ANS-C01 · Question #117
A company has an AWS Site-to-Site VPN connection between its existing VPC and on-premises network. The default DHCP options set is associated with the VPC. The company has an application that is…
The correct answer is B. Create an Amazon Route 53 Resolver rule. Associate the rule with the VPC. Configure the rule to. Explanation Option B is correct because Amazon Route 53 Resolver rules (specifically forwarding rules) allow you to selectively forward DNS queries for specific domains (like api.example.internal) to the on-premises Windows DNS servers, while still maintaining AWS-native DNS…
Question
A company has an AWS Site-to-Site VPN connection between its existing VPC and on-premises network. The default DHCP options set is associated with the VPC. The company has an application that is running on an Amazon Linux 2 Amazon EC2 instance in the VPC. The application must retrieve an Amazon RDS database secret that is stored in AWS Secrets Manager through a private VPC endpoint. An on-premises application provides internal RESTful API service that can be reached by URL (https://api.example.internal). Two on-premises Windows DNS servers provide internal DNS resolution. The application on the EC2 instance needs to call the internal API service that is deployed in the on-premises environment. When the application on the EC2 instance attempts to call the internal API service by referring to the hostname that is assigned to the service, the call fails. When a network engineer tests the API service call from the same EC2 instance by using the API service's IP address, the call is successful. What should the network engineer do to resolve this issue and prevent the same problem from affecting other resources in the VPC?
Options
- ACreate a new DHCP options set that specifies the on-premises Windows DNS servers. Associate
- BCreate an Amazon Route 53 Resolver rule. Associate the rule with the VPC. Configure the rule to
- CModify the local host file in the Amazon Linux 2 EC2 instance in the VPMap the service domain
- DModify the local /etc/resolv.conf file in the Amazon Linux 2 EC2 instance in the VPC. Change the
How the community answered
(16 responses)- A6% (1)
- B69% (11)
- C6% (1)
- D19% (3)
Explanation
Explanation
Option B is correct because Amazon Route 53 Resolver rules (specifically forwarding rules) allow you to selectively forward DNS queries for specific domains (like api.example.internal) to the on-premises Windows DNS servers, while still maintaining AWS-native DNS resolution for services like Secrets Manager private endpoints. This solution is scalable, applies VPC-wide, and avoids breaking existing DNS functionality.
Option A is wrong because replacing the default DHCP options set with one pointing solely to on-premises DNS servers would route all DNS queries to those servers - breaking resolution for AWS-native endpoints like the Secrets Manager VPC endpoint, which relies on Route 53 Resolver (AmazonProvidedDNS).
Option C is wrong because modifying the /etc/hosts file only fixes the problem on that single EC2 instance and does nothing to help other VPC resources, failing the requirement to prevent the issue VPC-wide.
Option D is wrong for the same reason as C - editing /etc/resolv.conf is an instance-level fix, not a scalable VPC-wide solution, and could also interfere with AWS DNS resolution.
Memory Tip
Think "Route 53 Resolver Rules = Surgical DNS Forwarding" - they let you forward specific domains to on-premises DNS without disrupting AWS-native DNS, making them the go-to solution whenever you need hybrid DNS resolution across a VPN or Direct Connect.
Topics
Community Discussion
No community discussion yet for this question.