ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver) / Question 1

SAP-C03 practice question: Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver)

Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A hospital group runs six hospitals with its data center on premises. Its AWS workloads use the name corp.hospitalgroup.internal, which only the on-premises DNS servers can answer, and on-premises systems need to resolve the names of AWS workloads in aws.hospitalgroup.internal.

The group connects to AWS over two AWS Direct Connect connections in different locations. If both Direct Connect connections fail, DNS resolution in both directions must keep working over an encrypted backup path, and no name may be published to public DNS.

Which solution meets these requirements?

Choose one answer.

  1. A. Create Route 53 Resolver inbound and outbound endpoints in two Availability Zones, with a forwarding rule that sends corp.hospitalgroup.internal to the on-premises servers, which forward aws.hospitalgroup.internal to the inbound endpoints. Add a Site-to-Site VPN as backup.
  2. B. Deploy two EC2 instances running DNS forwarder software in one Availability Zone, point the VPC's DHCP options at them, and configure the on-premises servers to forward aws.hospitalgroup.internal to those instances.
  3. C. Create a public Route 53 hosted zone for both internal names and add the records there, so that every network can resolve the names without forwarding rules.
  4. D. Create only a Resolver inbound endpoint in two Availability Zones, set the on-premises DNS servers to forward aws.hospitalgroup.internal to it, and add a Site-to-Site VPN as the backup path. Leave the VPC's default resolver to answer corp.hospitalgroup.internal for AWS workloads.
Show the answer and explanation

Answer: A

  • A. Right: Correct. Multi-AZ inbound and outbound endpoints handle DNS in both directions, and the forwarding rules keep each zone with its owner. The VPN gives an encrypted backup path, and nothing is published to public DNS.
  • B. Wrong: The forwarders sit in one Availability Zone, so an outage there stops resolution in both directions. The group would also run and patch DNS servers that Resolver endpoints manage for it.
  • C. Wrong: Publishing internal names to public DNS breaks the rule that no name may be published publicly, and it exposes internal host names on the internet.
  • D. Wrong: The VPC's default resolver cannot answer names that only the on-premises servers hold, so AWS workloads fail to resolve corp.hospitalgroup.internal. Without an outbound endpoint and a forwarding rule, that direction of resolution does not work.

Explanation

Resolving names in both directions needs inbound and outbound Resolver endpoints with forwarding rules, spread across Availability Zones, and a VPN backup for the Direct Connect paths. Single-zone forwarders, public DNS and an inbound-only design each break one stated requirement.

Hybrid DNS with Route 53 Resolver inbound and outbound endpoints On-premises DNS servers forward queries for AWS private zones over Direct Connect to a Resolver inbound endpoint in the VPC. A Resolver outbound endpoint with a forwarding rule sends queries for on-premises domains to the on-premises DNS servers. Route 53 Resolver answers from the private hosted zones. On-premises DNS over Direct Connect VPC Inbound endpoint answers on-prem Outbound endpoint forwarding rule Route 53 Resolver private hosted zones AWS zone queries on-prem queries
Inbound and outbound endpoints in two Availability Zones keep name resolution working both ways if one zone fails.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SAP-C03 practice examPractice Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver)All Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver) questions

Want more on Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver)? The 5 full-length practice sets have 6 more Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets