SAA-C03 Q241 · DNS

Question

A company runs an application in a VPC on AWS. The company's on-premises data center has a DNS server. The data center is connected to AWS through an AWS Direct Connect connection with a private virtual interface (VIF). The on-premises DNS server needs to resolve the DNS name of the application in the VPC.

Accepted Answer

**Answer D: Create an Amazon Route 53 Resolver inbound endpoint in the VPC**

Let's trace the DNS resolution flow step by step:

1. **Requirement**: The on-premises DNS server needs to resolve DNS names of applications *inside* the VPC.
2. **Problem**: By default, the VPC DNS resolver (AmazonProvidedDNS at VPC CIDR+2) only accepts queries from within the VPC. On-premises servers cannot reach it directly.
3. **Solution**: A Route 53 Resolver **inbound endpoint** creates ENIs (Elastic Network Interfaces) inside the VPC with IP addresses that are reachable from on-premises via Direct Connect.
4. **Flow**: On-premises DNS server → Direct Connect (private VIF) → Route 53 Resolver inbound endpoint ENIs → VPC DNS resolver → resolves the private DNS name → returns the answer back through the same

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips