Examkin

Soru

Zorluk: OrtaDatabase and Storage Strategy

A solutions architect is designing the database strategy for a new high-frequency transactional banking portal (OLTP workload). The portal requires sub-10 millisecond read and write latencies, dynamic read scaling to handle unpredictable traffic spikes, and a Recovery Time Objective (RTO) of less than 30 seconds. In compliance with corporate security guidelines, the database must be encrypted at rest using a key managed in a separate centralized security AWS account. Which database and storage strategy meets these requirements?

  1. Deploy an Amazon Aurora PostgreSQL cluster with Multi-AZ deployment. Create an Aurora Replica and configure Aurora Auto Scaling to dynamically adjust the number of replicas based on CPU utilization. Encrypt the cluster using an AWS KMS Customer Managed Key located in the centralized security account, with cross-account access granted via the KMS key policy.Cevap
  2. B
    Deploy an Amazon RDS for PostgreSQL instance with a Multi-AZ standby. Configure dynamic auto-scaling to scale out RDS standby instances to handle read spikes. Encrypt the database using an AWS KMS Customer Managed Key located in the centralized security account, with cross-account access granted via the KMS key policy.
  3. C
    Deploy an Amazon Aurora PostgreSQL cluster with Multi-AZ deployment. Create an Aurora Replica and configure Aurora Auto Scaling to dynamically adjust the number of replicas. Encrypt the cluster using the default AWS managed key (aws/rds) located in the centralized security account, sharing the key across accounts using a resource-based policy.
  4. D
    Deploy an Amazon RDS for PostgreSQL instance with cross-region read replicas. In the event of a primary zone failure, execute a manual failover script to promote a replica in the secondary region and update DNS records. Encrypt the database using an AWS KMS Customer Managed Key located in the centralized security account, with cross-account access granted via the KMS key policy.

Cevap

Deploy an Amazon Aurora PostgreSQL cluster with Multi-AZ deployment, configure Aurora Replicas with Aurora Auto Scaling for read capacity, and encrypt the cluster using a Customer Managed Key from the centralized security account via cross-account key policy permissions.
The correct strategy uses Amazon Aurora PostgreSQL with Multi-AZ and Aurora Replicas combined with Aurora Auto Scaling. This guarantees automatic failover within 30 seconds and allows read capacity to scale dynamically based on CPU metrics. To meet the security guidelines, a Customer Managed Key (CMK) is created in the security account and configured with a cross-account key policy, allowing the database service to perform cryptographic operations across accounts.

Adım Adım Çözüm

1
Determine the database engine and read scaling mechanism.
Amazon Aurora PostgreSQL with Aurora Replicas and Auto Scaling is chosen to handle OLTP reads with sub-10ms latency and dynamic scaling.
Standard Amazon RDS Multi-AZ standbys cannot serve read queries, making Aurora Auto Scaling with Aurora Replicas necessary to meet dynamic read requirements.
2
Verify high availability and disaster recovery constraints.
Aurora PostgreSQL Multi-AZ deployment supports automatic failover in less than 30 seconds.
Manual promotion of cross-region replicas or secondary sites cannot reliably meet the strict RTO of less than 30 seconds.
3
Select the correct encryption key configuration for cross-account access.
Create a Customer Managed Key (CMK) in the centralized security account and configure the key policy to allow cross-account access from the database account.
AWS-managed keys (such as aws/rds) cannot be modified or shared across accounts, meaning a Customer Managed Key is required.

Anahtar Kavram

Selecting the optimal database and encryption architecture to satisfy high availability, read-scaling, and cross-account security requirements.
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru