Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

An energy utility company is migrating 1515 physical on-premises servers hosting critical control systems to AWS using AWS Application Migration Service (MGN). Due to regulatory compliance, all replication traffic must remain private and must not traverse the public internet. A 2 Gbps2\text{ Gbps} AWS Direct Connect connection is established between the on-premises data center and an AWS Transit Gateway in a shared services account. The Transit Gateway routes traffic to a dedicated Migration VPC where the staging area subnet is located. The AWS MGN Replication Agent will be installed on each on-premises server. Which network and service configuration must be implemented to ensure that the replication traffic is kept entirely private and replication completes successfully?

  1. Configure the AWS MGN Replication Template to use private IP routing. Create Interface VPC Endpoints for the AWS MGN service inside the Staging VPC, and configure the on-premises DNS to resolve the MGN service endpoints to these private IPs. Allow inbound traffic on TCP port 1500 to the staging area subnets from the on-premises network, and allow outbound traffic on TCP port 443 from the source servers to the MGN Interface VPC Endpoints.Answer
  2. B
    Configure the AWS MGN Replication Template to use private IP routing. Create Interface VPC Endpoints for the AWS MGN service inside the Staging VPC. To ensure maximum security, configure the Staging VPC security groups to allow inbound traffic on TCP port 443 from the on-premises network, but block all other inbound traffic including TCP port 1500 to prevent unauthorized block-level data access.
  3. C
    Configure the AWS MGN Replication Template to use public IP routing. Establish a Public Virtual Interface (VIF) on the Direct Connect connection to route replication traffic to the public endpoints of AWS MGN, and configure a NAT Gateway in the Staging VPC to route return traffic from the replication servers back to the on-premises network.
  4. D
    Configure the AWS MGN Replication Template to use private IP routing. Create Interface VPC Endpoints for the AWS MGN service in a shared services VPC associated with a Route 53 Private Hosted Zone for the service endpoints, but do not associate this Private Hosted Zone with the Staging VPC to avoid overlapping DNS resolution conflicts with the on-premises domain controllers.

Answer

Configure the AWS MGN Replication Template to use private IP routing, create Interface VPC Endpoints in the Staging VPC, configure on-premises DNS to resolve MGN endpoints to these private IPs, allow inbound TCP port 1500 from the on-premises network to the staging subnets, and allow TCP port 443 outbound from the source servers to the interface endpoints.
The correct configuration establishes private IP routing in the AWS MGN Replication Template, deploy Interface VPC Endpoints for MGN in the Staging VPC, and maps DNS correctly. It also ensures both required ports (TCP 443 for control plane API calls and TCP 1500 for replication data transfer) are open in firewalls and security groups.

Step-by-Step Solution

1
Select private IP routing in the AWS MGN Replication Template.
Instructs the MGN replication servers and agents to route data replication traffic over the private Direct Connect link rather than using public IPs.
This complies with the security requirement to keep replication traffic off the public internet.
2
Create VPC Interface Endpoints for the MGN service in the Staging VPC.
Provides private IP addresses in the Staging VPC that map to the AWS MGN control plane.
Allows agents and replication servers to communicate with the AWS MGN control plane without requiring internet access.
3
Configure DNS and firewall rules to allow TCP ports 443 and 1500.
Ensures the replication agent can reach the control plane over port 443 and stream data blocks to the replication servers over port 1500.
Replication fails if the agent cannot establish the control connection (port 443) or the data replication stream (port 1500).

Key Concept

Private replication with AWS Application Migration Service (MGN) over VPN or Direct Connect requires configuring private IP routing in the replication template, creating VPC Interface Endpoints for control traffic (port 443), and opening port 1500 for data replication.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic