Q23 — AWS SAA-C03 Ch.16

Question 23 of 100 | ← Chapter 16

Q1223. A company has a hybrid environment. The company has set up an AWS Direct Connect connection between the company's on-premises data center and a workload that runs in a VPC. The company uses Amazon Route 53 for DNS on AWS.The company uses a private hosted zone to manage DNS names for a set of services that are hosted on AWS.The company wants the on-premises servers to use Route 53 for DNS resolution of the private hosted zone.Which solution will meet these requirements?

• A. Create a Route 53 inbound endpoint. Ensure that security groups and routing allow the traffic from the on-premises data center. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the inbound endpoint. ✓
• B. Create a Route 53 outbound endpoint. Ensure that security groups and routing allow the traffic from the VPC.Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the outbound endpoint.
• C. Edit the private hosted zone in Route 53 with a TXT record that references the on-premises DNS servers. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the base of the VPC CIDR IPv4 network range, plus two.
• D. Edit the private hosted zone in Route 53 with a PTR record that references the on-premises DNS servers. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the base of the VPC CIDR IPv4 network range, plus two

Correct Answer: A. Create a Route 53 inbound endpoint. Ensure that security groups and routing allow the traffic from the on-premises data center. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the inbound endpoint.

Explanation

To meet the requirement of allowing on-premises servers to use Route 53 for DNS resolution of a private hosted zone, let's analyze the options:Key Requirements:On-Premises DNS Resolution: The on-premises servers must be able to resolve DNS queries for the private hosted zone using Route 53.Private Hosted Zone: The private hosted zone is only resolvable within the VPC (or associated VPCs) by default. To extend this to on-premises, a mechanism is needed to forward DNS queries from on-premises to Route 53.Solution Analysis:Route 53 Resolver Endpoints:Inbound Endpoint: Allows DNS queries from on-premises to be forwarded to Route 53 for resolution. This is useful when you want Route 53 to resolve DNS queries originating from on-premises networks. Outbound Endpoint: Allows DNS queries from the VPC to be forwarded to on-premises DNS servers. This is not relevant for the requirement, as the goal is to resolve Route 53 private hosted zone queries from on- premises, not the other way around.TXT/PTR Records:TXT and PTR records are not used for DNS forwarding or resolution delegation in this context. TXT records are typically used for arbitrary text data (e.g., SPF records), and PTR records are used for reverse DNS lookups. These do not help in forwarding DNS queries to Route 53.Evaluating the Options:Option A: Create a Route 53 inbound endpoint. Ensure security groups and routing allow traffic from the on-premises data center. Configure the on-premises DNS server to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the inbound endpoint. Correct: This is the correct approach. The inbound endpoint allows Route 53 to resolve DNS queries from on-premises, and the on-premises DNS server is configured to forward queries for the private hosted zone to the inbound endpoint.Option B: Create a Route 53 outbound endpoint. Ensure security groups and routing allow traffic from the VPC. Configure the on-premises DNS server to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the outbound endpoint. Incorrect: The outbound endpoint is used for forwarding DNS queries from the VPC to on-premises, not the other way around.Option C: Edit the private hosted zone in Route 53 with a TXT record that references the on-premises DNS servers. Configure the on-premises DNS server to conditionally forward DNS queries for the private hosted zone's domain name to the base of the VPC CIDR IPv4 network range, plus two. Incorrect: TXT records are not used for DNS forwarding, and forwarding to the VPC CIDR base + 2 is not a valid mechanism for Route 53 resolution.Option D: Edit the private hosted zone in Route 53 with a PTR record that references the on-premises DNS servers. Configure the on-premises DNS server to conditionally forward DNS queries for the private hosted zone's domain name to the base of the VPC CIDR IPv4 network range, plus two. Incorrect: PTR records are for reverse DNS lookups, not for forwarding DNS queries to Route 53.Final Answer:A. Create a Route 53 inbound endpoint. Ensure that security groups and routing allow the traffic from the on-premises data center. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the inbound endpoint.