Route 53 routing and Resolver: SOA-C03 study notes and practice questions
What to know about Route 53 routing and Resolver for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
DNS questions ask how to route users, resolve names across hybrid networks, or why a name doesn’t resolve.
Hosted zones and records
Public hosted zones answer on the internet; private hosted zones answer only inside associated VPCs (which need DNS support and hostnames turned on).
Record types: A/AAAA (IPv4/IPv6), CNAME (alias to another name, not at the zone apex), MX, TXT, NS, SOA, CAA.
Alias records point to AWS resources (ELB, CloudFront, S3 website, API Gateway, another record), work at the apex, and have no query charge for AWS targets.
TTL: lower before a planned change so resolvers pick it up quickly.
Routing policies
Simple, weighted, latency, failover, geolocation, geoproximity, multivalue answer and IP-based. Geolocation routes by where the user is (for legal or content rules) and needs a default record for unmatched locations; latency routes by speed.
Route 53 Resolver
Feature
Use
Inbound endpoint
On-premises DNS servers forward queries into AWS to resolve private hosted zones
Outbound endpoint + forwarding rules
VPCs forward queries for on-premises domains out to on-premises DNS
Rules shared with RAM
Use one set of forwarding rules in many accounts
Query logging
Log DNS queries from VPCs
DNS Firewall
Block queries to bad domains
Other
DNSSEC signing for public zones protects against spoofing.
Domain registration and transfers are in Route 53 too.
Common traps
CNAME at the apex. Use an alias record.
Geolocation without a default record: users from unlisted places get no answer.
Inbound vs outbound endpoints. Inbound for on premises asking AWS; outbound for AWS asking on premises.
A logistics broker connects its data center to a VPC with AWS Direct Connect.
Instances in the VPC must resolve names in the on-premises domain corp.broker.example, and on-premises servers must resolve names in the Route 53 private hosted zone aws.broker.example associated with the VPC.
The broker wants a managed solution without running its own DNS servers in AWS.
Which TWO actions should a CloudOps engineer take? (Choose two.)
Choose two answers.
AA. Associate the private hosted zone with the data center network through the Direct Connect virtual interface.
BB. Change the VPC's DHCP options set so that instances use the on-premises DNS servers instead of the Amazon-provided DNS server.
CC. Create a Route 53 Resolver inbound endpoint, and configure the on-premises DNS servers to forward aws.broker.example to its IP addresses.
DD. Launch a pair of EC2 instances running BIND in the VPC to forward queries in both directions between the networks.
EE. Create a Route 53 Resolver outbound endpoint and a forwarding rule that sends corp.broker.example queries to the on-premises DNS servers.
Route 53 Resolver endpoints handle hybrid DNS in both directions. Outbound endpoints with forwarding rules send queries for on-premises domains to on-premises DNS servers, and inbound endpoints let on-premises DNS servers query private hosted zones. Both are managed and highly available across the subnets chosen for them.
Each direction has its own endpoint: inbound for queries from the data center, outbound for queries going to it.
A pet insurer serves policyholders in the United Kingdom and the United States from two copies of its portal, one in eu-west-2 and one in us-east-1.
A data-residency rule says UK users must always be sent to eu-west-2, even when us-east-1 would respond faster. All other users, including those in countries the company has not planned for, should go to us-east-1.
Which Route 53 configuration should a CloudOps engineer use?
Choose one answer.
AA. Geolocation records: United Kingdom to eu-west-2, plus a default location record to us-east-1.
BB. Latency-based records for the two Regions so that each user is sent to the Region with the lowest latency.
CC. Weighted records with a weight of 50 for each Region so that traffic is split evenly between the two portals.
DD. Geoproximity records with a positive bias on eu-west-2 so that more of Europe is routed to the UK portal.
Show the answer and explanation
Answer: A
A. Right: Correct. Geolocation routing answers based on where the user's DNS query comes from. The UK record enforces the residency rule, and the default record catches every other location. Learn more: Geolocation routing (opens in a new tab)
B. Wrong: Latency routing picks the fastest Region for each user. The rule says UK users must go to eu-west-2 even when us-east-1 is faster, so latency routing cannot guarantee it. Learn more: Latency-based routing (opens in a new tab)
D. Wrong: Geoproximity routes by distance to resources, adjusted by bias. It shifts boundaries rather than mapping a specific country to a Region, so it does not guarantee the rule. Learn more: Geoproximity routing (opens in a new tab)
Explanation
When a legal rule ties users in a country to a Region, geolocation routing is the right policy, because it answers by the user's location. A default record covers locations with no specific record, so no user gets an empty answer. Latency, weighted and geoproximity routing all decide by other factors.
Want more on Route 53 routing and Resolver? The 5 full-length practice sets have 10 more Route 53 routing and Resolver questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →