Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

A logistics company is migrating 88 physical on-premises servers to AWS using AWS Application Migration Service (MGN). A 1 Gbps1\text{ Gbps} AWS Direct Connect connection is established and terminated at an AWS Transit Gateway, which connects to the AWS landing zone VPCs. The on-premises servers are isolated from the public internet. The company requires that all replication control plane traffic and data replication traffic traverse the Direct Connect connection privately. Which TWO configurations must the solutions architect implement to meet these requirements?

  1. Configure the AWS Application Migration Service replication template to route replication data using private IP addresses, and configure network firewalls and security groups to allow outbound traffic on TCP port 15001500 from the source servers to the staging area subnet.Answer
  2. Create an interface VPC endpoint (AWS PrivateLink) for AWS Application Migration Service in the staging VPC, and execute the replication agent installer on the on-premises servers specifying the endpoint's private DNS name or IP address.Answer
  3. C
    Configure the AWS Application Migration Service replication template to use private IP routing, and restrict the staging area security groups to allow inbound replication traffic on TCP port 443443 only.
  4. D
    Bypass the Transit Gateway by connecting the Direct Connect connection to a Direct Connect Gateway associated directly with the target VPCs to manage transitive VPC-to-VPC routing for the migration workloads.
  5. E
    Create a Private Hosted Zone for the MGN service endpoint in a shared services VPC, and rely on Transit Gateway route propagation to automatically resolve the endpoint names across all staging and target VPCs.

Answer

The solutions architect must configure the replication template to use private IP addresses, open outbound TCP port 1500 to the staging subnet, provision an interface VPC endpoint (PrivateLink) for the migration service, and run the agent installer specifying the private endpoint details.
The correct options state that the solutions architect should configure the replication template to use private IP routing, allow outbound traffic on TCP port 1500, create an interface VPC endpoint for the service, and install the agent specifying the private endpoint. This addresses both replication data transmission (via private IPs and port 1500) and control plane registrations (via the interface VPC endpoint) without requiring any public internet access.

Step-by-Step Solution

1
Configure the MGN replication template to use private IP routing.
This prevents replication data from trying to route over the public internet, directing it over the private hybrid network path (Direct Connect and Transit Gateway) instead.
By default, replication servers communicate over public IPs, which is blocked by the internet-isolated source environment.
2
Provision an interface VPC endpoint (PrivateLink) for the MGN service in the staging VPC.
Creates private IP interfaces within the VPC for control plane communication.
Allows the on-premises replication agents to securely register and send heartbeat signals to the MGN control plane privately.
3
Ensure firewalls and security groups allow TCP port 1500.
Enables uninterrupted flow of data blocks from the agent to the replication servers.
Port 1500 is the dedicated port for data replication in AWS Application Migration Service.

Key Concept

Private replication and control plane connectivity over hybrid paths with AWS Application Migration Service (MGN)
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic