SAP-C02 Practice Question 4: Hybrid DNS Resolver Endpoints
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 1 · question 4 of 10
After migrating several applications into a multi-account, multi-VPC environment connected to two on-premises data centres by AWS Direct Connect, an operations team reports two DNS failures. Applications running on Amazon EC2 inside the VPCs cannot resolve corp.example.internal names that are served by the on-premises Microsoft DNS servers, and on-premises batch jobs cannot resolve the records in the private hosted zone aws.example.internal that fronts the migrated databases.
The company requires a solution that keeps the on-premises servers authoritative for corp.example.internal, keeps Route 53 authoritative for aws.example.internal, works for every existing and future VPC across all accounts without installing or patching any DNS software on EC2, and is configured once in a central networking account rather than per account.
What should the solutions architect do?
Show answer and explanation
Answer:
Route 53 Resolver (now called Route 53 VPC Resolver; it was renamed when Route 53 Global Resolver was introduced) solves hybrid DNS in both directions and it is a managed service, so nothing is installed on EC2. An outbound endpoint plus a forwarding rule sends queries that VPC workloads make for corp.example.internal to the on-premises DNS servers over Direct Connect. An inbound endpoint gives the on-premises servers a set of IP addresses in the VPC that they can conditionally forward to, letting them resolve the private hosted zone. Resolver rules are shareable resources: creating them once in the networking account and sharing them with AWS RAM, then associating them (and the private hosted zone) with VPCs in the member accounts, meets the "configure once centrally" requirement and extends to new VPCs by association rather than rebuild.
Option B works functionally but is precisely the self-managed DNS fleet the stem forbids: EC2 instances to size, patch, monitor, and make highly available in every VPC. Changing the DHCP option set also means the VPC loses the Amazon-provided resolver's built-in handling of VPC endpoint and private hosted zone records unless the BIND servers forward back to it.
Option C breaks the requirement that the AWS zone stay private: publishing internal database records in a public hosted zone exposes the naming and addressing of migrated databases on the internet. On top of that, the Amazon-provided resolver address (VPC base + 2) only answers queries that originate inside the VPC or arrive through a Resolver inbound endpoint; on-premises servers cannot forward to it directly.
Option D covers only one direction. Inbound endpoints let on-premises resolve AWS names, but nothing makes the VPC resolver forward corp.example.internal outward; the default resolver will return NXDOMAIN for a zone it does not host. It also builds an endpoint per VPC instead of sharing rules, which is more cost and more work.
Reference: What is Route 53 VPC Resolver?