SAP-C02 Practice Question 83: Private Hosted Zone Cross Account VPC

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 9 · question 3 of 10

Hybrid Networkingmedium

A shared-services account owns the Route 53 private hosted zone internal.example.com. Fifteen workload VPCs, each in a different AWS account, must resolve the records in this zone. The zone and the VPCs already exist. A solutions architect will use the Route 53 hosted zone association capabilities and wants the most secure sequence.

Which sequence of steps should the architect follow for each VPC?

Show answer and explanation

Answer:

B. In the shared-services account, authorize the association. In the VPC's account, associate the VPC. Then delete the authorization.

To associate a VPC and a private hosted zone that were created with different accounts, AWS documents three steps. First, *"using the account that created the hosted zone, authorize the association of the VPC with the private hosted zone"* (CreateVPCAssociationAuthorization), one request for each VPC. Second, *"using the account that created the VPC, associate the VPC with the hosted zone"* (AssociateVPCWithHostedZone). Third, it is *recommended* to delete the authorization, which *"does not affect the association"* but prevents the VPC from being re-associated later without the zone owner's approval (option B).

- A is wrong because the association fails without a prior authorization from the zone owner. The owner's approval must come first. - C is wrong because AWS states that you *"can't use the Route 53 console either to authorize the association of a VPC with a private hosted zone or to make the association"* across accounts. The CLI, SDKs or API are required, and the authorization is still needed. - D is wrong because 15 copies of the zone create 15 places to keep records consistent, which defeats the purpose of a shared zone.

Reference: Associating an Amazon VPC and a private hosted zone that you created with different AWS accounts

Practice Test 9 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.