Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A global container logistics company is migrating its operations to AWS, establishing a multi-account structure managed under AWS Organizations. The network topology uses a Hub-and-Spoke model where a central Network VPC is connected to multiple spoke VPCs and to the company’s on-premises data centers via AWS Transit Gateway (TGW) and AWS Direct Connect. The on-premises DNS servers manage the `onprem.cargo.internal` domain. The spoke accounts host private hosted zones (PHZs) for their respective services, such as `booking.aws.cargo.internal` and `tracking.aws.cargo.internal`.

The solution must meet the following requirements:
- On-premises clients must be able to resolve records within the `aws.cargo.internal` domain.
- Instances in all spoke VPCs must resolve records within the `onprem.cargo.internal` domain.
- Spoke VPCs must be able to resolve records in each other’s PHZs.

Which TWO steps should a solutions architect take to implement this DNS architecture? (Select TWO.)

  1. Deploy Route 53 Resolver inbound endpoints in the Network VPC, and configure the on-premises DNS servers to forward queries for the `aws.cargo.internal` domain and its subdomains to the inbound endpoint IP addresses.Answer
  2. For each spoke private hosted zone (PHZ), authorize VPC associations to the Network VPC and other spoke VPCs from the respective spoke accounts using the AWS CLI or SDK, and then associate the PHZs from the target VPC accounts.Answer
  3. C
    Share the private hosted zones (PHZs) from each spoke account using AWS Resource Access Manager (RAM) to the entire organization, enabling automatic cross-account VPC association.
  4. D
    Configure the on-premises DNS servers to forward queries for `aws.cargo.internal` directly to the Direct Connect Gateway's virtual interface IP addresses.
  5. E
    Create Route 53 Resolver outbound rules in each spoke VPC to forward queries for the other spoke domains to the inbound resolver endpoint in the central Network VPC.

Answer

Deploying Route 53 Resolver inbound endpoints in the Network VPC for on-premises forwarding, and authorizing/associating the cross-account Private Hosted Zones with the respective VPCs using the Route 53 API.
Deploying Route 53 Resolver inbound endpoints in the Network VPC allows the on-premises DNS servers to forward queries for AWS private domains to AWS. For cross-account private hosted zone resolution, the spoke accounts must first authorize the associations for their hosted zones to other VPCs, and the associations must then be completed. This enables all spoke VPCs to resolve each other's private DNS records.

Step-by-Step Solution

1
Deploy Route 53 Resolver inbound endpoints in the Network VPC.
On-premises clients can forward DNS queries for the `aws.cargo.internal` domain to the inbound endpoint IP addresses.
This enables inbound hybrid DNS resolution from the on-premises environment.
2
Authorize cross-account VPC associations for the spoke Private Hosted Zones.
The spoke accounts authorize the Network VPC and other spoke VPCs to associate with the hosted zones.
This is a prerequisite step in Route 53 when the private hosted zones and target VPCs reside in different AWS accounts.
3
Associate the spoke Private Hosted Zones with the authorized target VPCs.
Instances in any associated VPC can resolve the records of the associated private hosted zones.
This enables inter-VPC private DNS resolution without traversing external endpoints.

Key Concept

Route 53 Resolver endpoints and cross-account Private Hosted Zone association.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic