Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

A logistics company is migrating its real-time shipment-tracking application, running on 12 on-premises servers, to AWS using AWS Application Migration Service (MGN). The hybrid network architecture consists of an AWS Direct Connect connection terminated at an AWS Transit Gateway, which connects to a dedicated migration VPC. The company's security policy requires that all data replication traffic must remain private, traversing the Direct Connect connection without accessing the public internet. Additionally, after cutover, the target instances must automatically register with AWS Systems Manager (SSM) to perform post-launch configuration.

During the initial replication setup, the Solutions Architect notes that the MGN agent installation on the source servers succeeds, but the data replication status remains stalled.

Which two actions should the Solutions Architect take to resolve the replication failure and meet the post-launch management requirements? (Select TWO.)

  1. Configure the on-premises firewall and the Replication Server security group in the staging area to allow traffic on TCP port 1500 between the source servers and the replication servers.Answer
  2. Create VPC endpoints for AWS Systems Manager (SSM) in the target VPC, and configure the MGN post-launch template to install and verify the SSM Agent.Answer
  3. C
    Configure the staging area security groups and on-premises firewall to allow TCP port 443 for data replication, as MGN encrypts and compresses block-level replication traffic over standard HTTPS.
  4. D
    Associate the Route 53 Private Hosted Zone for Systems Manager endpoints with the staging area VPC and the Transit Gateway VPC, while omitting the association with the target VPC.
  5. E
    Provision a single NAT Gateway in a public subnet within the staging area VPC, and configure the staging area route tables to direct all outbound replication traffic to this NAT Gateway.

Answer

The correct actions are to allow TCP port 1500 traffic between the source servers and the replication servers, and to create Systems Manager VPC endpoints in the target VPC while configuring the post-launch template to install the Systems Manager agent.
The correct response combines enabling replication traffic over the required TCP port 1500 with setting up the necessary Systems Manager VPC endpoints and MGN post-launch configuration. Replicating source servers requires TCP port 1500 to be open between the source environment and the staging area replication servers. For target instances to securely register with AWS Systems Manager without internet access, interface VPC endpoints must be created in the target VPC, and the post-launch template must be configured to install the agent.

Step-by-Step Solution

1
Ensure the replication data channel is open by configuring firewalls and security groups to allow TCP port 1500.
Replication agent is able to establish connection with replication servers and begin data transfer.
AWS Application Migration Service requires TCP port 1500 for data replication traffic.
2
Configure the MGN post-launch settings to install the AWS Systems Manager Agent on launched target instances.
Target instances will have the agent installed automatically upon boot.
This automates the agent bootstrap process as part of the post-launch configuration.
3
Deploy Systems Manager interface VPC endpoints in the target VPC and enable Private DNS.
Launched instances can securely register with Systems Manager without needing public internet access.
This satisfies the privacy constraint for post-launch target instance management.

Key Concept

Configuring correct network connectivity (port 1500) and post-launch settings in AWS Application Migration Service (MGN) for secure, private migrations.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic