A global retail and supply chain enterprise manages its hybrid IT environment across multi… — AWS Certified Solutions Architect - Professional

A global retail and supply chain enterprise manages its hybrid IT environment across multiple AWS accounts using AWS Organizations. The infrastructure includes a central Shared Services VPC in a Network account and several Application VPCs in member accounts. Network connectivity to the on-premises datacenter is established via AWS Transit Gateway and AWS Direct Connect. The on-premises DNS servers host the zone `corp.internal`, while a Route 53 Private Hosted Zone (PHZ) for `aws.corp.internal` is hosted in the Shared Services account. The enterprise requires resources in all VPCs to resolve `corp.internal` and resources on-premises to resolve `aws.corp.internal`. Which TWO actions should the Solutions Architect perform to implement this hybrid DNS architecture? (Select TWO.)

In the Shared Services VPC, create Route 53 Resolver outbound endpoints. Create a Resolver forwarding rule for the corp.internal domain pointing to the on-premises DNS servers, share the rule with the organization using AWS Resource Access Manager (RAM), and associate the rule with the Application VPCs.Answer
From the Shared Services account, authorize the association of the aws.corp.internal private hosted zone with the Application VPCs in the member accounts using the AWS CLI or API. In each member account, associate the Application VPCs with the private hosted zone.Answer
C
Associate the aws.corp.internal private hosted zone with the Application VPCs directly from the Route 53 console in the Shared Services account, as resource sharing for private hosted zones is automatically enabled within AWS Organizations.
D
In the Shared Services VPC, create Route 53 Resolver inbound endpoints. Configure the on-premises DNS servers to forward queries for aws.corp.internal to the Transit Gateway's link-local IP address $169.254.169.253$ , routing traffic through a Direct Connect Gateway.
E
Create Route 53 Resolver inbound and outbound endpoints in each Application VPC. Set up conditional forwarding rules locally within each member account to forward queries for corp.internal directly to the on-premises DNS servers.

Answer

Create Route 53 Resolver outbound endpoints and a forwarding rule for the corporate domain in the Shared Services VPC, share the rule via AWS Resource Access Manager (RAM) to the Application VPCs, and authorize/associate the cross-account private hosted zone with the Application VPCs using the AWS CLI or API.

The correct options describe the standard, architecturally sound method for establishing hybrid DNS resolution in a multi-account AWS environment. Sharing centralized Route 53 Resolver outbound rules via AWS Resource Access Manager (RAM) allows member accounts to forward on-premises DNS queries without the cost of deploying outbound endpoints in every VPC. For cross-account Private Hosted Zones, using the AWS CLI or API to authorize and then associate the VPCs ensures that the Application VPCs can resolve the private DNS records hosted in the central Network account.

Step-by-Step Solution

Set up outbound DNS resolution from AWS to on-premises.

Create outbound Route 53 Resolver endpoints in the central Shared Services VPC. Create a forwarding rule for the `corp.internal` domain pointing to the on-premises DNS servers.

This enables DNS queries targeting the on-premises network to be forwarded over the Direct Connect connection.

Share the outbound Resolver rule across the organization.

Use AWS Resource Access Manager (RAM) to share the forwarding rule with the member accounts, and associate the rule with the Application VPCs.

This centralizes outbound resolver endpoints and rule configuration, reducing operational complexity and cost.

Enable DNS resolution of the AWS Private Hosted Zone (PHZ) in the Application VPCs.

Authorize the association of the `aws.corp.internal` PHZ with the Application VPCs using the AWS CLI/API in the Shared Services account, then associate them in the member accounts.

VPCs can only resolve names in a PHZ if the zone is associated with them. Since the PHZ and VPCs are in different accounts, cross-account association authorization is required.

Key Concept

Centralized Route 53 Resolver endpoints combined with cross-account Private Hosted Zone association authorization are required to build a scalable and secure hybrid DNS architecture.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic