Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

An automotive manufacturer is migrating its core supply chain management system, comprising 40 on-premises physical servers, to AWS using AWS Application Migration Service (MGN). The hybrid network connection is established via an AWS Direct Connect (DX) connection terminating on an AWS Transit Gateway. The target environment utilizes a dedicated Staging VPC for data replication and multiple Application VPCs for target workloads. To comply with security policies, all replication traffic must remain private over the DX connection, and no resources in the Staging VPC or on-premises can have direct access to the public internet.

To support this configuration, a solutions architect provisions VPC Interface Endpoints for the MGN control plane (mgn.{region}.amazonaws.com) and Amazon EC2 within a central Shared Services VPC. A Route 53 Private Hosted Zone (PHZ) for the MGN endpoint is created in the Shared Services account. During testing, the MGN agents are successfully installed on the source servers, but the replication status is reported as 'Stalled'. An investigation reveals that the replication servers launched in the Staging VPC are failing to communicate with the MGN control plane.

Which of the following actions should the solutions architect take to resolve this issue?

  1. Associate the Route 53 Private Hosted Zone in the Shared Services account with the Staging VPC. Update the Staging VPC route tables to route traffic destined for the Shared Services VPC through the Transit Gateway, and configure the security group of the MGN interface endpoints in the Shared Services VPC to accept inbound traffic on TCP port 443 from the Staging VPC CIDR range.Answer
  2. B
    Configure Route 53 Resolver outbound endpoints in the Staging VPC to forward DNS queries for the MGN endpoint to the on-premises DNS servers, which then forward those queries to Route 53 Resolver inbound endpoints in the Shared Services VPC, rather than associating the Private Hosted Zone with the Staging VPC.
  3. C
    Associate the Direct Connect Gateway directly with both the Staging VPC and the Shared Services VPC, and configure the Staging VPC route table to route traffic destined for the Shared Services VPC CIDR through the Direct Connect Gateway to enable transitive VPC-to-VPC routing.
  4. D
    Configure the MGN replication template to assign public IP addresses to the replication servers. Update the on-premises firewall to allow outbound TCP port 1500 to the public internet, and route replication traffic through a public internet path instead of the Direct Connect connection.

Answer

Associate the Route 53 Private Hosted Zone with the Staging VPC, configure routing via the Transit Gateway, and allow inbound traffic on port 443 in the interface endpoint's security group.
The correct answer addresses the DNS and routing requirements for a fully private MGN replication channel. Associating the Private Hosted Zone with the Staging VPC ensures that the replication servers can resolve the MGN endpoint to the private IP addresses of the interface endpoints in the Shared Services VPC. Configuring the Staging VPC route tables ensures a path exists through the Transit Gateway to the Shared Services VPC. Allowing inbound traffic on port 443 in the interface endpoint's security group allows the HTTPS connection to succeed.

Step-by-Step Solution

1
Associate the Route 53 Private Hosted Zone (PHZ) created in the Shared Services account with the Staging VPC.
This enables the replication servers launched in the Staging VPC to resolve the MGN service endpoint name (mgn.{region}.amazonaws.com) to the private IP addresses of the VPC Interface Endpoints in the Shared Services VPC.
By default, a PHZ is only resolvable within the VPCs it is associated with. Without this association, the replication servers will attempt to resolve the public IP of the MGN control plane, which they cannot reach due to lack of internet access.
2
Update the Staging VPC route tables to route traffic destined for the Shared Services VPC CIDR through the Transit Gateway.
Network packets from the replication servers in the Staging VPC can now reach the Shared Services VPC where the interface endpoints are hosted.
The replication servers must have a valid network path to the VPC interface endpoints to establish a connection.
3
Configure the security group attached to the VPC Interface Endpoints in the Shared Services VPC to allow inbound HTTPS (TCP port 443) traffic from the Staging VPC CIDR range.
The firewall rules allow the replication servers to complete the HTTPS handshake with the MGN control plane.
Security groups on VPC interface endpoints act as stateful firewalls; they must explicitly permit incoming traffic from the source VPC's network range.

Key Concept

To support private replication using AWS MGN over a Direct Connect connection without public internet access, you must deploy VPC interface endpoints in a VPC, associate the corresponding Route 53 Private Hosted Zone with all replicating VPCs (including the Staging VPC), ensure Transit Gateway routing is established, and configure security groups to allow HTTPS traffic (TCP port 443) from the replicating networks.

Alternative Method

Instead of Transit Gateway, VPC Peering could be used to connect the Staging VPC and the Shared Services VPC, provided IP addresses do not overlap, but the Route 53 Private Hosted Zone association with the Staging VPC remains a mandatory requirement.
Estimated Time:2m 30s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic