Question 590
A manufacturing organization plans a cloud migration wave near a legally mandated audit freeze. Operations cannot change software during the freeze, but the migration coordinator has scheduled a database engine upgrade and infrastructure cutover on the same date. Which sequencing decision reduces regulatory and rollback risk?
- Treat database engine upgrade and infrastructure cutover as one irreversible change during the audit freeze, without testing rollback separately.
- Separate unsupported simultaneous changes and schedule pilot, upgrade and cutover windows around the approved freeze with clear rollback gates.
- Perform all changes during the freeze without a documented exception because cloud migration dates override controls.
- Perform an out-of-window upgrade in production and rely on S3 backups without testing database-level compatibility or restoring data.
Explanation
Correct Answer
B:Distinct change stages reduce compounded failure causes and preserve audit-approved change control boundaries.
Incorrect Answers
A:Combining unapproved simultaneous changes defeats the mandated freeze and obscures which change caused a failure.
C:Ignoring a mandated freeze creates compliance risk and removes planned rollback capacity.
D:Backups alone do not authorize a change during a freeze or demonstrate that the upgrade and cutover can be rolled back safely.
Question 591
A company has several terabytes of files in an on-premises SMB share. Its new application will access the files through Amazon EFS. During the migration month, changed source files must be copied each evening with verification. A stable network link is available and the data must remain on the source until cutover. Which solution best fits?
- Use AWS DataSync with an SMB source and EFS destination, scheduling recurring incremental transfer tasks and validating the results.
- Use AWS DMS full-load-plus-CDC with an SMB share as the source and Amazon EFS as the database target.
- Configure a one-off SMB-to-S3 bulk copy and assume that a separate application EFS mount automatically receives nightly modified source files.
- Order offline Snowball Edge devices for every nightly incremental refresh without checking current new-customer service eligibility or available network synchronization.
Explanation
Correct Answer
A:DataSync supports SMB sources and EFS destinations with scheduled, incremental file transfer and verification features; this matches the network-connected recurring migration.
Incorrect Answers
B:DMS supports database endpoint/transaction migration, not arbitrary SMB filesystem incremental file replication into EFS; DataSync supports both file locations.
C:S3 upload is not an incremental SMB-to-EFS synchronization path; DataSync schedules verified changes directly to the supported EFS destination.
D:Snowball Edge is closed to new customers and offline transport is poorly suited to nightly incremental changes over an already viable link; DataSync is the supported recurring approach.
Question 592
A data center hosts a large fleet of supported physical and VMware application servers. The business requires rehosting to EC2 with continuous block-level replication and a short cutover window, without redesigning the applications. Which AWS migration service should be evaluated?
- Use AWS VM Import/Export to create a one-time EC2 AMI for each server, expecting it to continuously replicate future source block changes through cutover.
- Use AWS DMS full-load-plus-CDC for all database changes but do not replicate or prepare the source applications operating-system disks or boot configuration.
- Use AWS Application Migration Service (MGN) to replicate supported source servers and orchestrate test and cutover launches.
- Use AWS DMS full load plus CDC for the applications database and assume OS images, boot configuration and installed application processes are migrated with it.
Explanation
Correct Answer
C:MGN supports lift-and-shift server rehosting through continuous replication and controlled AWS launch/cutover stages.
Incorrect Answers
A:VM Import/Export supports image import but not the requested agent-driven continuous block replication and centrally orchestrated short downtime cutover.
B:DMS can migrate a supported database tier; it does not provide the whole-server block replication and launchable EC2 rehost workflow required.
D:DMS handles supported data stores. It does not capture operating-system volumes and construct launchable whole-server rehosts as MGN does.
Question 593
A company needs to migrate a heavily used Oracle database to Amazon RDS for PostgreSQL. Table schemas and stored procedures differ between engines, while replication of ongoing source transactions is required until cutover. Which combination addresses the two distinct needs?
- Run AWS DMS full-load-plus-CDC directly from Oracle to PostgreSQL without performing a source-to-target schema/procedure compatibility assessment.
- Use AWS Schema Conversion Tool for supported heterogeneous schema/code conversion and AWS DMS for data migration and supported CDC.
- Use only a one-time Schema Conversion Tool output and skip continuous DMS change replication while Oracle continues receiving writes.
- Convert stored procedures with Schema Conversion Tool and complete only a one-time static data export, leaving continued Oracle transactions unreplicated until cutover.
Explanation
Correct Answer
B:SCT handles compatible schema and code transformation while DMS transfers data and can maintain changes during the migration window.
Incorrect Answers
A:DMS moves supported table data and changes, but Oracle procedures and schema types can require separate conversion and validation using SCT or equivalent tooling.
C:Schema conversion addresses code compatibility but does not move all live changes to the PostgreSQL target before cutover; DMS CDC closes that gap.
D:SCT addresses code/schema differences but does not provide sustained source change replication; DMS CDC is needed for the live writes during the migration window.
Question 594
In November 2026, a scientific organization with AWS Enterprise Support has already reserved an AWS Data Transfer Terminal facility to upload 700 TB from a research site whose 50-Mbps connection is insufficient. The customer transports its own portable storage and must meet explicit data-at-rest and in-transit encryption requirements. A technician claims the secure terminal suite and its dedicated fiber links automatically encrypt all traffic. Which security correction is necessary before the data movement begins?
- Encrypt the portable drives but upload over plaintext connections because physical access to the Data Transfer Terminal suite automatically protects all bytes in transit.
- Encrypt the customer-owned portable media before transport, use TLS or other supported encryption for transfers to S3, tightly control credentials and keys, and verify uploaded objects.
- Use encrypted TLS uploads but carry unencrypted portable drives from the source site because the secured terminal room guarantees portable-media confidentiality during the journey.
- Enable S3 default SSE-KMS encryption at the destination and assume that setting retroactively encrypts the portable drives and the fiber link between the terminal and AWS.
Explanation
Correct Answer
B:The Data Transfer Terminal security guide expressly places responsibility for encryption on customers: portable storage must be protected at rest and the network transfer should use secure protocols such as TLS, with controlled keys and validation of delivered objects.
Incorrect Answers
A:Encrypting media at rest is necessary but the secure terminal facility and its fiber connection do not provide transport-layer encryption by default; protect the network upload separately.
C:Transport security does not replace at-rest encryption for portable storage that can be lost or accessed before arrival at the terminal.
D:SSE-KMS protects objects stored in Amazon S3, not bytes on portable media or in the physical terminal connection before they reach S3; use layered encryption end to end.
Question 595
A retailer receives batch order files from partners over SFTP and wants to retire the on-premises SFTP server. Partner SSH keys and managed user access must continue to work, while files are delivered directly into S3. Which managed migration target best fits?
- Use AWS Transfer Family SFTP connectors that periodically pull files from partner-hosted servers, although each partner must initiate uploads into the company-hosted endpoint.
- Configure Transfer Family SFTP connectors to pull from partner servers instead of creating an SFTP server endpoint that partners can upload into.
- Use AWS Transfer Family for an SFTP server backed by S3 with appropriately configured identity provider and per-partner access controls.
- Expose a Transfer Family SFTP server backed only by Amazon EFS and omit the required S3 destination integration and partner-specific identity mapping.
Explanation
Correct Answer
C:Transfer Family exposes a managed SFTP endpoint integrated with S3 and customer identity configuration, replacing maintenance of the on-premises server.
Incorrect Answers
A:SFTP connectors are client-initiated outbound transfers to remote servers; this use case needs a managed inbound SFTP server for partners to push to S3.
B:A connector is a managed SFTP client; partners requiring inbound client sessions must connect to a managed Transfer Family server with the S3-backed destination.
D:Transfer Family supports SFTP but the storage backend and user identity configuration must be S3-backed and scoped to the named partner requirements.
Question 596
A manufacturing data center will keep a large file share on premises for a year, but AWS analytics need low-latency local caching and S3-backed storage while systems gradually move. Which hybrid storage service should the architect consider?
- Deploy AWS DataSync as a nightly cloud migration task but expect on-premises file users to read synchronously from a local managed cache through the task.
- Build a nightly S3-to-SMB DataSync synchronization job but remove all local file caching from applications that require low-latency read-through access.
- Use direct S3 API operations in on-premises applications and eliminate file protocol access and the required local cache without code changes.
- Evaluate AWS Storage Gateway File Gateway to expose supported file protocols with cached access to objects stored in S3.
Explanation
Correct Answer
D:File Gateway can bridge on-premises file access to S3-backed storage with local caching during hybrid migration.
Incorrect Answers
A:DataSync copies files between locations; it is not the continually mounted local NFS/SMB cache and S3-backed filesystem presentation provided by File Gateway.
B:Scheduled copy tasks are different from an always-mounted, locally cached S3 File Gateway share accessible through file protocols.
C:Direct object APIs do not reproduce existing mounted NFS/SMB file semantics or a locally cached gateway while workloads remain on premises.
Question 597
A company has already replicated its application servers using AWS Application Migration Service and tested their EC2 boot paths. At launch, target machines must automatically install the approved monitoring agent, join a managed directory and execute validated configuration checks before being declared ready, using reusable Systems Manager documents. Which MGN configuration is appropriate?
- Enable only MGN continuous block replication and assume replication automatically joins launched servers to Active Directory and installs required application agents.
- Enable MGN post-launch actions with supported predefined or custom AWS Systems Manager documents for the launched test and cutover instances.
- Use an EC2 Launch Template with a larger instance size but do not supply user data, SSM Automation documents or a managed post-launch action.
- Run a DMS full-load-plus-CDC task against the application database and assume it configures the launched EC2 operating-system agents.
Explanation
Correct Answer
B:MGN post-launch actions execute supported SSM documents on launched instances, providing ordered and reusable modernization checks.
Incorrect Answers
A:Block replication keeps disk data current but does not automatically perform the requested target-instance configuration and validated post-launch checks.
C:A launch template can specify compute parameters; increasing capacity alone cannot execute the necessary directory join and agent configuration.
D:DMS can migrate database data but does not carry out the post-launch operating-system configuration required.
Question 598
A heavily used PostgreSQL database has already had its target schema prepared in RDS. The migration team now needs to load initial data from the on-premises source, keep up with ongoing change transactions, and check replication lag before final cutover with minimal read-only downtime. Which DMS task approach is appropriate?
- Configure an AWS DMS task with full load followed by CDC, monitor source change-capture prerequisites and replication lag, validate target data and only cut over after a tested catch-up point.
- Perform one full-load-only DMS task before cutover, monitor its completed state and assume writes committed after that load are already at the target.
- Enable CDC-only mode against an empty target and omit the initial full load despite the requirement to migrate pre-existing PostgreSQL records.
- Take a single table export after the final cutover and assume it retrospectively recovers lost concurrent source commits.
Explanation
Correct Answer
A:A DMS full-load-plus-CDC task moves baseline rows and then ongoing changes; monitoring latency and data validation informs a safe cutover window.
Incorrect Answers
B:Full-load completion does not imply that source changes occurring later were replicated without a CDC phase.
C:CDC-only mode can capture later transactions but does not automatically seed all previously existing rows in an empty target.
D:An after-the-fact export cannot guarantee orderly capture of transactions that were missed while the new app became writable.
Question 599
A migration program must retrieve inventory CSV files each evening from a supplier-operated SFTP server, then land them in a private S3 bucket for processing. The supplier will not push to an AWS-hosted SFTP server; it requires clients to initiate downloads over SFTP with managed credentials. Which AWS integration replaces a self-managed polling EC2 host?
- Provision a new Transfer Family managed SFTP server to wait for supplier uploads, although the supplier permits only client-initiated retrieval from its existing server.
- Use an S3 static website endpoint as an SFTP client and assume it can log in to the supplier’s SSH service.
- Use an AWS Transfer Family SFTP connector to retrieve remote files into S3, with permitted credentials, scheduling orchestration and status/error handling.
- Use a DataSync file-share task to poll the supplier SFTP endpoint directly with its SSH private key as if SFTP were a supported SMB/NFS source location.
Explanation
Correct Answer
C:Transfer Family SFTP connectors support retrieving files from remote SFTP servers into S3, making the download direction explicit without a persistent customer-managed polling host.
Incorrect Answers
A:An inbound SFTP server receives supplier-initiated connections; it does not satisfy the enforced outbound polling relationship.
B:S3 website hosting does not implement an SFTP client, SSH authentication or remote directory enumeration.
D:DataSync file-share locations do not make it a native managed SFTP client connector for partner-hosted files.
Question 600
A migration program already uses DataSync every night to copy SMB files from a factory share to EFS and has configured post-transfer integrity verification. Auditors now demand downloadable evidence identifying which individual files were transferred, skipped, verified or rejected in each task execution, including verification errors and supported checksums, without writing a custom file-crawler. What should be configured?
- Enable DataSync standard task reports with appropriate per-file detail and a controlled S3 report destination, then inspect verified and failed files after each run.
- Inspect only DataSync aggregate bytes-transferred CloudWatch metrics and infer which exact source files were verified or skipped from that aggregate.
- Enable DataSync CloudWatch Logs basic level only and assume it always includes a downloadable structured transferred/skipped/verified report for every file.
- Disable file verification in DataSync and use a single successful task-level status to assert every file is byte-for-byte correct.
Explanation
Correct Answer
A:DataSync task reports can enumerate attempted transferred, skipped, verified and deleted items and report verification outcomes, with supported file checksum details.
Incorrect Answers
B:Aggregate task metrics do not provide per-path outcomes, checksum fields and failure reasons required for auditable file-level evidence.
C:Logs can aid troubleshooting but the specifically structured per-file success/error task reports must be configured to meet the requirement.
D:A successful top-level transfer is not per-file verification evidence, and disabling verification weakens auditability.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests