosen because it natively scales to support 100,000100,000 writes per second and provides sub-1010 millisecond single-digit millisecond latency queries by primary key.
Relational options like RDS PostgreSQL cannot handle this scale without complex sharding, and DynamoDB's schema-less model fits unstructured sensor payloads.
2
Determine the disaster recovery configuration to meet RTO and RPO requirements.
DynamoDB Global Tables are selected to replicate data between two AWS Regions.
Global Tables replicate asynchronously with latency under 11 second, satisfying the RPO under 11 minute and supporting instant failover for an RTO under 1515 minutes.
3
Design the archiving pipeline for historical logs to meet the retrieval time and cost requirements.
Enable DynamoDB TTL to clean up records after 3030 days. Configure DynamoDB Streams to trigger an AWS Lambda function that writes logs to S3, and use an S3 Lifecycle policy to transition them to S3 Glacier Flexible Retrieval.
Glacier Flexible Retrieval provides standard retrieval times of 3 to 53\text{ to }5 hours, satisfying the audit SLA while keeping long-term storage costs extremely low.
4
Establish secure cross-account encryption and access control.
Configure a Customer Managed Key (CMK) in the centralized security account. Grant the logistics Lambda role permission in the KMS key policy, and update the destination S3 bucket policy to allow the Lambda role to write logs.
AWS-managed KMS keys (such as `aws/s3`) do not support policy modification and cannot be shared across accounts. Cross-account S3 access requires explicit authorization in the resource-based bucket policy.

Key Concept

Selecting and configuring AWS database and storage engines for scale, cross-account security, cost optimization, and strict RTO/RPO requirements.
Estimated Time:3m 0s
Rate this question

Topics

Database and Storage Strategy

More questions from this topic