Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

An enterprise is strengthening its network security posture across a multi-account AWS environment. The infrastructure consists of an on-premises datacenter connected via AWS Direct Connect to an AWS Transit Gateway. Multiple VPCs (Production, Development, and Shared Services) are attached to the Transit Gateway. The enterprise has a Route 53 Private Hosted Zone (PHZ) for `aws.corp.internal` created in the Shared Services account and associated with the Shared Services VPC. The security team requires that all VPCs must be able to resolve `aws.corp.internal` and on-premises resources must also resolve `aws.corp.internal`. Additionally, all VPCs must resolve the on-premises domain `onprem.corp.internal`. How should the Solutions Architect configure the DNS architecture to meet these requirements securely?

  1. A
    In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and a Route 53 Resolver Outbound Endpoint. Keep the `aws.corp.internal` PHZ associated only with the Shared Services VPC, and rely on Transit Gateway routing tables to forward DNS requests on port 53 from the other VPCs to the Shared Services VPC. Create a Route 53 Resolver forwarding rule for `onprem.corp.internal` pointing to the on-premises DNS servers, and associate this rule only with the Shared Services VPC.
  2. B
    In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and Outbound Endpoint. Set up a Direct Connect Gateway to enable transitive routing of DNS queries on port 53 directly to on-premises DNS servers. Attach a Service Control Policy (SCP) at the root level of the AWS Organization to grant permissions for all VPCs to access the Route 53 Private Hosted Zone without local VPC associations.
  3. In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and a Route 53 Resolver Outbound Endpoint. Associate the `aws.corp.internal` PHZ with all VPCs in the organization. Create a Route 53 Resolver forwarding rule for `onprem.corp.internal` pointing to the on-premises DNS servers, associate this rule with all VPCs in the organization, and configure the on-premises DNS servers to forward queries for `aws.corp.internal` to the Inbound Endpoint IP addresses.Answer
  4. D
    In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and a Route 53 Resolver Outbound Endpoint. Associate the `aws.corp.internal` PHZ with all VPCs. For auditing and log encryption, configure Route 53 Resolver query logging to an S3 bucket, encrypted with the default AWS-managed KMS key (`aws/route53`), and modify the KMS key policy to delegate decryption rights to all AWS Organization member accounts.

Answer

In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and a Route 53 Resolver Outbound Endpoint. Associate the `aws.corp.internal` PHZ with all VPCs in the organization. Create a Route 53 Resolver forwarding rule for `onprem.corp.internal` pointing to the on-premises DNS servers, associate this rule with all VPCs in the organization, and configure the on-premises DNS servers to forward queries for `aws.corp.internal` to the Inbound Endpoint IP addresses.
The correct solution uses Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC to bridge DNS resolution between AWS and on-premises networks. By associating the Private Hosted Zone with all consuming VPCs, queries within AWS resolve locally. The Resolver forwarding rule for the on-premises domain is shared and associated with all VPCs, ensuring outbound DNS requests reach the on-premises DNS servers. On-premises DNS servers forward queries for the AWS domain to the Inbound Endpoint IPs.

Step-by-Step Solution

1
Associate the Route 53 Private Hosted Zone (`aws.corp.internal`) with the Production, Development, and Shared Services VPCs.
Enables local resolution of the hosted zone inside each AWS VPC via the standard VPC resolver.
Route 53 Hosted Zones are only queryable from VPCs that are explicitly associated with them.
2
Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC.
Provides static IP addresses inside the VPC that can receive DNS queries from on-premises over Direct Connect.
Allows on-premises DNS forwarders to query AWS Private Hosted Zones.
3
Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver Forwarding Rule for `onprem.corp.internal`.
Enables forwarding DNS queries targeted at the on-premises domain to the on-premises DNS server IPs.
Allows resource instances inside AWS VPCs to resolve on-premises hostnames.
4
Associate the Resolver Forwarding Rule with all the VPCs in the organization.
Ensures that queries from any VPC for `onprem.corp.internal` are sent through the Outbound Endpoint.
Enables consistent cross-premises name resolution across the entire multi-account network.

Key Concept

Hybrid DNS resolution and multi-VPC Private Hosted Zone association.
Rate this question

Topics

Strengthening Identity, Access, and Network Security