Examkin

Question

Difficulty: MediumMulti-Account and Hybrid DNS Architecture Strategy

A health-tech company has established a hybrid, multi-account AWS environment using AWS Organizations. The central network architecture consists of a Shared Services account containing a Transit Gateway and a hub VPC, and multiple application member accounts containing spoke VPCs. The spoke VPCs are attached to the Transit Gateway. The company maintains an on-premises data center connected to the Transit Gateway via an AWS Direct Connect connection. A Route 53 Private Hosted Zone (PHZ) named `corp.healthtech.internal` is hosted in the Shared Services account. The company needs to allow resources in the spoke VPCs and servers in the on-premises data center to resolve domain names in the PHZ. An inbound Route 53 Resolver endpoint is already created in the hub VPC. Which TWO actions must the Solutions Architect perform to implement this DNS resolution strategy? (Select TWO.)

  1. Create VPC association authorizations for each spoke VPC in the Shared Services account, and then associate the spoke VPCs with the Private Hosted Zone from each application member account.Answer
  2. Configure the on-premises DNS forwarders to route DNS queries for `corp.healthtech.internal` to the IP addresses of the Route 53 Resolver inbound endpoint in the hub VPC.Answer
  3. C
    Share the Private Hosted Zone `corp.healthtech.internal` with the AWS Organization using AWS Resource Access Manager (RAM) to automatically associate it with all current and future spoke VPCs.
  4. D
    Configure a Route 53 Resolver outbound endpoint in the hub VPC with a forwarding rule for `corp.healthtech.internal` pointing to the Direct Connect Gateway (DXGW) to route DNS requests.
  5. E
    Associate the Private Hosted Zone directly with the Transit Gateway in the Shared Services account to allow transitive DNS resolution for all attached spoke VPCs.

Answer

The architecture is implemented by creating VPC association authorizations in the Shared Services account and associating the spoke VPCs from their respective application accounts, combined with configuring the on-premises DNS forwarders to point to the inbound Route 53 Resolver endpoint in the hub VPC.
The correct configurations involve performing cross-account Private Hosted Zone (PHZ) association and configuring on-premises DNS forwarding. First, because the PHZ is hosted in the Shared Services account and the spoke VPCs are in different application member accounts, a cross-account association must be established. This requires authorizing the association from the owner account (Shared Services) and then associating the spoke VPCs from the member accounts. Second, for the on-premises servers to resolve domain names in the PHZ over the Direct Connect connection, the on-premises DNS forwarders must target the IP addresses of the inbound Route 53 Resolver endpoint deployed in the hub VPC.

Step-by-Step Solution

1
Authorize and associate the Private Hosted Zone with the spoke VPCs.
The spoke VPCs in the application member accounts are authorized and associated with the Private Hosted Zone hosted in the Shared Services account.
This allows resources inside the spoke VPCs to use their local Route 53 Resolver to resolve names inside the Shared Services Private Hosted Zone.
2
Configure on-premises DNS servers to forward queries to the inbound Route 53 Resolver endpoint.
On-premises servers route queries for `corp.healthtech.internal` to the inbound resolver endpoint in the hub VPC.
This allows the on-premises servers to resolve resources in the private hosted zone using the Direct Connect link.

Key Concept

Cross-account Private Hosted Zone association combined with inbound Route 53 Resolver endpoints for hybrid DNS resolution.
Rate this question

Topics

Multi-Account and Hybrid DNS Architecture Strategy

More questions from this topic