Examkin

Soru

Zorluk: ZorDatabase and Storage Strategy

An airline company is designing a new global reservation system. The architecture must deploy across a primary AWS Region and a secondary AWS Region for disaster recovery. The database layer consists of an online transaction processing (OLTP) workload that handles active seat reservations.

The solution must satisfy the following requirements:
- Workload & Performance: Low-latency reservation writes (<15 ms< 15 \text{ ms}) under high traffic, with horizontal read scaling in the primary Region to handle spike searches from customers.
- Disaster Recovery: A target Recovery Point Objective (RPO) of 1 second1 \text{ second} and a Recovery Time Objective (RTO) of 2 minutes2 \text{ minutes} in the secondary Region.
- Cross-Account Archiving: Completed reservation receipts must be archived to an Amazon S3 bucket owned by a centralized compliance account (`Compliance-Acct`).
- Data Security: Archived files must be encrypted at rest using an AWS KMS key managed by the reservation application's production account (`Reservation-Acct`). Auditors operating in `Compliance-Acct` must be able to decrypt the receipts.

Which combination of storage and database strategy steps will satisfy these requirements? (Select TWO.)

  1. A
    Deploy an Amazon RDS for PostgreSQL database in a Multi-AZ deployment in the primary Region. Direct search traffic to the standby instance in the secondary Availability Zone, and use RDS Read Replicas to scale reads if replication lag increases.
  2. Deploy an Amazon Aurora PostgreSQL database as an Aurora Global Database. In the primary Region, configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas to scale out read capacity for customer searches.Cevap
  3. C
    Deploy an Amazon Aurora PostgreSQL database in the primary Region. Configure AWS Backup to perform hourly snapshots of the primary database and replicate them to the secondary Region to meet disaster recovery objectives.
  4. In the Reservation-Acct, create a KMS Customer Managed Key (CMK) and configure its key policy to allow the Compliance-Acct IAM roles to perform KMS decrypt operations. Configure the reservation application to write the S3 receipts using the CMK ARN for server-side encryption.Cevap
  5. E
    Encrypt the S3 receipts using the AWS-managed KMS key for S3 (aws/s3) in the Reservation-Acct. Edit the default key policy to delegate decryption permissions to the Compliance-Acct IAM roles.

Cevap

To meet the requirements, deploy an Amazon Aurora PostgreSQL database as an Aurora Global Database with Aurora Auto Scaling for read scaling, and create a KMS Customer Managed Key (CMK) in the Production account with a key policy allowing the Compliance account access to decrypt logs.
The correct solution involves deploying Amazon Aurora PostgreSQL as an Aurora Global Database to achieve near-instantaneous cross-region replication, which easily satisfies the 1-second RPO and 2-minute RTO. Aurora Auto Scaling dynamically manages Aurora Replicas to scale out reads horizontally. Additionally, cross-account encryption requires a Customer Managed Key (CMK) in the source account with key policy modifications that permit decryption by the target compliance account.

Adım Adım Çözüm

1
Analyze database latency, read scaling, and disaster recovery requirements.
Identify that Amazon Aurora Global Database provides sub-second cross-region replication for RPO/RTO goals, and Aurora Auto Scaling handles dynamic read workloads.
Standard RDS Multi-AZ standbys cannot serve read traffic, and restoring from snapshots exceeds the 2-minute RTO / 1-second RPO limits.
2
Analyze the cross-account S3 archiving and encryption requirements.
Recognize that a KMS Customer Managed Key (CMK) is needed because AWS-managed keys cannot be modified or shared cross-account.
The key policy must explicitly delegate decrypt permissions to the external Compliance-Acct roles, which requires a CMK.

Anahtar Kavram

Selecting high-availability database engines with cross-region replication under strict RTO/RPO constraints, coupled with configuring cross-account KMS Customer Managed Keys for secure storage access.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru