Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

An online travel agency is migrating its legacy customer loyalty application, which runs on 8 on-premises virtual machines, to AWS using AWS Application Migration Service (MGN). The network architecture connects the on-premises data center to a staging VPC in AWS via a 1 Gbps AWS Direct Connect connection terminated at an AWS Transit Gateway. During the migration setup, the MGN agents are successfully installed on the source servers, but the replication status on the MGN console remains stuck in the 'Initiating data replication' state with 0% progress. The network routing and security configurations must maintain a private traffic path. Which of the following actions should the Solutions Architect take to resolve this replication issue?

  1. Modify the on-premises firewall rules and the staging VPC security groups to allow outbound and inbound traffic over TCP port 1500, routing the replication traffic privately through the Transit Gateway to the replication servers.Answer
  2. B
    Configure the replication template to use public IP addresses for the replication servers, and verify that the on-premises firewall allows outbound traffic over TCP port 443 to the MGN control plane endpoints.
  3. C
    Bypass the Transit Gateway by associating the Direct Connect Gateway directly with the staging VPC's route table, and configure a public hosted zone in Route 53 to resolve the replication endpoints.
  4. D
    Deploy a single NAT Gateway in the staging VPC to route replication traffic to the internet, and configure the MGN agent to use the NAT Gateway's elastic IP address for data transit.

Answer

Modify the on-premises firewall rules and the staging VPC security groups to allow outbound and inbound traffic over TCP port 1500, routing the replication traffic privately through the Transit Gateway to the replication servers.
The correct action is to modify the on-premises firewall and staging VPC security groups to allow outbound and inbound TCP port 1500 traffic. AWS Application Migration Service requires TCP port 1500 for block-level data replication from the source agents to the replication servers in the staging area. Using the existing Direct Connect and Transit Gateway path satisfies the privacy requirement.

Step-by-Step Solution

1
Analyze the replication status and network path.
The MGN agents are installed (meaning TCP port 443 control plane connectivity is active), but replication is stuck at 0% (indicating the data plane is blocked). The path must remain private using the Direct Connect and Transit Gateway connection.
To identify why the control plane is communicating but the data replication has not started.
2
Identify the port requirements for MGN data replication.
MGN requires TCP port 1500 for continuous block-level data replication from the source servers to the replication servers in the staging area VPC.
To pinpoint the specific protocol and port blocking the replication stream.
3
Update firewall and security group rules to permit TCP port 1500.
On-premises firewalls allow outbound TCP port 1500, and the security groups associated with the MGN replication servers in the staging VPC allow inbound TCP port 1500 over the private network path.
To establish the replication data tunnel privately and allow data transfer to progress past the initiation phase.

Key Concept

AWS Application Migration Service (MGN) separates orchestration traffic (TCP port 443) from block-level data replication traffic (TCP port 1500). In a hybrid network using AWS Direct Connect or VPN, both ports must be appropriately routed and allowed through local firewalls and security groups to enable successful replication.
Estimated Time:2m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic