ANS-C01 · Question #50
A company is using Amazon Route 53 Resolver DNS Firewall in a VPC to block all domains except domains that are on an approved list. The company is concerned that if DNS Firewall is unresponsive…
The correct answer is B. Update the DNS Firewall VPC configuration to enable fail open for the VPC. Enabling the "fail open" feature in the Route 53 Resolver DNS Firewall VPC configuration ensures that if DNS Firewall becomes unresponsive, DNS queries will still be resolved. This helps maintain application service level agreements by allowing resources in the VPC to continue…
Question
A company is using Amazon Route 53 Resolver DNS Firewall in a VPC to block all domains except domains that are on an approved list. The company is concerned that if DNS Firewall is unresponsive, resources in the VPC might be affected if the network cannot resolve any DNS queries. To maintain application service level agreements, the company needs DNS queries to continue to resolve even if Route 53 Resolver does not receive a response from DNS Firewall. Which change should a network engineer implement to meet these requirements?
Options
- AUpdate the DNS Firewall VPC configuration to disable fail open for the VPC.
- BUpdate the DNS Firewall VPC configuration to enable fail open for the VPC.
- CCreate a new DHCP options set with parameter dns_firewall_fail_open=false. Associate the new
- DCreate a new DHCP options set with parameter dns_firewall_fail_open=true. Associate the new
How the community answered
(35 responses)- A17% (6)
- B71% (25)
- C9% (3)
- D3% (1)
Explanation
Enabling the "fail open" feature in the Route 53 Resolver DNS Firewall VPC configuration ensures that if DNS Firewall becomes unresponsive, DNS queries will still be resolved. This helps maintain application service level agreements by allowing resources in the VPC to continue operating even if Route 53 Resolver does not receive a response from DNS Firewall.
Topics
Community Discussion
No community discussion yet for this question.