Examkin

Question

Difficulty: MediumHybrid and VMware Cloud on AWS Migrations

A company is planning to migrate 40 on-premises VMware virtual machines (VMs) to native Amazon EC2 instances in a target VPC using AWS Application Migration Service (MGN). The migration must be completed over a private network connection using an existing AWS Direct Connect connection. The corporate security policy strictly prohibits replication traffic and agent communications from traversing the public internet. The on-premises network is connected to the target VPC via an AWS Transit Gateway. Which of the following configuration strategies should the Solutions Architect implement to meet these requirements?

  1. Create VPC interface endpoints in the replication staging area VPC for the MGN and EC2 services. Create a Route 53 Private Hosted Zone (PHZ) for these service endpoints and associate it with the staging area VPC and the target VPC. Configure the MGN replication template to use private IP addresses for data routing. Ensure the on-premises firewall and the staging area security groups allow outbound and inbound TCP port 1500 traffic, respectively.Answer
  2. B
    Create VPC interface endpoints in the shared services VPC for the MGN and EC2 services. Create a Route 53 Private Hosted Zone for the endpoints but associate it only with the shared services VPC. Set up an inbound Route 53 Resolver endpoint in the shared services VPC and configure on-premises DNS forwarders. Leave the MGN replication template settings at their default values to allow the agent to automatically locate the nearest replication server.
  3. C
    Create VPC interface endpoints in the replication staging area VPC for the MGN and EC2 services. Associate the Route 53 Private Hosted Zone for these endpoints with the staging area VPC. In the MGN replication template, enable the option to use private IP addresses for data routing. Configure the on-premises firewall and the staging VPC security groups to allow only TCP port 443 traffic, while blocking all other ports to maintain a hardened security posture.
  4. D
    Configure a Direct Connect Public Virtual Interface (VIF) to route replication traffic directly to the public AWS MGN service endpoints. Configure the MGN replication template to use public IP addresses. Set up a static route in the AWS Transit Gateway route tables that directs all traffic destined for the public MGN API endpoints to the Transit Gateway's default route, bypassing the staging VPC.

Answer

Create VPC interface endpoints in the replication staging area VPC for the MGN and EC2 services, associate the Private Hosted Zone with both the staging area and target VPCs, configure the replication template to use private IP addresses for data routing, and allow TCP port 1500 traffic on the firewalls and security groups.
The correct strategy establishes private endpoints (AWS PrivateLink) in the replication staging area VPC for the AWS MGN and Amazon EC2 services. It associates the Route 53 Private Hosted Zone (PHZ) with the staging and target VPCs to resolve service API calls to private IP addresses. Setting the MGN replication template to use private IP addresses ensures that data replication traffic flows over the private Direct Connect path. Finally, opening TCP port 1500 is critical as it is the port used by the MGN Replication Agent to replicate block-level data to the staging area replication servers.

Step-by-Step Solution

1
Configure VPC interface endpoints for MGN and EC2 inside the replication staging area VPC.
Enables private DNS hostnames and endpoints for control plane actions within the VPC.
Allows the on-premises replication agents to communicate with MGN and EC2 APIs privately over Direct Connect.
2
Create and associate a Route 53 Private Hosted Zone (PHZ) for the service endpoints with the staging area and target VPCs, and set up on-premises DNS forwarding.
Enables on-premises systems and resources in both VPCs to resolve the MGN service DNS queries to the private IP addresses of the VPC interface endpoints.
Ensures that DNS traffic does not route to public IP addresses.
3
Modify the AWS MGN replication template to enable private IP routing.
Instructs the Replication Agent to push data replication blocks directly to the private IPs of the replication servers in the staging area.
Forces the replication data path to go over the private Direct Connect link rather than public internet endpoints.
4
Open TCP port 1500 on the on-premises firewall (outbound) and the replication staging VPC security group (inbound).
Allows block-level data transfer between the on-premises agent and the replication servers.
Replication data transfer in AWS MGN occurs over TCP port 1500; blocking it halts replication.

Key Concept

Private connectivity and DNS resolution for AWS Application Migration Service (MGN) replication over Direct Connect
Rate this question

Topics

Hybrid and VMware Cloud on AWS Migrations

More questions from this topic