Examkin

Question

Difficulty: HardBackup and Restore Management

A company is designing a backup, restore, and high availability strategy for a critical transactional database running on Amazon RDS. The SysOps Administrator must satisfy the following requirements:
1. Automated daily backups must be replicated to a destination bucket in a secondary AWS Region.
2. In the event of an Availability Zone outage, the database must automatically failover to a standby instance in another Availability Zone within 2 minutes without requiring changes to application connection strings.
3. The replicated backups must be encrypted with a Customer Managed Key (CMK) in the destination Region, and access to decrypt these backups must be managed using IAM policies.

Which configuration must the SysOps Administrator implement to satisfy these requirements?

  1. A
    Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, use IAM policies to grant decrypt permissions on the destination KMS key to authorized users, without modifying the destination KMS key's policy to permit IAM-based access control.
  2. Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.Answer
  3. C
    Configure the primary database to use Multi-AZ deployment. Configure S3 Cross-Region Replication (CRR) to copy the backups from the source bucket to the destination bucket without enabling S3 versioning on either bucket. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.
  4. D
    Deploy a database Read Replica in a different Availability Zone to handle automatic failover. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Answer

Configure the primary database to use Multi-AZ deployment, enable S3 versioning on both the source and destination buckets for CRR, and modify the destination KMS key policy to allow the root principal to delegate key permissions via IAM.
The correct configuration combines Multi-AZ deployment to achieve automated, synchronous failover within 2 minutes without altering connection strings, enables S3 versioning on both buckets to allow S3 Cross-Region Replication (CRR) of the database backups, and configures the destination KMS key policy to permit the root principal to delegate key operations, enabling IAM policies to successfully control decryption access.

Step-by-Step Solution

1
Select Multi-AZ deployment for Amazon RDS
Synchronous database replication is established across Availability Zones, enabling automatic DNS failover in under 2 minutes without endpoint changes.
Meets the high availability RTO requirement without requiring application configuration changes.
2
Enable S3 versioning on the source and destination buckets and configure S3 CRR
Automated backups uploaded to the source S3 bucket are successfully replicated to the secondary Region destination S3 bucket.
S3 Cross-Region Replication has a hard prerequisite that versioning must be enabled on both source and destination buckets.
3
Modify the Customer Managed Key (CMK) policy in the destination Region to enable IAM policy delegation
The KMS key policy includes the default statement allowing the root principal (`arn:aws:iam::ACCOUNT_ID:root`) to perform key actions, which delegates policy control to IAM.
Without this statement in the KMS key policy, IAM policies cannot grant permissions to access or decrypt using the KMS key due to KMS policy evaluation precedence.

Key Concept

Integrating high availability, backup replication prerequisites, and KMS key policy delegation
Rate this question

Topics

Backup and Restore Management

More questions from this topic