Examkin

Soru

Zorluk: OrtaMulti-Account and Hybrid DNS Architecture Strategy

A retail corporation manages its AWS environment using AWS Organizations. A central network account contains a Hub VPC, which is connected to several Spoke VPCs in different member accounts via an AWS Transit Gateway. The company has a Route 53 Private Hosted Zone (PHZ) named retail.internal hosted in the central network account. An on-premises datacenter is connected to the Hub VPC via AWS Direct Connect. The security team requires that all DNS queries from the on-premises datacenter for retail.internal must be resolved securely, and resources in the Spoke VPCs must also resolve retail.internal hostnames. Which combination of steps should the solutions architect take to meet these requirements?

  1. Create Route 53 Resolver inbound endpoints in the Hub VPC and configure on-premises DNS servers to forward queries for retail.internal to the inbound endpoint IP addresses. Authorize the association of the retail.internal private hosted zone with the Spoke VPCs from the central network account using the AWS CLI or SDK, and then associate the Spoke VPCs with the hosted zone from each member account.Cevap
  2. B
    Create Route 53 Resolver inbound endpoints in the Hub VPC and configure on-premises DNS servers to forward queries for retail.internal to the inbound endpoint IP addresses. Share the retail.internal private hosted zone with the member accounts using AWS Resource Access Manager (RAM), and then associate the zone with the Spoke VPCs in the member accounts.
  3. C
    Create Route 53 Resolver outbound endpoints in the Hub VPC. Configure the AWS Direct Connect Gateway to route DNS queries for retail.internal directly to these outbound endpoints, and associate the Spoke VPCs with the private hosted zone using AWS Organizations Service Control Policies (SCPs).
  4. D
    Create Route 53 Resolver inbound endpoints in the Hub VPC and configure on-premises DNS servers to forward queries to these endpoints. Associate the Spoke VPCs with the private hosted zone directly using the AWS Management Console under the central network account without cross-account authorizations.

Cevap

Create Route 53 Resolver inbound endpoints in the Hub VPC and configure on-premises DNS servers to forward queries for retail.internal to the inbound endpoint IP addresses. Authorize the association of the retail.internal private hosted zone with the Spoke VPCs from the central network account using the AWS CLI or SDK, and then associate the Spoke VPCs with the hosted zone from each member account.
The correct solution involves setting up Route 53 Resolver inbound endpoints in the Hub VPC, which can be reached from on-premises over Direct Connect. For cross-account DNS resolution in Spoke VPCs, the retail.internal Private Hosted Zone must be associated with the Spoke VPCs. Because these VPCs are in different AWS accounts, the central network account must authorize the association using the AWS CLI, SDK, or API, and then each member account must associate their VPC with the hosted zone.

Adım Adım Çözüm

1
Configure DNS resolution from on-premises to AWS.
Create Route 53 Resolver inbound endpoints in the Hub VPC. Configure on-premises DNS servers to forward queries for retail.internal to the inbound endpoint IP addresses.
This allows on-premises DNS requests to reach Route 53 over the Direct Connect connection.
2
Authorize cross-account Private Hosted Zone association.
Run the create-vpc-association-authorization command using the AWS CLI/SDK from the central network account (owner of the PHZ) for each Spoke VPC in the member accounts.
Before a Private Hosted Zone can be associated with a VPC in a different AWS account, the owner of the PHZ must explicitly authorize the association.
3
Associate Spoke VPCs with the Private Hosted Zone.
Run the associate-vpc-with-hosted-zone command using the AWS CLI/SDK from the member accounts for each Spoke VPC.
The association must be accepted/created by the account that owns the target VPC to complete the setup.

Anahtar Kavram

Cross-account Private Hosted Zone association and Route 53 Resolver inbound endpoints
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account and Hybrid DNS Architecture Strategy

Bu konudan daha fazla soru