A company needs to migrate 600\text{ TB} of unstructured data from an on-premises SMB file… — AWS Certified Solutions Architect - Professional

A company needs to migrate $600\text{ TB}$ of unstructured data from an on-premises SMB file share to an Amazon S3 bucket within a strict $40\text{-day}$ window. The company has a $200\text{ Mbps}$ internet connection, but only $100\text{ Mbps}$ can be allocated for the migration to avoid impacting production operations. During the migration, the on-premises data will continue to be modified, producing approximately $2\text{ TB}$ of new or changed files weekly. All migrated data must be encrypted at rest in Amazon S3 using a Customer Managed Key (CMK) in AWS KMS to comply with strict security auditing policies. After the migration, external business partners must be able to securely access specific subsets of the data using the SFTP protocol, authenticating against the company's existing on-premises Active Directory. Which migration and access strategy meets these requirements with the least administrative effort and lowest risk of exceeding the timeline?

A
Deploy an AWS DataSync agent on-premises. Configure a replication task with bandwidth throttling set to $100\text{ Mbps}$ to copy the data directly from the SMB share to the Amazon S3 bucket, using the AWS KMS Customer Managed Key (CMK). Configure AWS Transfer for SFTP with custom Lambda-based authentication that queries the on-premises Active Directory to grant external partners access.
Order 8 AWS Snowball Edge Storage Optimized devices. Create import jobs specifying the S3 bucket and the AWS KMS Customer Managed Key (CMK). Copy the initial dataset to the devices locally, ship them to AWS, and wait for the data to be imported. Deploy an AWS DataSync agent on-premises, and configure a task to sync the SMB share to the S3 bucket. Run the DataSync task to transfer the weekly delta changes. Create an AWS Transfer for SFTP endpoint configured with an AWS Directory Service AD Connector to authenticate external partners against the on-premises Active Directory.Cevap
C
Order 8 AWS Snowball Edge Storage Optimized devices. Create import jobs using the default AWS-managed KMS key (aws/s3) to simplify the initial import configuration. Copy the initial dataset to the devices locally, ship them, and allow AWS to import the data. Deploy an AWS DataSync agent on-premises, and run weekly tasks to sync the changes. Create an AWS Transfer for SFTP endpoint with an AD Connector for authentication. Modify the key policy of the AWS-managed KMS key to delegate decryption rights to a separate audit account.
D
Request a new $1\text{ Gbps}$ AWS Direct Connect connection. Once provisioned, deploy an AWS DataSync agent on-premises and configure a task to replicate the $600\text{ TB}$ dataset directly to the Amazon S3 bucket using the Customer Managed Key (CMK) for encryption. Create an AWS Transfer for SFTP endpoint using service-managed authentication to manage the external business partners.

Cevap

The correct strategy requires ordering 8 AWS Snowball Edge Storage Optimized devices using a KMS Customer Managed Key for initial bulk migration, deploying AWS DataSync on-premises for transferring the weekly delta changes, and setting up AWS Transfer for SFTP with an AWS Directory Service AD Connector for partner authentication.

The correct strategy uses AWS Snowball Edge Storage Optimized devices to transfer the bulk data offline. Since transferring

600\text{ TB}

over a

100\text{ Mbps}

link takes over

550\text{ days}

, an offline migration is necessary to meet the

40\text{-day}

timeline. Deploying an AWS DataSync agent on-premises allows the weekly

2\text{ TB}

delta changes to be synchronized online, which takes less than two days. Specifying the Customer Managed Key (CMK) during the Snowball job creation ensures compliance with custom auditing policies. Configuring AWS Transfer for SFTP with an AWS Directory Service AD Connector satisfies the partner SFTP access requirements while authenticating users against the existing on-premises Active Directory.

Adım Adım Çözüm

Calculate the time required to transfer

600\text{ TB}

over the allocated

100\text{ Mbps}

network connection.

100\text{ Mbps}

, the transfer rate is approximately

1.08\text{ TB/day}

, meaning it would take over

550\text{ days}

to complete the copy. This confirms an offline shipping mechanism is required.

Establishing the baseline constraint ensures that online transfer is ruled out for the initial bulk data migration.

Select the appropriate Snowball Edge device quantity and configuration.

Since each Snowball Edge Storage Optimized device has approximately

80\text{ TB}

of usable storage, ordering 8 devices allows parallel local data copying and shipping, easily fitting within the

40\text{-day}

window.

This guarantees that the initial bulk data is migrated safely within the project timeline constraints.

Select and configure the encryption key mechanism.

The import jobs must be configured with a Customer Managed Key (CMK). AWS-managed keys (such as aws/s3) are ineligible because their policies cannot be customized to delegate access to external auditing accounts.

This satisfies the security auditing requirements for data at rest in Amazon S3.

Configure the delta synchronization and partner access methods.

Deploy an AWS DataSync agent on-premises to sync weekly modifications (

2\text{ TB}

takes less than two days over

100\text{ Mbps}

). Set up AWS Transfer for SFTP using an AD Connector to route authentication requests to the existing on-premises Active Directory.

This enables continuous updates during the migration process and provides partners with secure, federated access without duplicating credentials.

Anahtar Kavram

Selecting the optimal hybrid migration model based on network transfer constraints, utilizing offline import mechanisms for bulk data, delta sync for modifications, and standard identity federation for file protocol endpoints.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru