Examkin

Question

Difficulty: Very hardInfrastructure Migration with AWS Application Migration Service (MGN)

A pharmaceutical company is executing a lift-and-shift migration of its on-premises Manufacturing Execution System (MES) to AWS using AWS Application Migration Service (MGN). The on-premises servers are located in a secure subnet with outbound traffic filtered through a local firewall. Connectivity to AWS is established via a Site-to-Site VPN terminated on an AWS Transit Gateway in a centralized Network Services account. The target staging area resides in a dedicated Staging VPC in a separate Migration account, which is attached to the same Transit Gateway. After successful installation of the MGN replication agent on the source servers, the replication status in the AWS Migration Hub console remains 'Stalled' with zero bytes transferred. Which configuration changes must the Solutions Architect implement to establish replication connectivity and allow replication data to flow to the staging area? (Select TWO.)

  1. Configure the security group of the Replication Servers in the Staging VPC to allow inbound traffic on TCP port 15001500 from the on-premises source subnet CIDR block.Answer
  2. Update the Transit Gateway route tables and the Staging VPC route tables to ensure bidirectional routing is established between the Staging VPC subnet and the on-premises subnet.Answer
  3. C
    Associate the Route 53 Private Hosted Zone (PHZ) created for the MGN VPC endpoints with the Staging VPC, and configure an on-premises DNS conditional forwarder to resolve MGN endpoints via a VPC peering connection.
  4. D
    Deploy a single NAT Gateway in the public subnet of the Staging VPC, and configure the Staging VPC route tables to route all outbound replication server traffic through the NAT Gateway to reach the on-premises network.
  5. E
    Attach a Direct Connect Gateway directly to the Staging VPC, and establish a virtual interface (VIF) to bypass the Transit Gateway to enable transitive routing between the VPN and the Direct Connect Gateway.

Answer

Configure the security group of the Replication Servers in the Staging VPC to allow inbound traffic on TCP port 15001500 from the on-premises source subnet CIDR block, and update the Transit Gateway route tables and the Staging VPC route tables to ensure bidirectional routing is established between the Staging VPC subnet and the on-premises subnet.
The correct options ensure that the data replication path is open. First, configuring the security group in the staging area to allow inbound TCP port 15001500 from the source CIDR is mandatory because AWS MGN uses TCP port 15001500 for data replication. Second, routing tables on both the Transit Gateway and Staging VPC must be updated to facilitate private bidirectional communication across accounts and over the Site-to-Site VPN connection.

Step-by-Step Solution

1
Analyze the replication path requirements for AWS MGN.
Identify that the Replication Agent replicates data to the Staging Area over TCP port 15001500, while control plane communication uses port 443443.
Because the status is stalled and zero bytes have been transferred, data channel connectivity (TCP port 15001500) is blocked.
2
Review the staging area security group configuration.
Confirm that the Replication Server's security group must permit inbound TCP port 15001500 traffic from the on-premises source CIDR.
This allows the agent to push replicated blocks to the Replication Servers.
3
Review hybrid routing path via Transit Gateway.
Ensure Transit Gateway route tables propagate the on-premises CIDR to the Staging VPC attachment, and the Staging VPC route table has a route for the on-premises CIDR pointing to the Transit Gateway.
Without bidirectional routing, the TCP handshake on port 15001500 cannot complete.

Key Concept

AWS MGN data replication requires network-level routing and security group permissions on TCP port 15001500 between the source servers and the Replication Servers in the target staging VPC.
Estimated Time:3m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic