A healthcare provider is migrating its core electronic health record (EHR) database and we… — AWS Certified Solutions Architect - Professional

A healthcare provider is migrating its core electronic health record (EHR) database and web application servers from a private virtualization host to AWS using AWS Application Migration Service (MGN). The migration must utilize a secure, private network path over a $10\text{ Gbps}$ AWS Direct Connect connection terminated at an AWS Transit Gateway. Outbound internet access from the source virtual machines is prohibited due to regulatory requirements, meaning both replication data and control plane API traffic must remain strictly inside the private network. The staging area subnets are located in a dedicated Staging VPC connected to the Transit Gateway. Which of the following configuration steps must the Solutions Architect perform to establish the replication and control paths? (Select TWO.)

Configure the security groups associated with the Replication Servers in the Staging VPC to allow inbound replication traffic on TCP Port 1500 from the on-premises source subnets, and ensure the on-premises firewall allows outbound traffic on TCP Port 1500.Answer
Create Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service inside the Staging VPC, and associate the Route 53 Private Hosted Zone (PHZ) created for the MGN service with the Staging VPC to enable private DNS resolution of the MGN API endpoints.Answer
C
Deploy a single NAT Gateway in a public subnet of the Staging VPC and configure the private subnets' route tables to point default routes to the NAT Gateway to route replication traffic to the public MGN endpoints.
D
Configure a Direct Connect Gateway to perform transitive routing of replication traffic directly between the on-premises data center and the Staging VPC, bypassing the Transit Gateway for all replication operations.
E
Provision Route 53 Resolver endpoints in the Staging VPC but do not associate the Private Hosted Zone for MGN with the Staging VPC, allowing the on-premises servers to resolve the endpoint address via public DNS resolvers.

Answer

To configure private replication using AWS Application Migration Service (MGN), the Solutions Architect must allow inbound replication traffic on TCP Port 1500 from the on-premises source subnets in the Staging VPC security groups, and configure Interface VPC Endpoints for the AWS MGN service in the Staging VPC while associating the Route 53 Private Hosted Zone to ensure private DNS resolution.

The correct configurations allow both the replication data stream and the control plane API communication to remain completely private over the Direct Connect connection. Specifically, the data stream replicates over TCP Port 1500 to the Replication Servers, which requires appropriate security group and firewall permissions. Control plane APIs are accessed privately via interface endpoints, which require the Route 53 Private Hosted Zone associated with the Staging VPC for correct resolution.

Step-by-Step Solution

Configure the security groups of the MGN Replication Servers in the Staging VPC to allow inbound traffic on TCP Port 1500, which is the dedicated port for agent-to-replication-server data transit.

The Replication Servers can successfully receive data blocks sent by the on-premises agents.

This is required because the AWS MGN replication agent copies blocks directly to the Replication Servers using TCP Port 1500.

Create Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN API service in the Staging VPC to provide private access to the control plane.

The MGN control plane endpoints receive private IP addresses within the Staging VPC CIDR.

This ensures the agent can communicate with the service APIs without traversing the public internet.

Associate the Route 53 Private Hosted Zone generated by the MGN interface endpoints with the Staging VPC.

DNS queries for the MGN service endpoint resolve to the private IP addresses of the interface endpoints.

Without this association, the source servers and local resources would resolve the MGN endpoint to public IP addresses, which are unreachable under the strict private-only policy.

Key Concept

Private replication configuration for AWS Application Migration Service (MGN)

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic