SAP-C02 Question 28
Select 3An organization has a hybrid cloud architecture with workloads running both on AWS and in an on-premises data center. They want to resolve domain names hosted in an on-premises DNS from AWS services running in a VPC and vice versa. Which combination of steps should they take to ensure seamless bidirectional DNS resolution?
- A
Set up an Amazon Route 53 Resolver inbound endpoint in the VPC and configure the on-premises DNS to forward queries to it.
- B
Set up an Amazon Route 53 Resolver outbound endpoint in the VPC and configure AWS services to use it for DNS queries.
- C
Configure an Amazon Route 53 private hosted zone and associate it with the VPC for on-premises domain names.
- D
Configure rules in the Route 53 Resolver to forward specific domain queries to the on-premises DNS server's IP address.
- E
Ensure that there is a network connection (e.g., Direct Connect or VPN) between the VPC and the on-premises environment.
Show answer and explanation
Correct answers: A, D, E
Explanation
To enable bidirectional DNS resolution between AWS and the on-premises environment, you need to set up an inbound endpoint in Route 53 Resolver for on-premises queries to reach AWS, configure forwarding rules in Route 53 Resolver for AWS queries to reach the on-premises DNS, and ensure there is a network connection (e.g., Direct Connect or VPN) between the environments. An outbound endpoint is not needed for this specific use case, and private hosted zones are not relevant for integrating on-premises DNS.
- A. Correct.
Correct. An inbound endpoint allows the on-premises environment to resolve DNS queries for AWS-hosted resources by forwarding them to Route 53 Resolver.
- B. Incorrect.
Incorrect. An outbound endpoint is used to forward DNS queries originating in the VPC to an external DNS server, not for internal AWS queries.
- C. Incorrect.
Incorrect. A private hosted zone is used for DNS queries within the VPC but does not address integration with on-premises DNS.
- D. Correct.
Correct. Forwarding rules in Route 53 Resolver enable VPC-based workloads to resolve specific domain names using the on-premises DNS server.
- E. Correct.
Correct. A network connection (like Direct Connect or VPN) is essential to allow communication between the VPC and the on-premises environment for DNS resolution.