Examkin

Soru

Zorluk: Çok zorDatabase and Storage Strategy

A financial services firm is building a high-performance transaction auditing platform. The application requires an OLTP database for transaction metadata and an object storage solution for archiving raw transaction receipt files. The system must meet the following requirements:

- The transaction metadata database must handle high write throughput in the primary region (us-east-1) and support cross-region disaster recovery (us-west-2) with a recovery point objective (RPO) of less than 1 second and a recovery time objective (RTO) of less than 1 minute. Under normal operations, write performance in us-east-1 must not be impacted by database replication.
- Raw receipt files are stored in an Amazon S3 bucket in us-east-1 and must be automatically replicated to a compliance S3 bucket in us-west-2 owned by a separate audit AWS account.
- All receipt files must be encrypted at rest using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS). The replicated files in us-west-2 must be encrypted using a CMK owned by the audit account.
- The replication process must adhere to the principle of least privilege.

Which combination of database and storage configurations should the Solutions Architect recommend to meet these requirements? (Select TWO.)

  1. Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure local Aurora Replicas in the secondary region to enable rapid failover and support read scaling.Cevap
  2. Configure Amazon S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket. In the replication configuration, enable replication of KMS-encrypted objects, specify the audit account's Customer Managed Key (CMK) for destination encryption, and grant the replication IAM role permissions to decrypt in the source account and encrypt in the destination KMS key policy.Cevap
  3. C
    Provision an Amazon RDS for PostgreSQL database with a Multi-AZ deployment in us-east-1, and configure a cross-region Multi-AZ standby deployment in us-west-2. Route read-heavy queries to the standby instance in us-west-2 to optimize database performance.
  4. D
    Configure Amazon S3 Cross-Region Replication using the default AWS-managed KMS key (aws/s3) for encrypting objects in both the source and destination buckets. Update the default S3 KMS key policy to grant decrypt and encrypt permissions to the source account's replication IAM role.
  5. E
    Configure a multi-Region Amazon RDS for PostgreSQL database with synchronous replication across us-east-1 and us-west-2 to guarantee zero data loss. Implement a custom AWS Lambda function that copies receipt files to the destination S3 bucket on every s3:ObjectCreated event to achieve near-instantaneous file replication.

Cevap

The Solutions Architect should recommend deploying an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, along with configuring Amazon S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket, enabling replication of KMS-encrypted objects, and granting the replication IAM role appropriate permissions in the source and destination KMS key policies.
Deploying Amazon Aurora Global Database satisfies the database RTO of under 1 minute and RPO of under 1 second, as Aurora Global Database uses asynchronous storage-level replication that does not degrade write performance in the primary region. For the storage tier, configuring S3 Cross-Region Replication (CRR) with Customer Managed Keys (CMKs) is the only valid way to copy encrypted objects to a destination bucket in another AWS account. The replication IAM role must be granted permissions to decrypt in the source account and encrypt using the destination CMK in the target audit account, maintaining least-privilege access controls.

Adım Adım Çözüm

1
Evaluate the database tier requirements.
Identify that the database must support an RPO under 1 second, RTO under 1 minute, and asynchronous replication so write performance in the primary region is unaffected.
Amazon Aurora Global Database replicates data physically and asynchronously to a secondary region with typical lag under 1 second. Promoting the secondary cluster takes less than 1 minute, matching both RTO and RPO targets without adding synchronous write overhead.
2
Analyze why Amazon RDS Multi-AZ and synchronous replication are unsuitable.
Determine that Amazon RDS does not support synchronous cross-region replication, and Multi-AZ standbys cannot serve read queries.
RDS Multi-AZ is designed for high availability within a single region (or across AZs) and its standby is passive. Synchronous cross-region replication would cause prohibitive write latency.
3
Evaluate cross-account storage replication requirements.
Identify that raw transaction receipts in S3 must replicate cross-account and remain encrypted using Customer Managed Keys (CMKs).
S3 Cross-Region Replication (CRR) supports replicating KMS-encrypted objects. Because the target bucket is in a different account, the destination KMS CMK must explicitly authorize the source replication IAM role to perform kms:GenerateDataKey and kms:Encrypt actions.
4
Verify key constraints regarding KMS key types.
Confirm that AWS-managed keys (aws/s3) cannot be shared across accounts or have their policies modified.
Using AWS-managed keys for cross-account S3 replication fails because their key policies are immutable and cannot authorize roles from other AWS accounts.

Anahtar Kavram

Designing multi-region database replication using Amazon Aurora Global Database, and configuring cross-account Amazon S3 Cross-Region Replication for KMS-encrypted objects using Customer Managed Keys.
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru