Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

A smart agriculture technology provider is migrating its telemetry aggregation workloads, consisting of 1515 on-premises physical servers, to AWS using AWS Application Migration Service (MGN). The on-premises data center is connected to AWS via an AWS Direct Connect connection with a Private Virtual Interface (VIF) terminated on an AWS Transit Gateway. The target environment is a multi-account structure under AWS Organizations, where the migration staging area resides in a dedicated Staging VPC. Due to strict security policies, neither the on-premises environment nor the Staging VPC has direct internet access, and all data transfer must go over private networks. During the replication phase, the migration team observes that the MGN Replication Agent on the source servers cannot connect to the AWS MGN control plane or the staging area replication servers, preventing initial sync. Which of the following configuration steps must the Solutions Architect perform to successfully establish replication? (Select TWO.)

  1. Configure the on-premises firewall to permit outbound traffic on TCP port 1500 to the Staging VPC's replication subnet, and ensure the Staging VPC's replication security group allows inbound TCP port 1500 from the on-premises IP ranges.Answer
  2. Deploy Interface VPC endpoints for both AWS MGN and Amazon S3 in the Staging VPC, associate them with a Route 53 Private Hosted Zone that is shared with the on-premises DNS resolver, and configure the on-premises firewall to allow TCP port 443 outbound to these endpoints.Answer
  3. C
    Deploy a Gateway VPC endpoint for Amazon S3 in the Staging VPC, configure the Transit Gateway route tables to propagate routes from the gateway endpoint to the on-premises Direct Connect connection, and allow TCP port 80 outbound on the on-premises firewall.
  4. D
    Create a Route 53 Private Hosted Zone for AWS MGN, and disable the 'enableDnsHostnames' and 'enableDnsSupport' options on the Staging VPC to force the VPC to delegate all DNS resolution to the on-premises DNS server.
  5. E
    Deploy a NAT Gateway in a public subnet of the Staging VPC to route replication traffic, and configure the on-premises firewall to allow outbound UDP traffic on port 1500 to the NAT Gateway's public IP address.

Answer

Deploy Interface VPC endpoints for AWS MGN and Amazon S3 in the Staging VPC, share the associated Route 53 Private Hosted Zones with the on-premises resolver, allow outbound TCP port 443, and configure firewalls and security groups to permit TCP port 1500 for data replication.
Establishing replication without internet access requires opening TCP port 1500 for data replication and deploying Interface VPC endpoints for both AWS MGN and Amazon S3. The associated Route 53 Private Hosted Zones must be shared with the on-premises DNS resolver so the agent on the source servers resolves the public endpoints to the private IPs of the VPC endpoints.

Step-by-Step Solution

1
Open replication data path.
The MGN replication agent can send block-level replication traffic to the replication servers.
AWS MGN requires TCP port 1500 to be allowed outbound from the source servers and inbound to the staging subnet replication servers.
2
Deploy private service endpoints.
Source servers can reach the MGN control plane and S3 over Direct Connect.
Since the environment lacks internet connectivity, AWS PrivateLink Interface endpoints for MGN and S3 are required to route HTTPS control traffic privately.
3
Establish private DNS resolution.
On-premises servers resolve the regional MGN and S3 endpoints to the private IP addresses of the VPC endpoints.
Integrating on-premises DNS resolvers with Route 53 Private Hosted Zones ensures that API calls to MGN and S3 are redirected to the Interface VPC endpoints.

Key Concept

Deploying AWS Application Migration Service (MGN) in a secure, hybrid environment with no direct internet access requires using Interface VPC endpoints (PrivateLink) for both the MGN control plane and Amazon S3, along with opening TCP port 1500 for replication data traffic.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic