Exams / SAP-C03 / Study guide / Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver)
Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver): SAP-C03 study notes and practice questions
What to know about Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to connect on-premises sites to many VPCs with the right bandwidth, encryption and redundancy, and how to make DNS work across the boundary.
Direct Connect building blocks
Dedicated connections (1, 10, 100, 400 Gbps ports) or hosted connections from a partner for smaller or faster-to-order capacity.
Virtual interfaces:private VIF to a VPC or Direct Connect gateway, transit VIF to a Direct Connect gateway associated with Transit Gateways, public VIF for AWS public endpoints.
A Direct Connect gateway is global: one connection reaches VPCs and Transit Gateways in many Regions and accounts.
Encryption: Direct Connect isn’t encrypted by default. Use MACsec on supported dedicated connections, or run IPsec VPN over Direct Connect (a private IP VPN on a transit VIF).
SiteLink sends traffic between your own sites over the AWS backbone.
LAG bundles connections at one location for bandwidth, not location redundancy.
Redundancy and failover
Model
Design
Maximum resiliency
Separate connections at two Direct Connect locations, two devices each; for critical workloads
High resiliency
One connection at each of two locations
Development and test
Two connections at one location
VPN backup
Direct Connect primary, Site-to-Site VPN to the same Transit Gateway as backup; BGP prefers Direct Connect
Use BGP attributes (AS path prepending, local preference, more specific prefixes) to control active/passive paths, and BFD for fast failure detection.
Site-to-Site VPN
Two tunnels per connection, each in a different AZ. Standard tunnels carry up to 1.25 Gbps; 5 Gbps large-bandwidth tunnels are available on Transit Gateway and Cloud WAN (not virtual private gateways).
Terminate on a Transit Gateway and use ECMP across several connections for more aggregate bandwidth.
Accelerated VPN routes through Global Accelerator edge locations for distant sites.
Hybrid DNS with Route 53 Resolver
Inbound endpoint: on-premises DNS servers forward AWS zone queries (private hosted zones) to IP addresses in your VPC.
Outbound endpoint plus forwarding rules: VPC resources resolve on-premises domains (corp.example.com) through conditional forwarding.
Share rules with AWS RAM and centralize endpoints in a networking account; associate private hosted zones with many VPCs, including across accounts.
Split-horizon DNS: a public and a private hosted zone with the same name return different answers inside and outside the VPC.
How to choose
Scenario wording
Choose
“Critical workload, survive loss of a Direct Connect location”
Maximum resiliency model
“Encrypt traffic over Direct Connect”
MACsec, or IPsec VPN over Direct Connect
“Low-cost backup for Direct Connect”
Site-to-Site VPN on the Transit Gateway
“One connection to VPCs in several Regions”
Direct Connect gateway
“EC2 must resolve on-premises hostnames”
Outbound endpoint with forwarding rules
“On-premises apps must resolve private hosted zones”
Inbound endpoint
Common traps
Two connections at one location described as highly available.
Assuming Direct Connect is encrypted.
Custom DNS servers on EC2 instead of Resolver endpoints.
LAG for location redundancy.
Large-bandwidth VPN tunnels on a virtual private gateway.
A hospital group runs six hospitals with its data center on premises. Its AWS workloads use the name corp.hospitalgroup.internal, which only the on-premises DNS servers can answer, and on-premises systems need to resolve the names of AWS workloads in aws.hospitalgroup.internal.
The group connects to AWS over two AWS Direct Connect connections in different locations. If both Direct Connect connections fail, DNS resolution in both directions must keep working over an encrypted backup path, and no name may be published to public DNS.
Which solution meets these requirements?
Choose one answer.
AA. Create Route 53 Resolver inbound and outbound endpoints in two Availability Zones, with a forwarding rule that sends corp.hospitalgroup.internal to the on-premises servers, which forward aws.hospitalgroup.internal to the inbound endpoints. Add a Site-to-Site VPN as backup.
BB. Deploy two EC2 instances running DNS forwarder software in one Availability Zone, point the VPC's DHCP options at them, and configure the on-premises servers to forward aws.hospitalgroup.internal to those instances.
CC. Create a public Route 53 hosted zone for both internal names and add the records there, so that every network can resolve the names without forwarding rules.
DD. Create only a Resolver inbound endpoint in two Availability Zones, set the on-premises DNS servers to forward aws.hospitalgroup.internal to it, and add a Site-to-Site VPN as the backup path. Leave the VPC's default resolver to answer corp.hospitalgroup.internal for AWS workloads.
Show the answer and explanation
Answer: A
A. Right: Correct. Multi-AZ inbound and outbound endpoints handle DNS in both directions, and the forwarding rules keep each zone with its owner. The VPN gives an encrypted backup path, and nothing is published to public DNS.
B. Wrong: The forwarders sit in one Availability Zone, so an outage there stops resolution in both directions. The group would also run and patch DNS servers that Resolver endpoints manage for it.
C. Wrong: Publishing internal names to public DNS breaks the rule that no name may be published publicly, and it exposes internal host names on the internet.
D. Wrong: The VPC's default resolver cannot answer names that only the on-premises servers hold, so AWS workloads fail to resolve corp.hospitalgroup.internal. Without an outbound endpoint and a forwarding rule, that direction of resolution does not work.
Explanation
Resolving names in both directions needs inbound and outbound Resolver endpoints with forwarding rules, spread across Availability Zones, and a VPN backup for the Direct Connect paths. Single-zone forwarders, public DNS and an inbound-only design each break one stated requirement.
Inbound and outbound endpoints in two Availability Zones keep name resolution working both ways if one zone fails.
Want more on Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver)? The 5 full-length practice sets have 6 more Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Hybrid connectivity and DNS (Direct Connect, VPN, Route 53 Resolver)