AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Creating a single pair of Route 53 Resolver endpoints in a central (shared services) VPC satisfies all constraints. The inbound endpoint exposes two IP addresses that are reachable from the data-center over Direct Connect; on-premises DNS conditional forwarders send queries for every aws.example.com sub-domain to those addresses, giving on-premises clients access to the VPCs' private hosted zones without relying on VPC peering. An outbound endpoint in the same VPC is configured with a conditional forwarding rule for corp.example.com that targets the on-premises DNS servers. Because a Route 53 Resolver forwarding rule can be shared with other VPCs through AWS Resource Access Manager, each new application VPC gains corp.example.com resolution simply by associating the shared rule-no additional endpoints or peering paths are required. Security groups on the endpoints allow traffic only from the known on-premises resolver IPs, so the configuration is not an open recursive resolver. The other options either rely on the Amazon-provided ".2" resolver that cannot be reached from on-premises, require an endpoint in every VPC (high operational overhead), misuse DNS Firewall instead of rule sharing, or place corp.example.com inside a private hosted zone, which would fragment the namespace and break authoritative resolution from on-premises.