ANS-C01 Question 277
Select 3Your company has a multi-account AWS architecture where each account hosts specific services. The organization also maintains on-premises infrastructure connected to AWS via AWS Direct Connect. You are tasked with implementing a DNS architecture to enable seamless resolution of domain names for services in the on-premises environment, across AWS accounts, and for external customers accessing public-facing services. Which combination of steps should you take to achieve this?
- A
Set up Amazon Route 53 Resolver in each AWS account and associate it with the on-premises network using inbound and outbound rules.
- B
Create a centralized shared services account with a Route 53 Private Hosted Zone and share it with other accounts using Resource Access Manager (RAM).
- C
Configure Route 53 Public Hosted Zones for public-facing services and ensure the DNS records point to public IP addresses.
- D
Set up Route 53 Resolver endpoints only in the primary account and configure conditional forwarding rules to resolve DNS queries for on-premises and cross-account services.
- E
Use AWS Transit Gateway to route DNS queries between AWS accounts and the on-premises environment.
- F
Deploy an EC2 instance running a custom DNS server in each AWS account to handle DNS resolution for cross-account communication.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement a complex hybrid and multi-account DNS architecture, you need to utilize Amazon Route 53 Resolver for hybrid DNS resolution, configure Route 53 Public Hosted Zones for external services, and centralize DNS resolution using Route 53 Resolver endpoints with conditional forwarding rules. These steps ensure seamless DNS resolution for on-premises, cross-account, and public-facing services. Other options, such as using Transit Gateway or deploying custom DNS servers, are either unrelated to DNS resolution or unnecessarily complex.
- A. Correct.
Correct. Amazon Route 53 Resolver enables hybrid DNS resolution by creating inbound and outbound endpoints for DNS queries between AWS accounts and on-premises environments.
- B. Incorrect.
Incorrect. While Route 53 Private Hosted Zones can be shared using RAM, this does not address DNS requirements for public-facing services or on-premises environments.
- C. Correct.
Correct. Public Hosted Zones in Route 53 are appropriate for external, public-facing services, ensuring public DNS resolution for customer access.
- D. Correct.
Correct. Centralized Route 53 Resolver endpoints with conditional forwarding rules can simplify DNS resolution for on-premises and cross-account services.
- E. Incorrect.
Incorrect. AWS Transit Gateway is used for network routing, not for DNS resolution. It does not directly solve hybrid or multi-account DNS challenges.
- F. Incorrect.
Incorrect. Deploying custom DNS servers on EC2 instances is not an optimal or scalable solution, especially given the availability of native AWS DNS services.