Q71 — AWS SAA-C03 Ch.10

Question 71 of 100 | ← Chapter 10

Q671. A company is designing a web application on AWS. The application will use a VPN connection between the company's existing data centers and the company's VPCs The company uses Amazon Route 53 as its DNS service.The application must use private DNS records to communicate with the on-premises services from a VPC.Which solution will meet these requirements in the MOST secure manner?

• A. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC ✓
• B. Create a Route 53 Resolver inbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC
• C. Create a Route 53 private hosted zone. Associate the private hosted zone with the VPC
• D. Create a Route 53 public hosted zone. Create a record for each service to allow service communication

Correct Answer: A. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC

Explanation

To meet the requirements of using private DNS records to communicate with on-premises services from a VPC in the most secure manner when using a VPN connection between the company's existing data centers and the company's VPCs, the solution that will best meet these requirements is:A. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.Here's the rationale behind this solution:Option A: Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.By creating a Route 53 Resolver outbound endpoint, you establish a secure connection between your VPC and your on-premises network. This allows DNS resolution requests from your VPC to be sent securely over the VPN connection to your on-premises DNS servers.Creating a resolver rule allows you to configure the DNS names that should be resolved by the Route 53 Resolver outbound endpoint. By associating the resolver rule with the VPC, you ensure that DNS queries from the VPC are routed through the resolver endpoint and resolved by the on-premises DNS servers.Option B: Create a Route 53 Resolver inbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.Creating a Route 53 Resolver inbound endpoint is used when you want to resolve DNS queries from your on-premises network to resources in your VPC. This option is not suitable for the requirement of using private DNS records to communicate with on-premises services from the VPC.Option C: Create a Route 53 private hosted zone. Associate the private hosted zone with the VPC. Creating a Route 53 private hosted zone is used to manage DNS records within your VPC. However, it does not provide a direct solution for securely communicating with on-premises services via VPN. It is primarily used for internal DNS resolution within the VPC.Option D: Create a Route 53 public hosted zone. Create a record for each service to allow service communication.Creating a public hosted zone is used when you want to manage DNS records for publicly accessible resources. This option is not suitable for the requirement of using private DNS records to communicate with on-premises services.Therefore, the most secure solution that meets the requirements is to create a Route 53 Resolver outbound endpoint, create a resolver rule, and associate the resolver rule with the VPC (Option A). This allows DNS resolution requests from the VPC to be securely sent over the VPN connection to the on- premises DNS servers, enabling communication with on-premises services using private DNS records.