Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

A multinational retail company manages its multi-account environment on AWS using AWS Organizations. The central infrastructure is hosted in a Shared Services account, while application workloads run in multiple Spoke accounts. The company recently acquired a regional retail chain that operates an on-premises data center with a local Active Directory domain (corp.acquired.internal). A Transit Gateway connects the central Shared Services VPC, the Spoke VPCs, and the on-premises network via a Direct Connect connection.

The solutions architect must implement a hybrid DNS resolution strategy with the following requirements:
1. Instances in the Spoke VPCs must be able to resolve resources in the corp.acquired.internal domain.
2. On-premises servers must be able to resolve resources in a Route 53 Private Hosted Zone (PHZ) named prod.enterprise.aws, which is hosted in the Shared Services account.

Which TWO configuration steps must the solutions architect perform to meet these requirements? (Select TWO.)

  1. In the Shared Services account, create a Route 53 Resolver outbound endpoint in the Shared Services VPC. Create an outbound Resolver forwarding rule for corp.acquired.internal that targets the on-premises DNS servers, share this rule with the organization using AWS Resource Access Manager (RAM), and associate the rule with the Spoke VPCs.Cevap
  2. Authorize the cross-account association of the prod.enterprise.aws Private Hosted Zone with the Spoke VPCs using the Route 53 API in the Shared Services account, and then associate the Spoke VPCs with the Private Hosted Zone in each respective Spoke account.Cevap
  3. C
    Use AWS Resource Access Manager (RAM) to share the prod.enterprise.aws Private Hosted Zone with the Spoke accounts, and then directly associate the Spoke VPCs to the shared hosted zone via the Route 53 Console.
  4. D
    Create an outbound Route 53 Resolver rule in the Spoke accounts for corp.acquired.internal. Configure the rule to route queries through a Direct Connect Gateway (DXGW) private virtual interface directly to the on-premises DNS servers, bypassing the Transit Gateway.
  5. E
    In the Shared Services account, configure a Route 53 Resolver inbound endpoint in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for prod.enterprise.aws to the IP addresses of the inbound endpoint.

Cevap

The correct architecture requires: (1) Creating an outbound Route 53 Resolver endpoint in the Shared Services VPC, creating a forwarding rule for the acquired domain targeting the on-premises DNS servers, sharing the rule with the organization via AWS RAM, and associating it with the Spoke VPCs. (2) Authorizing the association of the central Private Hosted Zone with the Spoke VPCs using the Route 53 API in the Shared Services account, and then associating the Spoke VPCs with the Private Hosted Zone from each Spoke account.
To satisfy both requirements, the solution must establish cross-account DNS resolution and hybrid resolution. The option to create a Route 53 Resolver outbound endpoint in the Shared Services VPC, define a forwarding rule for the on-premises domain, share it via AWS RAM, and associate it with the Spoke VPCs addresses the first requirement. The option to authorize the cross-account association of the Private Hosted Zone with the Spoke VPCs using the Route 53 API, followed by associating the Spoke VPCs in the Spoke accounts, addresses the second requirement by allowing the Spoke VPCs to query the central Private Hosted Zone.

Adım Adım Çözüm

1
Configure Outbound DNS Resolution for Spoke VPCs
Created a Route 53 Resolver outbound endpoint in the Shared Services VPC, created a forwarding rule for corp.acquired.internal pointing to the on-premises DNS servers, and shared the rule with the Spoke accounts via AWS Resource Access Manager (RAM).
This allows all Spoke VPCs associated with the shared rule to forward DNS queries for the acquired on-premises domain over the Transit Gateway/Direct Connect connection to the on-premises Active Directory DNS servers.
2
Authorize and Establish Cross-Account Private Hosted Zone Association
Authorized the cross-account association of the prod.enterprise.aws Private Hosted Zone (PHZ) with the Spoke VPCs from the Shared Services account, and then associated each Spoke VPC with the PHZ in the Spoke accounts.
This enables instances within the Spoke VPCs to resolve records in the prod.enterprise.aws hosted zone which resides in the Shared Services account.

Anahtar Kavram

Cross-account Private Hosted Zone association and Route 53 Resolver rules shared via RAM are key to multi-account, hybrid DNS architectures.
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru