Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

An aerospace engineering company manages its multi-account environment on AWS using AWS Organizations. The central network infrastructure is hosted in a Shared Services account, which contains a Transit Gateway that connects multiple application VPCs in member accounts and an on-premises data center. A Route 53 Private Hosted Zone (PHZ) for corp.aero.internal is created in the Shared Services account. The company needs resources in both the member account VPCs and the on-premises data center to resolve DNS queries for corp.aero.internal. Which architecture will meet these requirements with the least administrative and operational overhead?

  1. A
    Use AWS Resource Access Manager (RAM) to share the corp.aero.internal private hosted zone with the AWS Organization. Associate the shared private hosted zone with all member VPCs. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS forwarders to route queries for the internal domain to these inbound endpoint IP addresses.
  2. B
    Associate the corp.aero.internal private hosted zone with the Shared Services VPC. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure Route 53 Resolver outbound rules in all member accounts to forward queries for corp.aero.internal to these inbound endpoints. Configure the on-premises DNS forwarders to route queries to the same inbound endpoints.
  3. Authorize and associate the corp.aero.internal private hosted zone in the Shared Services account with the member VPCs using cross-account VPC association. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS forwarders to route queries for the internal domain to these inbound endpoint IP addresses.Answer
  4. D
    Associate the corp.aero.internal private hosted zone with the Shared Services VPC. Deploy Route 53 Resolver outbound endpoints in the member VPCs. Configure the outbound endpoints to forward queries for the internal domain to the on-premises DNS servers, which then route the queries back to the Shared Services VPC inbound endpoints via AWS Direct Connect Gateway.

Answer

Authorize and associate the corp.aero.internal private hosted zone in the Shared Services account with the member VPCs using cross-account VPC association. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS forwarders to route queries for the internal domain to these inbound endpoint IP addresses.
The correct solution uses cross-account Private Hosted Zone (PHZ) association to allow member VPCs to natively resolve DNS queries for the zone. This avoids any additional query fees or endpoint charges for VPC-to-VPC traffic. For the on-premises hybrid DNS resolution, creating Route 53 Resolver inbound endpoints in the Shared Services VPC and configuring the on-premises DNS forwarders to target these endpoints is the standard and most efficient pattern.

Step-by-Step Solution

1
Authorize cross-account association of the Private Hosted Zone (PHZ) from the Shared Services account to the member VPCs.
The member VPCs are permitted to associate with the PHZ hosted in the Shared Services account.
By default, a PHZ can only be associated with VPCs in the same account unless explicit authorization is granted using the AWS CLI or SDK.
2
Associate the member VPCs with the authorized PHZ from the member accounts.
Resources in the member VPCs can natively resolve domains within corp.aero.internal using the Route 53 Resolver (provided by the 169.254.169.253 IP address) without traversing endpoints.
This establishes native DNS resolution for the PHZ inside the member VPCs with zero additional hop latency or endpoint charges.
3
Create Route 53 Resolver inbound endpoints in the Shared Services VPC and configure on-premises DNS servers to forward queries for corp.aero.internal to the inbound endpoint IP addresses.
On-premises resources can resolve corp.aero.internal domains by forwarding queries over Direct Connect/VPN to the Shared Services VPC.
Inbound endpoints are required to receive DNS queries from outside AWS (such as from on-premises networks) and resolve them against Route 53.

Key Concept

Cross-Account PHZ Association and Hybrid DNS Resolution using Route 53 Resolver Inbound Endpoints
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic