SOA-C02 · Question #591
A SysOps administrator is troubleshooting an implementation of Amazon CloudWatch Synthetics. The CloudWatch Synthetics results must be sent to an Amazon S3 bucket. The SysOps administrator has…
The correct answer is A. Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VPC. Option A is correct because a private VPC with no internet access must use VPC Interface Endpoints to reach AWS services like S3 and CloudWatch. These endpoints rely on DNS to resolve service hostnames (e.g., s3.amazonaws.com) to private IP addresses within the VPC - so both…
Question
A SysOps administrator is troubleshooting an implementation of Amazon CloudWatch Synthetics. The CloudWatch Synthetics results must be sent to an Amazon S3 bucket. The SysOps administrator has copied the configuration of an existing canary that runs on a VPC that has an internet gateway attached. However, the SysOps administrator cannot get the canary to successfully start on a private VPC that has no internet access. What should the SysOps administrator do to successfully run the canary on the private VPC?
Options
- AEnsure that the DNS resolution option and the DNS hostnames option are turned on in the VPC.
- BEnsure that the DNS resolution option and the DNS hostnames option are turned off in the VPC.
- CEnsure that the DNS resolution option and the DNS hostnames option are turned off in the VPC.
- DEnsure that the DNS resolution option and the DNS hostnames option are turned on in the VPC.
How the community answered
(40 responses)- A85% (34)
- B3% (1)
- C10% (4)
- D3% (1)
Explanation
Option A is correct because a private VPC with no internet access must use VPC Interface Endpoints to reach AWS services like S3 and CloudWatch. These endpoints rely on DNS to resolve service hostnames (e.g., s3.amazonaws.com) to private IP addresses within the VPC - so both DNS Resolution and DNS Hostnames must be enabled for the canary to successfully communicate with S3.
Options B and C are wrong (and are actually identical distractors) because turning DNS resolution and DNS hostnames off would break DNS-based service discovery entirely, making it impossible for the canary to locate any AWS service endpoints - the opposite of what's needed.
Option D is also identical to A, making it a duplicate distractor; in real exam scenarios, if two answers look the same, one is typically the trap to test whether you're reading carefully.
Memory tip: Think "private VPC = no internet, but still needs a path to AWS services." VPC Endpoints are that private path, and they speak DNS - so DNS Resolution and DNS Hostnames must always be ON when using VPC Endpoints. No DNS = no endpoint resolution = canary fails to start.
Topics
Community Discussion
No community discussion yet for this question.