Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A health-tech company is migrating its electronic health record (EHR) platform to AWS. The target topology consists of a central Network account containing a hub VPC, and multiple application accounts containing spoke VPCs, all interconnected via AWS Transit Gateway. The on-premises data center is connected to the hub VPC via an AWS Direct Connect connection. A Private Hosted Zone (PHZ) for the domain aws.healthtech.internal is created in a central Shared Services account. AWS resources in the spoke VPCs and servers on-premises must be able to resolve records in aws.healthtech.internal. Which of the following actions should the Solutions Architect take to establish this hybrid DNS resolution? (Select TWO.)

  1. Create Route 53 Resolver inbound endpoints in the Network account's hub VPC. On the on-premises DNS servers, configure conditional forwarders for the aws.healthtech.internal domain pointing to the inbound endpoint IP addresses.Answer
  2. In the Shared Services account, authorize the association of the aws.healthtech.internal Private Hosted Zone with each spoke VPC. In each application account, associate the spoke VPCs with the Private Hosted Zone.Answer
  3. C
    Share the aws.healthtech.internal Private Hosted Zone with the AWS Organization using AWS Resource Access Manager (RAM) to automatically enable DNS resolution for all spoke VPCs.
  4. D
    Configure the spoke VPCs to use the Direct Connect Gateway as their primary DNS server to route all queries for the aws.healthtech.internal domain transitively to the on-premises DNS servers.
  5. E
    Create Route 53 Resolver outbound endpoints in each application account's spoke VPC, and configure them to forward all DNS queries directly to the inbound endpoints in the Network account.

Answer

Create Route 53 Resolver inbound endpoints in the Network account's hub VPC, configure on-premises conditional forwarders pointing to these endpoints, and perform cross-account Private Hosted Zone association for the spoke VPCs.
To achieve DNS resolution for the private hosted zone from on-premises, you must deploy Route 53 Resolver inbound endpoints in the hub VPC and configure on-premises DNS servers to forward queries to those endpoints. For the spoke VPCs to resolve the zone, they must be associated with the Private Hosted Zone, which requires authorizing the association from the zone's owner account and associating the VPC from the spoke accounts.

Step-by-Step Solution

1
Enable on-premises resolution of the private hosted zone.
Route 53 Resolver inbound endpoints are created in the hub VPC. The on-premises DNS servers forward queries for aws.healthtech.internal to the inbound endpoint IP addresses over Direct Connect.
Inbound endpoints act as forwarding targets within the AWS network that have access to Route 53 private resolution.
2
Establish cross-account VPC association with the Private Hosted Zone.
The Shared Services account owner runs the authorization command for the spoke VPCs, and the application account owners associate their VPCs with the Private Hosted Zone.
This allows resources in the spoke VPCs to query Route 53 directly and resolve names in the shared private hosted zone.

Key Concept

Cross-account Private Hosted Zone association and hybrid name resolution using Route 53 Resolver endpoints.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic