ANS-C01 Question 27
Single answerYour company operates a hybrid infrastructure with resources in both an on-premises data center and AWS. The company wants to create a DNS solution to ensure that internal users can resolve private AWS resources (like EC2 instances in a VPC) and on-premises servers, while external users should only be able to resolve public-facing web applications hosted in AWS. Which DNS solution should you design?
- A
Use Amazon Route 53 Private Hosted Zones for private DNS resolution and Route 53 Public Hosted Zones for public resolution.
- B
Use Amazon Route 53 Resolver endpoints to forward DNS queries for private resources and Route 53 Public Hosted Zones for public resolution.
- C
Set up Amazon Route 53 Public Hosted Zones for both private and public resources, and use access control lists (ACLs) to restrict access to private resources.
- D
Deploy an on-premises DNS server integrated with Amazon Route 53 Resolver endpoints for private DNS resolution and Route 53 Public Hosted Zones for public resources.
Show answer and explanation
Correct answer: B
Explanation
The best solution to meet the hybrid DNS requirements is to use Amazon Route 53 Resolver endpoints for forwarding DNS queries for private resources (both in AWS and on-premises) and Route 53 Public Hosted Zones for external users resolving public-facing applications. This approach minimizes complexity and ensures seamless resolution for both private and public resources.
- A. Incorrect.
This option is incorrect because Route 53 Private Hosted Zones are designed specifically for VPCs and cannot resolve on-premises resources without additional configurations. This solution does not fully meet the hybrid requirements.
- B. Correct.
This is the correct answer. Route 53 Resolver endpoints can forward DNS queries for private resources (both in AWS and on-premises), while Route 53 Public Hosted Zones can handle DNS resolution for public-facing applications.
- C. Incorrect.
This option is incorrect because Route 53 Public Hosted Zones cannot resolve private resources, and ACLs are not used to restrict DNS resolution in this context. This does not satisfy the hybrid requirements.
- D. Incorrect.
This option is partially correct but not optimal. While using an on-premises DNS server integrated with Route 53 Resolver endpoints could work, it adds unnecessary complexity compared to using Route 53 Resolver endpoints directly for hybrid DNS resolution.