AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ65

Network Security, Compliance, and Governance

A company runs multiple workloads in one VPC with public and private subnets. The company sets up an AWS Direct Connect connection to provide connectivity between its on-premises network and the VPC.

The company buys a domain in its AWS account. Requests originating from the company’s network must resolve the domain to a private Application Load Balancer (ALB). Requests originating from the internet must resolve the domain to a public ALB.

Which solution meets these requirements?

  • A Create an Amazon CloudFront distribution for the domain. Create an AWS Lambda@Edge function that inspects each request and routes requests from the internet to the public ALB. Configure the Lambda@Edge function to route requests from the company’s network to the private ALB. Create an Amazon Route 53 public hosted zone for the domain. Include an A record that is configured as an alias that points to the CloudFront distribution.
  • B Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALCreate a Route 53 private hosted zone for the domain. Include an alias record that points to the private ALConfigure a Route 53 inbound resolver endpoint on the VPC. Configure the company's network DNS to forward queries for the domain to the endpoint.
  • C Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALB. Create an additional alias record for the domain that routes to the private ALB. Associate a geolocation routing policy with the CIDR range of the company’s network.
  • D Deploy new Amazon EC2 instances that host DNS servers in each of the private subnets. Configure the DNS servers to return the IP address of the public ALB for requests from the internet. Configure the DNS servers to return the IP address of the private ALB for requests from the company’s network. Configure a public Amazon Route 53 inbound resolver to forward all requests for the domain to the EC2 instances. Enable client IP preservation.
Explanation

A Route 53 public hosted zone can provide the public alias record for internet DNS resolution, while a private hosted zone associated with the VPC can provide an alias record with the same name for the private ALB. Configuring the on-premises DNS resolver to forward queries for that domain to a Route 53 Resolver inbound endpoint allows clients on the company network, connected through Direct Connect, to resolve the private hosted-zone record. Route 53 Resolver inbound endpoints accept DNS queries from an on-premises network, and private hosted zones are resolvable through an inbound endpoint connected to an associated VPC.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!