Examkin

Question

Difficulty: Very hardMulti-Account and Hybrid DNS Architecture Strategy

A financial services company is designing a hybrid DNS architecture across their AWS Organization and an on-premises datacenter. The environment consists of a central Network Services AWS account containing a Shared Services VPC, a Production AWS account containing a Production VPC, and an AWS Transit Gateway connecting both VPCs and the on-premises network. A Private Hosted Zone (PHZ) named prod.internal is created in the Production account and associated with the Production VPC. A Private Hosted Zone (PHZ) named shared.internal is created in the Network Services account and associated with the Shared Services VPC. The on-premises DNS servers manage the corp.local domain. The solutions architect must establish a centralized DNS resolution strategy meeting these requirements:
- On-premises servers must resolve names in prod.internal and shared.internal.
- Resources in the Production VPC must resolve names in corp.local and shared.internal.
- The architecture must minimize the deployment of Route 53 Resolver Endpoints to minimize costs.

Which of the following actions must the solutions architect perform to meet these requirements? (Select THREE.)

  1. In the Network Services account, create a Route 53 Resolver Outbound Rule for corp.local pointing to the on-premises DNS servers. Share the rule with the Production account using AWS Resource Access Manager (RAM), and associate the rule with the Production VPC.Answer
  2. In the Production account, authorize the association of the prod.internal private hosted zone with the Shared Services VPC. In the Network Services account, associate the Shared Services VPC with the prod.internal private hosted zone.Answer
  3. Configure the on-premises DNS servers to forward queries for prod.internal and shared.internal to the IP addresses of a Route 53 Resolver Inbound Endpoint deployed in the Shared Services VPC.Answer
  4. D
    Use AWS Resource Access Manager (RAM) to share the prod.internal private hosted zone from the Production account to the Network Services account, and associate the shared zone with the Shared Services VPC.
  5. E
    Configure a Route 53 Resolver Outbound Rule in the Network Services account targeting the Direct Connect Gateway's virtual interface (VIF) IP addresses to route queries for corp.local to on-premises.
  6. F
    In the Production account, deploy Route 53 Resolver Inbound and Outbound Endpoints in the Production VPC. Configure on-premises DNS servers to forward queries for prod.internal to the Production VPC's Inbound Endpoint.

Answer

To establish the hybrid DNS architecture, the solutions architect must: 1. Create a Route 53 Resolver Outbound Rule for corp.local in the Network Services account, share it via AWS RAM, and associate it with the Production VPC. 2. Authorize the cross-account association of the prod.internal private hosted zone in the Production account and associate it with the Shared Services VPC in the Network Services account. 3. Configure the on-premises DNS servers to forward queries for both prod.internal and shared.internal to the central Route 53 Resolver Inbound Endpoint in the Shared Services VPC.
The correct architecture uses a single central Shared Services VPC to host Route 53 Resolver Inbound and Outbound endpoints to minimize costs. For the Inbound Endpoint to resolve the prod.internal domain hosted in the Production account, the Shared Services VPC must be associated with the prod.internal Private Hosted Zone. Because this is a cross-account association, it requires authorization in the Production account followed by association in the Network Services account. For outbound resolution, a single forwarding rule for corp.local is created in the central account, shared via AWS Resource Access Manager (RAM), and associated with the Production VPC.

Step-by-Step Solution

1
Centralize Inbound DNS resolution from on-premises.
Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC and configure on-premises conditional forwarders to point to its IP addresses.
This allows on-premises systems to query AWS DNS. Centralizing this in the Shared Services VPC minimizes costs by avoiding duplicate Inbound Endpoints in other VPCs.
2
Establish cross-account Private Hosted Zone (PHZ) association for the Production VPC's domain.
Authorize the association of the prod.internal PHZ in the Production account with the Shared Services VPC, then perform the association in the Network Services account.
Inbound Endpoints can only resolve domains for PHZs that are explicitly associated with the VPC housing the Inbound Endpoint. Since prod.internal is in the Production account, a cross-account association is required.
3
Centralize Outbound DNS resolution to on-premises.
Create a Route 53 Resolver Outbound Endpoint and forwarding rule for corp.local in the Shared Services VPC, share the rule with the Production account via AWS RAM, and associate the rule with the Production VPC.
This enables instances in the Production VPC to resolve the on-premises domain via Transit Gateway using the central Outbound Endpoint, satisfying the cost-minimization and name resolution requirements.

Key Concept

Cross-Account Private Hosted Zone association and centralized Route 53 Resolver Endpoints in a hybrid multi-account environment.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic