ANS-C01 Question 207
Select 3Your company has a hybrid cloud setup where corporate users from on-premises need to resolve private AWS-hosted domain names (e.g., internal.example.com) managed in an Amazon Route 53 private hosted zone. To ensure this functionality, you have deployed an Amazon Route 53 Resolver inbound endpoint in your VPC. However, DNS queries from on-premises are not resolving correctly. What steps should you take to troubleshoot and resolve the issue?
- A
Verify that the on-premises DNS server forwards queries for
internal.example.comto the IP address of the Amazon Route 53 Resolver inbound endpoint. - B
Ensure that the security group associated with the Route 53 Resolver inbound endpoint allows inbound traffic on UDP and TCP port 53 from the on-premises network.
- C
Check that the private hosted zone is associated with the same VPC as the Route 53 Resolver inbound endpoint.
- D
Confirm that the Route 53 Resolver outbound endpoint is properly configured to forward queries to the on-premises DNS server.
- E
Verify that the IAM role attached to the Route 53 Resolver inbound endpoint has permissions to access the private hosted zone.
Show answer and explanation
Correct answers: A, B, C
Explanation
To enable on-premises networks to resolve private domain names hosted in Route 53 private hosted zones, the on-premises DNS server must forward queries to the Route 53 Resolver inbound endpoint. Additionally, the inbound endpoint's security group must allow traffic on UDP and TCP port 53 from the on-premises network. The private hosted zone must also be associated with the same VPC as the inbound endpoint to enable DNS resolution. Outbound endpoints and IAM roles are not relevant in this specific scenario.
- A. Correct.
Correct. The on-premises DNS server must forward queries for private domain names to the IP address of the Route 53 Resolver inbound endpoint for proper resolution.
- B. Correct.
Correct. The security group must allow inbound traffic on UDP and TCP port 53 from the on-premises network to ensure DNS queries can reach the inbound endpoint.
- C. Correct.
Correct. The private hosted zone must be associated with the same VPC where the Route 53 Resolver inbound endpoint is deployed for DNS queries to resolve correctly.
- D. Incorrect.
Incorrect. An outbound endpoint is used for forwarding DNS queries from AWS to external DNS servers. In this scenario, the issue relates to inbound queries from on-premises, so an outbound endpoint is not relevant.
- E. Incorrect.
Incorrect. Route 53 Resolver inbound endpoints do not rely on IAM roles for access to private hosted zones. Permissions for private hosted zones are managed through VPC associations.