Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

An automotive technology enterprise has established a multi-account AWS environment using AWS Organizations. The network topology consists of a Shared Services VPC and several spoke VPCs in different member accounts, all interconnected via an AWS Transit Gateway. The Shared Services VPC contains Route 53 Resolver inbound and outbound endpoints connected to the on-premises corporate network over an AWS Direct Connect connection. A Private Hosted Zone (PHZ) for auto.internal is hosted in a dedicated DevOps AWS account. A Solutions Architect must configure the architecture so that resources in the spoke VPCs can resolve DNS queries for the on-premises domain corp.local and the AWS Private Hosted Zone auto.internal.

Which TWO actions should the Solutions Architect take to configure DNS resolution for this architecture? (Select TWO.)

  1. Create cross-account VPC association authorizations for the auto.internal private hosted zone in the DevOps account for each spoke VPC, and then associate the private hosted zone with each spoke VPC from their respective accounts.Answer
  2. Create a Route 53 Resolver forwarding rule for corp.local in the Shared Services account pointing to the on-premises DNS servers via the outbound resolver endpoint, share the rule with the spoke accounts using AWS Resource Access Manager (RAM), and associate the rule with each spoke VPC.Answer
  3. C
    Associate the auto.internal private hosted zone with the Shared Services VPC only, and configure the spoke VPCs' DHCP options sets to use the Route 53 Resolver inbound endpoint IP addresses in the Shared Services VPC.
  4. D
    Share the Route 53 Resolver outbound endpoint directly with the spoke accounts using AWS Resource Access Manager (RAM), and create local resolver rules in each spoke account that route DNS traffic through the Direct Connect Gateway.

Answer

Create cross-account VPC association authorizations for the private hosted zone in the DevOps account and associate it with the spoke VPCs, and create a Route 53 Resolver forwarding rule for the on-premises domain in the Shared Services VPC account, share it via AWS RAM, and associate it with each spoke VPC.
The correct solution involves two distinct parts: first, establishing resolution for the AWS private hosted zone across accounts by creating VPC association authorizations in the owner account and then executing the association in the member accounts; second, enabling resolution for the on-premises domain by creating a resolver forwarding rule in the Shared Services account, sharing that rule via AWS RAM, and associating it with the spoke VPCs.

Step-by-Step Solution

1
Authorize the cross-account association of the private hosted zone with each spoke VPC from the DevOps account where the zone resides.
Association authorizations are created and registered for the spoke VPCs.
Before a VPC in another account can be associated with a private hosted zone, the hosted zone owner must authorize the cross-account association.
2
Associate the private hosted zone with the spoke VPCs from each of the spoke VPC accounts.
The private hosted zone is associated with all spoke VPCs.
This allows resources inside the spoke VPCs to perform local DNS lookups for the hosted zone domain directly.
3
Create a Route 53 Resolver forwarding rule for the corporate domain pointing to the on-premises DNS servers, share this rule with the spoke accounts using AWS RAM, and associate it with each spoke VPC.
The spoke VPCs can now forward queries for the corporate domain to the outbound endpoint in the Shared Services VPC.
This allows spoke VPCs to utilize the centralized hybrid network path for resolving corporate on-premises DNS queries.

Key Concept

Centralized and cross-account DNS resolution in a hybrid, multi-account AWS environment using Route 53 Resolver endpoints and cross-account Private Hosted Zone association.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic