Examkin

Question

Difficulty: Very hardInfrastructure Migration with AWS Application Migration Service (MGN)

An enterprise is migrating its core on-premises transaction processing systems to AWS using AWS Application Migration Service (MGN). The architecture utilizes a 10 Gbps AWS Direct Connect connection terminating at an AWS Transit Gateway in a centralized Network Services VPC. The replication traffic is directed to a dedicated Staging Area VPC. While the MGN replication agent was successfully installed on all on-premises servers using HTTPS port 443, the replication status on the AWS Migration Hub console remains in a 'Stalled' state, and no data blocks are being synchronized. The network team confirms that the Transit Gateway has active attachments to the Staging Area VPC and routing tables are properly configured. Which combination of network and security configurations will resolve this replication stall while maintaining high availability and AWS best practices?

  1. Configure the on-premises firewall to allow outbound traffic over TCP port 1500 to the Staging Area VPC CIDR, configure the Staging Area VPC security groups to allow inbound traffic over TCP port 1500 from the on-premises subnet, and deploy redundant NAT Gateways across all active Availability Zones in the Staging Area VPC to route outbound control plane communication.Answer
  2. B
    Modify the local firewall to allow outbound HTTPS traffic on TCP port 443 only, and configure the replication servers in the Staging Area VPC to accept inbound traffic on TCP port 443, as the replication agent tunnels all block-level data replication blocks through the control plane endpoint.
  3. C
    Establish a Transit Gateway Peering connection directly between the on-premises router and the Staging Area VPC, bypass the central Transit Gateway routing tables to prevent transitive routing delays, and allow inbound TCP port 1500 on the replication servers.
  4. D
    Configure the on-premises firewall and the Staging Area VPC security groups to allow traffic over TCP port 1500, and deploy a single NAT Gateway in one Availability Zone of the Staging Area VPC, pointing all subnet route tables to this gateway to handle outbound status updates to the MGN control plane.

Answer

Configure the on-premises firewall to allow outbound traffic over TCP port 1500 to the Staging Area VPC CIDR, configure the Staging Area VPC security groups to allow inbound traffic over TCP port 1500 from the on-premises subnet, and deploy redundant NAT Gateways across all active Availability Zones in the Staging Area VPC to route outbound control plane communication.
The correct option addresses the direct cause of the data replication stall by opening TCP port 1500 outbound on the on-premises firewall and inbound on the replication server security groups in the Staging Area VPC. Simultaneously, it maintains high availability by deploying redundant NAT Gateways across all active Availability Zones for the replication servers to communicate with the MGN control plane.

Step-by-Step Solution

1
Identify the ports required for replication by the AWS Application Migration Service (MGN) agent.
TCP Port 443 is used for control plane communication and agent installation, while TCP Port 1500 is used for replicating the actual data blocks to the replication servers in the staging area.
Resolving the stall requires establishing the replication channel on TCP Port 1500.
2
Ensure firewall and security group settings permit TCP Port 1500.
The local on-premises firewall must allow outbound TCP 1500, and the Staging Area VPC security groups must allow inbound TCP 1500 from the on-premises subnet.
This allows the replication agent to push data blocks to the replication EC2 instances.
3
Design the outbound communication path for the replication servers in the Staging Area VPC.
Deploy redundant NAT Gateways across all active Availability Zones in the Staging Area VPC to provide highly available outbound routes to the MGN control plane.
Ensures that a single Availability Zone outage does not interrupt control plane status updates for all replication servers.

Key Concept

AWS MGN network architecture requires TCP port 1500 for replication data transport, separate from the HTTPS TCP port 443 control plane path, along with redundant NAT Gateways for multi-AZ staging environment resilience.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic