An international automotive logistics enterprise is migrating its legacy ERP and distribut… — AWS Certified Solutions Architect - Professional

An international automotive logistics enterprise is migrating its legacy ERP and distribution scheduling workloads comprising $45$ physical servers from an on-premises data center to AWS. Security policies mandate that all migration traffic must be completely private, bypassing the public internet. The hybrid network architecture consists of a $10\text{ Gbps}$ AWS Direct Connect connection linked to a Direct Connect Gateway, which is attached to an AWS Transit Gateway. The Transit Gateway routes traffic to a target spoke VPC and a dedicated replication staging area VPC across multiple Availability Zones. The migration team has installed the AWS Application Migration Service (AWS MGN) replication agent on the source servers and configured the replication template to use private IP addresses. However, replication fails to initiate. The agent logs show that the source servers cannot connect to either the AWS MGN control plane endpoints or the replication servers in the staging VPC. Which configuration steps should the solutions architect implement to establish replication connectivity while adhering to the security requirements?

Deploy Interface VPC Endpoints for AWS MGN in the replication staging area VPC. Associate the Amazon Route 53 private hosted zone for the endpoints with the staging area VPC, and configure a Route 53 Resolver inbound endpoint to resolve the service domain from the on-premises environment. Open outbound TCP port $443$ and TCP port $1500$ on the on-premises firewall to the staging VPC subnets, and configure the AWS Transit Gateway routing tables to allow bidirectional traffic between the on-premises data center and the staging VPC.Answer
B
Deploy Interface VPC Endpoints for AWS MGN in the replication staging area VPC. Configure Route 53 Resolver inbound endpoints for service name resolution. Open outbound TCP port $443$ and TCP port $80$ on the on-premises firewall to the staging VPC subnets, and configure a single non-redundant NAT Gateway in the staging VPC to handle outbound traffic. Rely on the NAT Gateway to route the replication traffic over the Direct Connect public virtual interface.
C
Establish a Direct Connect Gateway connected directly to the target spoke VPC and replication staging VPC using virtual private gateways (VGWs) to bypass the AWS Transit Gateway. Configure Route 53 Resolver outbound endpoints to forward DNS queries to on-premises DNS servers. Open outbound TCP port $443$ and TCP port $1500$ on the on-premises firewall to the staging VPC CIDR, and configure the staging area security groups to restrict access.
D
Deploy Interface VPC Endpoints for AWS MGN in the target spoke VPC. Configure Route 53 Resolver inbound endpoints to handle DNS queries from the on-premises network. Open outbound TCP port $443$ and TCP port $1500$ on the on-premises firewall to the target VPC CIDR. Rely on the assumption that associating the Route 53 Private Hosted Zone with the target VPC automatically enables name resolution and interface endpoint routing for the staging VPC without explicit association.

Answer

The configuration option that deploys Interface VPC Endpoints in the replication staging area VPC, configures Route 53 Resolver inbound endpoints, opens TCP ports

443

and

1500

on the firewall, and ensures proper Transit Gateway routing.

Establishing Interface VPC Endpoints for AWS MGN in the replication staging VPC allows the replication servers and agents to access MGN control plane endpoints privately. Associating the Route 53 private hosted zone with the staging VPC and configuring Route 53 Resolver inbound endpoints allows the on-premises servers to resolve the endpoint domain names. Opening outbound TCP port

443

(for control plane communication) and TCP port

1500

(for data replication) on the firewall ensures the agent can establish connectivity. Finally, configuring Transit Gateway routes enables bidirectional private communication between the on-premises environment and the replication staging area.

Step-by-Step Solution

Deploy Interface VPC Endpoints for AWS MGN (e.g., mgn.region.amazonaws.com) in the staging VPC.

Enables private access to the AWS MGN control plane without routing traffic over the public internet.

Security policies prevent any public internet traversal, requiring interface endpoints for control plane API calls.

Associate the Route 53 Private Hosted Zone (PHZ) with the staging VPC and set up Route 53 Resolver inbound endpoints.

Allows on-premises source servers to resolve the AWS MGN endpoint domain names to their private IP addresses in the staging VPC.

The replication agent installed on-premises needs to resolve the control plane endpoints to the private VPC endpoint IPs.

Configure the on-premises firewall to permit outbound traffic to the staging VPC CIDR on TCP port

443

and TCP port

1500

Allows the on-premises agent to establish control plane communication (port

443

) and begin block-level data replication (port

1500

AWS MGN uses TCP port

1500

for data replication to the replication servers and TCP port

443

for control plane orchestration.

Ensure that the AWS Transit Gateway routing tables allow bidirectional traffic between the on-premises network CIDR and the staging VPC subnets.

Establishes network-level connectivity between the source servers and both the interface endpoints and replication servers.

Replication fails if Transit Gateway or Direct Connect Gateway routing blocks bidirectional pathing.

Key Concept

Private infrastructure replication using AWS Application Migration Service (MGN) over Direct Connect and Transit Gateway.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic