ANS-C01 practice question 22 of 35

A company is migrating an application from on premises to AWS. The company will host the application on Amazon EC2 instances that are deployed in a…

A company is migrating an application from on premises to AWS. The company will host the application on Amazon EC2 instances that are deployed in a single VPC. During the migration period, DNS queries from the EC2 instances must be able to resolve names of on-premises servers. The migration is expected to take 3 months After the 3-month migration period, the resolution of on- premises servers will no longer be needed. What should a network engineer do to meet these requirements with the LEAST amount of configuration?

Answer options

A: Set up an AWS Site-to-Site VPN connection between on premises and AWS. Deploy an Amazon Route 53 Resolver outbound endpoint in the Region that is hosting the VPC. Correct answer

B: Set up an AWS Direct Connect connection with a private VIF. Deploy an Amazon Route 53 Resolver inbound endpoint and a Route 53 Resolver outbound endpoint in the Region that is hosting the VPC.

C: Set up an AWS Client VPN connection between on premises and AWS. Deploy an Amazon Route 53 Resolver inbound endpoint in the VPC.

D: Set up an AWS Direct Connect connection with a public VIF. Deploy an Amazon Route 53 Resolver inbound endpoint in the Region that is hosting the VPC. Use the IP address that is assigned to the endpoint for connectivity to the on-premises DNS servers.

Correct Answer:

A. Set up an AWS Site-to-Site VPN connection between on premises and AWS. Deploy an Amazon Route 53 Resolver outbound endpoint in the Region that is hosting the VPC.

Explanation

To resolve on-premises server names from EC2 instances in a VPC, a hybrid DNS architecture is required. This involves two components: network connectivity and a DNS forwarding mechanism. An AWS Site-to-Site VPN provides a secure and relatively simple way to establish network connectivity for a temporary period. An Amazon Route 53 Resolver outbound endpoint provides the mechanism to forward DNS queries from the VPC to the on-premises DNS servers. This combination directly addresses the requirements with standard, well-integrated AWS services and represents the least complex configuration among the viable options for a temporary setup.

Why Incorrect

B. Direct Connect is more complex and costly to set up than a VPN, making it unsuitable for a temporary 3-month need. It also incorrectly includes an inbound endpoint.
C. AWS Client VPN is for connecting individual clients, not for site-to-site network connectivity. It also incorrectly specifies an inbound endpoint, which is for the opposite traffic flow.
D. A public VIF is for accessing public AWS services, not for private connectivity to a VPC. This option also incorrectly specifies an inbound endpoint.

References

1. AWS Documentation, "Integrating your DNS with Microsoft Active Directory". The section "From AWS to your on-premises network" describes using a Route 53 Resolver outbound endpoint to forward queries from a VPC to on-premises DNS servers.

2. AWS Documentation, "What is AWS Site-to-Site VPN?". This document describes Site-to-Site VPN as a way to create a secure connection between your data center or branch office and your AWS cloud resources.

3. AWS Documentation, "Outbound endpoints". This page explains that outbound endpoints are required to forward DNS queries from your VPCs to your on-premises network.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test