Examkin

Question

Difficulty: Very hardInfrastructure Migration with AWS Application Migration Service (MGN)

An organization is migrating its on-premises inventory databases to AWS using AWS Application Migration Service (MGN). The on-premises data center is connected to AWS via a 10 Gbps AWS Direct Connect (DX) connection terminating on a Transit Gateway in a central Shared Services VPC. The staging area subnets are deployed in this VPC and must remain isolated from the public internet due to security compliance rules. All migration replication traffic must travel securely over the private DX connection. Which of the following configuration steps must be performed to establish replication and ensure control plane communication under these constraints? (Select TWO.)

  1. Configure the AWS MGN Replication Template to use private IP addresses for data routing, and ensure that the staging area security groups and on-premises firewalls allow replication traffic on TCP port 1500.Answer
  2. Establish interface VPC endpoints (AWS PrivateLink) for the AWS MGN service in the staging VPC, and ensure that the on-premises DNS resolves the MGN service endpoints to these private IP addresses.Answer
  3. C
    Configure the AWS MGN Replication Template to route replication traffic over HTTPS (TCP port 443) to the staging area subnets, allowing the security groups to block all other custom TCP ports.
  4. D
    Associate a Route 53 Private Hosted Zone (PHZ) containing the MGN service endpoint records with the Shared Services VPC, relying on automatic PHZ inheritance to resolve DNS queries in all Transit Gateway-attached spoke VPCs without manual association.
  5. E
    Deploy a single NAT Gateway in one Availability Zone of the Shared Services VPC to route all outbound MGN agent control traffic to the public MGN API endpoints, and update all staging subnet route tables to use this NAT Gateway as their default route.

Answer

Configure the AWS MGN Replication Template to use private IP addresses for data routing with TCP port 1500 open, and establish interface VPC endpoints for AWS MGN with appropriate DNS resolution.
To migrate workloads privately using AWS Application Migration Service (MGN) without internet access, you must configure the MGN Replication Template to use private IPs for replication, and ensure firewalls/security groups allow TCP port 1500 traffic. Additionally, interface VPC endpoints (PrivateLink) must be created for AWS MGN so that the replication agent can communicate with the control plane securely over the Direct Connect connection using private DNS resolution.

Step-by-Step Solution

1
Configure the replication template in AWS MGN to use private IP addresses for data replication, ensuring replication traffic traverses the private Direct Connect link instead of public routes.
The AWS MGN agent will attempt to connect to the replication servers in the staging area using their private IP addresses.
This is required because the staging area subnets do not have public IP routing and all traffic must remain private.
2
Ensure TCP port 1500 is allowed outbound from the on-premises source servers and inbound at the security group of the replication servers in the staging area subnets.
The replication agent can successfully establish a data channel to send block-level writes to the replication servers.
AWS MGN uses TCP port 1500 for the continuous data replication stream.
3
Deploy interface VPC endpoints (PrivateLink) for the AWS MGN service (com.amazonaws.<region>.mgn) inside the staging VPC.
Private IP addresses are allocated within the staging subnets for the MGN control plane API.
The replication agent needs to communicate with the MGN control plane for orchestration, which is otherwise unreachable from an isolated network.
4
Configure DNS resolution so that the on-premises source servers can resolve the public MGN service DNS name to the private IP addresses of the interface endpoints.
The replication agent resolves the service endpoint to the PrivateLink interface IPs, enabling secure control plane communication.
This ensures the agent can register and receive migration instructions without public internet access.

Key Concept

Configuring AWS MGN for private replication over AWS Direct Connect using private IPs, custom ports (TCP 1500), and interface VPC endpoints for control plane access.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic