AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ239

Network Security, Compliance, and Governance

A company deploys an internal website behind an Application Load Balancer (ALB) in a VPC. The VPC uses the CIDR block 172.31.0.0/16. The company creates a private hosted zone for the website’s example.com domain in Amazon Route 53. The company establishes an AWS Site-to-Site VPN connection between its office network and the VPC.

A network engineer must configure a DNS solution so employees can access the internal webpage from the office network by using the private domain URL https://example.com.

Which combination of steps satisfies this requirement?

Choose two
  • A Create an alias record that points to the ALB in the Route 53 private hosted zone.
  • B Create a CNAME record that points to the ALB internal domain in the Route 53 private hosted zone.
  • C Create a Route 53 Resolver inbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver inbound endpoint.
  • D Create a Route 53 Resolver outbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver outbound endpoint.
  • E On the office DNS server, configure a conditional forwarder for the private domain to the VPC DNS at 172.31.0.2.
Explanation

A Route 53 alias record can point the apex record, example.com, to an Application Load Balancer. DNS queries originating on the office network must be conditionally forwarded to a Route 53 Resolver inbound endpoint, which provides the path for on-premises resolvers to query records in a private hosted zone associated with the VPC. Resolver outbound endpoints serve the opposite direction, and AWS does not support forwarding on-premises private DNS queries directly to the VPC CIDR-plus-two resolver address.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!