Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A multinational smart grid operator manages its infrastructure using AWS Organizations. The network topology consists of a central Hub VPC in a Network Services account and several spoke VPCs in separate production accounts. The spoke VPCs are connected to the Hub VPC via an AWS Transit Gateway. The on-premises grid operations center is connected to the Hub VPC via an AWS Direct Connect connection terminated at a Direct Connect Gateway. The on-premises environment hosts telemetry servers resolved by a local DNS server zone grid.local. The AWS environment hosts microservices that need to resolve names in the grid.local domain, and the on-premises servers must resolve services in a Route 53 Private Hosted Zone (PHZ) named aws.grid.internal hosted in a Shared Services account. To minimize latency and avoid single points of failure, the operator requires a scalable, highly available, and secure DNS resolution strategy across all environments. Which TWO actions should a Solutions Architect take to meet these requirements? (Select TWO.)

  1. In the Shared Services account, authorize the association of the aws.grid.internal private hosted zone with the Hub VPC and each spoke VPC. In the respective accounts containing the Hub and spoke VPCs, associate the VPCs with the private hosted zone.Answer
  2. Deploy Route 53 Resolver inbound endpoints in the Hub VPC, and configure the on-premises DNS servers to forward queries for aws.grid.internal to these inbound endpoint IP addresses. Deploy Route 53 Resolver outbound endpoints in the Hub VPC, create a Resolver rule for grid.local pointing to the on-premises DNS servers, share this rule via AWS Resource Access Manager with the organization, and associate it with all spoke VPCs.Answer
  3. C
    Use AWS Resource Access Manager in the Shared Services account to share the aws.grid.internal private hosted zone with the organization. In each spoke and hub account, accept the resource share and associate the private hosted zone with the local VPCs.
  4. D
    Configure the on-premises DNS servers to route all queries for aws.grid.internal to the Direct Connect Gateway's virtual interface IP address directly, bypassing the need for Route 53 Resolver inbound endpoints.
  5. E
    Create a Route 53 Resolver outbound rule for aws.grid.internal in the Hub VPC, associate it with the spoke VPCs, and configure it to forward queries to the Transit Gateway's default IP address to handle cross-account hosted zone resolution.

Answer

The correct actions are to authorize the cross-account association of the private hosted zone in the Shared Services account and perform the association in the respective VPC accounts, while deploying Route 53 Resolver inbound/outbound endpoints in the hub VPC, sharing the outbound rule via AWS Resource Access Manager (RAM), and configuring on-premises DNS forwarding.
The correct actions configure secure cross-account hosted zone resolution and hybrid DNS forwarding. First, because the Private Hosted Zone is owned by the Shared Services account, it must be associated with the Hub and spoke VPCs using the Route 53 cross-account authorization and association process. Second, hybrid resolution is achieved by placing inbound and outbound Route 53 Resolver endpoints in the Hub VPC, forwarding on-premises queries to the inbound endpoints, and sharing the outbound Resolver forwarding rule via AWS RAM with the spoke VPCs to allow them to resolve on-premises domains.

Step-by-Step Solution

1
Set up cross-account Private Hosted Zone association by running 'aws route53 create-vpc-association-authorization' in the Shared Services account for the Hub and spoke VPCs, and then running 'aws route53 associate-vpc-with-private-hosted-zone' in the respective Hub and spoke accounts.
The aws.grid.internal zone is resolvable by the Route 53 Resolver (.2 IP) in both the Hub and spoke VPCs.
This establishes cross-account private DNS resolution within AWS without using RAM, which does not support PHZs.
2
Create Route 53 Resolver inbound endpoints in the Hub VPC across multiple availability zones and point on-premises DNS forwarders for aws.grid.internal to these inbound IPs.
On-premises clients can resolve AWS internal resources over Direct Connect.
This provides a highly available entry point for on-premises DNS queries entering the AWS network.
3
Create Route 53 Resolver outbound endpoints in the Hub VPC, configure a forwarding rule for grid.local pointing to the on-premises DNS servers, share this rule via AWS RAM with the AWS Organization, and associate it with the spoke VPCs.
AWS spoke resources can resolve grid.local domains by routing queries through the outbound endpoints to the on-premises DNS servers.
This centralizes outbound DNS resolution, reduces endpoint costs by sharing a single outbound rule, and enables bidirectional resolution.

Key Concept

Centralized hybrid DNS architecture requires using Route 53 Resolver inbound and outbound endpoints in a hub VPC to interface with on-premises DNS, using AWS Resource Access Manager to share the outbound forwarding rules with spoke accounts, and utilizing cross-account PHZ association authorizations for internal VPC resolution.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic