SAA-C03 practice question 8 of 35

A company is migrating mobile banking applications to run on Amazon EC2 instances in a VPC. Backend service applications run in an on-premises data…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Design Resilient Architectures

A company is migrating mobile banking applications to run on Amazon EC2 instances in a VPC. Backend service applications run in an on-premises data center. The data center has an AWS Direct Connect connection into AWS. The applications that run in the VPC need to resolve DNS requests to an on-premises Active Directory domain that runs in the data center. Which solution will meet these requirements with the LEAST administrative overhead?

Answer options

Correct Answer:

Explanation

Amazon Route 53 Resolver is a fully managed AWS service designed specifically for hybrid cloud DNS resolution. By creating a Route 53 Resolver outbound endpoint in the VPC, you enable DNS queries to be sent to an on-premises network. A conditional forwarding rule is then configured to direct queries for the specific on-premises domain (e.g., corp.example.com) to the on-premises DNS servers' IP addresses over the Direct Connect connection. This approach is highly available, scalable, and requires minimal configuration and no ongoing server management, thereby meeting the requirement for the least administrative overhead.

Why Incorrect

A. This solution requires manually provisioning, configuring, patching, and managing EC2 instances and DNS software, which incurs significant administrative overhead compared to a managed service.

B. An Amazon Route 53 private hosted zone is used for authoritative DNS resolution for a domain within a VPC, not for forwarding queries to an external network.

D. Deploying a new Active Directory domain controller and configuring a trust is a complex solution for identity management and authentication, representing excessive administrative overhead for a DNS resolution requirement.

References

1. Amazon Route 53 Developer Guide

"Resolving DNS queries between VPCs and your network": This section details the use of Route 53 Resolver for hybrid DNS. It states

"To forward DNS queries from your VPCs to your on-premises network

you create a Route 53 Resolver outbound endpoint and forwarding rules." This directly supports the chosen answer.

2. Amazon Route 53 Developer Guide

"Forwarding outbound DNS queries to your network": This page provides a step-by-step guide

explaining

"When you create a rule

you specify the domain name that you want to forward queries for... and the IP addresses of the DNS resolvers on your network that you want to forward the queries to." This confirms the mechanism described in option C.

3. AWS Whitepaper

"Hybrid Cloud DNS Solutions for Amazon VPC": This document outlines architectural patterns for hybrid DNS. In the section "Outbound DNS Resolution from an Amazon VPC

" it recommends using Route 53 Resolver outbound endpoints and forwarding rules as the primary

managed solution for resolving on-premises domain names from within a VPC.

Question 8 of 35

Question breakdown

Tests: Implement hybrid DNS resolution between a VPC and on-premises
Difficulty: Easy

Key idea: Route 53 Resolver outbound endpoints with forwarding rules send queries for on-premises domains to on-premises DNS servers as a managed service.

How to reach the answer

VPC workloads must resolve names in an on-premises AD domain reachable over Direct Connect.
This is a conditional-forwarding problem, not an authoritative-hosting or identity problem.
'LEAST administrative overhead' rules out self-managed DNS EC2 instances and new domain controllers.
Route 53 Resolver endpoints plus forwarding rules deliver this fully managed and highly available.

Each option

AIncorrect. Self-managed DNS servers on EC2 require patching, scaling, and HA design, adding overhead.
BIncorrect. A private hosted zone is authoritative within the VPC and cannot delegate resolution to on-premises servers via NS records.
CCorrect. Resolver endpoints with conditional forwarding rules resolve the on-premises namespace over Direct Connect with no servers to manage.
DIncorrect. Building a new AD domain and trust is heavy identity infrastructure for what is only a DNS forwarding need.

Common trap: Thinking a private hosted zone with NS records can delegate to on-premises DNS the way public delegation works.

In practice: Hybrid environments almost always deploy Resolver outbound endpoints for corporate domains and inbound endpoints so on-premises hosts can resolve private AWS names.

Remember: Hybrid DNS between VPCs and on-premises = Route 53 Resolver endpoints plus forwarding rules.

Official documentation: What is Route 53 Resolver? · Forwarding outbound DNS queries to your network

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SAA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test