Examkin

Soru

Zorluk: Çok zorDatabase and Storage Strategy

A financial services company is designing a high-volume, multi-region Online Transaction Processing (OLTP) application. The primary database cluster will be deployed in the 'us-east-1' region, and a disaster recovery (DR) database cluster must be maintained in the 'us-west-2' region. The business requirements specify a Recovery Time Objective (RTO) of under 2 minutes and a Recovery Point Objective (RPO) of under 5 seconds for the database tier. Additionally, security compliance mandates that all data must be encrypted at rest using encryption keys managed in a centralized security account. An audit team in a separate AWS account needs to run read-only compliance queries against a copy of the database in the 'eu-west-1' region every 24 hours.

Which database and storage strategy meets these requirements with the lowest recovery time and operational overhead?

  1. A
    Deploy an Amazon RDS for PostgreSQL Multi-AZ DB instance with a cross-region read replica in 'us-west-2'. Encrypt the database using a Customer Managed Key (CMK) in the centralized security account. To perform a failover, promote the cross-region read replica in 'us-west-2'. For the audit team, configure the cross-region read replica to allow cross-account access from the audit team's account to run daily read-only compliance queries directly on the replica.
  2. Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in 'us-east-1' and a secondary cluster in 'us-west-2'. Encrypt the database clusters using a Customer Managed Key (CMK) in the centralized security account. In the event of a primary region failure, promote the secondary cluster to primary. To support the audit team, configure a daily automated workflow that takes an Aurora snapshot in 'us-east-1', copies it to 'eu-west-1' using a CMK shared with the analytics account, shares the copied snapshot cross-account, and restores it to a temporary Aurora cluster in 'eu-west-1'.Cevap
  3. C
    Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in 'us-east-1' and a secondary cluster in 'us-west-2'. Encrypt the database clusters using the default AWS-managed KMS key ('aws/rds'). Configure Route 53 Application Recovery Controller (ARC) to automate failover. To support the audit team, share the daily automated Aurora snapshots directly from the primary account to the audit team's account, and restore the snapshot in 'eu-west-1' using the AWS-managed KMS key.
  4. D
    Deploy an Amazon RDS for PostgreSQL DB instance in 'us-east-1' with Multi-AZ enabled. Encrypt the database using a Customer Managed Key (CMK) in the centralized security account. Configure a read replica in 'us-west-2' with Aurora replica auto-scaling enabled to automatically scale reader nodes. For the audit team, share the daily automated S3 database backups directly with the audit account using an S3 bucket policy that permits cross-account access, but encrypt the bucket using the default 'aws/s3' KMS key.

Cevap

The database strategy utilizing Amazon Aurora PostgreSQL Global Database with Customer Managed Keys (CMKs) in a centralized security account, and a daily snapshot copy and share workflow to the audit region, meets all RTO, RPO, encryption, and cross-account access requirements.
The correct strategy uses Amazon Aurora Global Database to achieve the sub-second cross-region replication lag (meeting RPO) and fast promotion of the secondary cluster (meeting RTO). By encrypting the clusters with a Customer Managed Key (CMK), the key policy can be modified to grant cross-account access, which is a requirement for sharing encrypted snapshots. Because snapshots are region-specific, copying the snapshot to the target region using the shared CMK, sharing it, and restoring it there correctly enables cross-account database audit queries.

Adım Adım Çözüm

1
Evaluate the RTO and RPO requirements.
Amazon Aurora Global Database provides storage-level replication with lag under 1 second and promotion times under 2 minutes, meeting the 5-second RPO and 2-minute RTO constraints.
Standard RDS cross-region replication is asynchronous and has higher latency, making it unsuitable for strict sub-5-second RPO targets under write-heavy workloads.
2
Identify the correct key management strategy for cross-account snapshot access.
A Customer Managed Key (CMK) in the centralized security account must be used, with its key policy configured to grant decryption permissions to the target accounts.
AWS-managed KMS keys cannot be shared cross-account because their policies are immutable.
3
Design the snapshot sharing workflow across regions and accounts.
Automate snapshot generation in 'us-east-1', copy the snapshot to 'eu-west-1' using a shared CMK, share the copy cross-account to the audit account, and restore the snapshot.
Database snapshots are regional resources and must be copied to the destination region using a shared key before they can be shared and restored.

Anahtar Kavram

Multi-region database design using Aurora Global Database combined with cross-account snapshot sharing via Customer Managed KMS Keys (CMKs).
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru