Examkin

Question

Difficulty: Very hardInfrastructure Migration with AWS Application Migration Service (MGN)

A logistics company is migrating its core on-premises dispatch and routing application servers to AWS using AWS Application Migration Service (MGN). The on-premises environment consists of VMware virtual machines connected to AWS via a 10 Gbps AWS Direct Connect connection terminated at an AWS Transit Gateway. The Transit Gateway connects to a central hub VPC and a target migration VPC containing the staging area subnet configured in the MGN replication template. Security policies strictly prohibit any internet access from either the on-premises servers or the target migration VPC. The MGN agents are installed on the source servers, but they cannot establish communication with the MGN service endpoints, preventing the replication process from initiating. Which two actions must the solutions architect take to resolve these connectivity issues and start replication over the private network? (Select TWO.)

  1. Create interface VPC endpoints for both MGN and Amazon S3 in the staging VPC, and configure the on-premises DNS resolver to forward queries for these endpoints to Route 53 Inbound Resolver endpoints in the hub VPC.Answer
  2. Configure the security group of the MGN replication servers in the staging VPC to allow inbound traffic on TCP port 1500 from the on-premises CIDR block, and verify that the on-premises network firewall allows outbound traffic on TCP port 1500 to the staging subnet.Answer
  3. C
    Configure the security group of the MGN replication servers in the staging VPC to only allow inbound traffic on TCP port 443 from the on-premises CIDR block, assuming replication traffic is encrypted and tunneled over HTTPS.
  4. D
    Provision an Amazon S3 Gateway Endpoint in the staging VPC, and configure the Transit Gateway route tables to advertise the prefix list of the Gateway Endpoint to the on-premises firewall over the Direct Connect connection.
  5. E
    Associate the Route 53 Private Hosted Zones for the MGN and S3 endpoints only with the hub VPC, expecting the target migration VPC to resolve the private DNS names transitively through the Transit Gateway.
  6. F
    Deploy a single NAT Gateway in a single public subnet of the hub VPC to route the replication traffic over the internet, and configure the Transit Gateway to point all outbound traffic to this single NAT Gateway instance.

Answer

The correct actions are: 1) Create interface VPC endpoints for MGN and Amazon S3 in the staging VPC, and forward on-premises DNS queries to Route 53 Inbound Resolver endpoints in the hub VPC. 2) Configure the staging VPC security group and on-premises firewall to allow inbound and outbound traffic on TCP port 1500.
To establish private replication using AWS MGN over a Direct Connect connection without internet access, two main components must be configured: control plane communication (including agent installer downloads) and replication data channel connectivity. For control plane communication, the MGN agent needs access to the MGN API and Amazon S3. Because internet access is prohibited, interface VPC endpoints (PrivateLink) for both MGN and S3 must be created in the staging VPC. On-premises source servers must resolve these endpoints to their private IPs, which requires creating Route 53 Inbound Resolver endpoints in the hub VPC and configuring on-premises DNS to forward queries. For replication data channel connectivity, replication servers in the staging VPC communicate with source agents over TCP port 1500. This requires opening TCP port 1500 inbound on the staging security group and outbound on the on-premises firewall.

Step-by-Step Solution

1
Analyze the network path and security constraints.
Identify that replication traffic must flow privately over Direct Connect / Transit Gateway without using the public internet, requiring AWS PrivateLink for MGN and S3 control plane endpoints.
This determines the choice of Interface Endpoints instead of Gateway Endpoints or NAT Gateways, as Gateway Endpoints are not routable over Direct Connect/TGW from on-premises, and NAT Gateways require internet routing.
2
Configure DNS resolution for private endpoints.
Create Route 53 Inbound Resolvers in the hub VPC and forward local DNS queries for the MGN and S3 endpoints to these resolver IPs.
On-premises servers must resolve the public DNS names of AWS services (such as MGN API and S3) to the private IP addresses of the interface endpoints.
3
Configure data plane replication ports.
Modify the security groups in the staging area and the local firewall to allow TCP port 1500.
MGN agents replicate data blocks using TCP port 1500 directly to the replication servers; blocking this port will cause the replication state to remain stalled.

Key Concept

Establishing secure, private, and high-performance network connectivity for AWS Application Migration Service (MGN) using interface endpoints, Route 53 Inbound Resolvers, and security group rules for data replication over AWS Direct Connect.
Estimated Time:4m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic