ANS-C01 practice question 19 of 35

A company has a hybrid cloud environment. The company’s data center is connected to the AWS Cloud by an AWS Direct Connect connection. The AWS…

Full set: 291 questions
A company has a hybrid cloud environment. The company’s data center is connected to the AWS Cloud by an AWS Direct Connect connection. The AWS environment includes VPCs that are connected together in a hub-and-spoke model by a transit gateway. The AWS environment has a transit VIF with a Direct Connect gateway for on-premises connectivity. The company has a hybrid DNS model. The company has configured Amazon Route 53 Resolver endpoints in the hub VPC to allow bidirectional DNS traffic flow. The company is running a backend application in one of the VPCs. The company uses a message-oriented architecture and employs Amazon Simple Queue Service (Amazon SQS) to receive messages from other applications over a private network. A network engineer wants to use an interface VPC endpoint for Amazon SQS for this architecture. Client services must be able to access the endpoint service from on premises and from multiple VPCs within the company's AWS infrastructure. Which combination of steps should the network engineer take to ensure that the client applications can resolve DNS for the interface endpoint? (Choose three.)
Answer options
A: Create the interface endpoint for Amazon SQS with the option for private DNS names turned on. Correct answer
B: Create the interface endpoint for Amazon SQS with the option for private DNS names turned off.
C: Manually create a private hosted zone for sqs.us-east-1.amazonaws.com. Add necessary records that point to the interface endpoint. Associate the private hosted zones with other VPCs.
D: Use the automatically created private hosted zone for sqs.us-east-1.amazonaws.com with previously created necessary records that point to the interface endpoint. Associate the private hosted zones with other VPCs. Correct answer
E: Access the SQS endpoint by using the public DNS name sqs.us-east-1 amazonaws.com in VPCs and on premises. Correct answer
F: Access the SQS endpoint by using the private DNS name of the interface endpoint .sqs.us-east- 1.vpce.amazonaws.com in VPCs and on premises.
Correct Answer:
A. Create the interface endpoint for Amazon SQS with the option for private DNS names turned on.; D. Use the automatically created private hosted zone for sqs.us-east-1.amazonaws.com with previously created necessary records that point to the interface endpoint. Associate the private hosted zones with other VPCs.; E. Access the SQS endpoint by using the public DNS name sqs.us-east-1 amazonaws.com in VPCs and on premises.
Explanation

Creating the interface VPC endpoint with private DNS enabled automatically generates a private hosted zone (PHZ) that maps the standard Regional service name (sqs.us-east-1.amazonaws.com) to the endpoint’s private IPs. By associating that PHZ with additional VPCs, the same private DNS resolution becomes available everywhere. When on-premises resolvers forward queries to Route 53 Resolver inbound endpoints, the “public” service name returns the private addresses, so clients can keep using sqs.us-east-1.amazonaws.com over the private network.

Why Incorrect

B. Disabling private DNS prevents automatic PHZ creation and forces clients to use endpoint-specific names.
C. Manually building a PHZ duplicates the automatic one and risks configuration drift.
F. The vpce-specific hostname works but is unnecessary; clients can use the familiar regional service name after private DNS is enabled.

References

1. Interface Endpoints Guide, “Enable private DNS for interface endpoints,” paras 1-3 (https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#vpce-private-dns).

2. Same guide, “DNS hostnames and names that Amazon creates,” table 1.

3. Route 53 Resolver Hybrid Guide, “Forwarding DNS queries from on-premises to AWS,” Step 5 (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-forwarding.html).

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ANS-C01 practice questions

Scroll to Top