Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

A bioinformatics research institute is migrating 24 local physical servers running genomic analysis pipelines to AWS using AWS Application Migration Service (MGN). The on-premises network is connected to AWS via a 2 Gbps AWS Direct Connect connection using a Transit Virtual Interface (Transit VIF) terminating at a Direct Connect Gateway, which is associated with an AWS Transit Gateway. The Transit Gateway connects a Shared Services VPC and a dedicated Migration Staging VPC. In compliance with strict genomic data privacy regulations, all migration and replication traffic must traverse the private Direct Connect path and cannot route over the public internet. No internet gateway or NAT gateway is permitted in the Migration Staging VPC. Which configuration strategy should the Solutions Architect implement to establish secure, private replication while minimizing operational overhead?

  1. Configure the AWS MGN replication template to use private IP routing. Deploy VPC interface endpoints for AWS MGN (com.amazonaws.us-east-1.mgn) in the Migration Staging VPC, and ensure private DNS is enabled. Configure the on-premises firewalls and Migration Staging security groups to allow outbound TCP Port 443 from the on-premises servers to the MGN interface endpoints, and outbound TCP Port 1500 from the on-premises servers to the replication servers' subnet in the Migration Staging VPC.Answer
  2. B
    Configure the AWS MGN replication template to use private IP routing. Deploy VPC interface endpoints for AWS MGN (com.amazonaws.us-east-1.mgn) in the Shared Services VPC. Associate the Amazon Route 53 Private Hosted Zone (PHZ) for MGN with the Migration Staging VPC. Configure on-premises firewalls to allow outbound TCP Port 443 and TCP Port 1500 only to the Shared Services VPC, relying on Transit Gateway transit routing to forward the replication blocks to the Migration Staging VPC.
  3. C
    Configure the AWS MGN replication template to use private IP routing. Deploy VPC interface endpoints for AWS MGN (com.amazonaws.us-east-1.mgn) in the Migration Staging VPC. Configure the on-premises firewall and Migration Staging security groups to allow outbound TCP Port 443 from on-premises to the interface endpoints. Block TCP Port 1500 at the perimeter firewall to enforce SSL/TLS encryption for all data transit, allowing MGN to tunnel replication traffic over HTTPS.
  4. D
    Configure the AWS MGN replication template to use public IP routing. Establish an AWS Direct Connect Public Virtual Interface (Public VIF) on the connection to route replication traffic to the public AWS MGN endpoints. Deploy NAT Gateways in the Migration Staging VPC to translate the replication servers' private IP addresses to public IPs for on-premises communication.

Answer

Configure the AWS MGN replication template to use private IP routing. Deploy VPC interface endpoints for AWS MGN in the Migration Staging VPC, and configure the on-premises firewalls and Migration Staging security groups to allow outbound TCP Port 443 from the on-premises servers to the MGN interface endpoints, and outbound TCP Port 1500 from the on-premises servers to the replication servers' subnet in the Migration Staging VPC.
The correct configuration establishes a fully private replication path. By setting the replication template to use private IP routing and provisioning interface VPC endpoints (PrivateLink) for MGN in the Migration Staging VPC, the replication agent can communicate with the control plane over TCP Port 443. Crucially, the replication agent must also have direct access to the replication servers in the staging subnet over TCP Port 1500 to transmit data blocks. This design fulfills the security requirement of avoiding the public internet and NAT Gateways while satisfying all network port prerequisites.

Step-by-Step Solution

1
Select private IP routing in the AWS Application Migration Service (MGN) Replication Template.
Configures MGN to allocate private IP addresses to replication servers and expect replication traffic over the private network path.
Allows replication traffic to route over the AWS Direct Connect connection instead of the public internet, satisfying the security and regulatory constraints.
2
Deploy Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service in the Migration Staging VPC.
Enables the on-premises MGN replication agent to securely communicate with the MGN control plane API over the Direct Connect path using private IP addresses.
Provides a private route to the MGN control plane, resolving the lack of public internet access (no Internet Gateway or NAT Gateway) in the staging environment.
3
Configure network security groups and on-premises firewalls to allow TCP Port 443 and TCP Port 1500.
Establishes connectivity for both the control plane (Port 443 to the VPC endpoints) and the data plane (Port 1500 directly to the replication servers' subnet).
Ensures the replication agent can register with the control plane and successfully stream compressed, encrypted replication blocks to the staging area.

Key Concept

AWS Application Migration Service (MGN) supports data replication over private networks (VPN or Direct Connect) by utilizing private IP routing and Interface VPC Endpoints (PrivateLink) for control plane communication. In this topology, control traffic uses TCP Port 443 to the endpoints, and data replication traffic uses TCP Port 1500 directly to the replication servers in the staging subnet.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic