Examkin

Soru

Zorluk: ZorMulti-Account and Hybrid DNS Architecture Strategy

A global energy enterprise is migrating its smart grid monitoring system to a multi-account AWS environment managed under AWS Organizations. The architecture consists of a central Shared Services VPC (10.10.0.0/16) connected to an on-premises datacenter (172.16.0.0/12) via AWS Direct Connect and AWS Transit Gateway. Multiple spoke VPCs in production accounts (using the range 10.50.0.0/16) are attached to the same Transit Gateway. A Route 53 Private Hosted Zone (PHZ) for grid.internal is created in the Shared Services account. The on-premises DNS servers (172.16.1.10 and 172.16.1.11) host the zone corp.internal. Spoke VPC instances must resolve domains in both grid.internal and corp.internal, and on-premises hosts must resolve domains in grid.internal. Which combination of actions should the Solutions Architect take to implement this DNS architecture? (Select TWO.)

  1. In the Shared Services account, authorize the association of the grid.internal private hosted zone with each spoke VPC. In each production account, accept the association using the AWS CLI or Route 53 API to link the spoke VPCs to the private hosted zone.Cevap
  2. In the Shared Services account, create a Route 53 Resolver Outbound Endpoint in the central VPC, and create a forwarding rule for corp.internal pointing to the on-premises DNS servers. Share this rule with the production accounts using AWS Resource Access Manager (RAM), and associate it with the spoke VPCs.Cevap
  3. C
    Use AWS Resource Access Manager (RAM) to share the grid.internal private hosted zone directly from the Shared Services account to the production accounts, and associate it with the spoke VPCs.
  4. D
    Configure the Transit Gateway to route DNS traffic (UDP/TCP port 53) destined for the Route 53 Resolver link-local IP address (169.254.169.253) from the spoke VPCs directly to the Shared Services VPC over a Direct Connect Gateway.
  5. E
    Create a Route 53 Resolver Inbound Endpoint in each production account spoke VPC, and configure a forwarding rule for corp.internal pointing to the Direct Connect Gateway's public virtual interface.

Cevap

The correct architecture requires authorizing the cross-account association of the private hosted zone with the spoke VPCs using the Route 53 API, and sharing a centralized Route 53 Resolver Outbound Endpoint forwarding rule using AWS Resource Access Manager (RAM).
To establish hybrid DNS resolution, a combination of cross-account Private Hosted Zone (PHZ) association and shared Route 53 Resolver rules is required. The option to authorize the association of the grid.internal PHZ with each spoke VPC followed by accepting the association in the production accounts correctly handles name resolution for the AWS-hosted zone. Additionally, the option to create a Route 53 Resolver Outbound Endpoint in the central VPC, create a forwarding rule for corp.internal, and share it with production accounts using AWS RAM provides a cost-effective and scalable mechanism for spoke VPCs to resolve on-premises domain names.

Adım Adım Çözüm

1
Authorize the association of the grid.internal Private Hosted Zone (PHZ) in the Shared Services account with the spoke VPCs in the production accounts.
The spoke VPCs are permitted to link to the PHZ managed in the Shared Services account.
Route 53 Private Hosted Zones cannot be shared directly via AWS Resource Access Manager (RAM). Cross-account VPC association requires an explicit authorization step from the zone owner.
2
Accept the association in each production account for their respective spoke VPCs using the Route 53 API or CLI.
Spoke VPCs can now resolve grid.internal domains directly using the Route 53 Resolver.
The association must be accepted from the target account's context to complete the relationship.
3
Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and configure a forwarding rule for corp.internal pointing to the on-premises DNS IPs.
A centralized mechanism is established to route queries for corp.internal to the on-premises environment.
This centralizes outbound DNS resolution and avoids the cost of deploying outbound endpoints in every individual spoke VPC.
4
Share the Route 53 Resolver forwarding rule via AWS Resource Access Manager (RAM) to the production accounts and associate the rule with the spoke VPCs.
Spoke VPCs can now resolve corp.internal domains by forwarding queries through the shared outbound endpoint in the Shared Services VPC.
Sharing rules via RAM allows spoke VPCs to utilize the central outbound resolver endpoints transitively over the Transit Gateway.

Anahtar Kavram

Hybrid and multi-account DNS integration utilizing Route 53 Resolver endpoints, cross-account Private Hosted Zone association, and AWS Resource Access Manager (RAM) rule sharing.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru