Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A smart grid utility operator manages a multi-account AWS environment using AWS Organizations. The network topology consists of a Hub VPC in a Shared Services account and multiple Spoke VPCs in Production and Development accounts. The Hub VPC is connected to an on-premises SCADA data center via AWS Transit Gateway and AWS Direct Connect.

The operator hosts a Route 53 Private Hosted Zone (PHZ) named corp.utility.internal in the Shared Services account. The on-premises DNS servers manage the onprem.utility.internal domain. The operator needs a DNS resolution strategy that meets the following requirements:
1. Instances in the Spoke VPCs must resolve hostnames in corp.utility.internal.
2. Instances in the Spoke VPCs must resolve hostnames in onprem.utility.internal.
3. On-premises systems must resolve hostnames in corp.utility.internal.
4. DNS queries between the Spoke VPCs and on-premises must traverse the hybrid connection securely.

Which of the following architectures meets these requirements with the least administrative overhead?

  1. Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. In the Shared Services account, create a Resolver outbound rule for onprem.utility.internal pointing to the on-premises DNS servers, share it with the Spoke accounts using AWS Resource Access Manager (RAM), and associate it with the Spoke VPCs. Authorize cross-account VPC associations for the Spoke VPCs to the corp.utility.internal Private Hosted Zone (PHZ) from the Shared Services account, and associate the Spoke VPCs with the PHZ. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.Answer
  2. B
    Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. In the Shared Services account, create a Resolver outbound rule for onprem.utility.internal pointing to the on-premises DNS servers, and a Resolver forwarding rule for corp.utility.internal pointing to the inbound endpoint IPs. Share both rules with the Spoke accounts using AWS Resource Access Manager (RAM), and associate them with the Spoke VPCs. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.
  3. C
    Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. Authorize cross-account VPC associations for the Spoke VPCs to the corp.utility.internal Private Hosted Zone (PHZ) from the Shared Services account, and associate the Spoke VPCs with the PHZ. In each Spoke account, create a local Route 53 Resolver outbound rule for onprem.utility.internal and route DNS queries directly through the Direct Connect Gateway to the on-premises DNS servers, without traversing the Transit Gateway. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.
  4. D
    Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. Share the corp.utility.internal Private Hosted Zone (PHZ) with the entire AWS Organization using AWS Resource Access Manager (RAM) to allow automatic association with all Spoke VPCs. In the Shared Services account, create a Resolver outbound rule for onprem.utility.internal pointing to the on-premises DNS servers, share it with the Spoke accounts using AWS RAM, and associate it with the Spoke VPCs. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.

Answer

Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. In the Shared Services account, create a Resolver outbound rule for onprem.utility.internal pointing to the on-premises DNS servers, share it with the Spoke accounts using AWS Resource Access Manager (RAM), and associate it with the Spoke VPCs. Authorize cross-account VPC associations for the Spoke VPCs to the corp.utility.internal Private Hosted Zone (PHZ) from the Shared Services account, and associate the Spoke VPCs with the PHZ. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.
The correct architecture uses Route 53 Resolver inbound endpoints to allow on-premises systems to resolve the AWS Private Hosted Zone (PHZ) and outbound endpoints to forward queries for the on-premises domain. Cross-account PHZ association via the Route 53 API (authorizing the Spoke VPCs first, then associating them) is the standard and supported method to enable Spoke VPCs to resolve the PHZ locally. Sharing a single outbound resolver rule using AWS Resource Access Manager (RAM) minimizes administrative overhead compared to setting up rules in each individual account.

Step-by-Step Solution

1
Set up centralized DNS query endpoints in the hub VPC.
Inbound and outbound Route 53 Resolver endpoints are created in the Shared Services Hub VPC, allowing hybrid DNS queries to flow between AWS and the on-premises SCADA data center.
Centralizing resolver endpoints prevents the need to deploy and manage endpoints in every spoke VPC, lowering costs and operational complexity.
2
Authorize and associate the Private Hosted Zone with the Spoke VPCs.
Submit a cross-account VPC association authorization from the Shared Services account for each Spoke VPC, and then run the associate command in each Spoke VPC account to bind the VPCs to the corp.utility.internal PHZ.
This allows instances in the Spoke VPCs to resolve resources in the corp.utility.internal zone locally via the default Route 53 Resolver IP, without traversing outbound endpoints.
3
Share the outbound forwarding rule with Spoke accounts using AWS RAM.
A Route 53 Resolver outbound forwarding rule for onprem.utility.internal is created in the Shared Services account and shared with the Spoke accounts via AWS RAM, enabling the Spoke VPCs to associate the rule locally.
Sharing the rule centrally avoids duplicate rule administration across multiple Spoke accounts and directs queries for on-premises domains to the centralized outbound endpoint.
4
Configure on-premises DNS servers to forward queries to the inbound resolver endpoint.
On-premises SCADA DNS servers are configured with conditional forwarders targeting the inbound resolver endpoint IP addresses for the corp.utility.internal domain.
This enables on-premises clients to resolve AWS private resources securely over Direct Connect by forwarding queries to the Route 53 Resolver.

Key Concept

Multi-Account and Hybrid DNS Architecture Strategy
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic