Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A health-tech company manages a multi-account AWS environment using AWS Organizations. Workloads running in spoke VPCs in multiple member accounts must access on-premises systems under the hospital.local domain, which are connected via an AWS Transit Gateway and an AWS Direct Connect connection. Additionally, these workloads must resolve internal service endpoints hosted in a central Private Hosted Zone (PHZ) named clinical.platform.aws in a Shared Services AWS account. Which architecture provides the most operationally efficient and secure DNS resolution across the hybrid and multi-account environment?

  1. A
    In the Shared Services account, associate the clinical.platform.aws private hosted zone (PHZ) with the central VPC. Deploy Route 53 Resolver inbound endpoints in the central VPC, and deploy outbound endpoints to resolve hospital.local. Share the outbound resolver rule using AWS Resource Access Manager (RAM). Configure the spoke VPCs' DHCP options sets to use the inbound endpoint IP addresses as their primary DNS servers.
  2. B
    In the Shared Services account, create the clinical.platform.aws private hosted zone (PHZ) and share it directly with the organization using AWS Resource Access Manager (RAM). In each member account, associate the shared PHZ with the local spoke VPCs. Deploy dedicated Route 53 Resolver outbound endpoints in each spoke VPC to forward queries for hospital.local to the on-premises DNS servers.
  3. In the Shared Services account, deploy Route 53 Resolver outbound endpoints in the central VPC, and create an outbound resolver rule for hospital.local pointing to the on-premises DNS servers. Share the resolver rule with the organization using AWS Resource Access Manager (RAM), and associate it with the spoke VPCs. Authorize cross-account VPC associations for the clinical.platform.aws private hosted zone (PHZ) from the Shared Services account, and associate the PHZ with the spoke VPCs in each member account.Answer
  4. D
    In the Shared Services account, deploy Route 53 Resolver outbound endpoints in the central VPC, and create an outbound resolver rule for hospital.local pointing to the on-premises DNS servers. Configure the outbound endpoints to route traffic through a Direct Connect Gateway associated with a Virtual Private Gateway (VGW) attached to the central VPC. Associate the clinical.platform.aws private hosted zone (PHZ) with the central VPC, and allow spoke VPCs to query it transitively over AWS Transit Gateway.

Answer

In the Shared Services account, deploy Route 53 Resolver outbound endpoints in the central VPC, and create an outbound resolver rule for hospital.local pointing to the on-premises DNS servers. Share the resolver rule with the organization using AWS Resource Access Manager (RAM), and associate it with the spoke VPCs. Authorize cross-account VPC associations for the clinical.platform.aws private hosted zone (PHZ) from the Shared Services account, and associate the PHZ with the spoke VPCs in each member account.
The correct architecture leverages native cross-account Private Hosted Zone (PHZ) association, which allows instances in spoke VPCs to resolve the clinical.platform.aws domain locally and securely. For hybrid resolution, deploying outbound resolver endpoints in a central Shared Services VPC and sharing the resolver rule via AWS Resource Access Manager (RAM) allows spoke VPCs to query the on-premises hospital.local domain efficiently while keeping costs and operational overhead to a minimum.

Step-by-Step Solution

1
Authorize cross-account VPC associations for the private hosted zone.
The clinical.platform.aws PHZ in the Shared Services account is authorized to be associated with the spoke VPCs in the member accounts.
Cross-account authorization is required before a VPC in a different AWS account can be associated with a Private Hosted Zone.
2
Associate the spoke VPCs with the private hosted zone in the member accounts.
Spoke VPCs resolve clinical.platform.aws records locally without routing queries through a central inbound endpoint.
Associating the PHZ directly with each spoke VPC allows the native Route 53 Resolver (.2) to answer queries directly, eliminating network hops and extra costs.
3
Deploy centralized Route 53 Resolver outbound endpoints and configure rules.
An outbound endpoint is created in the Shared Services VPC, and an outbound rule for hospital.local is mapped to forward queries to the on-premises DNS servers.
This centralizes hybrid DNS configuration, reducing the need for costly outbound endpoints in every spoke VPC.
4
Share the outbound resolver rule via AWS RAM and associate it with the spoke VPCs.
Spoke VPCs automatically forward queries for hospital.local to the Shared Services VPC's outbound endpoint.
Sharing the rule via AWS RAM allows spoke VPCs to reuse the central outbound endpoint, providing consistent resolution for on-premises domains.

Key Concept

Cross-account Route 53 Private Hosted Zone association and centralized hybrid DNS routing using Route 53 Resolver rules shared via AWS RAM.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic