ANS-C01 Question 285
Select 2A company has a hybrid cloud architecture with workloads deployed both on AWS and on-premises. The company wants to use a Route 53 hosted zone to manage DNS records for their internal services, which should be accessible only from on-premises and their VPCs. However, they also need to manage DNS records for their public-facing website that should be accessible to users over the internet. How should the company configure the hosted zones in Route 53?
- A
Create a private hosted zone for internal services and associate it with the appropriate VPCs.
- B
Use a single public hosted zone for both internal services and the public-facing website.
- C
Create a public hosted zone for the public-facing website.
- D
Create a private hosted zone for the public-facing website and associate it with the appropriate VPCs.
- E
Create separate private hosted zones for each VPC for internal services.
Show answer and explanation
Correct answers: A, C
Explanation
The company should use a private hosted zone for internal services to ensure DNS records are resolvable only from their VPCs and on-premises network. For the public-facing website, they should use a public hosted zone to make it accessible over the internet. This separation ensures appropriate accessibility and security for both internal and external services.
- A. Correct.
This is correct because private hosted zones allow DNS records to be resolved only within the associated VPCs or via a connected network (e.g., on-premises via Direct Connect or VPN). This is appropriate for internal services that should not be accessible from the internet.
- B. Incorrect.
This is incorrect because using a single public hosted zone for both internal and public-facing services would expose the internal services to the internet, which violates the requirement for internal-only access.
- C. Correct.
This is correct because public hosted zones are designed to manage DNS records for resources that need to be accessible over the internet, such as a public-facing website.
- D. Incorrect.
This is incorrect because a private hosted zone is not appropriate for a public-facing website, as it would only allow DNS resolution within the associated VPCs.
- E. Incorrect.
This is incorrect because creating separate private hosted zones for each VPC would complicate DNS management unnecessarily. A single private hosted zone can be associated with multiple VPCs.