ANS-C01 · Question #138
A network engineer is designing the DNS architecture for a new AWS environment. The environment must be able to resolve DNS names of endpoints on premises, and the on-premises systems must be able…
The correct answer is A. Create an Amazon Route 53 private hosted zone for the overall cloud domain. Plan to create C. Create Amazon Route 53 Resolver inbound and outbound endpoints in the central AWS account F. Share the Amazon Route 53 Resolver rules between accounts by using AWS Resource Access. Explanation Options A, C, and F work together to create a fully AWS-native, scalable DNS architecture. Option A establishes a Route 53 private hosted zone for the central cloud domain, allowing individual accounts to manage their own subdomains through delegation - meeting the…
Question
A network engineer is designing the DNS architecture for a new AWS environment. The environment must be able to resolve DNS names of endpoints on premises, and the on-premises systems must be able to resolve the names of AWS endpoints. The DNS architecture must give individual accounts the ability to manage subdomains. The network engineer needs to create a single set of rules that will work across multiple accounts to control this behavior. In addition, the network engineer must use AWS native services whenever possible. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)
Options
- ACreate an Amazon Route 53 private hosted zone for the overall cloud domain. Plan to create
- BCreate AWS Directory Service for Microsoft Active Directory server endpoints in the central AWS
- CCreate Amazon Route 53 Resolver inbound and outbound endpoints in the central AWS account
- DEnsure that networking exists between the other accounts and the central account so that traffic
- EEnsure that networking exists between the other accounts and the central account so that traffic
- FShare the Amazon Route 53 Resolver rules between accounts by using AWS Resource Access
How the community answered
(62 responses)- A71% (44)
- B5% (3)
- D8% (5)
- E16% (10)
Explanation
Explanation
Options A, C, and F work together to create a fully AWS-native, scalable DNS architecture. Option A establishes a Route 53 private hosted zone for the central cloud domain, allowing individual accounts to manage their own subdomains through delegation - meeting the multi-account subdomain management requirement. Option C creates Route 53 Resolver inbound and outbound endpoints in a central account, which is the AWS-native mechanism to enable bidirectional DNS resolution between on-premises systems and AWS (inbound for on-prem → AWS, outbound for AWS → on-prem). Option F uses AWS Resource Access Manager (RAM) to share Resolver rules across multiple accounts, creating the "single set of rules" that governs DNS forwarding behavior consistently without duplicating configuration.
Option B is incorrect because AWS Directory Service (Microsoft Active Directory) is not the appropriate AWS-native DNS tool for this use case - it introduces unnecessary complexity and cost when Route 53 Resolver already handles hybrid DNS natively. Options D and E appear to address networking connectivity, which is a prerequisite but not a DNS architecture step - the question asks specifically about DNS design decisions, not VPC peering or Transit Gateway configuration.
Memory Tip: Think "Hosted Zone → Resolver Endpoints → Share Rules" - Host it, Resolve it, Share it. For hybrid DNS on AWS, Route 53 Resolver + RAM sharing is always the AWS-native answer.
Topics
Community Discussion
No community discussion yet for this question.