ANS-C01 Question 210
Single answerYour company has a hybrid cloud architecture where workloads are running in both an on-premises environment and AWS. You need to configure DNS resolution so that on-premises systems can resolve both internal AWS private domain names and on-premises domain names. Additionally, AWS resources need to resolve on-premises domain names. Which solution would best achieve this?
- A
Configure AWS Route 53 private hosted zones and associate them with your VPC. Use an on-premises DNS resolver that forwards queries for AWS private domains to the Route 53 Resolver inbound endpoint.
- B
Set up an AWS Route 53 Resolver outbound endpoint in your VPC and configure it to forward DNS queries for on-premises domains to your on-premises DNS resolver.
- C
Use Route 53 public hosted zones to store records for both AWS and on-premises domains, and configure your on-premises DNS servers to query Route 53 directly.
- D
Deploy an AWS Route 53 Resolver inbound endpoint in your on-premises data center to resolve DNS queries from AWS to on-premises domains.
Show answer and explanation
Correct answer: A
Explanation
To enable bi-directional DNS resolution between AWS and on-premises environments, you need to use a combination of Route 53 private hosted zones for internal AWS domain names and Route 53 Resolver endpoints. An inbound resolver endpoint allows on-premises DNS servers to forward queries for AWS private domains into the VPC. In this scenario, using the inbound endpoint achieves the desired resolution for both AWS and on-premises domains.
- A. Correct.
Correct. This solution allows on-premises systems to resolve AWS private domain names by forwarding queries to the Route 53 Resolver inbound endpoint. AWS resources can resolve on-premises domains by using the default VPC resolver and forwarding queries to the on-premises DNS resolver.
- B. Incorrect.
Incorrect. While an outbound endpoint allows AWS to forward queries to on-premises DNS, it does not address the requirement for on-premises systems to resolve AWS private domain names.
- C. Incorrect.
Incorrect. Public hosted zones are not suitable for private domain names as they are globally accessible and do not provide the level of security required for internal DNS resolution.
- D. Incorrect.
Incorrect. Route 53 Resolver inbound endpoints are specific to AWS and cannot be deployed in an on-premises data center.