Examkin

Soru

Zorluk: Çok zorDatabase and Storage Strategy

A global energy trading firm is designing a high-throughput settlement ledger system (OLTP workload) that must span two AWS Regions: us-east-1 (primary) and us-west-2 (secondary) to support near-real-time transactions. The database requires strict ACID compliance and must handle high-volume write transactions in the primary region, while read traffic must scale horizontally in both regions to support analyst dashboards. The architecture must satisfy a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 5 minutes. Additionally, security compliance mandates that the database be encrypted at rest using Customer Managed Keys (CMKs) and all database audit logs must be securely centralized in an Amazon S3 bucket located in a dedicated, separate security account. Which design strategy meets these database performance, disaster recovery, and security compliance requirements?

  1. Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Auto Scaling on the reader instances in both regions. Encrypt the clusters using regional Customer Managed Keys (CMKs) in their respective regions. Configure PostgreSQL audit logs (pgAudit) to publish to Amazon CloudWatch Logs, and use an Amazon Kinesis Data Firehose stream in each region to deliver the logs to the centralized S3 bucket, ensuring the security account's S3 bucket policy grants s3:PutObject permissions to the Firehose IAM roles.Cevap
  2. B
    Deploy a Multi-AZ Amazon RDS for PostgreSQL DB instance in us-east-1 and configure a cross-region read replica in us-west-2. Configure target tracking scaling policies to dynamically add standby instances to the Multi-AZ deployment during read spikes. Encrypt the primary database and replica using the default AWS-managed KMS key (aws/rds). Configure a script on an Amazon EC2 instance to periodically copy PostgreSQL audit logs to the centralized S3 bucket using cross-account IAM roles.
  3. C
    Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Encrypt both the primary and secondary clusters using a single, shared Customer Managed Key (CMK) ARN created in us-east-1 to ensure cryptographic parity during replication. Configure Aurora to export logs directly to the security account's S3 bucket using an S3 VPC endpoint, without modifying the destination bucket policy since both accounts belong to the same AWS Organization.
  4. D
    Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1. Configure AWS Backup to take continuous backups and copy them to us-west-2. Set up a pilot light environment in us-west-2 consisting of an inactive Aurora DB cluster. In the event of a primary region failure, restore the latest backup to the pilot light cluster. Configure the database to write audit logs to a local S3 bucket, and use S3 Cross-Region Replication (CRR) to replicate the log files to the centralized security account's S3 bucket without configuring a destination bucket policy.

Cevap

Deploy an Amazon Aurora PostgreSQL Global Database with regional Customer Managed Keys (CMKs) in each region, configuring Aurora Auto Scaling on reader instances, publishing audit logs to CloudWatch Logs, and using Kinesis Data Firehose to stream them to the centralized S3 bucket with a bucket policy that permits s3:PutObject.
The correct answer leverages Amazon Aurora PostgreSQL Global Database, which offers cross-region replication latency under 1 second (satisfying the 1-minute RPO) and can be promoted to a primary cluster in less than 1 minute (satisfying the 5-minute RTO). Readers in both regions can scale horizontally using Aurora Auto Scaling. Encryption compliance is maintained by utilizing regional Customer Managed Keys (CMKs) in each region. Centralized logging is achieved by exporting database audit logs to CloudWatch Logs and streaming them to the security account's S3 bucket using Kinesis Data Firehose, with proper cross-account s3:PutObject permissions defined in the destination S3 bucket policy.

Adım Adım Çözüm

1
Determine the optimal database replication architecture for OLTP and RTO/RPO targets.
Amazon Aurora Global Database provides sub-second replication lag (meeting the RPO of 1 minute) and supports regional failover within 1 minute (meeting the RTO of 5 minutes).
Traditional RDS read replicas or AWS Backup restore mechanisms cannot meet the strict 5-minute RTO.
2
Analyze options for scaling read capacity dynamically in both regions.
Aurora reader instances (replicas) in both the primary and secondary clusters can scale horizontally using Aurora Auto Scaling.
RDS Multi-AZ standby instances are passive and cannot serve read traffic or auto-scale horizontally.
3
Determine KMS key replication constraints across regions.
AWS KMS keys are regional resource types. To encrypt the Aurora Global Database, regional Customer Managed Keys (CMKs) must be created in both us-east-1 and us-west-2.
A single KMS key ARN cannot be shared or referenced across different AWS regions.
4
Evaluate cross-account log centralization and security controls.
Exporting logs to CloudWatch and streaming them via Kinesis Data Firehose allows secure, cross-account delivery to S3, provided the target S3 bucket policy explicitly allows s3:PutObject for the Firehose roles.
Logs cannot write cross-account without explicit permission policies on the target S3 bucket.

Anahtar Kavram

Multi-region database architectures with strict RTO/RPO requirements, KMS multi-region boundary limitations, and secure cross-account log centralization.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru