ANS-C01 Question 278
Select 4Your company operates a hybrid architecture with workloads distributed across an on-premises data center and multiple AWS accounts. You are tasked with designing a DNS solution that ensures seamless name resolution between on-premises resources and services distributed across multiple AWS accounts. The solution must allow for private name resolution within AWS and also resolve on-premises resources' names from AWS. Which combination of steps should you implement to achieve this?
- A
Set up Amazon Route 53 Resolver inbound and outbound endpoints in each AWS account and configure forwarding rules for on-premises and intra-account DNS queries.
- B
Create a centralized Amazon Route 53 private hosted zone in one AWS account and associate it with all relevant VPCs across multiple AWS accounts.
- C
Deploy an Amazon Route 53 Resolver rule to forward all unresolved DNS queries from AWS to the on-premises DNS server using IP addresses.
- D
Establish a VPC peering connection between all VPCs across AWS accounts to enable name resolution for private hosted zones.
- E
Integrate AWS Direct Connect or VPN to establish connectivity between on-premises and AWS, enabling DNS queries to traverse the network.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To implement a complex hybrid and multi-account DNS architecture, you need to address both private DNS resolution within AWS and seamless hybrid name resolution. Route 53 Resolver inbound and outbound endpoints facilitate DNS query forwarding between AWS and on-premises. A centralized private hosted zone ensures consistent DNS resolution across AWS accounts, while a Resolver rule forwards unresolved DNS queries to on-premises. Finally, connectivity, such as Direct Connect or VPN, ensures the network path for DNS queries. VPC peering is unnecessary for this architecture.
- A. Correct.
Correct: Route 53 Resolver inbound and outbound endpoints enable DNS query forwarding between AWS and on-premises environments. This is a key step to implement hybrid DNS architecture.
- B. Correct.
Correct: Centralizing the private hosted zone in one AWS account and associating it with all relevant VPCs ensures consistent private DNS resolution across multiple AWS accounts.
- C. Correct.
Correct: Configuring a Route 53 Resolver rule to forward unresolved queries from AWS to the on-premises DNS server enables hybrid name resolution for on-premises resources.
- D. Incorrect.
Incorrect: VPC peering is not required for private hosted zone DNS resolution across accounts. Associating private hosted zones with VPCs is sufficient.
- E. Correct.
Correct: Direct Connect or a VPN establishes the network connectivity required for DNS queries to traverse between on-premises and AWS environments.