ANS-C01 Question 276
Select 2You are designing a hybrid DNS architecture for a company that has on-premises infrastructure and multiple AWS accounts. The company requires its on-premises applications to resolve domain names for resources hosted in multiple AWS accounts, and AWS-hosted applications must be able to resolve on-premises domain names. Additionally, each AWS account uses its own private hosted zone for internal domain names. How can you implement this architecture to meet the requirements?
- A
Set up AWS Route 53 Resolver in each AWS account and configure bidirectional hybrid DNS forwarding between the on-premises DNS and Route 53 Resolver endpoints.
- B
Create a centralized private hosted zone in one AWS account and associate it with all other AWS accounts.
- C
Deploy AWS Route 53 Resolver rules in each AWS account to forward DNS queries for the on-premises domains to the on-premises DNS server.
- D
Configure an Amazon Route 53 public hosted zone for internal domain names and use it for cross-account DNS resolution.
- E
Use AWS Transit Gateway to share private hosted zones across multiple AWS accounts to enable DNS resolution for resources in different accounts.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements of a complex hybrid and multi-account DNS architecture, you need to enable bidirectional DNS resolution between on-premises and AWS environments. AWS Route 53 Resolver allows you to set up hybrid DNS forwarding, enabling on-premises applications to resolve AWS domain names and vice versa. Additionally, Route 53 Resolver rules can forward DNS queries for on-premises domains to on-premises DNS servers, ensuring AWS-hosted applications can resolve on-premises domain names. Centralized hosted zones, public hosted zones, and AWS Transit Gateway are not suitable for this use case.
- A. Correct.
Correct: Setting up AWS Route 53 Resolver with bidirectional hybrid DNS forwarding allows DNS queries to flow between the on-premises DNS servers and AWS accounts, meeting the requirement for cross-environment DNS resolution.
- B. Incorrect.
Incorrect: While a centralized private hosted zone can simplify management, it does not allow on-premises systems to resolve domain names in AWS accounts or support cross-account DNS resolution for private hosted zones.
- C. Correct.
Correct: Using Route 53 Resolver rules to forward DNS queries for on-premises domains to the on-premises DNS servers ensures that AWS-hosted applications can resolve on-premises domain names.
- D. Incorrect.
Incorrect: Public hosted zones are intended for public DNS resolution and are not suitable for internal or private DNS architectures. This option does not meet the requirements for private DNS resolution across environments.
- E. Incorrect.
Incorrect: AWS Transit Gateway is used for network connectivity and does not provide the capability to share or resolve private hosted zones across accounts or environments.