Examkin

Question

Difficulty: MediumHybrid and VMware Cloud on AWS Migrations

A company is planning to migrate its on-premises VMware vSphere virtual machines (VMs) to native Amazon EC2 instances using AWS Application Migration Service (MGN). The migration network path must utilize an existing 1 Gbps1\text{ Gbps} AWS Direct Connect connection with a backup Site-to-Site VPN. The company's compliance policy mandates that replication traffic must be encrypted and remain entirely within a private network path without traversing the public internet. The migration requires a Recovery Point Objective (RPO) of less than 1010 minutes and a replication cutover window with less than 1515 minutes of downtime. During the initial agent deployment, the replication status remains in the 'Establishing connection' state, and data replication cannot start. Security groups and network ACLs are configured to allow HTTPS traffic (TCP port 443) to AWS endpoints. Which network configuration modification will resolve the replication connection issue while adhering to all compliance constraints?

  1. Configure the on-premises firewall and the staging area security groups to allow inbound and outbound traffic over TCP port 1500, and enable the use of private IP addresses for data replication in the AWS MGN replication template.Answer
  2. B
    Configure a Direct Connect public virtual interface to establish connectivity to the AWS MGN public endpoints, and configure the staging area security groups to allow inbound traffic on TCP port 443.
  3. C
    Associate the AWS MGN service endpoints with a Route 53 Private Hosted Zone in a central shared services account, and configure the replication template to use public IP addresses over the Direct Connect private virtual interface.
  4. D
    Configure a Direct Connect Gateway directly to handle the transitive routing of replication traffic between the on-premises VMware environment and the staging VPC, and ensure that TCP port 8080 is open in the on-premises firewall.

Answer

Configure the on-premises firewall and the staging area security groups to allow inbound and outbound traffic over TCP port 1500, and enable the use of private IP addresses for data replication in the AWS MGN replication template.
Allowing inbound and outbound traffic over TCP port 1500 on the on-premises firewall and staging area security groups, and enabling the use of private IP addresses in the replication template resolves the connection block and routes data replication over the private Direct Connect path, satisfying the security and connectivity compliance constraints.

Step-by-Step Solution

1
Identify the network ports required by AWS Application Migration Service (MGN) for replication data transfer.
Determine that while control plane traffic uses TCP port 443, the actual data replication traffic from source agents to replication servers in the staging area occurs over TCP port 1500.
Replication will fail to initiate and remain in an 'Establishing connection' state if TCP port 1500 is blocked in the firewalls or security groups.
2
Analyze compliance requirements regarding the data path of replication traffic.
Determine that traffic must route via private IPs over the Direct Connect connection or VPN to keep the data entirely within the private network path.
By default, MGN replication traffic uses public IP addresses. Setting the replication template to use private IP addresses routes the replication traffic over the private virtual interface (VIF) of the Direct Connect connection.

Key Concept

AWS MGN data replication requires TCP port 1500 to be open between source servers and the staging area, and private IP replication must be enabled to comply with private-path constraints.
Rate this question

Topics

Hybrid and VMware Cloud on AWS Migrations

More questions from this topic