Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

A healthcare provider is migrating its clinical diagnostics imaging system from an on-premises data center to AWS using AWS Application Migration Service (MGN). The on-premises environment is connected to AWS via a 1 Gbps1\text{ Gbps} AWS Direct Connect connection terminated at an AWS Transit Gateway. To comply with patient data privacy regulations, the source servers are hosted in a secure zone with no outbound internet access, and all data transmission to AWS must occur over private connections.

The migration engineer has installed the AWS Replication Agent on the source servers, but the replication status remains stuck at "Connecting" and the agents fail to register with the AWS MGN service.

Which of the following configuration steps should the solutions architect perform to resolve the connectivity issues and initiate replication? (Select two.)

  1. Configure the security groups of the replication servers in the staging area and the on-premises firewalls to allow inbound traffic on TCP port 1500 from the source servers.Answer
  2. Deploy Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service in the staging VPC, and configure the on-premises DNS to forward queries for the MGN regional endpoint to Route 53 Resolver inbound endpoints.Answer
  3. C
    Deploy a single NAT Gateway in the staging VPC and update the Transit Gateway route table to direct outbound traffic from the on-premises subnet to the NAT Gateway to resolve the public MGN API endpoint.
  4. D
    Create a Route 53 Private Hosted Zone for the MGN regional endpoint in the staging VPC, but do not associate it with the staging VPC, relying on the Transit Gateway to propagate the DNS records to the on-premises networks.
  5. E
    Establish a Direct Connect Gateway connection directly to handle transitive routing between the staging VPC and the target VPC, bypassing the Transit Gateway for replication data.

Answer

The solutions architect must configure the staging area security groups and on-premises firewalls to allow inbound traffic on TCP port 1500 from the source servers, and deploy Interface VPC Endpoints for the AWS MGN service in the staging VPC while configuring on-premises DNS to forward queries to Route 53 Resolver inbound endpoints.
To establish replication in a strictly private environment, two communication channels must be configured. First, the data replication channel requires TCP port 1500 to be open from the source servers to the replication servers in the staging area. Second, the control plane registration and communication require the agent to reach the MGN API endpoint on TCP port 443. Since public internet access is prohibited, Interface VPC Endpoints must be created in the staging VPC. On-premises DNS servers must then be configured to resolve the MGN endpoint to these private IPs by forwarding queries to a Route 53 Resolver inbound endpoint.

Step-by-Step Solution

1
Identify the network requirements for AWS MGN replication data transfer.
Establish that the replication agents send data to replication servers in the staging area using TCP port 1500.
Replication traffic requires opening port 1500 through all firewalls and security groups along the network path.
2
Identify the network requirements for MGN control plane registration and management.
Acknowledge that agents must communicate with the regional MGN service API over HTTPS (TCP port 443).
Because the source environment has no internet access, interface VPC endpoints (PrivateLink) are required in the staging VPC to access the MGN endpoints privately.
3
Configure DNS resolution for private endpoints.
Route queries for the MGN service endpoint from the on-premises DNS to the Route 53 Resolver inbound endpoint.
This ensures the source servers resolve the public MGN service address to the private IP addresses of the interface VPC endpoints.

Key Concept

Network architecture and DNS resolution for private replication using AWS Application Migration Service (MGN) over AWS Direct Connect.
Estimated Time:2m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic