Examkin

Soru

Zorluk: OrtaDatabase and Storage Strategy

A financial technology company is designing a new cloud-native wealth management application. The architecture must span two AWS Regions (Primary and Secondary) to support disaster recovery. The workload consists of:

1. An OLTP database containing transaction records. The database must sustain rapid, unpredictable spikes in read traffic, maintain read replication lag under 20 milliseconds, and support a disaster recovery plan with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute.
2. A centralized audit vault containing monthly PDF statement exports. These statement files must be stored in Amazon S3, encrypted at rest, and made securely accessible to a compliance audit application running in a separate AWS account within the same AWS Organization.

Which combination of database and encryption configurations should a solutions architect select to meet these requirements? (Select TWO.)

  1. Deploy an Amazon Aurora Global Database with the primary cluster in the primary Region and a secondary cluster in the secondary Region, and configure Aurora Auto Scaling for the Aurora Replicas to handle read spikes.Cevap
  2. Encrypt the S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant the external audit account's IAM role permissions to decrypt the data.Cevap
  3. C
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary Region, and configure the application to direct read spikes to the Multi-AZ standby instance to offload the primary database.
  4. D
    Configure a single-region Amazon Aurora cluster in the primary Region, and configure daily cross-region snapshot replication to the secondary Region to meet the disaster recovery objectives.
  5. E
    Encrypt the S3 bucket using the default AWS-managed key (aws/s3), and configure the S3 bucket policy to allow access to the external audit account.

Cevap

Deploy an Amazon Aurora Global Database with the primary cluster in the primary Region and a secondary cluster in the secondary Region, configure Aurora Auto Scaling for the Aurora Replicas to handle read spikes, encrypt the S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant the external audit account's IAM role permissions to decrypt the data.
The correct combination requires Amazon Aurora Global Database for the transaction database to meet the 1-second RPO (via asynchronous physical replication) and 1-minute RTO (via fast promotion of the secondary cluster), with Aurora Auto Scaling to handle read spikes without exceeding the 20-millisecond replica lag constraint. For the cross-account S3 bucket access, a Customer Managed Key (CMK) in AWS KMS is required because its key policy can be updated to delegate access to the compliance audit account's role.

Adım Adım Çözüm

1
Analyze the database requirements for RTO, RPO, and read scaling.
Identify that Amazon Aurora Global Database matches the RPO of 1 second (asynchronous physical replication lag is typically < 1 second) and RTO of 1 minute (secondary promotion takes less than a minute). Aurora Replicas share the same storage volume as the primary instance, keeping replication lag under 10 ms, and can scale dynamically using Aurora Auto Scaling.
This establishes the necessary database engine and multi-region replication architecture.
2
Analyze the S3 encryption and cross-account access requirements.
Determine that cross-account access to encrypted S3 objects requires a Customer Managed Key (CMK) because the default AWS-managed key (aws/s3) cannot have its key policy modified to delegate access to an external account.
This establishes the security and encryption architecture for the PDF statement exports.
3
Evaluate and eliminate incorrect database configurations.
Reject directing reads to the RDS Multi-AZ standby because it is passive and cannot serve read traffic. Reject daily snapshot replication because it fails the 1-second RPO and 1-minute RTO constraints.
This filters out sub-optimal or non-functional database setups.
4
Evaluate and eliminate incorrect encryption configurations.
Reject the option utilizing the default AWS-managed KMS key (aws/s3) for cross-account access because AWS-managed keys cannot be shared cross-account.
This filters out the invalid KMS design.

Anahtar Kavram

Selecting and configuring AWS database and storage services to meet strict RTO/RPO targets, read scalability, and secure cross-account encryption access.
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru