SOA-C02 · Question #113
A company manages its production applications across several AWS accounts. The company hosts the production applications on Amazon EC2 instances that run Amazon Linux 2. The EC2 instances are spread…
The correct answer is D. In Account B, use the AWS CLI to create a VPC association authorization. When the association. Option D is correct because the VPC association authorization must be initiated by Account B, which owns the private hosted zone. The two-step process requires: (1) the hosted zone owner (Account B) creates the authorization via CLI, then (2) the VPC owner (Account A) completes…
Question
A company manages its production applications across several AWS accounts. The company hosts the production applications on Amazon EC2 instances that run Amazon Linux 2. The EC2 instances are spread across multiple VPCs. Each VPC uses its own Amazon Route 53 private hosted zone for private DNS. A VPC from Account A needs to resolve private DNS records from a private hosted zone that is associated with a different VPC in Account B. What should a SysOps administrator do to meet these requirements?
Options
- AIn Account A, create an AWS Systems Manager document that updates the /etc/resolv.conf file
- BIn Account A, create an AWS CloudFormation template that associates the private hosted zone
- CIn Account A, use the AWS CLI to create a VPC association authorization. When the association
- DIn Account B, use the AWS CLI to create a VPC association authorization. When the association
How the community answered
(24 responses)- A8% (2)
- B13% (3)
- C4% (1)
- D75% (18)
Explanation
Option D is correct because the VPC association authorization must be initiated by Account B, which owns the private hosted zone. The two-step process requires: (1) the hosted zone owner (Account B) creates the authorization via CLI, then (2) the VPC owner (Account A) completes the association - the authorization must come from the resource being shared, not the requester.
Why the distractors fail:
- A is wrong because modifying
/etc/resolv.confvia Systems Manager is a manual, unsupported workaround that bypasses Route 53's built-in cross-account DNS association mechanism. - B is wrong because CloudFormation cannot perform cross-account Route 53 VPC associations - this operation is only supported via the AWS CLI or API, not the console or CloudFormation.
- C is wrong because Account A owns the VPC, not the hosted zone; the authorization command (
create-vpc-association-authorization) must run in the account that owns the hosted zone (Account B), not the account requesting access.
Memory tip: Think of it like a building access badge - the building owner (Account B, the hosted zone account) must issue the authorization first, then the visitor (Account A, the VPC account) can badge in and complete the association.
Topics
Community Discussion
No community discussion yet for this question.