ANS-C01 Question 293
Single answerYour organization has deployed a hybrid cloud environment with an on-premises data center and an AWS VPC. The on-premises environment uses a private DNS server to resolve internal domain names, while the VPC relies on Route 53 Resolver. You need to ensure that DNS queries for a specific internal domain (e.g., 'internal.example.com') originating from the VPC are forwarded to the on-premises DNS server for resolution. How can you achieve this?
- A
Create a Route 53 private hosted zone for 'internal.example.com' and associate it with the VPC.
- B
Configure a Route 53 Resolver outbound endpoint in the VPC and set up a forwarding rule for 'internal.example.com' pointing to the on-premises DNS server.
- C
Set up a Route 53 Resolver inbound endpoint in the VPC to receive DNS queries from the on-premises DNS server.
- D
Enable Amazon Route 53 DNSSEC signing for 'internal.example.com' to secure DNS queries between the VPC and on-premises.
Show answer and explanation
Correct answer: B
Explanation
To forward DNS queries for a specific domain (e.g., 'internal.example.com') from a VPC to an on-premises DNS server, you must configure a Route 53 Resolver outbound endpoint in the VPC. This outbound endpoint allows DNS queries to leave the VPC and reach the on-premises DNS server. A forwarding rule specific to 'internal.example.com' directs these queries to the appropriate external server. Other options, such as private hosted zones or inbound endpoints, do not address the requirement of forwarding DNS queries to an external DNS server.
- A. Incorrect.
This option is incorrect because a private hosted zone would only be used to define custom DNS records within the VPC, not to forward queries to an on-premises DNS server.
- B. Correct.
This option is correct because a Route 53 Resolver outbound endpoint is specifically designed to forward DNS queries from the VPC to external DNS servers, such as the on-premises DNS server. Additionally, you can configure a forwarding rule for 'internal.example.com' to direct these queries appropriately.
- C. Incorrect.
This option is incorrect because an inbound endpoint is used to allow DNS queries from an external source (like on-premises) to resolve AWS-hosted domain names, not the other way around.
- D. Incorrect.
This option is incorrect because enabling DNSSEC signing improves the security of DNS records but does not facilitate DNS query forwarding or delegation.