Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 1 discussion

A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT B. EC2 conditional forwarder will not meet Highest performance requirement. NOT C. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT D. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/

A because it requires all VPC can resolve the example.com. All VPCs must be associated with private hosted zone

Associating the private hosted zone with all Vpc's ensures native name resolution inside AWS without cross-VPC resolution challenges. Route 53 inbound resolver allows on-premises DNS servers to query Route 53 Private Hosted Zones over the Direct Connect link. Transit Gateway connects all VPCs and on-premises to the shared services VPC hosting the inbound resolver. This setup offers high performance and low complexity.

A is correct

A is correct

A is correct.

529問を全て行った結果合格できました！体感80%ほど似た問題があったので頑張ってください！

I have just taken the exam and 75 percent of the questions were from here. Prepare well for these Questions. Good Luck!

On-premises systems should be able to resolve and connect to cloud.example.com, it is inbound resolver, C is incorrect. All VPCS will need to associate their private zones to the Transit Gateway, associated only the shared VPC with TGW forces all the DNS query from other VPCS forward to shared VPC, add the latency. d is incorrect

When a Route 53 private hosted zone needs to be resolved in multiple VPCs and AWS accounts as described earlier, the most reliable pattern is to share the private hosted zone between accounts and associate it to each VPC that needs it.

A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/

Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.

1-1. Private hosted zone One Account -> 2 Account PHZ is not Equals. 1-2. VPCs in Private hosted zone 2. On-Premise -> AWS Domain Name Query [ Route 53 Resolver ] 3. Private hosted zone - Route 53 Resolver

"All VPCs and only need inbound Resolver"

Answer is A: Please see link below for the solution: https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html

The correct option would be option A: Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. This option will allow the on-premises systems to resolve and connect to cloud.example.com by forwarding the DNS queries to the inbound resolver in the shared services VPC, which will then forward the queries to the private hosted zone. All VPCs will be able to resolve cloud.example.com by resolving the queries through the private hosted zone associated to all VPCs. Additionally, this option takes advantage of the already existing AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway, which will provide the highest performance.

The best architecture to meet the given requirements with the HIGHEST performance would be Option A: A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. This architecture ensures that all VPCs can resolve the cloud.example.com domain using the private hosted zone. Additionally, it creates a Route 53 inbound resolver in the shared services VPC that can handle DNS resolution requests from on-premises systems through the transit gateway. This setup allows for fast and efficient DNS resolution with minimal latency.