Examkin

Soru

Zorluk: OrtaDatabase and Storage Strategy

A technology company is designing a new critical business application utilizing an online transaction processing (OLTP) database. The system must support high-availability read operations that scale dynamically during peak traffic periods, while maintaining a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of near-zero. Additionally, transaction logs must be stored securely in an Amazon S3 bucket located in a separate, centralized Compliance Audit AWS account. All data at rest must be encrypted. The security policy mandates that the Compliance Audit account must be able to decrypt the transaction logs, and the encryption keys must be managed in the Production account using custom key policies to delegate access. Which database and storage design satisfies these requirements?

  1. Deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Auto Scaling configured for the reader instances. Encrypt the DB cluster using a Customer Managed Key (CMK) in AWS KMS. Configure log replication to the Amazon S3 bucket in the Compliance Audit account, and configure the KMS CMK key policy in the Production account to allow the Compliance Audit account to decrypt the data.Cevap
  2. B
    Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ standby instance. Enable Auto Scaling on the standby instance to handle read traffic. Encrypt the DB instance using a Customer Managed Key (CMK) in AWS KMS. Configure log replication to the Amazon S3 bucket in the Compliance Audit account.
  3. C
    Deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Auto Scaling configured for the reader instances. Encrypt the DB cluster using the default AWS-managed KMS key for Amazon RDS (aws/rds). Configure log replication to the Amazon S3 bucket in the Compliance Audit account, and modify the default key policy to delegate decryption permissions to the Compliance Audit account.
  4. D
    Deploy an Amazon Aurora PostgreSQL DB cluster with a single writer instance. Replicate database logs to the Amazon S3 bucket in the Compliance Audit account. To handle disaster recovery and read scaling, configure a backup process that exports daily database snapshots to Amazon S3, copies them to the Compliance Audit account, and restores them manually to a standby DB instance if a failure occurs.

Cevap

Deploying an Amazon Aurora PostgreSQL DB cluster with Aurora Auto Scaling for reader instances, encrypting with a Customer Managed Key (CMK), and updating the KMS key policy to allow cross-account S3 decrypt permissions.
The correct answer utilizes Amazon Aurora PostgreSQL with reader replicas and Auto Scaling to scale read performance dynamically while ensuring low latency replication. It also correctly specifies a Customer Managed Key (CMK) rather than an AWS-managed key, enabling the policy modifications necessary to delegate cross-account decryption rights to the Compliance Audit account.

Adım Adım Çözüm

1
Select database engine and architecture to support horizontal read scaling and low RTO/RPO.
Amazon Aurora PostgreSQL with reader auto-scaling is selected as it replicates data with minimal lag and allows readers to scale out. Standard RDS Multi-AZ standby instances cannot serve traffic.
To satisfy the high-availability read scaling requirements and strict recovery times.
2
Determine the required encryption key configuration for cross-account access.
A Customer Managed Key (CMK) is chosen instead of the default AWS-managed key.
Default AWS-managed keys do not support policy modification and cannot be shared across accounts.
3
Configure permissions for the S3 bucket and encryption keys to allow compliance decryption.
Update the KMS CMK key policy in the Production account to trust the Compliance Audit account principal.
Allows the cross-account compliance system to decrypt the replicated transaction logs.

Anahtar Kavram

Selecting high-performance databases with cross-account access delegation and horizontal scaling.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru