A financial compliance platform must deploy a transaction auditing application across two … — AWS Certified Solutions Architect - Professional

A financial compliance platform must deploy a transaction auditing application across two AWS Regions: `eu-west-1` (Primary) and `us-east-1` (Secondary). The application tier runs on Amazon EC2 instances in private subnets across three Availability Zones (AZs) in each Region. The architecture must satisfy a Recovery Time Objective ( $RTO$ ) of less than 5 minutes for a regional disaster recovery failover. The Recovery Point Objective ( $RPO$ ) requires zero data loss ( $RPO = 0$ ) within the primary Region during an AZ failure, and less than 10 seconds ( $RPO < 10\text{ seconds}$ ) for a regional failover. Outbound internet connectivity to external payment validation APIs must remain operational in each Region even if an entire Availability Zone or its NAT Gateway experiences an outage. Additionally, private internal DNS names must resolve correctly across VPCs in both Regions. Which architecture meets these requirements while minimizing recovery time and administrative complexity?

Deploy Amazon Aurora PostgreSQL Multi-AZ in eu-west-1 as the primary cluster of an Aurora Global Database, with a secondary cluster in us-east-1. Configure one NAT Gateway in each Availability Zone in both regions, and configure private subnet route tables to direct outbound traffic to the local NAT Gateway. Associate the Route 53 Private Hosted Zone directly with the VPCs in both regions. Use Route 53 Application Recovery Controller (ARC) routing controls and routing control health checks to manage regional failover routing.Cevap
B
Deploy Amazon RDS PostgreSQL Multi-AZ in eu-west-1, and direct read-heavy reporting queries to the standby replica in the second Availability Zone to optimize database performance. Set up an RDS cross-region read replica in us-east-1 for disaster recovery. Deploy a single NAT Gateway in eu-west-1 and a single NAT Gateway in us-east-1 within a single public subnet to centralize outbound internet egress. Associate the Route 53 Private Hosted Zone with the VPC in eu-west-1, and configure Route 53 Resolver endpoints to route DNS queries from us-east-1. Use Route 53 Failover routing policies pointing to the Application Load Balancer health checks for public DNS failover.
C
Deploy Amazon Aurora PostgreSQL Multi-AZ in eu-west-1. Configure hourly AWS Backup copy jobs to copy database snapshots to us-east-1 to serve as the recovery source. Deploy NAT Gateways in each Availability Zone in both regions. Associate the Route 53 Private Hosted Zone with the VPCs in both regions. Use Route 53 Active-Passive failover routing based on CloudWatch alarms monitoring regional application availability to failover traffic to us-east-1.
D
Deploy Amazon Aurora PostgreSQL Multi-AZ in eu-west-1 as the primary cluster of an Aurora Global Database, with a secondary cluster in us-east-1. Configure a NAT Gateway in each Availability Zone in both regions. Associate the Route 53 Private Hosted Zone with the primary VPC in eu-west-1 only, and configure a VPC peering connection between the primary and secondary VPCs to allow DNS query forwarding. Use Route 53 Geolocation routing policies to route all traffic to the primary region unless the primary region becomes completely unavailable.

Cevap

Deploy Amazon Aurora PostgreSQL Multi-AZ in the primary region as part of an Aurora Global Database, use Route 53 Application Recovery Controller (ARC) for DNS failover, configure NAT Gateways in each Availability Zone, and associate the Private Hosted Zone directly with VPCs in both regions.

The correct architecture uses Amazon Aurora Global Database to achieve low-latency asynchronous cross-region replication, meeting the sub-10 second RPO requirement. Within the primary region, Multi-AZ deployment provides synchronous replication, ensuring an RPO of 0 for local AZ failures. Route 53 Application Recovery Controller (ARC) routing controls allow rapid, manual or automated failover of DNS records without relying on client-side cache TTLs, satisfying the 5-minute RTO. Having one NAT Gateway per Availability Zone ensures that an AZ failure does not disrupt outbound internet traffic from other AZs. Finally, associating the Private Hosted Zone directly with VPCs in both regions is the standard, highly resilient way to support cross-VPC private DNS resolution without external resolver endpoints.

Adım Adım Çözüm

Select the database replication model.

Amazon Aurora Global Database with Multi-AZ in the primary region.

Ensures synchronous replication locally (RPO = 0) and low-latency asynchronous replication (< 1 second) across regions, meeting the RPO < 10 seconds requirement.

Configure NAT Gateway architecture for outbound internet resilience.

Deploy one NAT Gateway per Availability Zone in each VPC.

Prevents outbound internet access failures across the entire VPC if a single Availability Zone containing a NAT Gateway experiences an outage.

Set up private DNS resolution for internal microservices.

Associate the Route 53 Private Hosted Zone directly with the VPCs in both regions.

Allows native, highly available resolution of private domain names across regions without introducing routing or endpoint dependencies.

Implement the regional failover routing mechanism.

Configure Route 53 Application Recovery Controller (ARC) routing controls.

Enables rapid routing shifts during failover within seconds by using highly available health check states, avoiding standard DNS TTL cache propagation delays.

Anahtar Kavram

Multi-region disaster recovery design using Aurora Global Database, Route 53 Application Recovery Controller, NAT Gateway redundancy, and cross-region Private Hosted Zone association.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru