Q22 — AWS SAA-C03 Ch.16

Question 22 of 100 | ← Chapter 16

Q1222. Acompany hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants the application be accessible only from inside the VPC that hosts the ALB. The company creates an alias record of example.com in Amazon Route 53. The DNS record for the application must be resolvable only in the VPC where the application runs.Which solution will meet these requirements?

• A. Use an internet-facing ALB. Create a Route 53 public hosted zone for the application DNS name
• B. Use an internal ALB. Create a Route 53 public hosted zone for the application DNS name.
• C. Use an internet-facing ALB. Create a Route 53 private hosted zone for the application DNS name.
• D. Use an internal ALB. Create a Route 53 private hosted zone for the application DNS name. ✓

Correct Answer: D. Use an internal ALB. Create a Route 53 private hosted zone for the application DNS name.

Explanation

To meet the requirements of making the application accessible only from inside the VPC and ensuring the DNS record is resolvable only within that VPC, let's analyze the options:Key Requirements:Application Accessibility: The application should only be accessible from inside the VPC. DNS Resolution: The DNS record (example.com) should only be resolvable within the VPC.Solution Analysis:ALB Type:An internet-facing ALB is accessible from the public internet, which violates the requirement of restricting access to the VPC only.An internal ALB is only accessible within the VPC (or via VPC peering, Direct Connect, etc.), which meets the accessibility requirement.Route 53 Hosted Zone:A public hosted zone makes the DNS record resolvable publicly, which violates the requirement of restricting DNS resolution to the VPC.A private hosted zone makes the DNS record resolvable only within the VPC (or associated VPCs in the same AWS account or via VPC sharing), which meets the DNS resolution requirement.Evaluating the Options:Option A: Internet-facing ALB + Public Hosted ZoneIncorrect: The ALB is accessible from the internet, and the DNS is resolvable publicly.Option B: Internal ALB + Public Hosted ZoneIncorrect: While the ALB is internal, the DNS is still resolvable publicly, which violates the requirement.Option C: Internet-facing ALB + Private Hosted ZoneIncorrect: The ALB is accessible from the internet, even though the DNS is resolvable only within the VPC. This is not secure because the ALB is still exposed to the internet.Option D: Internal ALB + Private Hosted ZoneCorrect: The ALB is only accessible within the VPC, and the DNS is resolvable only within the VPC.Final Answer:D. Use an internal ALB. Create a Route 53 private hosted zone for the application DNS name.