An enterprise is planning to migrate a legacy high-frequency trading platform and its supp… — AWS Certified Solutions Architect - Professional

An enterprise is planning to migrate a legacy high-frequency trading platform and its supporting workloads to AWS. The on-premises infrastructure consists of:
- 50 physical bare-metal servers running a custom Linux distribution with a proprietary, non-standard kernel. Corporate security compliance policies strictly prohibit modifying the kernel, installing third-party kernel modules, or deploying any resident agent software on these latency-sensitive systems.
- 250 virtual machines running on Microsoft Hyper-V (Windows Server 2022).
The security compliance team mandates the following rules:
- Deep packet SSL/TLS inspection is active on all outbound firewalls and proxies.
- No direct outbound connections to the public internet are allowed; all traffic must transit through an explicit outbound proxy.
The migration architect needs to:
1. Map network dependencies at the process level for the Hyper-V virtual machines hosting the transactional databases.
2. Obtain CPU, RAM, and disk utilization data for all systems to assist in right-sizing the target AWS instances.
3. Consolidate and track all discovery and migration status data within AWS Migration Hub.

Which approach will satisfy these discovery and tracking requirements with the least operational overhead?

A
Deploy the AWS Application Discovery Agentless Collector on the Hyper-V hosts. For the bare-metal servers, install the AWS Application Discovery Agent and configure it to bypass the proxy. For the Hyper-V database VMs, enable the database discovery feature in the Agentless Collector to map process-level network connections.
B
Deploy the AWS Application Migration Service (MGN) replication agent on all Hyper-V virtual machines and physical bare-metal servers. Utilize the replication agent's telemetry to perform dependency mapping in AWS Migration Hub, routing the replication traffic through the SSL/TLS inspecting proxy over TCP port 1500.
Deploy the AWS Application Discovery Agentless Collector on the Hyper-V hosts to gather configuration and performance history for the virtual machines. Export the bare-metal server configurations and performance metrics to a CSV file and import them into AWS Migration Hub. Install the AWS Application Discovery Agent on the Hyper-V database VMs, and import the proxy's root CA certificate into the trusted certificate store of the VM operating systems.Answer
D
Deploy the AWS Application Discovery Agentless Collector on both the Hyper-V hosts and the physical bare-metal servers. Configure the collector to perform WMI and SSH scans across the network segments to gather configuration and performance history. Enable agentless process-level dependency mapping in the collector settings.

Answer

Deploy the AWS Application Discovery Agentless Collector on the Hyper-V hosts to gather configuration and performance history for the virtual machines. Export the bare-metal server configurations and performance metrics to a CSV file and import them into AWS Migration Hub. Install the AWS Application Discovery Agent on the Hyper-V database VMs, and import the proxy's root CA certificate into the trusted certificate store of the VM operating systems.

Deploying the Agentless Collector on Hyper-V hosts avoids virtual machine-level agent overhead while gathering VM metrics. Manual CSV import for bare-metal servers respects the policy against agent installation on low-latency kernels. The Discovery Agent is required on the database VMs to map process-level network dependencies, and importing the proxy's root CA certificate ensures the agent can establish secure HTTPS connections through the SSL/TLS inspecting proxy.

Step-by-Step Solution

Determine the discovery mechanism for physical bare-metal servers under the agent restriction constraint.

Since agents cannot be installed on the bare-metal servers due to custom kernel and performance restrictions, and they are not hosted on a supported hypervisor, the configuration and performance details must be collected using custom tools/scripts and imported manually into AWS Migration Hub using the import CSV template.

This avoids violating security and compatibility requirements.

Determine the discovery mechanism for Hyper-V virtual machines to capture performance metrics and process-level network dependencies.

Deploy the AWS Application Discovery Agentless Collector on Hyper-V hosts to collect configuration and performance metrics without agent overhead. For the database servers requiring process-level network dependency mapping, deploy the AWS Application Discovery Agent.

The Agentless Collector does not support process-level network dependency mapping, which requires the local agent.

Address network security and outbound SSL/TLS inspection requirements for the deployed agents.

Configure the AWS Application Discovery Agents to trust the outbound proxy by importing the proxy's root CA certificate into the trusted certificate store of the VM operating systems.

The Discovery Agent communicates via outbound HTTPS. Without trusting the SSL-inspecting proxy's CA, HTTPS certificate verification will fail, preventing discovery data transmission.

Consolidate and track all discovery and migration status data.

Imported CSV data, Agentless Collector metadata, and Agent-based dependency data will all be consolidated and visible within the centralized AWS Migration Hub dashboard.

AWS Migration Hub integrates natively with both the Agent and Agentless Collector, as well as imported CSV discovery records.

Key Concept

AWS Application Discovery Service supports agentless discovery for VMware and Hyper-V environments for system specifications and performance metrics. However, process-level network dependency mapping requires the installation of the AWS Application Discovery Agent. Physical bare-metal environments or machines with unsupported configurations must utilize CSV imports. When security controls enforce SSL/TLS inspection on outbound proxies, the agent's OS must be updated to trust the proxy's root CA certificate to avoid SSL validation failure.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic