Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 322 discussion

Option C: Amazon Route 53 Resolver with Conditional Forwarding Rules Least Administrative Overhead: This option leverages AWS-managed services to handle DNS resolution without the need to manage additional infrastructure or complicated configurations. Route 53 Resolver Endpoints: Create inbound and outbound endpoints to handle DNS queries between AWS and the on-premises environment. Inbound Endpoints: Allow on-premises systems to resolve DNS names hosted in AWS. Outbound Endpoints: Forward DNS queries from AWS to on-premises DNS servers. Conditional Forwarding Rules: Set up rules to forward specific domain queries (like your Active Directory domain) to the on-premises DNS servers. This ensures seamless DNS resolution for the applications in the VPC. B: Private hosted zones are intended for DNS records within AWS. A & D: too much overhead

C is right The company needs to resolve DNS requests from EC2 instances in a VPC to an on-premises Active Directory domain that runs in a data center with an AWS Direct Connect connection. Amazon Route 53 Resolver is specifically designed for this use case, providing a secure way to enable name resolution between your on-premises and cloud-based resources. By using Route 53 Resolver, you can create DNS endpoints within the VPC that resolve DNS queries to the on-premises Active Directory domain without requiring any additional infrastructure or overhead in the data center.

Why not B?

Option C

Answer is C, least admin overhead using Route 53 resolver with conditional forwarding

Answer C

Option C: Amazon Route 53 Resolver > Conditional Forwarding Lower Maintenance than Option A which using EC2.

To forward DNS queries from your VPCs to your network, you create an outbound endpoint. reference: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html

I vote for C

https://aws.amazon.com/blogs/security/how-to-set-up-dns-resolution-between-on-premises-networks-and-aws-using-aws-directory-service-and-amazon-route-53/