Task 4.2: Determine the optimal migration approach for existing workloads.

• ACreate an Aurora PostgreSQL read replica of the Oracle database and promote it to a standalone cluster at cutover

  Incorrect

  Aurora PostgreSQL read replicas can be created from RDS for PostgreSQL DB instances. For a database that is not PostgreSQL-compatible, AWS points to AWS DMS.

• BCopy the Oracle data files to Amazon S3 with AWS DataSync and attach the copied files to the new Aurora cluster

  Incorrect

  DataSync moves files and objects. Aurora PostgreSQL cannot use Oracle data files, and the engines differ.

• CRun an AWS DMS full-load task only, during the cutover window, after converting the schema

  Incorrect

  A full load of 20 TB takes far longer than 30 minutes, and without ongoing replication every change made during the load is lost.

• DConvert the schema with DMS Schema Conversion or AWS SCT, then run a DMS full load with change data capture

  Correct

  Schema conversion translates the Oracle schema and code objects to PostgreSQL, and a DMS task with full load plus ongoing replication keeps the target in sync, so cutover needs only a short pause.

Heterogeneous and near-zero downtime: convert the schema first, then full load plus change data capture with AWS DMS.

• ATurn on the Use private IP option in the MGN replication settings so replication travels over Direct Connect

  Correct

  By default MGN replicates over the public internet to public IP addresses. The private IP option routes replication through a private connection such as Direct Connect or a VPN.

• BAllow inbound TCP port 1500 to the staging area subnet from 0.0.0.0/0 so that every source server can connect

  Incorrect

  Only the source servers need to reach the staging area subnet on port 1500. Opening it to every address widens exposure and does nothing for the policy.

• CKeep the database credentials in AWS Secrets Manager and reference the secrets from the DMS endpoints

  Correct

  DMS endpoints can authenticate with secrets stored in Secrets Manager, so the passwords never appear in the endpoint definitions.

• DTurn off encryption on the DMS endpoints so that the full load of the large tables runs faster

  Incorrect

  This removes the encryption that the policy requires for database connections.

• EConfigure SSL for the DMS source and target endpoint connections

  Correct

  AWS DMS can encrypt connections to source and target endpoints with SSL, which meets the encryption requirement.

Private routing for MGN, SSL on DMS endpoints and Secrets Manager for credentials together cover all three parts of the policy.

• ARun an AWS DataSync task from the NFS share to the bucket over Direct Connect on a schedule, with a bandwidth limit

  Correct

  DataSync copies from NFS to S3, can transfer only the data that changed on later runs, includes data integrity validation, and lets you limit the bandwidth that a task uses.

• BSet up an AWS Transfer Family SFTP server and have a script upload the changed files to it over SFTP every night

  Incorrect

  Transfer Family serves SFTP users. A custom upload script would have to handle change detection, verification and throttling itself.

• CUpload the files with S3 Transfer Acceleration from a server in the data center, repeating the upload for changed files

  Incorrect

  Transfer Acceleration speeds up uploads over the internet through edge locations. It does not use the idle Direct Connect link or detect changed files.

• DMount the NFS share on an EC2 instance through a VPN and copy it with a scheduled cp command

  Incorrect

  A copy command has no built-in incremental transfer, verification or bandwidth limit, and a VPN adds a slower path when Direct Connect is available.

Large online file transfers with incremental runs, verification and throttling are what DataSync does over an existing private link.

• AAWS DMS, migrating the databases on each server and then recreating the rest of each server on EC2 by hand

  Incorrect

  AWS DMS migrates databases, not whole servers, so the rest of each server would have to be rebuilt manually.

• BVM Import/Export, exporting each virtual machine and importing it as an AMI during its window

  Incorrect

  Importing images is a one-time copy, so every change made after the export is lost or the server must be stopped for the whole import, which is hard to fit into one hour.

• CAWS Transform MGN, replicating the servers continuously and launching test instances before cutover

  Correct

  MGN replicates source servers continuously at block level, converts them to run on AWS, supports test launches and gives cutover windows typically measured in minutes.

• DAWS DataSync, copying each server's disks to Amazon S3 and launching instances from them

  Incorrect

  DataSync transfers files and objects. It does not turn server disks into bootable EC2 instances.

Rehosting many servers with short cutovers and test launches is the job of AWS Transform MGN, formerly AWS Application Migration Service.

• ATake a snapshot, restore it to Aurora, and accept the hours of changes lost

  Incorrect

  Changes made after the snapshot would be lost or need a long freeze.

• BCreate an Aurora read replica of the RDS instance, then promote it at cutover

  Correct

  Aurora can create a special read replica of an RDS for MySQL instance using binary log replication, which is promoted when you migrate.

• CExport the data with mysqldump over the weekend

  Incorrect

  An export and import of 2 TB means a long write freeze.

• DCopy the database files to S3 and attach them to Aurora

  Incorrect

  Aurora does not attach copied database files of an RDS instance.

RDS for MySQL moves to Aurora with minimal downtime through an Aurora read replica.

• ARoute 53 weighted records for the AWS and on-premises endpoints, each with a health check, starting at weights of 10 and 90

  Correct

  Weighted routing sends each resource a share of traffic that matches its relative weight, which suits testing a new version and moving traffic in steps. With health checks on the records, Route 53 stops returning an unhealthy endpoint, so traffic falls back to the other one.

• BAn AWS Global Accelerator standard accelerator whose endpoint group holds both sites, with endpoint weights moving traffic to AWS

  Incorrect

  Endpoint weights can manage how much traffic each endpoint gets, but a standard accelerator's endpoints must be load balancers, EC2 instances or Elastic IP addresses in AWS. The on-premises site cannot be an endpoint, so there is nothing to fall back to.

• CRoute 53 geolocation records that send one country at a time to AWS until every country has moved

  Incorrect

  Geolocation routing chooses resources by the users' location, so it moves whole countries, not a controlled 10% share of all users worldwide.

• DRoute 53 latency-based records for both sites so that each user reaches whichever site answers faster

  Incorrect

  Latency-based routing serves users from the AWS Region with the lowest latency, based on traffic between users and AWS data centers. It gives no control over the share of users, and latency to a non-AWS site is not measured.

The constraints are a controlled percentage of all users, an on-premises fallback with no AWS components, automatic return on failure and no client changes. Global Accelerator cannot use the data center as an endpoint, and geolocation and latency routing do not control percentages. Weighted records with health checks meet all of them through DNS.

• AThe task's table statistics, comparing the inserts, updates and deletes applied to each table with the source's row counts

  Incorrect

  Table statistics show how many inserts, deletes and updates DMS applied to each table. Matching counts say nothing about whether each row holds the same data as its source row.

• BA premigration assessment of the task, with its report kept as evidence for the auditors

  Incorrect

  A premigration assessment evaluates a task before it runs to find problems that might prevent it from running as expected. It does not compare migrated data.

• CThe task's CDCLatencySource and CDCLatencyTarget metrics, showing that replication kept up until the cutover

  Incorrect

  These metrics help find the cause of replication latency. Low latency shows that changes arrive quickly, not that each target row matches its source row.

• DDMS data validation turned on for the task, so that full-load and CDC changes are compared with the source

  Correct

  Data validation compares each source row with its target row after the full load and compares incremental changes as they occur, reporting any mismatches. It issues its own queries, which adds load to both databases.

The constraints are row-by-row comparison, coverage of CDC changes, reported mismatches and no custom scripts. Table statistics only count changes, a premigration assessment runs before the move, and latency metrics measure speed. DMS data validation compares every row, including ongoing changes, and reports mismatches.

• AReuse one range in every VPC and connect each VPC to the data center through private NAT gateways

  Incorrect

  A private NAT gateway can enable communication between networks even when their CIDR ranges overlap, which helps when overlap already exists. Here it is the address translation the team will not run, and every VPC would need it.

• BBuild the new VPCs with IPv6-only subnets so that their addresses can never overlap any IPv4 network

  Incorrect

  IPv6-only subnets have no IPv4 CIDR block, and their resources must communicate over IPv6. The migrated applications support only IPv4.

• CChoose ranges that overlap neither the on-premises networks nor each other, sized for growth over the migration

  Correct

  A transit gateway does not support routing between VPCs with identical or overlapping CIDRs; routes for an overlapping VPC are not propagated. Unique ranges that also avoid on-premises networks let every VPC and the data center reach each other without translation.

• DUse the default VPC that already exists in each account so that no new ranges have to be planned

  Incorrect

  Default VPCs need no planning, but every default VPC uses the 172.31.0.0/16 CIDR block, so the VPCs of different accounts overlap one another and cannot all be routed through the transit gateway.

The constraints are full routing through one transit gateway, IPv4-only applications, connections initiated from on premises, and no address translation. Private NAT gateways translate addresses, IPv6-only subnets do not fit IPv4-only applications, and default VPCs all share one range. Unique, non-overlapping ranges are the only option that meets every constraint.

• ATurn on S3 Transfer Acceleration for the bucket and upload the footage over the facility's internet link

  Incorrect

  Transfer Acceleration speeds up long-distance transfers through edge locations, but it cannot add bandwidth: a fully used 1 Gbps link moves less than 230 TB in three weeks.

• BTurn on S3 Object Lock in compliance mode on the bucket so that the uploaded objects cannot be changed

  Incorrect

  Object Lock stops object versions from being overwritten or deleted after they are stored. It does not show that what was stored matches the files on the drives.

• CUpload each file with its precalculated full-object CRC-64/NVME checksum so that S3 verifies it and stores the value

  Correct

  When a precalculated checksum is supplied, including the full object checksum type for multipart uploads, S3 calculates its own value, compares the two before storing the object, and keeps the checksum with the object as evidence.

• DWrite the footage to virtual tapes through an AWS Storage Gateway Tape Gateway at the facility

  Incorrect

  Tape Gateway replaces physical tape infrastructure for backup software and archives virtual tapes in S3 Glacier storage classes. It does not deliver the files as objects in the bucket, and it would still use the 1 Gbps link.

• EBook a reservation at an AWS Data Transfer Terminal and upload the drives there with the studio's own devices

  Correct

  Data Transfer Terminal facilities are network-ready locations where customers bring their own storage devices for fast uploads to AWS after reserving a time in the console. The service is available to Enterprise Support customers.

The network rules out any online path in three weeks, so the drives have to travel to a place with fast connectivity, which is what Data Transfer Terminal provides for Enterprise Support customers. Integrity is a separate requirement: supplying the checksums computed at the facility on upload makes S3 reject any object whose data does not match and keeps the checksum with each object for the auditors.