Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A biotech company has a multi-account AWS environment managed under AWS Organizations. A central Network account hosts a VPC connected to the company's on-premises laboratory network via AWS Direct Connect. Multiple Workload accounts run research applications in separate VPCs. The company needs to establish a hybrid DNS resolution strategy with the following requirements:
- Instances in the Workload VPCs must resolve private records for the on-premises domain lab.local hosted on on-premises DNS servers.
- The on-premises laboratory network must resolve records in a Route 53 Private Hosted Zone (PHZ) for research.internal hosted in the Network account.
- Instances in the Workload VPCs must also resolve records in research.internal.

Which of the following configurations meets these requirements with the least administrative overhead?

  1. In the Network account, create Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC. Create a Resolver forwarding rule for the domain lab.local that points to the on-premises DNS servers, and share the rule with the Workload accounts using AWS Resource Access Manager (RAM). Associate the rule with all VPCs. Authorize the association of the research.internal PHZ with the Workload VPCs, and perform the associations from the Workload accounts. Configure the on-premises DNS servers to forward queries for research.internal to the Inbound Endpoint IP addresses.Answer
  2. B
    In the Network account, create a Route 53 Resolver Outbound Endpoint. Share the research.internal PHZ and the Outbound Endpoint with the Workload accounts using AWS Resource Access Manager (RAM). In each Workload VPC, create a Resolver forwarding rule for lab.local pointing to the on-premises DNS servers. Configure a Transit Gateway static route for UDP port 53 pointing to the Route 53 Resolver system IP address (169.254.169.253) to resolve AWS records from on-premises.
  3. C
    In the Network account, create Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC. Create a Resolver forwarding rule for lab.local pointing to the on-premises DNS servers, and share it with the Workload accounts using AWS Resource Access Manager (RAM). Associate the rule with all VPCs. In each Workload account, recreate the research.internal PHZ and associate it with the local VPCs. Configure the on-premises DNS servers to forward queries for research.internal to the Inbound Endpoint IP addresses.
  4. D
    In the Network account, create a Route 53 Resolver Inbound Endpoint. Associate the research.internal PHZ with all Workload VPCs directly using the Route 53 console. Configure a Transit Gateway to route all DNS traffic for lab.local directly to the on-premises DNS servers over Direct Connect using Transit Gateway Route Tables, bypassing the need for Resolver Outbound Endpoints.

Answer

The correct configuration is to deploy Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC, share the outbound rule via AWS Resource Access Manager (RAM), authorize and associate the Private Hosted Zone cross-account, and point on-premises DNS servers to the Inbound Endpoint.
The correct solution involves creating Inbound and Outbound Route 53 Resolver Endpoints in the central Network VPC. The Outbound Endpoint handles DNS forwarding from all AWS VPCs to on-premises DNS servers via a shared Resolver Rule distributed using AWS RAM. This avoids deploying endpoints in every workload VPC, saving costs. Cross-account PHZ association enables EC2 instances in the Workload VPCs to query the private hosted zone directly. Lastly, forwarding on-premises queries to the Inbound Endpoint allows the laboratory network to resolve resources in the AWS private zone.

Step-by-Step Solution

1
Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC.
Establishes physical endpoints to receive DNS queries from on-premises (Inbound) and send queries to on-premises (Outbound).
Allows resolving DNS between the on-premises network and AWS VPCs over the Direct Connect connection.
2
Create a Route 53 Resolver forwarding rule for lab.local pointing to the on-premises DNS servers and share it with the Workload accounts via AWS Resource Access Manager (RAM).
Enables all VPCs in the Workload accounts to associate with the forwarding rule.
Allows EC2 instances in the Workload VPCs to forward queries for lab.local to the central Outbound Endpoint, minimizing endpoint costs.
3
Authorize the association of the research.internal Private Hosted Zone with the Workload VPCs in the Network account, and associate them from the Workload accounts.
Enables instances in the Workload VPCs to resolve records in research.internal directly.
A Private Hosted Zone must be associated with a VPC to be queryable by resources in that VPC, and cross-account associations require authorization.
4
Configure the on-premises DNS servers to forward queries for research.internal to the Inbound Endpoint IP addresses.
Allows on-premises hosts to resolve records inside the AWS PHZ.
Directs local laboratory queries for the AWS domain to the Inbound Endpoint, which resolves them via the local Route 53 Resolver.

Key Concept

Cross-account Private Hosted Zone (PHZ) association and Route 53 Resolver Rule sharing using AWS RAM represent the standard pattern for multi-account and hybrid DNS resolution, separating VPC DNS endpoints from consumer spoke VPCs to optimize costs.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic