Examkin

Question

Difficulty: HardMulti-Account and Hybrid DNS Architecture Strategy

A health-tech corporation is designing a hybrid DNS architecture across its on-premises data centers and a multi-account AWS environment managed via AWS Organizations. The AWS footprint consists of a central Network Services VPC hosting inbound and outbound Route 53 Resolver endpoints, and multiple Application VPCs in separate member accounts. A Route 53 Private Hosted Zone (PHZ) for `prod.healthtech.internal` is created in a Shared Services account. The on-premises DNS servers must resolve `prod.healthtech.internal`, and the Application VPCs must resolve the on-premises domain `corp.healthtech.local`. Connectivity is established using AWS Transit Gateway.

Which TWO steps are required to achieve secure, minimal-latency DNS resolution across this hybrid environment? (Select TWO.)

  1. Authorize the association of the Route 53 Private Hosted Zone with the Application VPCs and the Network Services VPC from the Shared Services account, and then associate the VPCs with the Private Hosted Zone from their respective member accounts.Answer
  2. Create Route 53 Resolver outbound rules for the on-premises domain in the Network Services account, share the rules with the AWS Organization using AWS Resource Access Manager (RAM), associate them with all VPCs, and configure on-premises conditional forwarders pointing to the inbound resolver endpoint IP addresses.Answer
  3. C
    Share the Route 53 Private Hosted Zone with the AWS Organization using AWS Resource Access Manager (RAM) to allow all member account VPCs to automatically resolve the zone without manual association authorizations.
  4. D
    Configure the AWS Transit Gateway route tables to route all DNS traffic targeting the link-local DNS IP address (169.254.169.253169.254.169.253) from the on-premises network to the Network Services VPC to bypass the need for provisioning inbound resolver endpoints.

Answer

Authorize the association of the Route 53 Private Hosted Zone with the Application VPCs and the Network Services VPC from the Shared Services account, then associate the VPCs with the Private Hosted Zone from their respective accounts; create Route 53 Resolver outbound rules in the Network Services account, share them via AWS Resource Access Manager, associate them with all VPCs, and configure on-premises DNS to forward to the inbound resolver endpoints.
To implement hybrid and cross-account DNS, you must establish trust between the accounts owning the VPCs and the account owning the Private Hosted Zone. This is achieved by authorizing the association from the owner account and then submitting the association request from the target accounts. Additionally, to route queries between on-premises and AWS, Route 53 Resolver inbound endpoints receive on-premises queries, and outbound rules shared via AWS RAM route VPC queries back to the on-premises servers.

Step-by-Step Solution

1
Authorize and associate the Private Hosted Zone across AWS accounts.
The Application VPCs and the Network Services VPC can now resolve names in the `prod.healthtech.internal` zone.
Because Private Hosted Zones cannot be shared via AWS RAM, you must authorize and accept associations across account boundaries using the Route 53 APIs.
2
Configure hybrid outbound DNS forwarding via Route 53 Resolver outbound rules.
VPCs can resolve the `corp.healthtech.local` domain hosted on-premises.
Creating outbound rules in the central network account and sharing them via RAM allows spoke VPCs to route on-premises DNS queries to the outbound endpoints.
3
Configure hybrid inbound DNS forwarding from the on-premises DNS servers.
On-premises clients can resolve names in the `prod.healthtech.internal` zone.
On-premises servers forward conditional queries to the Route 53 Resolver inbound endpoint IP addresses, which are reachable over the Transit Gateway connection.

Key Concept

Multi-Account and Hybrid DNS Architecture Strategy using Route 53 Resolver endpoints and cross-account Private Hosted Zone association.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic