Examkin

Soru

Zorluk: Çok zorMulti-Account and Hybrid DNS Architecture Strategy

A retail-tech enterprise has structured its multi-account environment using AWS Organizations. The network topology includes a central network account (Account A) containing a Shared Services VPC (`Shared-VPC`), which is connected to an on-premises network via AWS Transit Gateway (TGW) and AWS Direct Connect. Account B contains `Core-VPC` and hosts a Route 53 Private Hosted Zone (PHZ) named `core.aws.internal`. Account C contains `App-VPC`. The enterprise requires a hybrid DNS resolution strategy:

1. On-premises client machines must resolve resources in `core.aws.internal` via the Active Directory DNS servers (10.50.0.1010.50.0.10 and 10.50.0.1110.50.0.11).
2. EC2 instances in `Core-VPC` and `App-VPC` must resolve on-premises services in the `.corp.local` domain.

Which actions must a Solutions Architect take to implement this architecture while minimizing administrative overhead? (Select TWO.)

  1. In Account B, submit a cross-account VPC association authorization for `core.aws.internal` to Account A's `Shared-VPC` using the AWS CLI or API. In Account A, accept the association request to allow the central Inbound Resolver endpoint to resolve the private zone for queries coming from on-premises.Cevap
  2. In Account A, create Route 53 Resolver Outbound Endpoints in the `Shared-VPC` and configure an outbound forwarding rule for `.corp.local` pointing to the on-premises DNS servers. Share this rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate the shared rule with the VPCs in Account B and Account C.Cevap
  3. C
    In Account B, associate the private hosted zone `core.aws.internal` directly with the `Shared-VPC` in Account A using the Route 53 console, since cross-account hosted zone associations within the same AWS Organization are automatically authorized.
  4. D
    In Account B, create a Route 53 Resolver Inbound Endpoint in `Core-VPC`. Configure on-premises DNS servers to route queries for `core.aws.internal` via a Direct Connect Gateway (DXGW) attached directly to the `Core-VPC` virtual private gateway, relying on DXGW to transitively route DNS traffic to other VPCs.

Cevap

Authorize and associate the private hosted zone `core.aws.internal` in Account B with Account A's `Shared-VPC` using the AWS CLI or API to allow the central Inbound Resolver to answer queries, and configure a central Outbound Resolver Rule in Account A for `.corp.local` shared via AWS RAM with the consumer VPCs.
The correct implementation requires authorizing a cross-account Private Hosted Zone (PHZ) association via the CLI or API to allow the central Inbound Resolver in Account A to query `core.aws.internal` owned by Account B. Simultaneously, a central Outbound Resolver Endpoint in Account A is created, and the forwarding rules for `.corp.local` are shared with all accounts via AWS Resource Access Manager (RAM), ensuring both inbound and outbound DNS query flows are resolved efficiently with minimal overhead.

Adım Adım Çözüm

1
Authorize cross-account association of the Private Hosted Zone (PHZ) `core.aws.internal` from Account B to Account A's `Shared-VPC` using the `create-vpc-association-authorization` CLI command or API call.
Account A is permitted to associate its VPC with the PHZ owned by Account B.
Route 53 does not support cross-account VPC associations through the AWS Console, requiring API/CLI-based authorization beforehand.
2
Associate the `Shared-VPC` in Account A with the `core.aws.internal` PHZ using the `associate-vpc-with-hosted-zone` command in Account A.
The central Route 53 Resolver Inbound Endpoint in Account A's `Shared-VPC` can resolve names in `core.aws.internal`.
On-premises Active Directory servers query the central Inbound Resolver, which needs local association to query the PHZ database.
3
In Account A, provision Route 53 Resolver Outbound Endpoints in `Shared-VPC` and create a forwarding rule for `.corp.local` directing traffic to the on-premises Active Directory DNS servers.
An outbound resolution path for `.corp.local` is established from Account A.
Enables forwarding of DNS requests destined for the on-premises environment.
4
Share the Outbound Resolver forwarding rule with the AWS Organization via AWS Resource Access Manager (RAM), and associate the shared rule with `Core-VPC` (Account B) and `App-VPC` (Account C).
VPCs in Account B and Account C resolve `.corp.local` queries through the central outbound endpoints.
Minimizes administrative overhead by avoiding the deployment of outbound resolver endpoints in every individual account's VPC.

Anahtar Kavram

Centralized hybrid DNS architecture using Route 53 Resolver endpoints, cross-account Private Hosted Zone association, and AWS RAM rule sharing.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru