Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

An automotive manufacturing corporation uses AWS Organizations to manage its multi-account environment. A central Transit Gateway in a dedicated Network Services account connects the on-premises factory network (domain `factory.internal`) and multiple Line-of-Business (LOB) VPCs in separate member accounts. A Private Hosted Zone (PHZ) named `corp.internal` is hosted in a Shared Services account. The corporation requires a hybrid DNS strategy that allows systems in the LOB VPCs to resolve resources in the `factory.internal` domain, systems in the LOB VPCs to resolve resources in the `corp.internal` PHZ, and on-premises factory systems to resolve resources in the `corp.internal` PHZ. Which configuration meets these requirements with the least administrative effort and cost?

  1. A
    Create Route 53 Resolver inbound endpoints in the Network Services VPC and configure on-premises DNS servers to forward queries for `corp.internal` to the inbound endpoints. Associate the `corp.internal` PHZ with the Shared Services VPC. Rely on Transit Gateway routing to transitively resolve DNS queries for `corp.internal` from the LOB VPCs through the Shared Services VPC. Create a Route 53 Resolver outbound endpoint in the Network Services VPC, configure an outbound rule for `factory.internal` pointing to on-premises DNS servers, share the rule via AWS Resource Access Manager (RAM), and associate it with all LOB VPCs.
  2. Create Route 53 Resolver inbound endpoints in the Network Services VPC. Configure on-premises DNS servers to forward queries for `corp.internal` to the inbound endpoint IP addresses. Authorize and associate the `corp.internal` PHZ in the Shared Services account with the LOB VPCs. Create a Route 53 Resolver outbound endpoint in the Network Services VPC, configure an outbound rule for `factory.internal` pointing to on-premises DNS servers, share the rule via AWS Resource Access Manager (RAM), and associate it with all LOB VPCs.Cevap
  3. C
    Create a custom DHCP options set containing the IP addresses of the on-premises DNS servers, and assign it to all LOB VPCs. Configure the on-premises DNS servers to forward queries for `corp.internal` to a Direct Connect Gateway. Associate the `corp.internal` PHZ with the Shared Services VPC and configure a Direct Connect Gateway virtual interface to allow transitive routing of DNS queries between the LOB VPCs and the Shared Services VPC.
  4. D
    Create Route 53 Resolver inbound and outbound endpoints in each LOB VPC. Associate the `corp.internal` PHZ with each LOB VPC. Create outbound resolver rules in each LOB VPC pointing to the Shared Services VPC's Route 53 Resolver default IP address (10.0.0.210.0.0.2) for resolving `corp.internal`, and create separate outbound rules in each VPC pointing to the on-premises DNS servers for resolving `factory.internal`.

Cevap

The correct configuration is to create Route 53 Resolver inbound endpoints in the Network Services VPC for on-premises resolution, authorize and associate the `corp.internal` Private Hosted Zone with the Line-of-Business VPCs across accounts, and create a Route 53 Resolver outbound endpoint in the Network Services VPC with a shared outbound rule for `factory.internal`.
The correct configuration leverages Route 53 Resolver inbound endpoints to allow on-premises systems to resolve AWS-hosted resources. Since Route 53 Private Hosted Zones (PHZs) are not automatically transitively accessible over Transit Gateway, they must be associated with each VPC that needs to resolve them. Using a centralized Route 53 Resolver outbound endpoint in the Network Services VPC, coupled with outbound rules shared via AWS Resource Access Manager (RAM), allows all LOB VPCs to resolve on-premises names with minimal configuration and cost.

Adım Adım Çözüm

1
Enable on-premises resolution of AWS-hosted resources by creating Route 53 Resolver inbound endpoints.
On-premises DNS servers can forward queries for the `corp.internal` zone to the inbound endpoint IP addresses.
Inbound endpoints act as the entry point for DNS queries originating from outside the AWS network.
2
Configure cross-account Private Hosted Zone (PHZ) association for the Line-of-Business (LOB) VPCs.
The LOB VPCs can directly resolve names in `corp.internal` using local VPC resolver endpoints.
VPC DNS resolution is isolated; a PHZ must be explicitly associated with each VPC that needs to resolve its records.
3
Deploy a central Route 53 Resolver outbound endpoint and configure outbound forwarding rules.
An outbound rule for `factory.internal` is shared via AWS Resource Access Manager (RAM) and associated with the LOB VPCs.
Sharing a single set of outbound rules from a centralized network account reduces endpoint costs and simplifies administration.

Anahtar Kavram

Centralized hybrid DNS architecture using Route 53 Resolver endpoints and cross-account Private Hosted Zone association.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru