Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A biopharmaceutical research organization is deploying a multi-account AWS environment. The core network is built on a Hub-and-Spoke topology using AWS Transit Gateway, with a central Hub VPC in the Network Services account and multiple Spoke VPCs in separate member accounts (Production and Development) within the same AWS Organization. A Route 53 Private Hosted Zone (PHZ) named `research.internal` is hosted in a dedicated Shared Services account. The company's on-premises laboratory network is connected to the Hub VPC via AWS Direct Connect, where on-premises DNS servers manage the `lab.local` domain. The architecture must allow on-premises laboratory systems to resolve resources in the `research.internal` PHZ, and EC2 instances in all Spoke VPCs to resolve both `lab.local` and `research.internal` resources. The design must minimize administrative overhead and ensure that DNS traffic does not traverse the public internet.

Which TWO configuration steps are required to establish this DNS resolution path? (Select TWO.)

  1. In the Shared Services account, authorize the association of the research.internal private hosted zone with the Hub VPC and each Spoke VPC. In the Network Services and member accounts, accept the association to link the VPCs to the private hosted zone.Answer
  2. In the Network Services account, create Route 53 Resolver inbound and outbound endpoints in the Hub VPC. Create a Resolver forwarding rule for lab.local pointing to the on-premises DNS servers, share this rule with the member accounts using AWS Resource Access Manager (RAM), and associate it with the Spoke VPCs.Answer
  3. C
    In the Shared Services account, associate the research.internal private hosted zone with the Hub VPC. Enable DNS support on the Transit Gateway attachments to allow the Spoke VPCs to transitively resolve queries within the research.internal zone.
  4. D
    In the Network Services account, create a Route 53 Resolver forwarding rule for research.internal pointing to the VPC resolver (10.0.0.210.0.0.2) of the Hub VPC, and associate this rule with all Spoke VPCs.
  5. E
    Configure the on-premises DNS servers to forward queries for research.internal to the Direct Connect Gateway (DXGW) IP addresses, and configure the DXGW to route these queries to the Route 53 Resolver in the Shared Services account.

Answer

The correct options are: (1) authorizing the association of the research.internal private hosted zone with the Hub VPC and each Spoke VPC in the Shared Services account, and accepting the association in the Network Services and member accounts; and (2) creating Route 53 Resolver inbound and outbound endpoints in the Hub VPC, creating a forwarding rule for lab.local pointing to the on-premises DNS servers, sharing the rule via AWS Resource Access Manager (RAM), and associating it with the Spoke VPCs.
The correct configurations involve establishing cross-account Private Hosted Zone (PHZ) associations and deploying Route 53 Resolver endpoints. First, because the PHZ is hosted in the Shared Services account, it must be associated with the Hub VPC and the Spoke VPCs in the other accounts. This requires a cross-account authorization from the Shared Services account followed by acceptance in the respective target accounts. Second, a centralized resolver pattern in the Network Services Hub VPC using Route 53 Resolver inbound and outbound endpoints manages the hybrid traffic. An outbound endpoint with a forwarding rule for the on-premises domain is shared with the Spoke VPC accounts via AWS Resource Access Manager (RAM) to resolve on-premises names, while the inbound endpoint allows on-premises servers to forward queries to AWS.

Step-by-Step Solution

1
Authorize and establish cross-account Private Hosted Zone (PHZ) associations.
The Shared Services account authorizes the association of the research.internal PHZ with the Hub VPC and all Spoke VPCs. The Network Services and member accounts accept the associations, allowing local resolvers in all VPCs to resolve research.internal.
Since the PHZ is owned by a different account, a cross-account association is mandatory for the VPCs to resolve the private DNS zone locally.
2
Deploy Route 53 Resolver inbound endpoints in the central Hub VPC and configure on-premises forwarding.
On-premises DNS servers are configured to forward queries for research.internal to the inbound endpoint IPs.
This allows on-premises clients to safely query and resolve the AWS private DNS zone without exposing resources to the public internet.
3
Deploy Route 53 Resolver outbound endpoints and configure outbound forwarding rules.
A Resolver forwarding rule for lab.local is created pointing to the on-premises DNS servers. This rule is shared via AWS RAM and associated with the Spoke VPCs.
This enables instances in the Spoke VPCs to forward queries for on-premises domains through the Hub VPC's outbound endpoint.

Key Concept

Hybrid DNS resolution and cross-account Private Hosted Zone associations using Route 53 Resolver endpoints.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic