Examkin

Soru

Zorluk: OrtaDatabase and Storage Strategy

An enterprise is designing a new multi-tenant financial transaction platform (OLTP workload). The platform requires a relational database that handles moderate write volumes and dynamically scales read capacity across 22 AWS Regions to support end-of-month reporting spikes. The solution must achieve a recovery time objective (RTO) of less than 11 hour and a recovery point objective (RPO) of less than 1515 minutes. Additionally, compliance regulations require database exports stored in Amazon S3 to be directly decryptable by a central security audit team operating in a separate AWS account. Which database and storage strategy meets these requirements?

  1. Deploy an Amazon Aurora Global Database across both regions, and configure an Aurora Auto Scaling policy for reader instances in both the primary and secondary regions. Encrypt the database clusters using a Customer Managed Key (CMK) in AWS KMS, and configure the key policy to grant decrypt permissions to the external security audit account's IAM principal.Cevap
  2. B
    Deploy an Amazon RDS for PostgreSQL database with a Multi-AZ deployment in the primary region and cross-region read replicas. Configure RDS Auto Scaling to add standby instances to the Multi-AZ cluster to dynamically serve the reporting read traffic during peak periods, and encrypt the database using a Customer Managed Key (CMK) in AWS KMS with cross-account access.
  3. C
    Deploy an Amazon Aurora Global Database across both regions, and configure an Aurora Auto Scaling policy for reader instances in both the primary and secondary regions. Encrypt the database clusters using the default AWS-managed key for Amazon RDS (aws/rds), and configure the S3 bucket policy in the secondary account to grant the audit team access to the bucket.
  4. D
    Deploy an Amazon RDS for PostgreSQL database in the primary region. Use an AWS Lambda function to capture database snapshots every 22 hours, copy the snapshots to the secondary region, and restore them to a new database instance only during a disaster event. Encrypt the database using a Customer Managed Key (CMK) in AWS KMS with cross-account access.

Cevap

Deploy an Amazon Aurora Global Database across both regions, configure an Aurora Auto Scaling policy for reader instances in both the primary and secondary regions, and encrypt the database clusters using a Customer Managed Key (CMK) in AWS KMS with cross-account permissions.
The correct strategy uses Amazon Aurora Global Database because it satisfies the multi-region read requirement, scales reader instances automatically using Aurora Auto Scaling, and achieves an RPO of less than 11 second and RTO of less than 11 minute. Additionally, using an AWS KMS Customer Managed Key (CMK) allows the policy to be modified to grant decrypt permissions to the security auditing account's IAM principal, enabling cross-account data decryption of database exports.

Adım Adım Çözüm

1
Select a multi-region database solution that meets low RTO/RPO targets.
Amazon Aurora Global Database provides sub-second replication latency across regions, easily satisfying the target RTO of less than 11 hour and RPO of less than 1515 minutes.
Standard backup and restore methods or slow snapshot copies cannot meet strict cross-region failover limits.
2
Configure horizontal scale-out of read replicas for seasonal spikes.
Configure Aurora Auto Scaling to dynamically provision and remove Aurora Replicas (reader instances) in both regions based on performance metrics.
This handles the end-of-month spikes without maintaining over-provisioned idle databases.
3
Implement a cross-account encryption strategy for database exports.
Use an AWS KMS Customer Managed Key (CMK) instead of an AWS-managed key, modifying its key policy to trust the security audit account's IAM principal for the kms:Decrypt action.
AWS-managed keys do not support policy modifications and cannot be shared across AWS accounts.

Anahtar Kavram

Designing a multi-region, scalable relational database strategy using Aurora Global Database and Customer Managed KMS Keys for secure cross-account auditing.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru