Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A financial services corporation is establishing a multi-account AWS environment managed via AWS Organizations. The architecture consists of a centralized Network Services VPC in a Shared Services account, and multiple Spoke VPCs in separate Business Unit (BU) accounts. A Route 53 Private Hosted Zone (PHZ) for corp.internal is hosted in the Shared Services account. The on-premises data centers use local DNS servers for the onprem.internal domain, connected to the Network Services VPC via AWS Direct Connect and an AWS Transit Gateway. The corporation requires seamless, bidirectional hybrid DNS resolution: all AWS VPCs must resolve onprem.internal, and on-premises systems must resolve resources in the corp.internal PHZ, as well as resources in local PHZs associated with each Spoke VPC. Which TWO actions must the solutions architect take to implement this hybrid DNS resolution strategy? (Select TWO.)

  1. In the Shared Services account, create a Route 53 Resolver inbound endpoint in the Network Services VPC. Configure the on-premises DNS servers to forward DNS queries for corp.internal and the Spoke VPC local domains to the IP addresses of this inbound endpoint.Answer
  2. Create a Route 53 Resolver outbound endpoint in the Network Services VPC. Define a Route 53 Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers, associate the rule with the Network Services VPC, and share the rule across the AWS Organization using AWS Resource Access Manager (RAM) to allow Spoke VPCs to associate with it.Answer
  3. C
    Share the corp.internal Private Hosted Zone with the Business Unit accounts using AWS Resource Access Manager (RAM), and then associate the hosted zone with the Spoke VPCs from the Business Unit accounts.
  4. D
    Create a Route 53 Resolver outbound endpoint in each Spoke VPC, and configure a forwarding rule for onprem.internal pointing to the Direct Connect Gateway (DXGW) virtual interface IP addresses to route DNS queries without traversing AWS Transit Gateway.
  5. E
    Configure the on-premises DNS servers to forward queries for corp.internal directly to the IP address of the AWS Transit Gateway attachment, utilizing the Transit Gateway's native DNS forwarding services.

Answer

In the Shared Services account, create a Route 53 Resolver inbound endpoint in the Network Services VPC, configuring the on-premises DNS servers to forward queries to it; and create a Route 53 Resolver outbound endpoint in the Network Services VPC with a forwarding rule for onprem.internal shared across the AWS Organization using AWS Resource Access Manager (RAM).
The correct strategy combines a centralized Route 53 Resolver inbound endpoint to receive DNS queries from on-premises servers, and a centralized Route 53 Resolver outbound endpoint in the Network Services VPC to route queries to on-premises servers. Sharing the outbound resolver rule via AWS RAM allows Spoke VPCs to leverage the central outbound endpoint, avoiding the cost of provisioning endpoints in every Spoke VPC.

Step-by-Step Solution

1
Set up inbound DNS resolution from on-premises.
Create a Route 53 Resolver inbound endpoint in the Network Services VPC and configure on-premises DNS forwarders to target these inbound IP addresses for corp.internal and Spoke VPC domains.
This allows on-premises systems to resolve AWS-internal names by querying the inbound endpoint, which queries the Route 53 Resolver.
2
Set up outbound DNS resolution from AWS to on-premises.
Create a Route 53 Resolver outbound endpoint in the Network Services VPC and configure a forwarding rule for onprem.internal pointing to on-premises DNS servers.
This establishes the path for DNS queries originating in AWS to exit the AWS network and reach the on-premises DNS servers.
3
Share and associate the forwarding rule with Spoke VPCs.
Use AWS Resource Access Manager (RAM) to share the forwarding rule, and associate it with each Spoke VPC in the Business Unit accounts.
This ensures that resources in the Spoke VPCs automatically use the centralized outbound endpoint in the Network Services VPC to resolve onprem.internal without needing their own outbound endpoints.

Key Concept

Centralized Hybrid DNS Architecture with Route 53 Resolver Endpoints and RAM Shared Rules
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic