A global media company is migrating its legacy application workloads from a co-located dat… — AWS Certified Solutions Architect - Professional

A global media company is migrating its legacy application workloads from a co-located data center to AWS using AWS Application Migration Service (MGN). The hybrid connectivity consists of a $10\text{ Gbps}$ AWS Direct Connect connection terminated at an AWS Transit Gateway. The on-premises source servers reside in a restricted segment with no direct internet access. To facilitate migration, the Solutions Architect deploys Interface VPC Endpoints in the staging VPC for the MGN control plane and creates a Route 53 Private Hosted Zone (PHZ) for the service endpoints. During testing, the MGN agents fail to register from the on-premises servers, and the few servers that did register show a replication status of permanently stalled. Additionally, the staging VPC currently uses a single NAT Gateway in `us-east-1a` to handle egress traffic, violating high availability requirements. Which of the following actions should the Solutions Architect take to resolve the registration and replication stalls while establishing a highly available and resilient architecture? (Select TWO.)

Deploy Route 53 Resolver Inbound Endpoints in the staging VPC, configure the on-premises DNS servers to forward queries for the MGN control plane endpoint to these inbound endpoint IP addresses, and allow inbound TCP port $443$ traffic to the Interface VPC Endpoints from the on-premises network.Answer
Modify the staging VPC security groups and on-premises firewall rules to permit bidirectional traffic over TCP port $1500$ for data replication, and provision a NAT Gateway in each Availability Zone of the staging VPC to ensure redundant egress paths for staging resources.Answer
C
Associate the Route 53 Private Hosted Zone for the MGN endpoint directly with the on-premises network using AWS Resource Access Manager (RAM), and allow TCP port $1500$ traffic on the Transit Gateway route tables.
D
Configure an AWS Direct Connect Gateway to establish transitive VPC-to-VPC routing between the staging VPC and other target VPCs, bypassing the Transit Gateway to route MGN replication traffic.
E
Configure the MGN replication template to route traffic over the public internet and open TCP port $443$ only, as the MGN replication agent encapsulates replication blocks inside HTTPS traffic to bypass the port $1500$ requirement.
F
Retain the single NAT Gateway in `us-east-1a` to minimize costs, and configure cross-Availability Zone routing in the staging VPC route tables to allow resources in `us-east-1b` to failover to the NAT Gateway in `us-east-1a` during an outage.

Answer

To resolve the registration and replication issues and ensure high availability, the Solutions Architect must deploy Route 53 Resolver Inbound Endpoints to handle on-premises DNS forwarding for the MGN private endpoints, open TCP ports

443

and

1500

on the security groups and firewalls, and deploy a NAT Gateway in each Availability Zone of the staging VPC.

The correct solutions involve setting up Route 53 Resolver Inbound Endpoints in the staging VPC to allow the on-premises DNS servers to forward and resolve the MGN control plane private endpoint addresses. Additionally, the security groups and firewalls must permit traffic on TCP port

443

for agent registration and TCP port

1500

for data replication to the staging area replication servers. To achieve high availability and eliminate single points of failure, a NAT Gateway must be deployed in each Availability Zone of the staging VPC rather than relying on a single NAT Gateway.

Step-by-Step Solution

Deploy Route 53 Resolver Inbound Endpoints in the staging VPC and point the on-premises DNS forwarders to them.

On-premises source servers can successfully resolve the private DNS names for the MGN control plane interface endpoints.

On-premises servers must resolve the private IP addresses of the VPC endpoints to register with the MGN control plane.

Configure security groups on the Interface VPC Endpoints to allow inbound traffic on TCP port

443

from the on-premises subnets.

The MGN agents installed on the on-premises servers can successfully register with the MGN service control plane.

Agent registration requires HTTPS access (TCP port

443

) to the MGN control plane endpoints.

Allow inbound traffic on TCP port

1500

in the replication staging area security groups and on-premises firewalls.

The replication agents can stream block-level data to the replication servers in the staging VPC, resolving the stalled replication status.

MGN uses TCP port

1500

for the continuous replication of disk data blocks from source servers to staging area replication servers.

Deploy a NAT Gateway in each Availability Zone of the staging VPC and configure the private route tables accordingly.

The staging area resources have highly available and redundant outbound paths to the internet, eliminating a single point of failure.

A single NAT Gateway creates a single point of failure if its Availability Zone goes offline, disrupting egress traffic from other zones.

Key Concept

Configuring private data replication, hybrid DNS resolution, and multi-AZ egress redundancy for AWS Application Migration Service (MGN)

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic