Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

A financial technology company is setting up a multi-account environment on AWS using AWS Organizations. The company has a Shared Services AWS account containing a central VPC that hosts a Route 53 Private Hosted Zone (PHZ) named `fintech.local`. The company also has multiple production accounts, each containing an application VPC connected to the central VPC via an AWS Transit Gateway. The on-premises data center is connected to the Transit Gateway via AWS Direct Connect. On-premises servers and instances within the application VPCs must be able to resolve domain names in `fintech.local`. Which of the following actions should a solutions architect perform to meet these requirements? (Select TWO.)

  1. Authorize the association of the `fintech.local` private hosted zone with the application VPCs from the Shared Services account, and then associate the private hosted zone with the application VPCs from each production account.Cevap
  2. Create a Route 53 Resolver inbound endpoint in the Shared Services central VPC, and configure the on-premises DNS servers to forward queries for the `fintech.local` domain to the IP addresses of this inbound endpoint.Cevap
  3. C
    Share the `fintech.local` private hosted zone with the production accounts using AWS Resource Access Manager (RAM), and then configure the application VPCs to automatically associate with the shared resource.
  4. D
    Create a Route 53 Resolver outbound endpoint in the Shared Services central VPC, and configure AWS Transit Gateway route tables to forward DNS traffic (destination port 53) directly to the outbound endpoint's IP addresses.
  5. E
    Associate the `fintech.local` private hosted zone with the AWS Transit Gateway itself, which automatically propagates the DNS zones to all attached spoke VPCs and the on-premises Direct Connect gateway.

Cevap

To resolve the private hosted zone from both on-premises and the production VPCs, you must authorize the cross-account association of the private hosted zone with the application VPCs and perform the association, and deploy a Route 53 Resolver inbound endpoint in the central VPC to accept forwarded queries from the on-premises DNS servers.
To allow the application VPCs in the production accounts to resolve names in the Shared Services account's Private Hosted Zone (PHZ), the Solutions Architect must perform a cross-account association. This is done by creating an association authorization in the Shared Services account and then associating the VPC in the production account. To allow the on-premises servers to resolve names in the PHZ, a Route 53 Resolver inbound endpoint must be created in the central VPC, and the on-premises DNS servers must be configured to forward queries for `fintech.local` to the inbound endpoint's IP addresses.

Adım Adım Çözüm

1
Configure cross-account Private Hosted Zone association for the spoke VPCs.
The application VPCs in the production accounts can resolve names within the `fintech.local` zone.
Since the Private Hosted Zone is owned by the Shared Services account, cross-account association must be authorized by the owner and then accepted by the spoke VPC accounts.
2
Deploy Route 53 Resolver inbound endpoints in the central VPC.
An IP address is allocated in the central VPC to receive DNS queries.
On-premises servers need a target IP address within the AWS network to forward DNS queries for resolution by Route 53.
3
Configure on-premises DNS forwarding rules.
Queries for `fintech.local` originating from on-premises are routed to the inbound endpoint.
This establishes the hybrid DNS resolution path from on-premises to AWS.

Anahtar Kavram

Hybrid and multi-account DNS resolution using Route 53 Private Hosted Zones and Resolver endpoints
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru