ANS-C01 Question 283
Select 3Your company has a hybrid architecture setup with an on-premises data center and an AWS VPC. You need to configure DNS for the following requirements:
- Internal services hosted within the VPC (e.g., a private API) should only be resolvable by internal users and systems in the VPC or on-premises network through a VPN.
- Public services, such as the company’s website, should be resolvable by anyone on the internet.
Which of the following configurations should you use?
- A
Use a private hosted zone for the internal services and associate it with the VPC.
- B
Use a public hosted zone for the internal services and associate it with the VPC.
- C
Use a public hosted zone for the public services, such as the company’s website.
- D
Use a private hosted zone for the public services, such as the company’s website.
- E
Configure Route 53 Resolver rules to forward private hosted zone queries to the on-premises network.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the requirements, internal services should use a private hosted zone with VPC association, ensuring restricted access. Public services should use a public hosted zone for internet-wide access. Route 53 Resolver rules enable DNS resolution for private hosted zones across the hybrid architecture by forwarding queries to the on-premises network.
- A. Correct.
Correct. A private hosted zone is used to manage DNS records that should only be accessible within a specific VPC or via a connected network such as an on-premises data center. This is appropriate for the private API.
- B. Incorrect.
Incorrect. A public hosted zone would expose internal services to the internet, which goes against the requirement to keep them private.
- C. Correct.
Correct. A public hosted zone is used to manage DNS records for resources that should be available on the internet, such as the company’s website.
- D. Incorrect.
Incorrect. A private hosted zone is not appropriate for public services, as it restricts access to internal systems and does not allow internet-wide resolution.
- E. Correct.
Correct. Route 53 Resolver rules enable forwarding of DNS queries for private hosted zones to on-premises networks, ensuring DNS resolution across the hybrid setup.