Examkin

Question

Difficulty: MediumLarge-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

An enterprise needs to migrate a 300 TB300\text{ TB} dataset of seismic analysis files from an on-premises SMB file share to Amazon S3 within a strict 10-day migration window. The enterprise has a 100 Mbps100\text{ Mbps} dedicated internet connection available for this migration. Following the initial migration, legacy clients must be able to upload daily report files of approximately 50 GB50\text{ GB} in total using the SFTP protocol, authenticating against the enterprise's existing on-premises Active Directory. Furthermore, a data analysis application hosted in a separate AWS account must be able to access the migrated data securely using server-side encryption with AWS Key Management Service (AWS KMS). Which two of the following options should the solutions architect choose to meet these requirements? (Choose two.)

  1. Order multiple AWS Snowball Edge Storage Optimized devices to transfer the bulk dataset, and specify a Customer Managed Key (CMK) for encryption to allow cross-account access by modifying the key policy.Answer
  2. Create an AWS Transfer Family SFTP-enabled server endpoint, and configure it to use AWS Directory Service AD Connector to authenticate users against the on-premises Active Directory.Answer
  3. C
    Deploy AWS DataSync agents on-premises to copy the 300 TB300\text{ TB} SMB share directly to Amazon S3 over the 100 Mbps100\text{ Mbps} connection using scheduled tasks.
  4. D
    Order multiple AWS Snowball Edge Storage Optimized devices to transfer the bulk dataset, encrypting the data with the default AWS-managed KMS key (aws/s3) and granting cross-account access via S3 bucket policies.
  5. E
    Deploy an AWS Transfer Family SFTP-enabled server endpoint inside a central VPC, and route authentication traffic transitively through a Direct Connect Gateway to connect the on-premises Active Directory with spoke VPCs.

Answer

Ordering multiple AWS Snowball Edge Storage Optimized devices using a Customer Managed Key (CMK) for encryption, and creating an AWS Transfer Family SFTP-enabled server endpoint using AWS Directory Service AD Connector for user authentication.
The correct architecture requires offline transfer via AWS Snowball Edge due to the network bandwidth constraint, using a Customer Managed Key (CMK) to allow cross-account key delegation, and integrating AWS Transfer Family with AWS Directory Service AD Connector for on-premises AD authentication.

Step-by-Step Solution

1
Calculate the transfer time for the initial migration of 300 TB300\text{ TB} over the available 100 Mbps100\text{ Mbps} bandwidth.
Determined that transferring 300 TB300\text{ TB} over 100 Mbps100\text{ Mbps} takes approximately 277 days, which violates the 10-day requirement. Therefore, offline physical migration using AWS Snowball Edge is mandatory.
Ensure that the proposed migration method conforms to the temporal constraints.
2
Evaluate KMS key configuration for cross-account read access to the migrated S3 data.
Concluded that a Customer Managed Key (CMK) must be selected during the Snowball Edge job configuration so that its key policy can be updated to permit decryption by the application role in the other AWS account.
AWS-managed KMS keys do not support policy modification and cannot be shared across different accounts.
3
Select the appropriate authentication service for AWS Transfer Family.
Chose AWS Directory Service AD Connector to integrate the Transfer Family SFTP endpoint directly with the on-premises Active Directory domain controllers.
Allows legacy SFTP clients to authenticate using their existing Active Directory credentials without custom credentials management.

Key Concept

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family with cross-account access and Active Directory integration.
Rate this question

Topics

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

More questions from this topic