Examkin

Question

Difficulty: MediumLarge-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

An enterprise is migrating a 650 TB650\text{ TB} dataset of unstructured media files from an on-premises NFS file system to an Amazon S3 bucket in a target AWS account (Account B). The enterprise currently has a 1 Gbps1\text{ Gbps} AWS Direct Connect connection terminated in a shared services AWS account (Account A), with a 50 Mbps50\text{ Mbps} backup internet link. The migration must be completed within a strict timeline of 2121 days. Due to regulatory compliance, all data must be encrypted at rest using an AWS KMS Customer Managed Key (CMK), and the data transfer must not traverse the public internet.

Which combination of actions will meet these requirements most efficiently? (Select TWO.)

  1. Create AWS Snowball Edge Storage Optimized import jobs in Account B specifying the target Amazon S3 bucket, and request delivery of the devices to the on-premises datacenter.Answer
  2. Configure a Customer Managed Key (CMK) in Account B and update its key policy to grant the Snowball import IAM role permissions to decrypt and encrypt with the key.Answer
  3. C
    Deploy AWS DataSync agents on-premises and configure a task to transfer the data over the AWS Direct Connect connection directly to the Amazon S3 bucket in Account B.
  4. D
    Create AWS Snowball Edge import jobs in Account B using the default AWS-managed KMS key (`aws/s3`) to encrypt the data during transit and at rest.
  5. E
    Configure an AWS DataSync task using a Transit Gateway with a Transit VIF over the Direct Connect link to route traffic through Account A to Account B.

Answer

To migrate the data within the timeline, AWS Snowball Edge devices must be ordered from the target account (Account B). A Customer Managed Key (CMK) must be configured in Account B with its key policy updated to allow the Snowball import role to use the key.
The correct actions are to order AWS Snowball Edge Storage Optimized devices from the target account (Account B) and use a Customer Managed Key (CMK) in Account B with a key policy that trusts the Snowball import role. Since 650 TB650\text{ TB} cannot be transferred over the 1 Gbps1\text{ Gbps} link within 2121 days, an offline transfer using Snowball Edge is required. Ordering the devices from the target account allows importing directly to the destination bucket. A Customer Managed Key is necessary because AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

1
Calculate the time required to transfer the data over the network link.
Transferring 650 TB650\text{ TB} over a 1 Gbps1\text{ Gbps} link requires at least 6060 days, which is much greater than the 2121-day limit.
To determine whether online (DataSync) or offline (Snowball) transfer is required.
2
Order AWS Snowball Edge Storage Optimized devices directly from the target account (Account B).
Data will be imported directly into the destination S3 bucket in Account B after the devices are returned to AWS.
To avoid the need for copying data across accounts after the physical transfer.
3
Configure a Customer Managed Key (CMK) in Account B and grant access to the Snowball import role.
The Snowball import process can write encrypted data to the S3 bucket.
AWS-managed keys cannot be shared cross-account, so a Customer Managed Key is required.

Key Concept

Selecting the correct large-scale data transfer mechanism based on bandwidth and timeline constraints, and configuring cross-account IAM and KMS permissions.
Estimated Time:2m 0s
Rate this question

Topics

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

More questions from this topic