Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

A global pharmaceutical corporation is migrating its legacy laboratory database and research servers from an on-premises VMware environment to AWS using AWS Application Migration Service (MGN). The migration network path must be completely private, utilizing an existing 10 Gbps10\text{ Gbps} AWS Direct Connect connection that terminates at an AWS Transit Gateway. The Transit Gateway routes traffic to a dedicated staging VPC and a production VPC. The replication traffic must not traverse the public internet. Which of the following configurations must be implemented to establish successful private data replication? (Select TWO.)

  1. Configure the security group of the AWS MGN replication servers in the staging VPC to allow inbound traffic on TCP port 15001500 from the on-premises source IP range, and configure the on-premises network firewall to allow outbound traffic on TCP port 15001500 to the staging VPC CIDR.Answer
  2. Create VPC interface endpoints for AWS MGN in the staging VPC, associate the corresponding Amazon Route 53 private hosted zone with the staging VPC, and deploy an inbound Route 53 Resolver endpoint to resolve the service endpoints from the on-premises network.Answer
  3. C
    Configure the staging VPC security groups to allow inbound traffic on TCP port 443443 and TCP port 15001500 from the staging VPC to the on-premises network, and configure the on-premises firewall to allow inbound traffic on TCP port 15001500 from the replication servers.
  4. D
    Establish a Direct Connect Gateway directly associated with the virtual private gateway of the staging VPC to enable transitive routing, bypassing the Transit Gateway to minimize network hops during replication.
  5. E
    Deploy Route 53 Private Hosted Zones for the MGN interface endpoints in the production VPC without associating them with the staging VPC, and configure the on-premises DNS servers to forward requests to default AWS public DNS servers.

Answer

Successful private replication using AWS Application Migration Service (MGN) over Direct Connect requires configuring security groups and firewalls to allow inbound TCP port 15001500 traffic into the staging VPC from the on-premises CIDR (with outbound TCP port 15001500 allowed on-premises), and establishing VPC interface endpoints for MGN in the staging VPC, complete with Route 53 private hosted zone association and an inbound Route 53 Resolver endpoint to allow the on-premises source servers to resolve MGN endpoints privately.
Establishing a successful private infrastructure migration using AWS Application Migration Service requires allowing outbound data replication traffic on TCP port 15001500 from the source servers to the staging VPC replication servers, and allowing it inbound on the replication servers' security group. Additionally, because the architecture requires private endpoint communication without internet access, VPC interface endpoints for MGN must be deployed in the staging VPC. These endpoints require a Route 53 Private Hosted Zone associated with the staging VPC, and an inbound Route 53 Resolver endpoint must be configured to handle DNS resolution requests forwarded from the on-premises DNS servers.

Step-by-Step Solution

1
Configure the network data plane path for data replication.
Ensure TCP port 15001500 is allowed outbound from the on-premises source servers and inbound on the replication servers within the staging VPC security groups.
Replication servers (lightweight EC2 instances) launched in the staging area act as endpoints for receiving block-level data from the MGN replication agent over TCP port 15001500.
2
Configure private control plane communication.
Create interface VPC endpoints (AWS PrivateLink) for the MGN service in the staging VPC.
This allows the replication agent and replication servers to communicate with the MGN service control plane privately without traversing the public internet.
3
Establish hybrid DNS resolution for the private endpoints.
Associate the Route 53 Private Hosted Zone for the MGN VPC endpoints with the staging VPC, and deploy an inbound Route 53 Resolver endpoint.
On-premises source servers need to resolve the public MGN service domain names to the private IP addresses of the VPC interface endpoints. The inbound resolver endpoint acts as a DNS target for on-premises DNS forwarders.

Key Concept

Private replication with AWS Application Migration Service (MGN) requires both control plane connectivity (via VPC interface endpoints and hybrid DNS resolution) and data plane connectivity (via TCP port 15001500 routing over VPN or Direct Connect).
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic