{"question":{"id":37220,"htmlId":"question37220","kind":"SingleChoice","specVersion":null,"questionHtml":"

A financial-services company is building a hybrid-cloud architecture that connects its on-premises data center to multiple AWS VPCs over AWS Direct Connect. The company requires seamless, bidirectional DNS resolution: on-premises applications must resolve private hostnames for Amazon EC2 instances in the VPCs (for example, app-server.prod.vpc.example.com), and EC2 instances must resolve hostnames that live only in the on-premises namespace (for example, db.corp.internal). The solution must be highly available, scalable, and centrally manageable, and it must not require custom DNS server software on EC2 instances.

Which solution meets these requirements most effectively?

","descriptionHtml":"

The most effective design is to use Amazon Route 53 Resolver endpoints and conditional-forwarding rules:

Create an inbound endpoint in a shared or hub VPC. This endpoint exposes two or more IP addresses (in different Availability Zones) that on-premises DNS servers forward queries to, allowing on-premises hosts to resolve records stored in Route 53 private hosted zones.
Create an outbound endpoint in the same VPC and configure Resolver rules (for example, *.corp.internal) that forward VPC-originated queries to the on-premises DNS servers. The outbound endpoint sends the traffic across Direct Connect or the site-to-site VPN link.

Because each endpoint requires at least two IP addresses in different AZs, the solution is highly available by design and fully managed-no EC2-hosted DNS servers need to be deployed or patched.

Self-managed BIND servers on EC2 can work but introduce operational overhead for scaling, patching, and failure handling, so they do not best satisfy the requirements.
Deploying only inbound endpoints enables on-premises-to-AWS lookups but provides no path for VPC-originated queries to reach on-premises DNS, so bidirectional resolution is not achieved.
Creating a private hosted zone for corp.internal plus an outbound endpoint still lacks an inbound endpoint, so on-premises resolvers cannot query AWS records. In addition, the private hosted zone would be redundant because a forwarding rule for the same domain would take precedence and send the queries to the on-premises DNS servers anyway.

","answers":[{"id":2551062,"html":"

Deploy a pair of highly available EC2 instances running BIND in a central VPC. Configure on-premises DNS servers to forward queries to these instances, and configure the BIND servers to forward queries for the on-premises domain back to the on-premises DNS servers.

","isCorrect":false},{"id":2551061,"html":"

Create Route 53 Resolver inbound and outbound endpoints. Configure conditional forwarding on the on-premises DNS servers to send queries for the VPC domain to the inbound endpoint. Create Resolver rules to forward queries for the on-premises domain to the on-premises DNS servers via the outbound endpoint.

","isCorrect":true},{"id":2551063,"html":"

Create a Route 53 inbound endpoint in each VPC. Configure the on-premises DNS servers with conditional forwarders that send all AWS-related DNS queries to the IP addresses of the inbound endpoints.

","isCorrect":false},{"id":2551064,"html":"

Create a private hosted zone for the on-premises domain (corp.internal) and associate it with all VPCs. Create a Route 53 outbound endpoint and a rule to forward all queries from the VPCs to the on-premises DNS servers.

","isCorrect":false}],"textInput":null,"matching":null,"objectiveId":1897,"objectiveTitle":"Design Solutions for Organizational Complexity","nextQuestionUrl":"/study/questions/sap-c02/a-company-runs-a-steady-state-workload-that-consists-of-15-m7i-large-and-10/37392?HideScore=false&ObjectiveMode=RoundRobbinObjectives","questionUrl":"/study/questions/sap-c02/a-financial-services-company-is-building-a-hybrid-cloud-architecture-that/37220","followUpPrompts":[{"id":305333,"prompt":"How do Route 53 Resolver inbound and outbound endpoints work, and how do I set them up for high availability?","response":"Route 53 Resolver endpoints are managed VPC endpoints that enable DNS query traffic between VPCs and on‑premises resolvers. An inbound endpoint accepts DNS queries from on‑premises (so on‑prem can resolve private hosted zone names). An outbound endpoint sends VPC‑originated queries to on‑premises DNS servers. High availability best practices: - Create each endpoint with at least two IP addresses in different Availability Zones (AZs). Route 53 requires a minimum of two IPs for redundancy. If an IP/ENI fails in one AZ, the other AZ IPs still handle queries. - Place endpoints in a hub/shared VPC that peers or uses Transit Gateway to reach other VPCs for central management. - Use security groups on the endpoint ENIs to allow inbound/outbound DNS traffic (UDP/TCP port 53) from your on‑premises network and VPC CIDRs. - Configure Resolver rules for domains you want forwarded (outbound) and set on‑premises DNS conditional forwarders to the inbound endpoint IPs. - Ensure route tables and Direct Connect/VPN routes allow traffic between on‑prem and the endpoint subnets. These endpoints are fully managed by AWS (no EC2 DNS servers), scale to handle load, and are resilient when deployed across AZs."},{"id":305334,"prompt":"What are Resolver rules and how do they interact with on‑premises DNS and private hosted zones?","response":"Resolver rules define how Route 53 Resolver handles DNS queries originating in your VPCs. Two main types: forwarding rules (forward queries for a domain to specified IP addresses) and system rules. You create rules (for example, *.corp.internal) and associate them with one or more VPCs. Behavior and interactions: - Outbound (forward) rules send matching VPC queries to the IPs specified (typically your on‑prem DNS servers) via the outbound endpoint. - On‑premises conditional forwarders point to the inbound endpoint IPs so on‑prem hosts can resolve Route 53 private hosted zones. - If you create both a private hosted zone and a forwarding rule for the same domain, the forwarding rule will route matching queries to the configured destination (making a duplicate private hosted zone redundant for cross‑site resolution purposes). Resolver rules are centrally manageable in the Route 53 console or API and can be associated with multiple VPCs, enabling scalable, bidirectional DNS without running custom DNS software on EC2."},{"id":305335,"prompt":"What networking and security settings must I configure to let Resolver endpoints communicate with on‑premises DNS over Direct Connect?","response":"Key networking and security considerations: - Subnets & AZs: Create endpoint ENIs in private subnets across at least two AZs for HA. Ensure these subnets have route table entries toward your Direct Connect/VPN virtual private gateway or Transit Gateway. - Routing: Advertise routes over Direct Connect (or the VPN) so on‑premises networks can reach the endpoint IPs, and ensure VPCs can reach on‑prem via Transit Gateway/peering as applicable. - Security groups: Attach a security group to the endpoint ENIs that allows inbound DNS (UDP/TCP port 53) from on‑premises IP ranges and allows outbound DNS to on‑prem (for outbound endpoint). Also allow VPC sources that will query the endpoints. - Network ACLs and firewalls: Ensure NACLs and any on‑prem firewalls permit UDP/TCP 53 between on‑prem and the endpoint IPs. Allow TCP 53 for larger responses and zone transfers if needed. - Monitoring & logging: Enable Resolver query logging to CloudWatch or S3 for troubleshooting. Use VPC Flow Logs and Direct Connect monitoring to verify connectivity. Together these ensure secure, reliable DNS flow across Direct Connect without deploying DNS servers on EC2."}],"presentationMode":false,"hideFeedbackForm":false,"hideResponseBadges":false,"setId":null,"skipSaveResponse":false},"canVote":false,"streak":{"value":null,"title":null,"launchConfetti":false,"isRecord":false},"id":"crucial-react-010fe6cb889744368baff78814cb8e79"}

AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Report Issue