A financial services company is migrating a legacy, compliance-restricted application from… — AWS Certified Solutions Architect - Professional

A financial services company is migrating a legacy, compliance-restricted application from an on-premises data center to AWS using AWS Application Migration Service (MGN). The target architecture consists of a multi-account environment managed by AWS Organizations. The application servers will be launched into a private subnet within a Workload VPC.

Hybrid connectivity is established using an AWS Direct Connect connection terminated at an AWS Transit Gateway. The Transit Gateway connects the Workload VPC and a centralized Network Services VPC. The Network Services VPC hosts an outbound internet egress path consisting of a cluster of firewalls behind NAT Gateways. Due to strict regulatory requirements, the on-premises source servers have no outbound public internet access. The Solutions Architect has configured the MGN replication template to "Use private IP" for data routing and has created Interface VPC endpoints for MGN in the Workload VPC to keep all replication traffic within the private network.

The replication agent was successfully installed on the source servers, but the replication status is stuck at $0\%$ (Initiating) and fails to establish a data connection. Which combination of configuration modifications will resolve this issue and allow replication to proceed?

A
Configure the on-premises DNS servers to conditionally forward queries for mgn.<region>.amazonaws.com to Route 53 Resolver Inbound Endpoints in the Workload VPC. Allow outbound TCP port $443$ on the on-premises firewall to the Workload VPC CIDR. Configure the MGN replication server security group to allow inbound TCP port $443$ from the on-premises subnet, and configure the on-premises firewall to block TCP port $1500$ to enforce secure HTTPS-only data transit.
B
Associate the MGN Interface VPC endpoints with a Direct Connect Gateway using a private virtual interface (VIF). Configure the Workload VPC route table to route all on-premises replication traffic directly through a private VIF on the Direct Connect Gateway, bypassing the Transit Gateway for transitive routing between the Workload VPC and the on-premises environment.
Configure the on-premises DNS servers to conditionally forward queries for mgn.<region>.amazonaws.com to Route 53 Resolver Inbound Endpoints in the Workload VPC. Allow outbound TCP port $443$ and TCP port $1500$ on the on-premises firewall to the Workload VPC CIDR. Ensure the security group of the MGN Interface VPC endpoints allows inbound TCP port $443$ from the on-premises subnet, and the MGN replication server security group allows inbound TCP port $1500$ from the on-premises subnet.Cevap
D
Deploy the MGN Interface VPC endpoints and Route 53 Resolver Inbound Endpoints in the Network Services VPC. Create the Route 53 Private Hosted Zone for mgn.<region>.amazonaws.com and associate it only with the Network Services VPC. Configure the on-premises DNS servers to forward queries to the Inbound Endpoints, and configure the on-premises firewall to allow outbound TCP port $1500$ and port $443$ to the Workload VPC CIDR.

Cevap

Configure on-premises DNS to forward queries for the MGN service to Route 53 Resolver Inbound Endpoints, allow outbound TCP ports

443

and

1500

on the on-premises firewall to the Workload VPC CIDR, and allow inbound traffic on those ports in the corresponding AWS security groups.

The correct solution addresses both the control plane communication (TCP port

443

via Route 53 Resolver Inbound Endpoints and Interface VPC Endpoints) and the data plane replication (TCP port

1500

via Direct Connect routing and security groups). This allows secure, private infrastructure migration without exposing any workloads to the public internet.

Adım Adım Çözüm

Set up private DNS resolution for the MGN endpoint from on-premises.

Deploy Route 53 Resolver Inbound Endpoints in the Workload VPC, and configure the on-premises DNS servers to forward queries for mgn.<region>.amazonaws.com to the Inbound Endpoint IPs.

Since there is no public internet access, the on-premises servers must resolve the public MGN API endpoint name to the private IPs of the Interface VPC Endpoints.

Configure on-premises firewall rules.

Permit outbound TCP port

443

and TCP port

1500

from the source servers to the Workload VPC CIDR.

TCP port

443

is required to communicate with the MGN control plane API, and TCP port

1500

is required to transmit replication data to the replication servers.

Configure AWS Security Groups for incoming traffic.

Ensure the MGN Interface VPC Endpoint security group allows inbound TCP port

443

from the on-premises subnet, and the replication server security group allows inbound TCP port

1500

from the on-premises subnet.

This allows the source servers to establish connections to the MGN control plane endpoints and to the target replication servers in the staging area.

Anahtar Kavram

AWS MGN replication requires TCP port

443

to access the service API and TCP port

1500

for data replication. In private networks, this requires proper Route 53 Resolver Inbound Endpoints, Private Hosted Zone association, and security group/firewall configurations.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru