ANS-C01 Question 284
Select 2Your organization is hosting a multi-tier application on AWS. The frontend of your application is publicly accessible over the internet, while the backend services, like databases and internal APIs, should only be accessible within your VPC. You need to configure DNS to resolve the frontend domain (e.g., www.example.com) publicly, while ensuring backend domain names (e.g., db.internal.example.com) are only resolvable within the VPC. Which combination of hosted zones should you use?
- A
Use a public hosted zone for www.example.com and a private hosted zone for db.internal.example.com.
- B
Use a public hosted zone for both www.example.com and db.internal.example.com.
- C
Use a private hosted zone for www.example.com and db.internal.example.com.
- D
Use a public hosted zone for www.example.com and configure Route 53 Resolver for db.internal.example.com.
Show answer and explanation
Correct answers: A, D
Explanation
In this scenario, the frontend domain (www.example.com) needs to be publicly accessible, making a public hosted zone the appropriate choice. For backend services (db.internal.example.com), which should only be accessible within the VPC, you can use either a private hosted zone or Route 53 Resolver to ensure internal resolution. Both approaches fulfill the requirements for separating public and private access.
- A. Correct.
This is correct. Public hosted zones are ideal for domains that need to be accessible over the internet (e.g., www.example.com), while private hosted zones are designed for internal domain names that should only be resolvable within a VPC (e.g., db.internal.example.com).
- B. Incorrect.
This is incorrect. Using a public hosted zone for db.internal.example.com would expose internal resources to the internet, which violates the requirement to keep backend services private.
- C. Incorrect.
This is incorrect. A private hosted zone for www.example.com would restrict access to this domain to within the VPC, rendering the publicly accessible frontend unreachable.
- D. Correct.
This is correct. Using a public hosted zone for www.example.com ensures the domain is accessible over the internet, while Route 53 Resolver can be used to resolve internal resources like db.internal.example.com within the VPC.