Examkin

Question

Difficulty: Very hardInfrastructure Migration with AWS Application Migration Service (MGN)

A multinational financial corporation is migrating its legacy core transaction workloads to AWS using AWS Application Migration Service (MGN). The workload consists of 50 physical servers running a mix of Windows Server and Red Hat Enterprise Linux (RHEL). The target architecture is a multi-account environment managed by AWS Organizations, where data replication must occur privately over an AWS Direct Connect (DX) connection terminating at a Transit Gateway (TGW) in a central Network account. The staging area subnets are located in a Shared Services VPC within a central Infrastructure account, while the migrated instances must launch in the Production VPC in a separate Production account. The architecture must be resilient to Availability Zone (AZ) outages to prevent replication stalls, on-premises source servers must resolve AWS MGN API endpoints privately, and the target instances must automatically join the corporate Active Directory domain in the Production VPC post-launch.

During the pilot phase, the replication agent installation fails on-premises, staging replication stalls during AZ maintenance windows, and launched instances fail to join the Active Directory domain. Which combination of configuration steps will resolve all of these issues?

  1. Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints, associate it with both the Staging VPC and Production VPC, and deploy Route 53 Inbound Resolvers in the Staging VPC with conditional forwarders configured on-premises. Configure the MGN replication template to use staging subnets across multiple Availability Zones, each with a dedicated, redundant NAT Gateway. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.Answer
  2. B
    Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC, and associate a Route 53 Private Hosted Zone for the MGN endpoints with the Staging VPC. Set up Route 53 Inbound Resolvers in the Staging VPC to forward queries from on-premises. Configure the MGN replication template to deploy replication servers across multiple Availability Zones, routing all outbound traffic through a single NAT Gateway located in one primary Availability Zone. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, assign the AmazonSSMManagedInstanceCore and directory join permissions to the target instance launch templates, and enable the Active Directory integration post-launch action.
  3. C
    Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints in the central Infrastructure account, but do not associate it with the Staging VPC or Production VPC, relying instead on Transit Gateway route propagation to resolve private DNS queries. Set up Route 53 Inbound Resolvers in the Staging VPC. Configure the MGN replication template to use staging subnets across multiple Availability Zones with dedicated NAT Gateways in each zone. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.
  4. D
    Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints, associate it with both the Staging VPC and Production VPC, and deploy Route 53 Inbound Resolvers in the Staging VPC. Configure the MGN replication template to use staging subnets across multiple Availability Zones, each with a dedicated NAT Gateway. Configure the Staging VPC security groups to permit inbound traffic from the on-premises range on TCP port 443 only, blocking port 1500 to enhance security. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.

Answer

Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC, associate the Route 53 Private Hosted Zone with the Staging and Production VPCs, deploy Route 53 Inbound Resolvers with conditional forwarding, use multi-AZ staging subnets with redundant NAT Gateways, open TCP port 1500, and ensure the target EC2 Launch Template in the Production account has the proper IAM instance profile and Active Directory post-launch action enabled.
The correct solution addresses all requirements: it enables private DNS resolution and traffic routing over Direct Connect via interface endpoints and Route 53 Inbound Resolvers; it ensures high availability of replication by distributing replication servers across multiple Availability Zones with redundant NAT Gateways; it opens TCP port 1500 to allow the replication data channel; and it attaches the correct IAM instance profile with AWS Systems Manager (SSM) permissions alongside the Active Directory integration post-launch action to automate domain-joining during cutover.

Step-by-Step Solution

1
Configure private connectivity to MGN and S3 by creating VPC interface endpoints in the Staging VPC, and set up a Route 53 Private Hosted Zone associated with the Staging VPC.
Source servers can reach MGN control plane APIs and S3 securely over AWS Direct Connect without using public IP addresses.
The migration requirements specify that data replication and control plane traffic must bypass the public internet.
2
Deploy Route 53 Inbound Resolvers in the Staging VPC and configure conditional forwarders on the on-premises DNS servers for the MGN and S3 domain names pointing to the resolver IPs.
On-premises source servers can successfully resolve the private IP addresses of the VPC endpoints.
Without inbound resolvers and forwarding, the on-premises servers would attempt to resolve MGN endpoints via public DNS, failing to connect over the private network.
3
Configure the MGN replication template to allocate replication servers across multiple subnets in different Availability Zones, and ensure each subnet has a dedicated NAT Gateway.
Staging replication is protected against Availability Zone degradation or outages.
A single NAT Gateway creates a single point of failure. Deploying redundant NAT Gateways across multiple zones ensures continuous replication capabilities.
4
Configure the Staging VPC security group to permit inbound traffic from the on-premises subnet range on TCP port 1500.
The AWS Replication Agent can establish the data channel and stream replicated blocks to the staging replication servers.
AWS MGN uses TCP port 1500 exclusively for transferring the replicated data blocks from the source agent.
5
In the Production account, update the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore policy and configure the MGN Active Directory post-launch action.
Launched cutover instances are registered with Systems Manager and automatically joined to the domain.
SSM post-launch actions require the instance to have appropriate IAM permissions to interact with Systems Manager and Active Directory services.

Key Concept

Designing secure, resilient, and automated enterprise infrastructure migrations using AWS Application Migration Service (MGN) in a multi-account, hybrid DNS environment.
Estimated Time:3m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic