Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

An enterprise is migrating its core on-premises Enterprise Resource Planning (ERP) database and application servers to AWS using AWS Application Migration Service (MGN). The on-premises environment connects to a central Transit Gateway (TGW) in AWS via an AWS Direct Connect connection with a Transit Virtual Interface (VIF). The target AWS architecture consists of a shared services VPC where the MGN staging area is located, and multiple application target VPCs. The enterprise's security policy mandates that all control plane and replication data traffic must remain strictly private and route over the hybrid network connection without traversing the public internet. During the initial agent installation, the migration team observes that the replication status for the source servers remains stuck at 'Initiating connection' and data transfer has stalled. Which combination of actions should the Solutions Architect take to resolve the connectivity issue and satisfy the security requirements? (Select TWO.)

  1. Configure the on-premises firewall and the staging area security groups to allow inbound and outbound traffic over TCP port 1500 for data replication and TCP port 443 for control plane communication.Answer
  2. Provision interface VPC endpoints for the MGN service within the staging area VPC, create a Route 53 Inbound Resolver, and configure on-premises DNS conditional forwarders to route MGN endpoint queries to the resolver.Answer
  3. C
    Configure the on-premises firewall to permit outbound traffic to the staging area VPC only over TCP ports 80 and 443, as the replication agent tunnels replication payloads using standard HTTPS.
  4. D
    Establish a Direct Connect Gateway connection directly to a Virtual Private Gateway attached to each target application VPC, then configure transitive routing policies on the Direct Connect Gateway to pass replication traffic.
  5. E
    Create MGN interface VPC endpoints in the staging area VPC, associate the default Route 53 Private Hosted Zone with the target application VPCs, and rely on the Transit Gateway to route DNS queries across VPCs without configuring on-premises DNS forwarding.

Answer

Configure the on-premises firewall and staging area security groups to allow traffic on TCP port 1500 and TCP port 443, and establish interface VPC endpoints for the MGN service along with a Route 53 Inbound Resolver and conditional forwarders.
The correct options resolve the issue by opening the required port (TCP 1500) for data replication and setting up the hybrid DNS resolution architecture (PrivateLink interface endpoints, Route 53 Inbound Resolver, and conditional forwarders) needed to keep the control plane traffic private.

Step-by-Step Solution

1
Ensure that the network path allows replication data to flow from the source agents to the staging area.
TCP port 1500 is opened on the firewall and staging area security groups, allowing the block-level data replication stream to connect.
AWS MGN uses TCP port 1500 exclusively for the data replication stream between the agent and the replication servers.
2
Establish a private path to the MGN control plane to avoid traversing the public internet.
Interface VPC endpoints (AWS PrivateLink) are created for MGN in the staging area VPC.
PrivateLink maps the public MGN service endpoints to private IP addresses within the customer's VPC.
3
Resolve the MGN service endpoints privately from the on-premises servers.
A Route 53 Inbound Resolver is deployed, and the on-premises DNS is configured with conditional forwarders for the MGN service domain pointing to the inbound resolver.
This allows the on-premises replication agents to resolve the MGN service endpoints to the private IP addresses of the interface VPC endpoints.

Key Concept

AWS Application Migration Service requires TCP port 1500 for data replication and TCP port 443 for control plane communication. When migrating privately over AWS Direct Connect, interface VPC endpoints (PrivateLink) and a Route 53 Inbound Resolver must be configured to ensure private DNS resolution and traffic routing.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic