ANS-C01 Question 46
Single answerYou are designing a hybrid networking architecture for a company that hosts workloads in an Amazon VPC and on-premises data centers. The company wants to use Amazon Route 53 for DNS resolution for their domain, and they require that DNS queries originating from their on-premises environment resolve private resources hosted in the VPC. How can you meet this requirement?
- A
Create a Route 53 hosted zone and associate it with the VPC. Configure an outbound resolver endpoint in the VPC for on-premises DNS queries.
- B
Create a Route 53 private hosted zone and associate it with the VPC. Configure an inbound resolver endpoint in the VPC and update the on-premises DNS server to forward queries to the inbound endpoint.
- C
Configure a public Route 53 hosted zone for the domain and enable DNS query logging for tracking on-premises queries.
- D
Use Route 53 Resolver DNS forwarding rules to forward DNS queries from the VPC to the on-premises DNS server.
Show answer and explanation
Correct answer: B
Explanation
To allow DNS queries from on-premises environments to resolve private resources in a VPC, you must use a Route 53 private hosted zone associated with the VPC. Additionally, an inbound resolver endpoint must be configured in the VPC, and the on-premises DNS server must be updated to forward queries for the private hosted zone to this endpoint. This setup ensures seamless DNS resolution between on-premises and AWS environments.
- A. Incorrect.
Incorrect. While creating a hosted zone and outbound resolver endpoint allows VPC DNS queries to resolve on-premises resources, it does not address the requirement for on-premises DNS queries to resolve private resources in the VPC.
- B. Correct.
Correct. Creating a private hosted zone ensures private resources in the VPC are resolvable only within the VPC. Configuring an inbound resolver endpoint and updating the on-premises DNS server to forward queries to that endpoint allows on-premises DNS queries to resolve these private resources.
- C. Incorrect.
Incorrect. Public hosted zones are used for domains accessible on the internet, not for private resources within a VPC. DNS query logging does not help meet the requirement.
- D. Incorrect.
Incorrect. Forwarding rules in the Route 53 Resolver are used to forward DNS queries from the VPC to on-premises DNS servers, not the other way around.