Examkin

Soru

Zorluk: OrtaDatabase and Storage Strategy

A solutions architect is designing a database strategy for a new high-performance retail application (OLTP workload) that requires a MySQL-compatible database. The application expects massive spikes in read traffic that must be handled with minimal latency. The business requires a disaster recovery (DR) strategy in a secondary AWS Region with a recovery time objective (RTO) of less than 10 minutes10\text{ minutes} and a recovery point objective (RPO) of less than 1 minute1\text{ minute}. Furthermore, all database snapshots and transaction logs must be exported to an Amazon S3 bucket in a separate central security account, and the security auditing team must be able to decrypt the database exports using a cross-account IAM role. Which database and storage strategy should the solutions architect choose to meet these requirements?

  1. A
    Deploy a Multi-AZ Amazon RDS for MySQL database in the main region. To handle read spikes, rely on the Multi-AZ standby instance to automatically scale and serve read traffic. Set up cross-region read replicas in the disaster recovery region for cross-region replication. Encrypt the database using a Customer Managed Key (CMK) shared with the security account.
  2. B
    Deploy a single-region Amazon Aurora MySQL database. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Set up automated database snapshot copies to a secondary AWS Region every hour to meet the disaster recovery requirements. Encrypt the database using a Customer Managed Key (CMK) shared with the security account.
  3. Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the disaster recovery region. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Enable database encryption at rest using a KMS Customer Managed Key (CMK), and modify the key policy to allow access to the cross-account security IAM role.Cevap
  4. D
    Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the disaster recovery region. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Enable database encryption at rest using the default AWS-managed KMS key (`aws/rds`), and configure the S3 bucket policy in the central security account to grant decrypt permissions.

Cevap

Deploy an Amazon Aurora Global Database with reader Auto Scaling, using a KMS Customer Managed Key (CMK) shared with the security account to encrypt database storage.
The correct strategy uses Amazon Aurora Global Database, which replicates data with latency typically under 1 second1\text{ second} to a secondary AWS Region, fulfilling the 1 minute1\text{ minute} RPO and 10 minute10\text{ minute} RTO requirements. Using Aurora Auto Scaling for read replicas handles dynamic read scaling. To allow a separate AWS account to decrypt the database backups exported to S3, a Customer Managed Key (CMK) is required because AWS-managed keys (like `aws/rds`) cannot be shared across accounts.

Adım Adım Çözüm

1
Analyze the disaster recovery (DR) requirement of less than 1 minute1\text{ minute} RPO and 10 minutes10\text{ minutes} RTO.
Determine that periodic snapshots are insufficient due to RPO limits. Physical replication is required. Amazon Aurora Global Database replicates data cross-region with sub-second latency and allows regional failover within minutes.
To satisfy the database replication and recovery time objectives.
2
Evaluate the read-scaling requirement for handling read spikes.
Determine that Amazon Aurora Replicas with Auto Scaling can handle read scaling, whereas standard RDS Multi-AZ standbys cannot serve read traffic.
To choose a compute strategy that dynamically scales reads and maintains low latency.
3
Determine the encryption key type required for cross-account decryption of database exports in S3.
Establish that a Customer Managed Key (CMK) must be used. Modify the KMS key policy to grant the cross-account security IAM role permission to use the key.
AWS-managed KMS keys do not support cross-account sharing, which is a hard constraint for the external security audit requirement.

Anahtar Kavram

Architecting relational databases for high availability, low-latency cross-region disaster recovery, and cross-account secure encryption key management.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru