Q50 — AWS SAA-C03 Ch.17

Question 50 of 89 | ← Chapter 17

Q1350. A company has a single AWS account. The company runs workloads on Amazon EC2 instances in multiple VPCs in one AWS Region. The company also runs workloads in an on-premises data center that connects to the company's AWS account by using AWS Direct Connect.The company needs all EC2 instances in the VPCs to resolve DNS queries for the internal.example.com domain to the authoritative DNS server that is located in the on-premises data center. The solution must use private communication between the VPCs and the on-premises network. All route tables, network ACLs, and security groups are configured correctly between AWS and the on-premises data center.Which combination of actions will meet these requirements?(Select THREE.)

Correct Answer: B. Create an Amazon Route 53 outbound endpoint in one of the workload VPCs., C. Create an Amazon Route 53 Resolver rule with the Forward type configured to forward queries for internal.example.com to the on-premises DNS server., E. Associate the Amazon Route 53 Resolver rule with all the workload VPCs.

Explanation

The correct combination of actions to meet the requirements is B, C, and E.Explanation:The company needs to forward DNS queries for internal.example.com from EC2 instances in multiple VPCs to an on-premises DNS server using private communication (via AWS Direct Connect). This requires:An outbound endpoint in one VPC to send DNS queries to the on-premises network. A Resolver rule to specify which domain (internal.example.com) should be forwarded and where (to the on- premises DNS server).Association of the Resolver rule with all relevant VPCs to ensure DNS forwarding works across them.Why the correct options are B, C, and E:B. Create an Amazon Route 53 outbound endpoint in one of the workload VPCs An outbound endpoint is required to send DNS queries from AWS to the on-premises DNS server over Direct Connect (private communication).Only one outbound endpoint is needed per Region (it can serve multiple VPCs via Resolver rule associations).C. Create an Amazon Route 53 Resolver rule with the Forward type configured to forward queries for internal.example.com to the on-premises DNS serverA Forward-type Resolver rule specifies that queries for a particular domain (internal.example.com) should be forwarded to a specified DNS server (on-premises IP).The System type (Option D) is incorrect because it is used for forwarding queries to AWS-provided DNS (e.g., .amazonaws.com), not custom on-premises servers.E. Associate the Amazon Route 53 Resolver rule with all the workload VPCs The Resolver rule must be associated with all VPCs where EC2 instances need to resolve internal.example.com via the on-premises DNS server.This ensures DNS forwarding works across all VPCs, not just the one hosting the outbound endpoint.Why the other options are incorrect:A. Create an Amazon Route 53 inbound endpoint in all the workload VPCs Inbound endpoints are used to allow on-premises networks to resolve AWS-hosted domains (e.g., private hosted zones).Not needed here since the requirement is to forward AWS-initiated queries to on-premises DNS. D. Create an Amazon Route 53 Resolver rule with the System type configured to forward queries for internal.example.com to the on-premises DNS serverSystem type rules are for forwarding queries to AWS-managed DNS (e.g., .amazonaws.com), not custom domains or on-premises servers.F. Associate the Amazon Route 53 Resolver rule with the workload VPC with the new Route 53 endpoint This would limit DNS forwarding to only one VPC, whereas the requirement is to apply it to all VPCs.Correct Solution Workflow:Deploy an outbound endpoint in one VPC (B).Create a Forward-type Resolver rule for internal.example.com pointing to the on-premises DNS server (C). Associate the rule with all VPCs (E) to ensure DNS forwarding works everywhere.Conclusion:The correct combination is B, C, and E because they collectively enable private DNS forwarding from multiple VPCs to an on-premises DNS server using AWS Route 53 Resolver.