Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

A retail enterprise is migrating its legacy inventory management systems, which include 1212 on-premises application servers, to AWS using AWS Application Migration Service (MGN). The enterprise connects its on-premises network to AWS via an AWS Direct Connect connection terminated at an AWS Transit Gateway in a central Transit VPC. The Transit VPC connects to the target Migration VPC. Due to strict corporate security compliance, no internet access is permitted from either the on-premises network or the target Migration VPC. The Solutions Architect has installed the AWS Replication Agent on the on-premises servers, but the replication status shows that the agents are unable to communicate with the AWS MGN replication servers and are failing to register with the service. Which of the following configuration steps must the Solutions Architect take to establish connectivity and ensure successful data replication? (Select TWO.)

  1. Configure the on-premises firewalls and the security group of the Replication Staging Area to allow outbound traffic from the on-premises servers and inbound traffic to the replication servers over TCP port 1500.Answer
  2. Create an interface VPC endpoint (AWS PrivateLink) for the MGN service (com.amazonaws.region.mgn) in the target VPC, associate it with the target VPC, and configure a Route 53 Resolver inbound endpoint to resolve the service domain name from the on-premises DNS.Answer
  3. C
    Configure the staging area security groups to permit inbound HTTPS traffic on TCP port 443 from the on-premises servers to the replication servers for the continuous data replication stream.
  4. D
    Create a Route 53 Private Hosted Zone (PHZ) for the MGN endpoint in the Migration VPC and rely on Transit Gateway routing tables to transitively resolve the DNS names for the on-premises servers.
  5. E
    Provision a single NAT Gateway in the migration staging subnet to route all replication traffic over a Direct Connect public virtual interface (VIF) to the public AWS MGN endpoints.

Answer

The Solutions Architect must configure the on-premises firewalls and staging area security group to allow TCP port 1500 for replication data, and create an interface VPC endpoint for the MGN service in the target VPC combined with a Route 53 Resolver inbound endpoint for DNS resolution.
The option allowing TCP port 1500 is correct because AWS MGN uses TCP port 1500 to stream replicated blocks to replication servers. The option creating the interface VPC endpoint for MGN and configuring Route 53 Resolver inbound endpoints is correct because it resolves the private DNS for MGN control plane endpoints, enabling the agent to register securely without exposing traffic to the public internet.

Step-by-Step Solution

1
Ensure the replication data path is open.
TCP port 1500 is permitted outbound on the on-premises firewall and inbound on the replication staging area security groups.
The AWS Replication Agent replicates data blocks directly to the replication servers using TCP port 1500.
2
Enable private control plane access.
An interface VPC endpoint for the MGN service is provisioned in the target VPC.
This allows the agent on-premises to communicate with the MGN control plane without using the public internet.
3
Configure DNS resolution for the private endpoints.
Route 53 Resolver inbound endpoints are configured to forward DNS queries from on-premises to the private hosted zone associated with the VPC.
On-premises servers must resolve the public MGN service DNS names to the private IP addresses of the interface VPC endpoints.

Key Concept

Establishing hybrid connectivity and DNS resolution for AWS Application Migration Service (MGN) in a private network architecture.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic