Examkin

Question

Difficulty: HardAmazon Route 53 DNS Configuration and Routing Policies

A health-tech company hosts its patient record access portal on the apex domain (`patientportal.com`). The company must comply with strict data residency regulations: all web traffic originating from the European Union (EU) must be directed to an Application Load Balancer (ALB) deployed in the `eu-west-1` Region, while all other global traffic must be routed to a separate ALB deployed in the `us-east-1` Region. A SysOps administrator is configuring Amazon Route 53 to implement this routing logic.

Which two Route 53 record configurations must the administrator implement to meet these compliance requirements? (Select TWO.)

  1. Create an Alias record for the apex domain (`patientportal.com`) pointing to the `eu-west-1` ALB, using a Geolocation routing policy with the location set to Europe.Answer
  2. B
    Create a CNAME record for the apex domain (`patientportal.com`) pointing to the DNS name of the `eu-west-1` ALB, using a Geolocation routing policy with the location set to Europe.
  3. C
    Create an Alias record for the apex domain (`patientportal.com`) pointing to the `us-east-1` ALB, using a Geolocation routing policy with the location set to United States.
  4. Create an Alias record for the apex domain (`patientportal.com`) pointing to the `us-east-1` ALB, using a Geolocation routing policy with the location set to Default.Answer
  5. E
    Create a CNAME record for the apex domain (`patientportal.com`) pointing to the DNS name of the `us-east-1` ALB, using a Geolocation routing policy with the location set to Default.

Answer

Create an Alias record for the apex domain pointing to the `eu-west-1` ALB with a Geolocation routing policy set to Europe, and create another Alias record for the apex domain pointing to the `us-east-1` ALB with a Geolocation routing policy set to Default.
To route traffic for the zone apex (`patientportal.com`), only Alias records can be used. DNS standards do not permit CNAME records at the zone apex because they would conflict with the mandatory SOA and NS records. To satisfy geolocation routing requirements, one record must explicitly map the Europe location to the `eu-west-1` ALB. A second record must map the Default location to the `us-east-1` ALB. The Default location is required because Route 53 does not automatically fallback to another record if a geolocation query comes from an unmapped region (e.g., Asia or South America). Without the Default record, queries from these unmapped regions would fail to resolve.

Step-by-Step Solution

1
Identify DNS constraints at the zone apex.
Determine that CNAME records cannot coexist with SOA and NS records at the zone apex (`patientportal.com`), meaning only Alias records are valid.
DNS standard protocols forbid CNAME records at the zone apex. Route 53 Alias records resolve this by dynamically resolving to the target AWS resources.
2
Define the geolocation routing rule for the compliance-restricted region (EU).
Configure a Geolocation routing policy pointing to the `eu-west-1` ALB with the location set to Europe.
This guarantees that users within the EU are directed to the regional ALB to fulfill data residency compliance.
3
Configure a fallback rule for all other global locations.
Configure a Geolocation routing policy pointing to the `us-east-1` ALB with the location set to Default.
Without a Default record, any DNS queries coming from non-EU locations not explicitly mapped (e.g., Asia or South America) will receive a DNS resolution failure.

Key Concept

Amazon Route 53 Geolocation routing policy and zone apex record restrictions
Rate this question

Topics

Amazon Route 53 DNS Configuration and Routing Policies

More questions from this topic