Examkin

Soru

Zorluk: KolayMulti-Account and Hybrid DNS Architecture Strategy

A health-tech company has a multi-account AWS environment connected to an on-premises data center via AWS Transit Gateway. The Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) named corp.internal that is associated with the Shared Services VPC. Applications in the Production VPC and servers in the on-premises data center must resolve domain names in corp.internal. Which actions should a Solutions Architect take to enable this DNS resolution? (Select TWO.)

  1. Submit a cross-account private hosted zone association authorization from the Shared Services account for the Production VPC, and then associate the VPC using the Production account's credentials.Cevap
  2. Deploy a Route 53 Resolver inbound endpoint in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for corp.internal to the inbound endpoint IP addresses.Cevap
  3. C
    Utilize AWS Resource Access Manager (RAM) to distribute the corp.internal private hosted zone from the Shared Services account to the Production account.
  4. D
    Deploy a Route 53 Resolver outbound endpoint in the Production VPC, and create a forwarding rule to route queries for corp.internal to the on-premises DNS servers.
  5. E
    Add a route in the Transit Gateway route table that forwards all traffic on port 53 directly to the AWS-provided DNS IP address of the Shared Services VPC.

Cevap

Submit a cross-account private hosted zone association authorization from the Shared Services account for the Production VPC, then associate the VPC using the Production account's credentials, and deploy a Route 53 Resolver inbound endpoint in the Shared Services VPC while configuring the on-premises DNS servers to forward queries to the inbound endpoint IP addresses.
Enabling cross-account resolution of a Private Hosted Zone requires creating an association authorization from the zone owner account and then associating the consumer VPC from its own account. Enabling on-premises resolution of the same private zone requires setting up a Route 53 Resolver inbound endpoint in a VPC associated with the zone and forwarding on-premises DNS queries to the inbound endpoint's IP addresses.

Adım Adım Çözüm

1
Authorize cross-account association of the Private Hosted Zone.
The Production VPC is authorized to associate with the corp.internal Private Hosted Zone hosted in the Shared Services account.
VPCs in other accounts cannot resolve resources in a Private Hosted Zone without a direct VPC association, which requires a cross-account authorization step.
2
Associate the Production VPC with the Private Hosted Zone.
The Production VPC is associated with the corp.internal Private Hosted Zone.
This allows resources in the Production VPC to resolve DNS queries using the Private Hosted Zone's records.
3
Set up a Route 53 Resolver inbound endpoint in the Shared Services VPC.
An inbound endpoint is created with IP addresses in the Shared Services VPC.
This endpoint receives DNS queries from the on-premises DNS servers over the Transit Gateway connection.
4
Configure on-premises forwarders.
On-premises DNS servers are configured to forward corp.internal queries to the inbound endpoint IP addresses.
This ensures queries originating from on-premises for the corp.internal domain are routed to AWS Route 53 Resolver.

Anahtar Kavram

Multi-Account and Hybrid DNS resolution using Route 53 Private Hosted Zones, cross-account associations, and Route 53 Resolver inbound endpoints.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru