An enterprise is migrating its legacy document management system to AWS. The system contai… — AWS Certified Solutions Architect - Professional

An enterprise is migrating its legacy document management system to AWS. The system contains $1.8\text{ PB}$ of unstructured data stored on on-premises Network File System (NFS) and Server Message Block (SMB) file shares. The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but only $400\text{ Mbps}$ of this bandwidth can be dedicated to the migration due to ongoing production traffic. The migration must be completed, validated, and fully cut over within a strict $30\text{-day}$ window. In addition, external partners must continue to upload daily delta feeds (approximately $50\text{ GB}$ per day) using the SFTP protocol. The files must be stored in the destination Amazon S3 bucket and encrypted at rest using an AWS Key Management Service (AWS KMS) Customer Managed Key (CMK). Which combination of actions will meet these requirements in the most operationally efficient manner? (Select TWO.)

Order multiple AWS Snowball Edge Storage Optimized devices to migrate the bulk of the $1.8\text{ PB}$ dataset offline. After the Snowball import is complete, deploy AWS DataSync agents on-premises to sync the remaining incremental updates over the Direct Connect connection to the target S3 bucket.Answer
Provision an AWS Transfer for SFTP endpoint backed by the target Amazon S3 bucket. Configure the Transfer Family service role with an IAM policy that allows access to the S3 bucket and decrypt/encrypt permissions on the KMS Customer Managed Key (CMK).Answer
C
Deploy AWS DataSync agents on-premises and configure them to transfer the entire $1.8\text{ PB}$ dataset directly to the target S3 bucket over the $400\text{ Mbps}$ Direct Connect allocation, scheduling the task to run continuously to meet the deadline.
D
Migrate the initial $1.8\text{ PB}$ dataset using AWS Transfer Family SFTP endpoints over the Direct Connect connection by running concurrent SFTP scripts on-premises, and configure the S3 bucket to use the AWS-managed KMS key (aws/s3) to encrypt the data.
E
Order multiple AWS Snowball Edge Storage Optimized devices to migrate the bulk of the $1.8\text{ PB}$ dataset offline. Configure the target S3 bucket to use the AWS-managed KMS key (aws/s3), and modify the key policy of the aws/s3 key to grant the AWS Transfer Family service role permissions to encrypt the daily partner SFTP uploads.

Answer

The correct options are the ones proposing to use multiple AWS Snowball Edge Storage Optimized devices for the bulk offline migration followed by AWS DataSync for incremental online synchronization, and provisioning an AWS Transfer for SFTP endpoint with a service role that has explicit permissions on the KMS Customer Managed Key (CMK).

The correct combination requires using multiple AWS Snowball Edge Storage Optimized devices to handle the initial bulk migration offline, because the network bandwidth calculation proves that transferring

1.8\text{ PB}

over

400\text{ Mbps}

would violate the

30\text{-day}

limit. An incremental synchronization via AWS DataSync agents is then used to sync updates made to the on-premises shares while the devices were in transit. The partner workflow is met natively by AWS Transfer Family, and since a KMS Customer Managed Key (CMK) is required, the Transfer Family service role must be granted permissions on the key, which is only possible with a customer-owned key rather than an AWS-managed key.

Step-by-Step Solution

Calculate the transfer time for the bulk dataset over the available network bandwidth.

Total size is

1.8\text{ PB}

(

14.4\text{ million gigabits}

). Over a

400\text{ Mbps}

(

0.4\text{ Gbps}

) allocation, the transfer takes

14.4\text{ million} / 0.4 = 36\text{ million seconds} \approx 416.7\text{ days}

This shows that an online-only migration using AWS DataSync or SFTP directly over the Direct Connect link cannot meet the

30\text{-day}

requirement.

Select the appropriate offline migration mechanism for the initial copy.

Order multiple AWS Snowball Edge Storage Optimized devices to ship the bulk

1.8\text{ PB}

dataset offline to AWS.

Snowball Edge bypasses the network bandwidth constraint, allowing the bulk data to be imported within

10\text{ to }15\text{ days}

including shipping times.

Identify the synchronization mechanism for the data delta changes.

Deploy AWS DataSync agents on-premises to perform an incremental synchronization of the changed files after the Snowball import finishes.

DataSync is optimized for scanning and syncing metadata/file differences, which can easily be completed within the remaining migration days over the Direct Connect link.

Configure the legacy partner ingestion endpoint with security controls.

Provision AWS Transfer for SFTP and associate the service role with a policy allowing access to the KMS Customer Managed Key (CMK).

AWS-managed keys (aws/s3) do not support policy modifications. Therefore, custom integrations like Transfer Family requiring key policy access require a Customer Managed Key (CMK).

Key Concept

Selecting the optimal hybrid migration path using AWS Snow Family for physical transit limits combined with AWS DataSync for online delta validation, and leveraging AWS Transfer Family with custom Customer Managed Key policies for legacy SFTP protocols.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic