nerdexam
Amazon

SAP-C02 · Question #790

A company runs workloads on EC2 inmultiple VPCsin a single Region. They also have anon- premises DNS server(via Direct Connect). All EC2 instances must resolve internal.company.com using private…

The correct answer is B. Create a Route 53 outbound endpoint in one VPC. C. Create a Route 53 forwarding ruleto forward internal.company.com to the on-prem DNS. E. Associate the rule with all VPCs. EC2 instances across multiple VPCs need to resolve internal.company.com privately using an on-premises DNS server connected via Direct Connect.

Submitted by jakub_pl· Mar 6, 2026Design Solutions for Organizational Complexity

Question

A company runs workloads on EC2 inmultiple VPCsin a single Region. They also have anon- premises DNS server(via Direct Connect). All EC2 instances must resolve internal.company.com using private communication. What should a solutions architect do? (Choose three.)

Options

  • ACreate an Amazon Route 53 inbound endpoint in all workload VPCs.
  • BCreate a Route 53 outbound endpoint in one VPC.
  • CCreate a Route 53 forwarding ruleto forward internal.company.com to the on-prem DNS.
  • DCreate a Route 53 rule with the System type.
  • EAssociate the rule with all VPCs.
  • FAssociate the rule only with the VPC that has the outbound endpoint.

How the community answered

(13 responses)
  • A
    8% (1)
  • B
    85% (11)
  • F
    8% (1)

Why each option

EC2 instances across multiple VPCs need to resolve `internal.company.com` privately using an on-premises DNS server connected via Direct Connect.

ACreate an Amazon Route 53 inbound endpoint in all workload VPCs.

An inbound endpoint allows on-premises DNS servers to resolve AWS-hosted private DNS records, which is the opposite direction of the current requirement.

BCreate a Route 53 outbound endpoint in one VPC.Correct

A Route 53 Resolver outbound endpoint is necessary to forward DNS queries originating from AWS VPCs to an on-premises DNS server, establishing the egress path for DNS requests.

CCreate a Route 53 forwarding ruleto forward internal.company.com to the on-prem DNS.Correct

A Route 53 Resolver forwarding rule must be created to specify that DNS queries for the domain `internal.company.com` should be specifically forwarded to the IP address(es) of the on-premises DNS server(s).

DCreate a Route 53 rule with the System type.

Route 53 Resolver rules have types like "Forward" or "System"; for forwarding to on-prem, a "Forward" rule is implicitly what's needed for the domain, making "System type" too generic or incorrect.

EAssociate the rule with all VPCs.Correct

To ensure that all EC2 instances across *multiple* VPCs can use this forwarding rule for `internal.company.com`, the rule must be associated with *all* the relevant workload VPCs.

FAssociate the rule only with the VPC that has the outbound endpoint.

Associating the rule *only* with the VPC that has the outbound endpoint would prevent other VPCs from utilizing the forwarding rule, failing to meet the requirement for *all* EC2 instances across *multiple* VPCs.

Concept tested: Route 53 Resolver for hybrid DNS

Source: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice