AWS Certified Solutions Architect Professional SAP-C02 Practice Question
A global manufacturing company is migrating a complex, three-tier application from its on-premises data center to a new VPC in AWS. The migration will occur in phases over several months. During the transition, on-premises systems and new AWS resources, connected via AWS Direct Connect, must be able to resolve internal DNS hostnames in both environments.
The on-premises data center uses its own DNS servers for the internal domain corp.local. The new AWS resources will be part of the aws.corp.local subdomain, managed within a Route 53 private hosted zone associated with the VPC. The company's architecture team requires a solution that allows EC2 instances in the VPC to resolve on-premises hostnames (e.g., database.corp.local) and, conversely, allows on-premises servers to resolve EC2 instance hostnames (e.g., app-server.aws.corp.local). The solution must be scalable and highly available without requiring the replacement of the existing on-premises DNS servers.
Which solution meets these requirements for bidirectional DNS resolution?
Create a Route 53 Resolver inbound endpoint in the VPC and create a forwarding rule for the corp.local domain to target the on-premises DNS servers. Create a Route 53 Resolver outbound endpoint and configure on-premises DNS servers to forward queries for the aws.corp.local domain to the IP addresses of the outbound endpoint.
Launch two EC2 instances in different Availability Zones and install DNS forwarding software. Configure the VPC's DHCP options set to use these instances as DNS servers. On these instances, configure forwarding for the corp.local domain to on-premises servers and for the aws.corp.local domain to the Route 53 private hosted zone.
Create a Route 53 Resolver outbound endpoint in the VPC and configure a forwarding rule for the corp.local domain to target the on-premises DNS servers. Create a Route 53 Resolver inbound endpoint in the VPC. Configure the on-premises DNS servers to conditionally forward queries for the aws.corp.local domain to the IP addresses of the inbound endpoint.
Create a Route 53 Resolver outbound endpoint in the VPC. Create a forwarding rule to forward any queries for the corp.local domain to the on-premises DNS servers. Configure the on-premises DNS servers to forward queries for aws.corp.local to the IP address of the outbound endpoint.
The correct solution for enabling bidirectional DNS resolution in a hybrid environment is to use both inbound and outbound Route 53 Resolver endpoints.
To resolve on-premises domains from AWS (e.g., database.corp.local): An outbound endpoint is created in the VPC. A forwarding rule is associated with it, instructing the resolver to forward queries for the corp.local domain to the on-premises DNS servers. This handles the egress query flow from the VPC.
To resolve AWS domains from on-premises (e.g., app-server.aws.corp.local): An inbound endpoint is created in the VPC. This provides IP addresses that act as DNS targets. The on-premises DNS servers are then configured with a conditional forwarder for the aws.corp.local domain, pointing to the IP addresses of the inbound endpoint. This handles the ingress query flow into the VPC.
Incorrect options explained:
An option that swaps the roles of the endpoints is incorrect. Outbound endpoints send queries out from a VPC and do not have IP addresses that can be targeted by external forwarders. Inbound endpoints receive queries into a VPC.
Using only an outbound endpoint is insufficient because it only facilitates one-way resolution (from VPC to on-premises) and does not provide a mechanism for on-premises servers to send queries to Route 53.
Launching EC2 instances to run DNS forwarding software is an outdated pattern that adds operational overhead and complexity. The AWS-native, managed Route 53 Resolver service is the modern, highly available, and scalable solution for this use case, making it the superior choice.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the function of a Route 53 Resolver outbound endpoint?
Open an interactive chat with Bash
How does a Route 53 Resolver inbound endpoint work?
Open an interactive chat with Bash
Why is using Route 53 Resolver endpoints better than running DNS forwarding on EC2 instances?
Open an interactive chat with Bash
AWS Certified Solutions Architect Professional SAP-C02
Accelerate Workload Migration and Modernization
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access