Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

An automotive telematics enterprise manages its AWS environment through AWS Organizations. A central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for the domain name `fleet.telematics.internal`. The company has deployed a new vehicle-tracking application in a separate Production account within its own VPC. The application must resolve resource records within `fleet.telematics.internal`. Additionally, on-premises diagnostic servers connected via AWS Direct Connect must also resolve records in this PHZ. Which strategy should a solutions architect implement to enable DNS resolution for both the Production VPC and the on-premises servers?

  1. Submit a VPC association authorization for the Production VPC from the Shared Services account using the AWS CLI or SDK, accept the association from the Production account, and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC to receive forwarded DNS queries from the on-premises DNS servers.Answer
  2. B
    Share the Private Hosted Zone from the Shared Services account with the Production account using AWS Resource Access Manager (RAM), associate the shared zone with the Production VPC, and establish a Direct Connect Gateway connection with public virtual interfaces to route DNS queries to Route 53.
  3. C
    Configure the Production VPC's DHCP options set with the Amazon-provided DNS IP address (10.0.0.210.0.0.2) of the Shared Services VPC, establish a VPC peering connection between the VPCs, and configure Route 53 Resolver Outbound Endpoints in the Production VPC to handle incoming on-premises requests.
  4. D
    Associate the Private Hosted Zone with the Shared Services VPC, peer the Shared Services VPC with the Production VPC, and configure the Direct Connect Gateway to transitively route DNS queries directly to the Route 53 resolver in the Shared Services VPC without using resolver endpoints.

Answer

Authorize the VPC association from the Shared Services account using the AWS CLI or SDK, accept the association from the Production account, and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC to receive forwarded DNS queries from the on-premises DNS servers.
The correct strategy uses the official Route 53 cross-account VPC association workflow (create authorization from the owner account, then associate from the member VPC account) to allow the Production VPC to resolve records in the Shared Services PHZ. It also correctly utilizes Route 53 Resolver Inbound Endpoints to listen for DNS queries forwarded from the on-premises DNS servers over Direct Connect.

Step-by-Step Solution

1
Authorize cross-account Private Hosted Zone association.
The Shared Services account (owner of the PHZ) runs `aws route53 create-vpc-association-authorization` targeting the Production VPC ID.
This establishes permission for the Production VPC to be associated with the Private Hosted Zone in the Shared Services account.
2
Associate the Production VPC with the Private Hosted Zone.
The Production account runs `aws route53 associate-vpc-with-hosted-zone` using the PHZ ID and its VPC ID.
This allows EC2 instances in the Production VPC to natively resolve DNS queries for the `fleet.telematics.internal` domain.
3
Configure hybrid DNS resolution for on-premises clients.
Create Route 53 Resolver Inbound Endpoints in the Shared Services VPC and configure on-premises DNS forwarders to target these endpoint IP addresses over Direct Connect.
This allows on-premises diagnostic servers to route DNS requests for `fleet.telematics.internal` into the AWS network to be resolved by Route 53.

Key Concept

Cross-account Private Hosted Zone (PHZ) association requires a two-step authorization and association process via the Route 53 API/CLI. Hybrid DNS resolution from on-premises to AWS requires Route 53 Resolver Inbound Endpoints.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic