Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

An international logistics enterprise manages its multi-account AWS environment using AWS Organizations. A central Shared Services VPC in Account A hosts shared utilities and is connected to the on-premises data center via AWS Direct Connect and an AWS Transit Gateway. A Private Hosted Zone (PHZ) for ops.infra is created in Account A. Application VPCs in Account B need to resolve resources in the ops.infra domain and also resolve hostnames in the on-premises domain corp.local. Which TWO configurations are required to meet these DNS resolution requirements? (Select TWO.)

  1. Authorize the association of the Private Hosted Zone ops.infra with the application VPCs in Account B by executing the create-vpc-association-authorization command in Account A, and then complete the association by executing the associate-vpc-with-hosted-zone command in Account B.Answer
  2. Create a Route 53 Resolver outbound endpoint in the Shared Services VPC of Account A, configure a forwarding rule for the domain corp.local pointing to the on-premises DNS servers, and share the rule with Account B using AWS Resource Access Manager (RAM). In Account B, associate the shared rule with the application VPCs.Answer
  3. C
    Use AWS Resource Access Manager (RAM) to share the ops.infra Private Hosted Zone from Account A directly with the AWS Organization, and then use the Route 53 console in Account B to associate the shared zone with the application VPCs.
  4. D
    Configure static route table entries in the application VPCs of Account B that route DNS traffic (destination port 53) to the Direct Connect Gateway (DXGW) transit virtual interface, bypassing Route 53 Resolver endpoints.
  5. E
    Configure a Route 53 Resolver outbound endpoint in the application VPCs of Account B, and create an outbound resolver rule for ops.infra pointing to the inbound endpoint IP addresses in Account A's Shared Services VPC.

Answer

Authorize the cross-account association of the Private Hosted Zone from the owner account and complete it from the consumer account, while using Route 53 Resolver outbound endpoints and AWS RAM to share forwarding rules for the on-premises domain.
The correct steps require establishing cross-account Private Hosted Zone (PHZ) association and sharing Route 53 Resolver forwarding rules. To resolve the shared domain, which is a PHZ in Account A, from Account B, you must first authorize the cross-account association from Account A using the create-vpc-association-authorization API, and then accept the association in Account B using the associate-vpc-with-hosted-zone API. To resolve the on-premises domain, a central Route 53 Resolver outbound endpoint should be created in the Shared Services VPC in Account A, along with a forwarding rule pointing to the on-premises DNS servers. This forwarding rule must be shared with Account B via AWS Resource Access Manager (RAM) and associated with the application VPCs.

Step-by-Step Solution

1
Authorize the cross-account Private Hosted Zone association.
The owner of the Private Hosted Zone (Account A) authorizes the consumer VPCs (Account B) to associate with the zone using the create-vpc-association-authorization command.
AWS security boundaries require explicit authorization before a Private Hosted Zone can be associated with a VPC belonging to a different AWS account.
2
Complete the VPC association in the consumer account.
The owner of the consumer VPCs (Account B) associates the VPCs with the Private Hosted Zone hosted in Account A using the associate-vpc-with-hosted-zone command.
This allows resources inside the application VPCs to directly resolve internal resource hostnames in the shared zone without routing queries through resolver endpoints.
3
Deploy Resolver endpoints and share the forwarding rule.
A Route 53 Resolver outbound endpoint is created in Account A's Shared Services VPC. A forwarding rule for the on-premises domain is configured and shared with Account B using AWS Resource Access Manager (RAM). The rule is then associated with the application VPCs.
Sharing the central forwarding rule allows the application VPCs in Account B to utilize the shared services infrastructure to resolve on-premises hostnames over Direct Connect.

Key Concept

Cross-account Private Hosted Zone association and Route 53 Resolver rule sharing via AWS Resource Access Manager in hybrid networks.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic