Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

A media broadcasting company is migrating its critical live-stream metadata ingest applications, consisting of 12 legacy servers, from an on-premises data center to AWS using AWS Application Migration Service (MGN). The replication must occur over a private network connection using an AWS Direct Connect (DX) connection with a private virtual interface attached to an AWS Transit Gateway. Due to strict security compliance, neither the on-premises servers nor the staging subnets in the replication VPC can have outbound internet access. Which two configuration steps must a solutions architect perform to establish replication while meeting these requirements? (Select TWO.)

  1. Configure the AWS MGN replication template to use private IP routing, and deploy interface VPC endpoints (AWS PrivateLink) for AWS MGN and Amazon S3 in the staging area VPC.Answer
  2. Configure the on-premises corporate firewall and the staging area subnet security groups to allow outbound and inbound traffic on TCP port 1500.Answer
  3. C
    Configure the on-premises firewall to permit outbound traffic on TCP port 443 only, as AWS MGN tunnels replication data through the control plane protocol.
  4. D
    Bypass the AWS Transit Gateway by associating the Direct Connect gateway directly with the replication staging area VPC, relying on Direct Connect gateway transitive routing.
  5. E
    Create a Route 53 Private Hosted Zone for the MGN interface endpoints in a central shared services VPC without associating it with the replication staging VPC.

Answer

The correct options are configuring the AWS MGN replication template to use private IP routing with interface VPC endpoints for AWS MGN and Amazon S3, and configuring the on-premises firewall and staging area security groups to permit TCP port 1500.
The correct options are: 1) Configuring the replication template to use private IP routing and establishing interface VPC endpoints for MGN and S3. This allows the agents and replication servers to communicate securely and privately with the MGN control plane and download necessary agent components without traversing the public internet. 2) Allowing TCP port 1500 between the source servers and the replication staging area subnets, which is required for transmitting replicated block data.

Step-by-Step Solution

1
Enable private IP routing in the AWS MGN replication template.
The replication agents will use private IP addresses to communicate with replication servers in the staging VPC.
Neither the on-premises environment nor the staging area subnets have outbound internet access, necessitating private routing over the Direct Connect.
2
Deploy interface VPC endpoints for AWS MGN and Amazon S3 in the staging VPC.
Private paths are created within the VPC for MGN API calls and software downloads.
The MGN replication agents and servers require secure access to the MGN control plane and S3 to download the replication software.
3
Allow TCP port 1500 through the on-premises firewall and the staging subnet security groups.
Block-level replication data can flow from the source servers to the replication servers.
AWS MGN replicates block-level data over TCP port 1500, which must be open in transit firewalls and security groups.

Key Concept

Establishing private block-level replication using AWS Application Migration Service (MGN) in a highly secure, non-internet-facing hybrid environment.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic