Examkin

Soru

Zorluk: OrtaLarge-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

An enterprise needs to migrate a 250 TB250\text{ TB} dataset of legacy files from an on-premises NFS file system to an Amazon S3 bucket. The enterprise has a dedicated 100 Mbps100\text{ Mbps} network connection to AWS. The migration must be completed within a 1414-day maintenance window. The migrated data must be encrypted at rest using an AWS Key Management Service (AWS KMS) key that allows the enterprise to delegate cross-account decryption access to an external auditing team. Which strategy should a solutions architect recommend to meet these requirements?

  1. A
    Deploy an AWS DataSync agent on-premises to transfer the data from the NFS file system to the Amazon S3 bucket over the 100 Mbps100\text{ Mbps} network connection, utilizing task scheduling and built-in compression to optimize transfer performance.
  2. Order three AWS Snowball Edge Storage Optimized devices. Specify an AWS KMS Customer Managed Key (CMK) when creating the import jobs. Copy the data from the NFS file system to the devices using the Snowball client, and ship the devices back to AWS.Cevap
  3. C
    Order three AWS Snowball Edge Storage Optimized devices. Specify the default AWS-managed key (`aws/s3`) when creating the import jobs to encrypt the objects in S3, and grant cross-account read access using the S3 bucket policy.
  4. D
    Establish an AWS Direct Connect connection with a Hosted Connection of 100 Mbps100\text{ Mbps}. Use an AWS Transit Gateway and a transit Virtual Interface (VIF) to route AWS DataSync traffic privately to an S3 interface endpoint, completing the transfer over the private network.

Cevap

Order AWS Snowball Edge Storage Optimized devices and configure the import jobs to use an AWS KMS Customer Managed Key (CMK) to allow cross-account access.
The correct answer correctly identifies that transferring 250 TB250\text{ TB} of data over a 100 Mbps100\text{ Mbps} network connection takes too long, making offline migration with AWS Snowball Edge devices necessary. Additionally, it accurately points out that a Customer Managed Key (CMK) must be selected for encryption during the Snowball import configuration, because the key policy of default AWS-managed keys (`aws/s3`) cannot be edited to delegate decryption permissions to external AWS accounts.

Adım Adım Çözüm

1
Calculate the time required to migrate 250 TB250\text{ TB} over the existing 100 Mbps100\text{ Mbps} network link.
The transfer will take approximately 231231 days under ideal conditions.
This shows that an online data transfer mechanism is not viable for the 1414-day timeline, necessitating an offline data transfer using AWS Snowball Edge.
2
Select the appropriate storage medium for offline transfer and evaluate storage limits.
Three AWS Snowball Edge Storage Optimized devices are required to store the 250 TB250\text{ TB} dataset.
Shipping and loading three Snowball Edge devices will comfortably take 7−107-10 days, which fits within the 1414-day window.
3
Address the security requirement to delegate decryption access to an external auditing team in another account.
Select a Customer Managed Key (CMK) instead of an AWS-managed key.
Default AWS-managed keys (like `aws/s3`) do not allow key policy customization, meaning cross-account decryption cannot be configured. A CMK allows modifying the key policy to delegate cross-account access.

Anahtar Kavram

Selecting between online and offline data migration based on bandwidth constraints, and managing cross-account access for KMS-encrypted S3 objects.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

Bu konudan daha fazla soru