ANS-C01 Question 308
Select 3Your organization has a VPC with private subnets and needs to resolve DNS queries for both on-premises resources and external internet-based services. You have been asked to implement a solution that enables this functionality while ensuring efficient DNS query resolution. Which combination of options should you configure to meet the requirement?
- A
Create an Amazon Route 53 Resolver inbound endpoint in the VPC to receive DNS queries from on-premises systems.
- B
Create an Amazon Route 53 Resolver outbound endpoint in the VPC to forward DNS queries to custom DNS servers.
- C
Use a NAT gateway in the VPC to handle DNS queries for external internet-based services.
- D
Configure Route 53 private hosted zones to resolve DNS queries for on-premises systems.
- E
Associate a security group with the Route 53 Resolver endpoints to control access.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirements of resolving DNS queries for both on-premises and internet-based services, you need to configure both inbound and outbound Route 53 Resolver endpoints. The inbound endpoint allows on-premises systems to resolve DNS names within the VPC, while the outbound endpoint forwards DNS queries to external DNS servers, such as internet-based resolvers. Security groups are essential to control access to these endpoints. NAT gateways and private hosted zones do not fulfill the specific DNS resolution requirements in this scenario.
- A. Correct.
Correct. An inbound endpoint allows on-premises DNS resolvers to forward DNS queries into the VPC.
- B. Correct.
Correct. An outbound endpoint enables the VPC to forward DNS queries to external or custom DNS servers, such as on-premises DNS resolvers.
- C. Incorrect.
Incorrect. A NAT gateway does not provide DNS resolution functionality and is not required for handling DNS queries in this scenario.
- D. Incorrect.
Incorrect. Route 53 private hosted zones are used for internal DNS resolution within the VPC and cannot be directly used for on-premises systems.
- E. Correct.
Correct. Security groups are needed to control access to Route 53 Resolver endpoints and ensure only authorized systems can use them.