Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 71 discussion

Explanation: Enabling the "fail open" feature in the Route 53 Resolver DNS Firewall VPC configuration ensures that if DNS Firewall becomes unresponsive, DNS queries will still be resolved. This helps maintain application service level agreements by allowing resources in the VPC to continue operating even if Route 53 Resolver does not receive a response from DNS Firewall.

B is correct! Fail-close vs Fail-Open (DNS Firewall Configuration): • Fail-close: Resolver blocks query if no response from DNS Firewall (security over availability) • Fail-open: Resolver allows query if no response from DNS firewall (availability over security)

B is the correct answer. The definition of fail open, fellow engineers!

To meet the requirement of maintaining DNS query resolution even if Route 53 Resolver DNS Firewall is unresponsive, the network engineer should implement option B: B. Update the DNS Firewall VPC configuration to enable fail open for the VPC. When you enable "fail open" mode for a VPC's DNS Firewall configuration, it means that if the DNS Firewall service becomes unresponsive or unavailable, the DNS queries will be allowed to pass through without being blocked. This ensures that the application's service level agreements are maintained even if the DNS Firewall service experiences issues. By enabling fail open, you ensure that DNS queries can still be resolved even if DNS Firewall is not functioning correctly. This can prevent disruption to your applications and services due to DNS resolution failures.

B is correct.

B) https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-vpc-configuration.html

B, as in BUENO Good luck everyone! Has anyone made it this far taken the test with these questions??

B is correct D is wrong as enabling fail open for the VPC would mean that DNS queries would bypass DNS Firewall and proceed to the default DNS resolver. This might be a security risk as it would allow unapproved domains to be resolved, potentially exposing the company's resources to security threats.

B - coorect

BBBBBBBBBBB

B - correct.