Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

An e-commerce enterprise is migrating its legacy inventory management servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The replication path must use a private network link via an existing AWS Direct Connect connection, avoiding the public internet. The staging area VPC in AWS has no route to the internet. During initial setup, the MGN agents installed on the on-premises servers fail to communicate with the staging area in AWS, and replication status remains in the initiating phase. Which of the following actions should the solutions architect take to resolve this connectivity issue and enable private replication? (Select TWO.)

  1. Ensure that the security group attached to the replication servers in the staging VPC permits inbound traffic from the on-premises CIDR block on TCP port 1500, and configure the MGN replication template to use private IP routing.Answer
  2. Create VPC interface endpoints for MGN in the staging VPC, and configure the on-premises DNS to resolve the MGN service endpoints to the private IP addresses of the interface endpoints via Route 53 Inbound Resolvers.Answer
  3. C
    Establish a Route 53 Private Hosted Zone for the MGN service endpoint associated with the staging VPC, and set the MGN replication template to use public IP routing.
  4. D
    Configure the staging area route tables to direct all replication traffic through a Transit Gateway linked to a single NAT Gateway deployed in a shared services VPC.

Answer

To resolve the connectivity issues and establish private replication, the solutions architect must configure the staging VPC security groups to permit inbound traffic from the on-premises CIDR block on TCP port 1500, set the MGN replication template to use private IP routing, create VPC interface endpoints for the MGN service in the staging VPC, and set up on-premises DNS to resolve the MGN endpoints to the interface endpoints using Route 53 Inbound Resolvers.
The correct answer combines allowing replication traffic on TCP port 1500 with private IP routing, and configuring interface VPC endpoints for the MGN API with proper DNS resolution. This ensures both data replication traffic and control plane traffic can flow entirely over the private Direct Connect connection.

Step-by-Step Solution

1
Allow replication traffic on port 1500.
Staging area security groups permit inbound TCP port 1500 traffic from the on-premises source range.
AWS MGN uses TCP port 1500 for transmitting replicated data blocks from the agent to the replication servers.
2
Configure private IP routing in the template.
The replication servers and agents use private IPs for data replication over Direct Connect.
By default, MGN uses public IPs for data replication. Enabling private IP routing forces replication traffic over the private Direct Connect link.
3
Establish interface VPC endpoints for MGN API.
Agents can privately communicate with the MGN control plane.
The replication agent must access the MGN control plane API. In an environment without internet access, this requires setting up AWS PrivateLink interface endpoints and forwarding DNS queries accordingly.

Key Concept

Establishing private, secure data replication and control plane connectivity for AWS Application Migration Service (MGN) in environments without public internet access.
Estimated Time:2m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic