Examkin

Soru

Zorluk: ZorMulti-Account and Hybrid DNS Architecture Strategy

A multinational insurance group uses AWS Organizations to manage a multi-account environment. The core network topology consists of a central Hub VPC in a dedicated Network account and multiple spoke VPCs in separate member accounts, all interconnected using an AWS Transit Gateway. The company also maintains a corporate on-premises data center connected to the Hub VPC via AWS Direct Connect. A Private Hosted Zone (PHZ) named insurance.internal is hosted in a Shared Services account.

The enterprise requires a hybrid DNS resolution strategy where workloads in the on-premises data center must resolve hosts in the insurance.internal zone, and workloads in the spoke VPCs must resolve hosts in the insurance.internal zone as well as on-premises DNS names ending in corp.insurance. Inbound and outbound DNS traffic must be centralized through the Hub VPC to optimize cost and enforce network security policies.

Which combination of actions must a solutions architect take to meet these requirements? (Select TWO.)

  1. In the Shared Services account, authorize the association of the Private Hosted Zone with the Hub VPC and spoke VPCs. In the Hub and spoke accounts, associate the VPCs with the Private Hosted Zone.Cevap
  2. Create Route 53 Resolver inbound endpoints and outbound endpoints in the Hub VPC. Create a Route 53 Resolver forwarding rule for the corp.insurance domain pointing to the on-premises DNS servers, and associate this rule with the Hub VPC and all spoke VPCs.Cevap
  3. C
    Use AWS Resource Access Manager (RAM) in the Shared Services account to share the insurance.internal Private Hosted Zone with the AWS Organization, and associate the shared resource with the spoke VPCs.
  4. D
    Create a Route 53 Resolver forwarding rule for insurance.internal pointing to the inbound endpoint IP addresses in the Hub VPC, and associate this rule with the spoke VPCs.
  5. E
    Configure the on-premises DNS servers to route queries for insurance.internal directly to the Transit Gateway IP address, and configure Transit Gateway route tables to route DNS queries to the spoke VPCs.

Cevap

The correct actions are to authorize and associate the Private Hosted Zone with the Hub and spoke VPCs, and to configure Route 53 Resolver inbound/outbound endpoints in the Hub VPC with a forwarding rule for the on-premises domain associated with the VPCs.
To achieve hybrid DNS resolution, a Route 53 Private Hosted Zone (PHZ) in a shared account must be associated with the consumer VPCs. Because the PHZ resides in a separate Shared Services account, the solutions architect must use cross-account authorization. Centralizing DNS resolution in the Hub VPC requires Route 53 Resolver inbound endpoints for on-premises clients to target, and outbound endpoints to forward AWS queries to on-premises servers based on a forwarding rule associated with all participating VPCs.

Adım Adım Çözüm

1
Establish cross-account Private Hosted Zone resolution for all VPCs.
The Hub VPC and all spoke VPCs are associated with the insurance.internal Private Hosted Zone.
Since the Private Hosted Zone is in a separate Shared Services account, it must be explicitly authorized and associated with the target VPCs across accounts to allow native DNS resolution.
2
Deploy centralized Route 53 Resolver endpoints.
Inbound and outbound resolver endpoints are provisioned in the Hub VPC.
Inbound endpoints provide IP addresses for on-premises DNS forwarders, and outbound endpoints allow forwarding queries from AWS to the corporate data center.
3
Configure DNS forwarding for the on-premises domain.
A Route 53 Resolver rule is created for corp.insurance and associated with the Hub and spoke VPCs.
Associating the forwarding rule ensures that any query for the on-premises domain from any VPC is directed to the outbound endpoints, which route them to the on-premises DNS servers.

Anahtar Kavram

Centralized and cross-account hybrid DNS resolution using Route 53 Resolver endpoints and cross-account Private Hosted Zone association.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru