Examkin

Question

Difficulty: HardAWS Elastic Disaster Recovery

A company is using AWS Elastic Disaster Recovery (AWS DRS) to protect its on-premises virtual machines by replicating them to AWS. The company's security policy requires that all replication traffic and control plane communication occur privately over an existing AWS Direct Connect connection. No traffic is allowed to traverse the public internet. Which combination of actions must a SysOps Administrator perform to configure this environment? (Select TWO.)

  1. Enable the "Use private IP" option in the AWS DRS replication template.Answer
  2. Create interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the target VPC, and configure the on-premises DNS to resolve the DRS endpoints to these VPC endpoints.Answer
  3. C
    Configure an Amazon Route 53 Active-Passive failover routing policy to route the replication traffic to the staging area's public DNS endpoint.
  4. D
    Grant the IAM credentials used for the AWS Replication Agent installation the iam:AssumeRole permission on the recovery EC2 instance profile, while omitting the iam:PassRole permission.
  5. E
    Create a Gateway VPC endpoint for the AWS DRS service in the target VPC and associate it with the staging subnet's route table.

Answer

Enable the "Use private IP" option in the AWS DRS replication template, and create interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the target VPC while configuring on-premises DNS to resolve the endpoints privately.
The correct options are enabling the private IP option in the replication template and creating interface VPC endpoints for DRS. By enabling the "Use private IP" setting, data replication traffic (port 1500) will be directed to the staging area's private IP addresses, routing it over the Direct Connect link. Since the source servers have no internet access, they cannot reach the public AWS DRS endpoints; therefore, interface VPC endpoints must be provisioned in the target VPC to allow the agent to perform control plane actions (port 443) privately.

Step-by-Step Solution

1
Configure the AWS DRS replication template to use private IP addresses.
The Replication Agent will send replication data (port 1500) to the private IP addresses of the replication servers in the staging subnet instead of public IPs.
This keeps data replication traffic on the private AWS Direct Connect path.
2
Create interface VPC endpoints (AWS PrivateLink) for the DRS service (com.amazonaws.[region].drs) in the target VPC.
Private IP addresses are allocated in the VPC subnets for DRS control plane communication.
Since the on-premises servers lack internet access, they must communicate with the DRS control plane via these private endpoints.
3
Configure the DNS on-premises to resolve the DRS control plane URLs to the interface VPC endpoint IPs.
The agent successfully establishes control plane communication over Direct Connect without traversing the public internet.
Ensures the agent connects to the interface endpoints for control plane actions.

Key Concept

AWS Elastic Disaster Recovery private replication and control plane connectivity over Direct Connect/VPN using private IPs and Interface VPC Endpoints.
Rate this question

Topics

AWS Elastic Disaster Recovery

More questions from this topic