An enterprise is planning to migrate 50 physical servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The hybrid network infrastructure includes a 10 Gbps AWS Direct Connect connection terminated on a Transit Gateway in a central shared services VPC. Strict security policies dictate that all replication traffic must be private and cannot traverse the public internet. The staging area VPC has no Internet Gateway attached. After installing the AWS Replication Agent on several on-premises servers, the Solutions Architect notes that the replication status is 'Stalled' and the agents cannot connect to the replication servers. Which two configuration steps must the Solutions Architect perform to resolve this issue and establish private replication? (Select TWO.)
- Configure the AWS Application Migration Service replication settings to use private IP routing, and ensure that the on-premises firewall and the staging VPC security groups permit outbound and inbound traffic on TCP Port 1500 respectively.Answer
- Create interface VPC endpoints for AWS Application Migration Service in the staging VPC, and associate the resulting Route 53 Private Hosted Zone with the staging VPC and any peer VPCs that handle DNS resolution for the hybrid network.Answer
- CDeploy a single NAT Gateway in the staging VPC to route the data replication traffic, allowing the replication servers to communicate with the AWS Application Migration Service public endpoints over the public internet.
- DConfigure the AWS Replication Agent to route block-level data replication over TCP Port 443 to the MGN control plane interface endpoint, eliminating the need to open port 1500 on the on-premises firewall.
- EConfigure a Direct Connect Gateway to enable transitive VPC-to-VPC routing between the staging VPC and the central shared services VPC without using a Transit Gateway to resolve DNS queries.