Examkin

Question

Difficulty: HardLarge-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

An enterprise is migrating its on-premises data center workloads to AWS and needs to transfer two primary datasets within a strict 14-day migration window. The enterprise has a dedicated 500 Mbps500\text{ Mbps} AWS Direct Connect connection. The datasets consist of:

* 850 TB850\text{ TB} of active user documents stored on an on-premises SMB file share, which must be migrated to Amazon FSx for Windows File Server.
* 250 TB250\text{ TB} of media files stored on an on-premises NFS export, which must be migrated to Amazon S3.

The security policy mandates that all migrated data must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key that is owned and managed by a centralized security account. Additionally, an existing on-premises SFTP server used by external partners to access the media files must be replaced with a fully managed service on AWS, preserving existing credentials and hostnames.

Which combination of actions will meet these requirements within the migration window? (Select TWO.)

  1. Order multiple AWS Snowball Edge Storage Optimized devices. Copy both the SMB and NFS datasets onto the devices. Configure the Snowball job to encrypt the imported data in Amazon S3 using a customer managed KMS key created in the security account.Answer
  2. Create an AWS DataSync task without an agent to copy the migrated SMB data from the target Amazon S3 bucket to the Amazon FSx for Windows File Server file system. Configure an AWS Transfer for SFTP endpoint backed by AWS Secrets Manager to authenticate external partners using their existing credentials.Answer
  3. C
    Use AWS DataSync to copy both the SMB and NFS datasets directly from on-premises to Amazon FSx and Amazon S3 over the 500 Mbps500\text{ Mbps} AWS Direct Connect link. Configure the task to run continuously with high bandwidth limits.
  4. D
    Order multiple AWS Snowball Edge Storage Optimized devices. Copy the SMB and NFS datasets to the devices, and configure the import process to encrypt the target S3 buckets using the default AWS-managed KMS key (aws/s3) to enable automatic cross-account decryption by the security account.
  5. E
    Set up an AWS Transit Gateway routed through the Direct Connect gateway to configure transitive VPC-to-VPC routing. Deploy on-premises AWS DataSync agents to stream both datasets over the Transit Gateway directly to AWS to meet the 14-day migration window.

Answer

Ordering multiple AWS Snowball Edge Storage Optimized devices to import the data to Amazon S3 using a customer managed KMS key, and creating an AWS DataSync task to copy the SMB data from Amazon S3 to Amazon FSx for Windows File Server while setting up AWS Transfer for SFTP backed by AWS Secrets Manager.
The correct strategy combines offline physical transfer via AWS Snowball Edge to overcome network limits, combined with post-migration in-cloud copying. Using Snowball Edge to seed Amazon S3 meets the time constraint. A customer managed KMS key satisfies the cross-account encryption requirement. Because Snowball Edge cannot write directly to Amazon FSx, AWS DataSync is run inside AWS to copy data from S3 to FSx for Windows. AWS Transfer for SFTP with Secrets Manager provides a managed replacement that preserves existing partner credentials.

Step-by-Step Solution

1
Calculate the data transfer volume and timeline constraint.
Total data size = 850 TB+250 TB=1100 TB850\text{ TB} + 250\text{ TB} = 1100\text{ TB}. Direct Connect bandwidth = 500 Mbps500\text{ Mbps}. Online transfer would require: Time=1100×1012×8500×106×86400≈203.7 days\text{Time} = \frac{1100 \times 10^{12} \times 8}{500 \times 10^6 \times 86400} \approx 203.7\text{ days}. Therefore, offline transfer using AWS Snowball Edge devices is required.
To determine whether online or offline transfer is feasible within the 14-day window.
2
Select the appropriate encryption key type for cross-account compliance.
Identify that a customer managed KMS key must be used instead of an AWS-managed key (aws/s3), since the latter's key policies cannot be altered to grant cross-account permissions to the security account.
To satisfy security requirements allowing cross-account decryption.
3
Map Snowball Edge imports to the final target storage.
Data is imported from the Snowball Edge devices into Amazon S3. For the SMB data, an AWS DataSync task is configured within the AWS Cloud to replicate files from the source S3 bucket to the destination FSx for Windows File Server file system. No DataSync agent is needed for in-cloud transfers.
Because Snowball Edge cannot directly seed data into Amazon FSx for Windows File Server.
4
Configure the managed SFTP migration strategy.
Provision AWS Transfer for SFTP and integrate it with AWS Secrets Manager as a custom identity provider to handle external partner authentication without credentials modification.
To replace the on-premises SFTP server while preserving existing partner client configurations.

Key Concept

Selecting the optimal data transfer method based on bandwidth, time, storage protocols, and AWS KMS cross-account access capabilities.
Rate this question

Topics

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

More questions from this topic