Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A health-tech corporation is migrating its clinical management platform to AWS. The infrastructure is organized under AWS Organizations with a multi-account structure:

* A central Network VPC in a Shared Services account connects to the on-premises data center via a 10 Gbps AWS Direct Connect connection terminating at an AWS Transit Gateway.
* Multiple Application VPCs in separate AWS accounts host the containerized services and are attached to the Transit Gateway.
* A Route 53 Private Hosted Zone (PHZ) for `clinical.local` is created in the Shared Services account.
* The on-premises domain is `corp.internal`, and on-premises servers host the DNS records for this domain.

To comply with health-tech security regulations, all DNS traffic must remain private. The architecture must enable resources in all Application VPCs to resolve both `clinical.local` and `corp.internal` domains, and on-premises servers must be able to resolve `clinical.local` domains.

Which of the following actions should the solutions architect perform to meet these requirements? (Select TWO).

  1. In the Shared Services account, configure a Route 53 Resolver outbound endpoint in the Network VPC. Create a forwarding rule for `corp.internal` pointing to the on-premises DNS servers, share the rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate it with the Application VPCs.Answer
  2. In the Shared Services account, authorize the association of the `clinical.local` Private Hosted Zone with the Application VPCs in the other accounts using the AWS CLI or Route 53 API, and then create the associations in those application accounts.Answer
  3. C
    Use AWS Resource Access Manager (RAM) to share the `clinical.local` Private Hosted Zone with the AWS Organization, and then associate the hosted zone with the Application VPCs in the Route 53 console of each application account.
  4. D
    Configure the on-premises DNS servers to route queries for `clinical.local` directly to a Direct Connect Gateway private virtual interface, bypassing the Transit Gateway to reduce routing latency.

Answer

Configure a Route 53 Resolver outbound endpoint in the central Network VPC, create a forwarding rule for the on-premises domain, share it via AWS RAM, and associate it with the Application VPCs; and authorize the cross-account association of the Private Hosted Zone with the Application VPCs using the AWS CLI or Route 53 API, then create the associations in those accounts.
To establish hybrid DNS resolution, the architect must create a Route 53 Resolver outbound endpoint in the central Network VPC, define a rule forwarding queries for `corp.internal` to the on-premises DNS servers, share this rule with the organization via AWS RAM, and associate it with the application VPCs. Additionally, for the application VPCs to resolve the Private Hosted Zone `clinical.local` hosted in the Shared Services account, the architect must authorize the cross-account VPC association using the Route 53 API/CLI and then associate the VPCs in each application account.

Step-by-Step Solution

1
Set up outbound name resolution for the on-premises domain.
Create a Route 53 Resolver outbound endpoint in the central Network VPC. Create a forwarding rule for `corp.internal` pointing to the on-premises DNS server IP addresses.
This allows Route 53 to forward queries for the on-premises domain to the on-premises DNS servers.
2
Distribute the outbound resolver rule across the AWS Organization.
Use AWS Resource Access Manager (RAM) to share the forwarding rule with the organization, and associate it with the Application VPCs.
This avoids having to create outbound endpoints in every application VPC, centralizing outbound DNS traffic and reducing costs.
3
Set up cross-account Private Hosted Zone (PHZ) resolution.
Authorize the association of the `clinical.local` PHZ with the Application VPCs from the Shared Services account, and then perform the association from each application VPC's account.
Because Private Hosted Zones cannot be shared via AWS RAM, cross-account VPC association requires Route 53 API-level authorization and association.

Key Concept

Cross-account Private Hosted Zone association and Route 53 Resolver rules configuration for hybrid environments
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic