Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

For the separate situation An AWS Enterprise Support customer can physically transport portable drives to an AWS transfer facility but cannot upload 500 TB over its office WAN, Reserve AWS Data Transfer Terminal and bring the storage devices for high-speed ingestion could be useful. Data Transfer Terminal accepts customer-owned devices at secured physical facilities; Snow Family devices are unavailable to new customers.

Configure AWS Transfer Family with SFTP and approved authentication solves the related scenario A partner requires managed SFTP uploads into an AWS-hosted S3 bucket; transfer Family presents managed file-transfer protocols backed by AWS storage.

Use AWS DataSync with suitable source and target locations and scheduled verification would address a different requirement: A NAS holds 80 TB of files that must move to EFS over a reliable WAN without custom sync scripts. DataSync transfers supported file data with managed copy and integrity features.

Although Freeze or redirect writes to an agreed single writer before promoting the AWS target can be valid when A database is cut over while on-premises writes continue to the old primary, it targets a different technical condition. Split-brain writes create diverging database state during migration.

This alternative, Deploy Resolver inbound endpoints and forwarding from corporate DNS where appropriate, is appropriate when A migration fails only for internal users because on-premises DNS queries do not resolve private AWS names. Hybrid DNS forwarding provides private VPC-name resolution to external enterprise resolvers.

For the separate situation A source service must operate simultaneously with the new AWS environment during a short validation window, Configure bounded weighted DNS traffic shifting with compatible data and rollback plans could be useful. Weighted routing allows controlled traffic split while both application backends remain operational.

Freeze or redirect writes to an agreed single writer before promoting the AWS target would address a different requirement: A database is cut over while on-premises writes continue to the old primary. Split-brain writes create diverging database state during migration.

For the separate situation After application cutover, some clients still resolve an old on-premises hostname because DNS TTLs are high, Lower appropriate DNS TTLs ahead of cutover and monitor resolver propagation could be useful. Clients may retain previous DNS answers until caching periods expire.

Configure bounded weighted DNS traffic shifting with compatible data and rollback plans solves the related scenario A source service must operate simultaneously with the new AWS environment during a short validation window; weighted routing allows controlled traffic split while both application backends remain operational.

For the separate situation After application cutover, some clients still resolve an old on-premises hostname because DNS TTLs are high, Lower appropriate DNS TTLs ahead of cutover and monitor resolver propagation could be useful. Clients may retain previous DNS answers until caching periods expire.

Validate domain delegation and authoritative DNS ownership before Route 53 updates solves the related scenario A migration plan assumes the production domain can be changed even though the external registrar zone remains authoritative elsewhere; changes in a nonauthoritative zone do not affect public DNS responses.

Although Deploy Resolver inbound endpoints and forwarding from corporate DNS where appropriate can be valid when A migration fails only for internal users because on-premises DNS queries do not resolve private AWS names, it targets a different technical condition. Hybrid DNS forwarding provides private VPC-name resolution to external enterprise resolvers.

For the separate situation A source service must operate simultaneously with the new AWS environment during a short validation window, Configure bounded weighted DNS traffic shifting with compatible data and rollback plans could be useful. Weighted routing allows controlled traffic split while both application backends remain operational.

Deploy Resolver inbound endpoints and forwarding from corporate DNS where appropriate solves the related scenario A migration fails only for internal users because on-premises DNS queries do not resolve private AWS names; hybrid DNS forwarding provides private VPC-name resolution to external enterprise resolvers.

Lower appropriate DNS TTLs ahead of cutover and monitor resolver propagation would address a different requirement: After application cutover, some clients still resolve an old on-premises hostname because DNS TTLs are high. Clients may retain previous DNS answers until caching periods expire.

Freeze or redirect writes to an agreed single writer before promoting the AWS target solves the related scenario A database is cut over while on-premises writes continue to the old primary; split-brain writes create diverging database state during migration.

Validate domain delegation and authoritative DNS ownership before Route 53 updates would address a different requirement: A migration plan assumes the production domain can be changed even though the external registrar zone remains authoritative elsewhere. Changes in a nonauthoritative zone do not affect public DNS responses.

This alternative, Configure bounded weighted DNS traffic shifting with compatible data and rollback plans, is appropriate when A source service must operate simultaneously with the new AWS environment during a short validation window. Weighted routing allows controlled traffic split while both application backends remain operational.

Configure backup hybrid identity connectivity and test the path under circuit failure would address a different requirement: A migration requires workloads to access a corporate IdP when a Direct Connect circuit fails. Authentication availability is part of the recovery path for migrated services.

For the separate situation A migrated Windows service must retain Kerberos access to users in the existing on-premises AD forest while using AWS Managed Microsoft AD, Configure a supported Active Directory trust and hybrid DNS and network connectivity could be useful. Directory trust enables cross-forest authentication when DNS and Kerberos paths work between the forests.

Remove and rotate the secret and use Secrets Manager or temporary role credentials solves the related scenario An on-premises service account password is embedded in a migration script checked into Git; secret rotation and controlled runtime retrieval prevent repeating source-code credential leaks.

For the separate situation A new AWS landing zone must enforce region restrictions before the first migration wave lands, Establish appropriate Organizations OUs and SCP guardrails before account enrollment could be useful. Precutover governance prevents new workloads from deploying outside authorized boundaries.

Remove and rotate the secret and use Secrets Manager or temporary role credentials solves the related scenario An on-premises service account password is embedded in a migration script checked into Git; secret rotation and controlled runtime retrieval prevent repeating source-code credential leaks.

Although Configure backup hybrid identity connectivity and test the path under circuit failure can be valid when A migration requires workloads to access a corporate IdP when a Direct Connect circuit fails, it targets a different technical condition. Authentication availability is part of the recovery path for migrated services.

For the separate situation A migrated Windows service must retain Kerberos access to users in the existing on-premises AD forest while using AWS Managed Microsoft AD, Configure a supported Active Directory trust and hybrid DNS and network connectivity could be useful. Directory trust enables cross-forest authentication when DNS and Kerberos paths work between the forests.

Remove and rotate the secret and use Secrets Manager or temporary role credentials solves the related scenario An on-premises service account password is embedded in a migration script checked into Git; secret rotation and controlled runtime retrieval prevent repeating source-code credential leaks.

Although Provide compatible directory connectivity through AWS Directory Service or managed AD integration can be valid when A migrated application previously used Active Directory integrated authentication for file shares, it targets a different technical condition. Directory-aware workloads require working identity and domain services after relocation.

Configure backup hybrid identity connectivity and test the path under circuit failure solves the related scenario A migration requires workloads to access a corporate IdP when a Direct Connect circuit fails; authentication availability is part of the recovery path for migrated services.

Although Provide compatible directory connectivity through AWS Directory Service or managed AD integration can be valid when A migrated application previously used Active Directory integrated authentication for file shares, it targets a different technical condition. Directory-aware workloads require working identity and domain services after relocation.

This alternative, Configure a supported Active Directory trust and hybrid DNS and network connectivity, is appropriate when A migrated Windows service must retain Kerberos access to users in the existing on-premises AD forest while using AWS Managed Microsoft AD. Directory trust enables cross-forest authentication when DNS and Kerberos paths work between the forests.

Although Provide compatible directory connectivity through AWS Directory Service or managed AD integration can be valid when A migrated application previously used Active Directory integrated authentication for file shares, it targets a different technical condition. Directory-aware workloads require working identity and domain services after relocation.

Establish appropriate Organizations OUs and SCP guardrails before account enrollment would address a different requirement: A new AWS landing zone must enforce region restrictions before the first migration wave lands. Precutover governance prevents new workloads from deploying outside authorized boundaries.

This alternative, Remove and rotate the secret and use Secrets Manager or temporary role credentials, is appropriate when An on-premises service account password is embedded in a migration script checked into Git. Secret rotation and controlled runtime retrieval prevent repeating source-code credential leaks.