A multinational healthcare conglomerate is planning to migrate its core patient portal and… — AWS Certified Solutions Architect - Professional

A multinational healthcare conglomerate is planning to migrate its core patient portal and clinical data processing applications from an on-premises datacenter to AWS. The environment consists of two main components: a VMware vSphere 7.0 cluster hosting 400 virtual machines (VMs) running Red Hat Enterprise Linux (RHEL) and Ubuntu, and a bare-metal cluster hosting 50 database servers running legacy IBM AIX and Oracle Solaris operating systems.

Due to strict HIPAA and PCI-DSS compliance regulations, the security team enforces the following constraints:
- No software agents or third-party packages can be installed on the bare-metal database servers.
- VMs within the restricted PCI-DSS network segment have no direct internet access, but can communicate with an on-premises central proxy server.
- The migration team must minimize administrative overhead on the hypervisor hosts while still gathering network dependency mapping for the application VMs to plan migration waves.

The organization wants to discover this environment, group resources into applications, and track migration progress using AWS Migration Hub.

Which TWO actions should the Solutions Architect take to meet these requirements?

Deploy the AWS Application Discovery Agentless Collector in the VMware environment to gather VM metadata and performance utilization. For the application VMs requiring network dependency mapping, install the Application Discovery Agent and configure the agent's proxy settings to route data through the central proxy.Answer
For the bare-metal database servers, manually populate the AWS Migration Hub import CSV template with server details and upload it. Group the imported database servers and the discovered application VMs into logical applications within AWS Migration Hub to track the migration progress.Answer
C
Install the AWS Application Migration Service (MGN) replication agent on the bare-metal database servers to automatically discover server configuration metrics and stream disk block-level data to the staging area via TCP port 1500.
D
Deploy the AWS Application Discovery Agentless Collector in the VMware environment to perform network dependency mapping for the RHEL and Ubuntu VMs, avoiding the need for individual agent installations.
E
Create a new transit VPC with AWS Transit Gateway to bypass the on-premises proxy, allowing the application VMs in the restricted PCI-DSS segment to send discovery data directly to the public AWS Application Discovery Service endpoints.

Answer

Deploy the AWS Application Discovery Agentless Collector in the VMware environment, install the Application Discovery Agent on the application VMs routing through the central proxy, and manually import the bare-metal database server specifications using the Migration Hub CSV import template.

Deploying the Agentless Collector on VMware provides a low-overhead inventory collection, while deploying the Agent-based collector on the application VMs captures the detailed process-level network connections required for application dependency mapping. The agents can be configured to use the existing central proxy for outbound connectivity to satisfy PCI-DSS constraints. For the bare-metal database servers running unsupported OSs (AIX/Solaris) where agents are forbidden, importing their data manually using the Migration Hub CSV template is the only viable discovery mechanism. Once both discovered and imported servers are available, they can be grouped into logical applications in Migration Hub to track the migration waves.

Step-by-Step Solution

Select the discovery tool for VMware VMs based on mapping and overhead requirements.

Deploy the Application Discovery Agentless Collector to gather general VM metadata with low overhead, but install the Application Discovery Agent on the application VMs because agentless discovery cannot capture process-level network dependency mappings required for planning migration waves.

Agent-based discovery is required for network connection mapping, while Agentless Collector minimizes hypervisor overhead for general inventory.

Configure agent network access in the restricted PCI-DSS segment.

Configure the Application Discovery Agents on the restricted VMs to route their outbound discovery traffic through the central proxy.

The Application Discovery Agent supports outbound communication via a proxy, satisfying security constraints without modifying the network architecture.

Address discovery for the legacy Unix bare-metal servers.

Prepare and upload a CSV file using the Migration Hub import template with specifications of the AIX and Solaris servers.

The Application Discovery Agent and Agentless Collector do not support bare-metal servers running AIX or Solaris, and security policies prohibit agent installations on these servers. Manual import is the supported alternative.

Group discovered and imported resources into applications in AWS Migration Hub.

Create application groups in AWS Migration Hub combining the discovered VMs and imported bare-metal databases.

Grouping resources allows tracking the migration progress of logical application stacks as a single unit on the Migration Hub dashboard.

Key Concept

Selecting and configuring AWS Application Discovery Service tools (Agent vs. Agentless vs. Manual Import) to satisfy compliance, operating system compatibility, and dependency mapping requirements.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic