Examkin

Soru

Zorluk: OrtaDatabase and Storage Strategy

An organization is designing a high-volume financial transaction platform (OLTP workload). The platform requires a relational database that can support up to 50,000 read requests per second and 10,000 write requests per second. The system must maintain a Recovery Point Objective (RPO) of 0 (no data loss) and a Recovery Time Objective (RTO) of less than 30 seconds during an Availability Zone outage. The database must encrypt all data at rest, and the security team in Account A must centrally manage the encryption keys and audit key usage for database instances deployed in Account B.

Which database and storage configuration meets these requirements?

  1. Deploy an Amazon Aurora PostgreSQL database cluster in Account B with Aurora Replicas. Enable Aurora Auto Scaling for the replicas to handle read scaling. Encrypt the database cluster at rest using an AWS KMS Customer Managed Key (CMK) created in Account A and shared with Account B via key policy.Cevap
  2. B
    Deploy an Amazon RDS for PostgreSQL database instance with a Multi-AZ standby deployment in Account B. Direct the read traffic to the standby instance during peak traffic hours to scale read operations. Encrypt the database instance at rest using an AWS KMS Customer Managed Key (CMK) created in Account A and shared with Account B.
  3. C
    Deploy an Amazon Aurora PostgreSQL database cluster in Account B with Aurora Replicas. Encrypt the database cluster at rest using the default AWS managed key for Amazon RDS (aws/rds). Configure IAM permissions to allow the security team in Account A to manage and audit the encryption key.
  4. D
    Deploy a single-AZ Amazon RDS for PostgreSQL database instance in Account B. Configure automated daily backups and copy them to a secondary Availability Zone. In the event of an Availability Zone outage, restore the database from the copied snapshot in the secondary zone.

Cevap

Deploying an Amazon Aurora PostgreSQL database cluster in Account B with Aurora Replicas and scaling them using Aurora Auto Scaling, encrypted with a cross-account Customer Managed Key (CMK) from Account A.
The correct option meets all requirements. Amazon Aurora PostgreSQL supports synchronous replication within its storage volume across multiple Availability Zones, ensuring an RPO of 0. Aurora's failover mechanism promotes a replica to primary in less than 30 seconds, meeting the RTO requirement. Aurora Replicas can serve read queries and support auto-scaling to handle high read volumes. By using an AWS KMS Customer Managed Key (CMK) in Account A, the key policy can be modified to grant the database in Account B permissions to use the key, while keeping key management and auditing under the control of Account A.

Adım Adım Çözüm

1
Evaluate RPO and RTO requirements to select the database architecture.
Amazon Aurora PostgreSQL with Multi-AZ/Aurora Replicas provides synchronous replication within the cluster (RPO = 0) and automated failover in less than 30 seconds (RTO < 30 seconds). A single-AZ RDS instance or manual snapshot restores cannot meet these criteria.
Aurora's storage architecture and replica failover design are built to meet strict RPO and RTO goals.
2
Evaluate read capacity requirements to select the read scaling strategy.
Aurora Replicas can be scaled horizontally (optionally using Auto Scaling) to handle up to 50,000 read requests per second. RDS Multi-AZ standby instances are passive and cannot serve read traffic.
Read scaling must be handled by active replicas, not passive failover standbys.
3
Evaluate security and cross-account key management requirements.
An AWS KMS Customer Managed Key (CMK) created in Account A can be shared with Account B using a key policy, allowing the Account A security team to retain full administrative and audit control. AWS managed keys (like aws/rds) cannot be shared across accounts.
Cross-account resource encryption requires a Customer Managed Key to allow policy modification for cross-account access.

Anahtar Kavram

Designing database and storage solutions to meet replication, scale, and security requirements by choosing between Aurora and RDS, managing read capacity, and implementing cross-account AWS KMS encryption.
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru