Examkin

Soru

Zorluk: ZorDatabase and Storage Strategy

A multinational financial institution is designing a new retail banking portal. The portal contains a transaction processing workload (OLTP) and a customer monthly account statements storage system (Object storage).

The transaction database requires high availability across multiple Availability Zones with a recovery time objective (RTO) of under 3030 seconds and a recovery point objective (RPO) of 00. The database must also scale read capacity dynamically to handle sudden spikes in query volume.

The account statement storage system must encrypt all statements at rest and grant read-only access to an auditing application located in a separate AWS account within the same AWS Organization.

Which two database and storage designs should the Solutions Architect select to meet these requirements?

  1. Deploy an Amazon Aurora PostgreSQL DB cluster with a Multi-AZ deployment, and configure Aurora Auto Scaling to dynamically add Aurora Replicas to scale read performance based on CPU utilization.Cevap
  2. Store the monthly account statements in an Amazon S3 bucket. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK), update the KMS key policy to permit cross-account access from the auditing account, and use an S3 bucket policy to allow read operations from that account.Cevap
  3. C
    Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ standby deployment, and configure the standby instance to dynamically accept and scale read traffic during peak periods.
  4. D
    Deploy a single-node Amazon Aurora PostgreSQL DB instance, and configure a Pilot Light replication setup to copy database snapshots to another Availability Zone every 1515 minutes to reduce database storage costs.
  5. E
    Store the monthly account statements in an Amazon S3 bucket encrypted with the default AWS-managed KMS key (`aws/s3`), and configure an S3 bucket policy to grant read access to the auditing account.

Cevap

Deploy an Amazon Aurora PostgreSQL DB cluster with a Multi-AZ deployment and configure Aurora Auto Scaling to dynamically add Aurora Replicas to scale read performance based on CPU utilization. Additionally, store the monthly account statements in an Amazon S3 bucket encrypted using an AWS KMS Customer Managed Key (CMK), update the KMS key policy to permit cross-account access from the auditing account, and use an S3 bucket policy to allow read operations from that account.
The correct solution combines Amazon Aurora PostgreSQL and Amazon S3. Aurora's Multi-AZ architecture features synchronous replication at the storage tier to guarantee an RPO of 00 and handles failover within 3030 seconds. Dynamic read replica scaling is achieved using Aurora Replicas managed by Auto Scaling. For cross-account compliance access, S3 objects must be encrypted with a Customer Managed Key (CMK) rather than an AWS-managed key, because only CMK policies can be modified to delegate decryption permissions to external AWS accounts. Combining this key policy modification with an S3 bucket policy ensures safe and functional cross-account access.

Adım Adım Çözüm

1
Evaluate the database tier for high availability, RTO, RPO, and read scalability constraints.
Identify that Amazon Aurora PostgreSQL with Multi-AZ provides synchronous replication (RPO of 00) and automatic failover in under 3030 seconds (RTO requirement). Aurora Auto Scaling dynamically manages Aurora Replicas to handle read spikes.
Ensures the database selection meets both the immediate recovery parameters and horizontal scaling requirements.
2
Analyze cross-account access requirements for S3 bucket objects encrypted at rest.
Determine that a Customer Managed Key (CMK) is required because the default AWS-managed KMS key (`aws/s3`) cannot be shared across accounts due to fixed key policies.
Establishes a secure and valid key management strategy that permits cross-account permission delegation.
3
Configure permissions on both S3 and KMS for the external auditing account.
Modify the KMS key policy to delegate decryption capability to the external account, and add an S3 bucket policy allowing read access to the external account's IAM principal.
Allows the external auditing account to successfully retrieve and decrypt the account statements.

Anahtar Kavram

Selecting high-availability database engines that support active read scaling, combined with cross-account KMS key policies and bucket policies for secure storage sharing.
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru