Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A healthcare technology company has a multi-account AWS environment managed under AWS Organizations. The architecture consists of a central `Network-Shared` account containing a Hub VPC, which connects to the on-premises datacenter via AWS Direct Connect. Two consumer accounts, `Clinical-Apps` and `Data-Analytics`, contain Spoke VPCs connected to the Hub VPC using an AWS Transit Gateway. The on-premises environment hosts legacy health systems in the `corp.internal` DNS domain. The company has created a Route 53 Private Hosted Zone (PHZ) named `aws.internal` in the `Network-Shared` account.

The company needs to establish a DNS resolution strategy that meets the following requirements:
- On-premises servers must be able to resolve resources within `aws.internal`.
- EC2 instances in the Spoke VPCs must be able to resolve names in the on-premises `corp.internal` domain.

Which TWO actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. In the `Network-Shared` account, create a Route 53 Resolver inbound endpoint in the Hub VPC. Configure the on-premises DNS servers to forward queries for the `aws.internal` domain to the IP addresses of this inbound endpoint.Answer
  2. In the `Network-Shared` account, create a Route 53 Resolver outbound endpoint in the Hub VPC. Create a Resolver forwarding rule for the `corp.internal` domain pointing to the on-premises DNS servers. Share the rule with the other accounts using AWS Resource Access Manager (RAM), and associate the rule with the Spoke VPCs in the `Clinical-Apps` and `Data-Analytics` accounts.Answer
  3. C
    Use AWS Resource Access Manager (RAM) to share the `aws.internal` Private Hosted Zone from the `Network-Shared` account to the consumer accounts, then associate the shared hosted zone with the Spoke VPCs in the `Clinical-Apps` and `Data-Analytics` accounts.
  4. D
    Create a Route 53 Resolver outbound endpoint in each Spoke VPC. Configure the outbound endpoints to forward queries for `aws.internal` to the AWS Transit Gateway, and configure a static route in the Transit Gateway to redirect these queries to the Hub VPC's Route 53 Resolver.
  5. E
    In the `Network-Shared` account, create a Route 53 Resolver inbound endpoint in the Hub VPC. Associate the `aws.internal` Private Hosted Zone with the Direct Connect Gateway (DXGW) to allow the on-premises DNS servers to resolve records transitively without configuring forwarders.

Answer

To establish the DNS resolution strategy, the solutions architect must configure a Route 53 Resolver inbound endpoint in the Hub VPC to receive queries for `aws.internal` forwarded from the on-premises DNS servers. Additionally, the architect must configure a Route 53 Resolver outbound endpoint in the Hub VPC along with a forwarding rule for `corp.internal` pointing to the on-premises DNS servers, share this rule with the consumer accounts using AWS Resource Access Manager (RAM), and associate the rule with the Spoke VPCs.
The correct architecture requires a Route 53 Resolver inbound endpoint in the Hub VPC to process incoming queries from the on-premises DNS servers for `aws.internal`. For outbound resolution, a Route 53 Resolver outbound endpoint in the Hub VPC combined with a forwarding rule for `corp.internal` is shared with the spoke accounts via AWS Resource Access Manager (RAM). This allows instances in the Spoke VPCs to resolve the on-premises domain names through the shared rule association.

Step-by-Step Solution

1
Set up inbound DNS resolution from on-premises to AWS.
On-premises servers can resolve records in `aws.internal`.
By creating a Route 53 Resolver inbound endpoint in the Hub VPC, the AWS side exposes IP addresses. The on-premises DNS servers can then forward queries for `aws.internal` to these IP addresses.
2
Set up outbound DNS resolution from AWS to on-premises.
Hub VPC is capable of forwarding queries for `corp.internal` to on-premises.
Creating a Route 53 Resolver outbound endpoint in the Hub VPC allows AWS to forward queries to external DNS servers. A forwarding rule defines that queries for `corp.internal` must go to the on-premises DNS server IPs.
3
Extend outbound DNS resolution to the Spoke VPCs in the consumer accounts.
Spoke VPCs can resolve records in `corp.internal`.
Sharing the Resolver forwarding rule using AWS Resource Access Manager (RAM) allows the `Clinical-Apps` and `Data-Analytics` accounts to associate their Spoke VPCs with the rule, enabling them to use the Hub VPC's outbound endpoint.

Key Concept

Multi-Account Hybrid DNS Resolution using Route 53 Resolver Endpoints and Shared Rules
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic