Examkin

Question

Difficulty: MediumAzure Cosmos DB and NoSQL Solutions

A financial services company is designing a global document-sharing platform. The architecture stores document metadata in Azure Cosmos DB for NoSQL and the PDF files in Azure Blob Storage. The system expects a 70:3070:30 read-to-write ratio, requires a 99.999%99.999\% read and write availability SLA, and must survive a regional datacenter outage. The PDF files must be accessible to external clients using temporary, revocable links. Which design combination should you recommend to meet these requirements?

  1. A
    Set the Cosmos DB partition key to `documentStatus`, configure Geo-Zone-Redundant Storage (GZRS) for Blob Storage, and generate short-lived Shared Access Signatures (SAS) associated with a stored access policy.
  2. B
    Set the Cosmos DB partition key to `contractId`, configure Locally Redundant Storage (LRS) for Blob Storage, and generate short-lived Shared Access Signatures (SAS) associated with a stored access policy.
  3. Set the Cosmos DB partition key to `contractId`, configure Geo-Zone-Redundant Storage (GZRS) for Blob Storage, and generate short-lived Shared Access Signatures (SAS) associated with a stored access policy.Answer
  4. D
    Set the Cosmos DB partition key to `contractId`, configure Geo-Zone-Redundant Storage (GZRS) for Blob Storage, and generate Shared Access Signatures (SAS) with a multi-year lifetime directly in the URI without a stored access policy.

Answer

To meet all design requirements, the partition key for Azure Cosmos DB must be a high-cardinality field such as `contractId`. Azure Blob Storage should be configured with Geo-Zone-Redundant Storage (GZRS) to withstand regional disasters. Finally, secure document links must be generated using short-lived Shared Access Signatures (SAS) associated with a stored access policy to support immediate revocation.
The correct design uses a high-cardinality partition key (`contractId`) for Azure Cosmos DB to prevent hot partitions and ensure even distribution of requests. To survive a regional outage, GZRS provides zone-redundancy and geo-redundancy, ensuring data is resilient to regional disasters. For secure and revocable client access, generating short-lived SAS tokens that reference a stored access policy allows the security key to be revoked easily if compromised.

Step-by-Step Solution

1
Select a Cosmos DB partition key that distributes workload evenly.
Using `contractId` instead of a low-cardinality property like `documentStatus` distributes logical partitions uniformly and avoids hot partitions.
Azure Cosmos DB partitions data horizontally based on the key. Low-cardinality keys group data together, leading to throughput limitations.
2
Select the storage replication tier that supports regional failover.
Select Geo-Zone-Redundant Storage (GZRS) instead of Locally Redundant Storage (LRS).
LRS replicates data only within a single physical location. To survive a regional disaster, data must be geo-replicated.
3
Establish a secure mechanism for temporary file access that supports revocation.
Generate short-lived SAS tokens that reference a stored access policy.
Stored access policies allow immediate revocation of permissions by modifying the policy, whereas direct ad-hoc SAS URIs cannot be easily revoked.

Key Concept

Designing highly scalable, disaster-resilient, and secure storage solutions using Azure Cosmos DB and Azure Blob Storage.
Rate this question

Topics

Azure Cosmos DB and NoSQL Solutions

More questions from this topic