Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A global pharmaceutical research corporation is designing a hybrid DNS resolution strategy for its multi-account AWS environment. The network architecture uses a central hub-and-spoke topology, where spoke VPCs in multiple member accounts are connected via AWS Transit Gateway to a Shared Services VPC in a central networking account. An on-premises laboratory network is connected to the Transit Gateway using an AWS Direct Connect connection with a Transit Virtual Interface (Transit VIF).

A Private Hosted Zone (PHZ) named `aws.pharma.internal` is hosted in the Shared Services AWS account and associated with the Shared Services VPC. The on-premises network uses DNS servers hosting the zone `corp.local`. Spoke VPCs must be able to resolve resources in both `aws.pharma.internal` and `corp.local`. Additionally, on-premises hosts must be able to resolve resources in `aws.pharma.internal`.

Which of the following configurations represents the most secure and operationally efficient way to meet these requirements?

  1. A
    Share the `aws.pharma.internal` Private Hosted Zone directly with all spoke accounts using AWS Resource Access Manager (RAM). In each spoke account, associate the shared hosted zone with the local spoke VPCs. Create Route 53 Resolver Outbound Rules in the Shared Services account for `corp.local` pointing to on-premises DNS, share the rules via AWS RAM, and configure on-premises DNS forwarders to target a Route 53 Resolver Inbound Endpoint in the Shared Services VPC.
  2. B
    Associate the `aws.pharma.internal` Private Hosted Zone with the Shared Services VPC. In each spoke VPC, create Route 53 Resolver Outbound Rules that forward queries for `aws.pharma.internal` to the Route 53 Resolver Inbound Endpoint in the Shared Services VPC. To resolve `corp.local`, configure Route 53 Resolver Outbound Rules in each spoke account and route the DNS traffic to on-premises DNS servers directly over a Direct Connect Gateway (DXGW) public virtual interface, bypassing the Transit Gateway.
  3. In the Shared Services account, authorize the association of the `aws.pharma.internal` Private Hosted Zone with each spoke VPC. In each member account, associate the spoke VPC with the Private Hosted Zone. In the Shared Services account, create a Route 53 Resolver Outbound Endpoint and a resolver rule for `corp.local` pointing to the on-premises DNS servers. Share the resolver rule with the member accounts using AWS Resource Access Manager (RAM) and associate it with each spoke VPC. Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `aws.pharma.internal` to the inbound endpoint IP addresses.Answer
  4. D
    In each member account, submit an association request to link the spoke VPCs with the `aws.pharma.internal` Private Hosted Zone directly. In the Shared Services account, create a Route 53 Resolver Outbound Endpoint and a resolver rule for `corp.local` pointing to the on-premises DNS servers. Associate the outbound rule directly with the Transit Gateway to automatically enable resolution for all spoke VPCs. Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `aws.pharma.internal` to the inbound endpoint IP addresses.

Answer

The correct answer is the configuration that authorizes cross-account Private Hosted Zone association, shares the outbound resolver rules via AWS Resource Access Manager (RAM), and configures inbound endpoints for on-premises forwarding.
To resolve private DNS names across different AWS accounts, a Private Hosted Zone must be associated with the target VPCs. Because the Private Hosted Zone is in a different account than the spoke VPCs, the owner account must first authorize the association, and then the spoke accounts must accept the association. For hybrid DNS resolution of the on-premises domain, Route 53 Resolver Outbound Endpoints and rules must be created in the hub/Shared Services VPC and shared with spoke accounts via AWS Resource Access Manager (RAM) to allow spoke VPCs to associate with the rules. On-premises DNS resolution of the private hosted zone is achieved by forwarding queries to Route 53 Resolver Inbound Endpoints in the Shared Services VPC over the established Direct Connect connection.

Step-by-Step Solution

1
Establish cross-account Private Hosted Zone (PHZ) resolution for the spoke VPCs.
The Shared Services account owner authorizes the spoke VPCs to associate with the `aws.pharma.internal` PHZ, and each member account creates the association.
This allows instances in the spoke VPCs to resolve records in the PHZ directly and efficiently without traversing resolver endpoints.
2
Configure resolution of the on-premises `corp.local` domain from AWS.
An outbound resolver endpoint is created in the Shared Services VPC, an outbound rule for `corp.local` is defined pointing to on-premises DNS IPs, shared via RAM, and associated with all spoke VPCs.
This permits spoke VPCs to resolve on-premises hostnames over the Transit Gateway and Direct Connect connection.
3
Configure resolution of the `aws.pharma.internal` domain from on-premises.
An inbound resolver endpoint is created in the Shared Services VPC, and on-premises DNS forwarders are configured to route queries for `aws.pharma.internal` to the inbound endpoint IPs.
This enables on-premises clients to resolve AWS resources by querying the Route 53 Resolver over the Direct Connect transit virtual interface.

Key Concept

Multi-Account and Hybrid DNS Architecture Strategy
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic