An enterprise is migrating a 280\text{ TB} dataset from an on-premises NFS file system to … — AWS Certified Solutions Architect - Professional

An enterprise is migrating a $280\text{ TB}$ dataset from an on-premises NFS file system to an Amazon S3 bucket located in the company's Production AWS account. The entire migration must be completed within 3 weeks. The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but only $200\text{ Mbps}$ of this bandwidth can be dedicated to the migration project. The solution must support automatic daily replication of incremental changes until the final cutover, preserve file metadata, and ensure that the data is encrypted at rest using a key that can be shared with a separate Analytics AWS account. Which strategy will meet these requirements within the specified timeframe?

A
Deploy multiple AWS DataSync agents on-premises. Configure an AWS DataSync task to copy the entire $280\text{ TB}$ dataset directly from the NFS share to the target S3 bucket over the dedicated $200\text{ Mbps}$ Direct Connect link, encrypting the data at rest with a Customer Managed KMS key (CMK) that allows cross-account access.
B
Order multiple AWS Snowball Edge Storage Optimized devices. Configure the import job to point to the target S3 bucket using the default AWS-managed KMS key (`aws/s3`) for encryption at rest. Ship the devices to AWS. Once the bulk import is complete, deploy an AWS DataSync agent on-premises to sync incremental changes from the NFS share to the S3 bucket over the dedicated Direct Connect link.
Order multiple AWS Snowball Edge Storage Optimized devices. Configure the import job to point to the target S3 bucket, specifying a Customer Managed KMS key (CMK) configured with a key policy that allows cross-account access. Copy the bulk data to the devices and ship them back to AWS. Once the data is imported, deploy an AWS DataSync agent on-premises to copy daily incremental changes from the NFS share to the target S3 bucket over the dedicated Direct Connect bandwidth using the same CMK.Answer
D
Order multiple AWS Snowball Edge Storage Optimized devices to import the bulk data into the target S3 bucket. To sync incremental updates, deploy an AWS DataSync agent on-premises and configure a Direct Connect Gateway to route the replication traffic through a transit VPC network directly to the S3 bucket, assuming the Direct Connect Gateway will route transitive traffic between the VPCs without an AWS Transit Gateway.

Answer

The correct strategy is to order multiple AWS Snowball Edge Storage Optimized devices for the initial bulk data import using a Customer Managed KMS key (CMK) that allows cross-account access, and then use an on-premises AWS DataSync agent to replicate incremental changes over the Direct Connect link using the same CMK.

The correct strategy uses AWS Snowball Edge devices for the bulk import because transferring

280\text{ TB}

over a dedicated

200\text{ Mbps}

link would take approximately 130 days, which fails the 3-week timeline constraint. AWS DataSync is then configured to sync daily incremental changes over the Direct Connect link. Since the target bucket is in a different account and the data must be shared with an Analytics account, a Customer Managed KMS key (CMK) is required because AWS-managed keys (`aws/s3`) cannot be configured with custom policies for cross-account sharing.

Step-by-Step Solution

Calculate the transfer time over the network link to determine if offline transfer is required.

200\text{ Mbps}

, the maximum theoretical throughput is

25\text{ MB/s}

(

2.16\text{ TB/day}

). Transferring

280\text{ TB}

requires

280 / 2.16 \approx 129.6\text{ days}

, which exceeds the 21-day (3-week) limit. An offline transfer using AWS Snowball Edge is mandatory.

To verify if the available network bandwidth is sufficient for direct migration of the bulk data.

Evaluate the encryption and cross-account sharing requirements for the target S3 bucket.

The default AWS-managed S3 KMS key (`aws/s3`) cannot be shared across accounts. A Customer Managed Key (CMK) must be created in the Production account, and its key policy must grant permissions to the Snowball service, the on-premises DataSync agent, and the Analytics account roles.

To satisfy security compliance and cross-account access requirements.

Define the architecture for capturing updates after the bulk transfer.

Once the bulk data is imported into S3 via Snowball Edge, configure an AWS DataSync agent on-premises to sync incremental updates over the

200\text{ Mbps}

network allocation. Daily incrementals will fit easily within the network bandwidth.

To achieve metadata preservation and low-overhead incremental updates until the cutover.

Key Concept

Selecting the optimal hybrid migration path using Snowball Edge for bulk transfer and DataSync for incremental network synchronization, while using Customer Managed Keys (CMKs) to satisfy cross-account key sharing policies.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic