Route 53 Resolver for Hybrid DNS Resolution

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Create a Route 53 Resolver outbound endpoint and associate a resolver rule with the VPC to forward DNS queries to on-premises servers.

Question

A company is designing a web application on AWS. The application will use a VPN connection between the company’s existing data centers and the company's VPCs. The company uses Amazon Route 53 as its DNS service. The application must use private DNS records to communicate with the on-premises services from a VPC. Which solution will meet these requirements in the MOST secure manner?
  1. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC. Correct Answer
  2. Create a Route 53 Resolver inbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.
  3. Create a Route 53 private hosted zone. Associate the private hosted zone with the VPC.
  4. Create a Route 53 public hosted zone. Create a record for each service to allow service communication

Key Takeaways

The exam tests the distinction between Private Hosted Zones (for local AWS records) and Route 53 Resolver (for forwarding queries across a VPN). The common trap is selecting C, which only works if the records exist locally in AWS, ignoring the 'on-premises services' requirement.

This question addresses secure hybrid cloud DNS resolution using Amazon Route 53 Resolver to forward queries from VPCs to on-premises servers. It establishes that Resolver endpoints are required to bridge the network gap securely.

Common mistake: Candidates often choose Option C because it seems simpler and more direct, failing to realize that private hosted zones cannot resolve names that are not hosted within that specific zone or account.

Expert Analysis

Why the Answer Is Correct

Option A is the correct solution because it utilizes Amazon Route 53 Resolver to create a secure bridge between the VPC and the on-premises network. An outbound endpoint allows DNS queries originating in the VPC to be forwarded to the on-premises DNS servers. By associating a resolver rule with the VPC, you ensure that queries for on-premises domains are automatically routed through the VPN connection to the internal DNS infrastructure, maintaining security and privacy.

Why the Other Options Are Wrong

Option B uses an inbound endpoint, which is designed to allow on-premises clients to query DNS records hosted in the VPC; this is the reverse of what is needed here. Option C creates a private hosted zone, which is used to host DNS records within AWS. Since the application needs to communicate with on-premises services, those records do not exist in the VPC's private zone, making this option ineffective for resolution unless you manually duplicate every record, which is impractical. Option D uses a public hosted zone, which exposes records to the internet and violates the security requirement.

Community Comment Notes

The community consensus strongly favors Option A, noting that Route 53 Resolver is the standard service for hybrid DNS scenarios. As user JCVDB23 explained, the outbound endpoint forwards queries from the VPC to the on-premises DNS service. Several users highlighted the directionality: Outbound is VPC-to-On-Premise, while Inbound is On-Premise-to-VPC. One user noted that while C might work if you manage all records in AWS, the prompt implies leveraging existing on-premises services, making A the architecturally correct choice for integration.

Exam Strategy

Always distinguish between hosting records (Hosted Zone) and resolving/forwarding records (Resolver). If the target is external (on-premises), you need a mechanism to forward queries, which requires a Resolver Endpoint and Rule.

Frequently Asked Questions

Why can't I just use a Private Hosted Zone?

Private hosted zones store records locally in AWS. They cannot resolve names that reside on your on-premises DNS servers unless you manually replicate them, which defeats the purpose of hybrid integration.

What is the difference between inbound and outbound endpoints?

Outbound endpoints forward queries FROM the VPC TO on-premises. Inbound endpoints allow queries TO come FROM on-premises INTO the VPC. You need outbound here.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. haci 👍 17 Answered A
    If you have workloads that leverage both VPCs and on-premises resources, you also need to resolve DNS records hosted on-premises. Similarly, these on-premises resources may need to resolve names hosted on AWS. Through Resolver endpoints and conditional forwarding rules, you can resolve DNS queries between your on-premises resources and VPCs to create a hybrid cloud setup over VPN or Direct Connect (DX). Specifically: Inbound Resolver endpoints allow DNS queries to your VPC from your on-premises network or another VPC. Outbound Resolver endpoints allow DNS queries from your VPC to your on-premises network or another VPC. Reference: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html
  2. JCVDB23 👍 6 Answered A
    Amazon Route 53 Resolver provides DNS resolution for VPCs and on-premises networks over a Direct Connect or VPN connection. An outbound resolver endpoint forwards DNS queries from your VPC to your on-premises DNS service. A resolver rule specifies the domain names for the DNS queries that you want to forward (such as example.com), and the IP addresses of the DNS resolvers in your on-premises network. Option C is not suitable because private hosted zones are used to route traffic within a VPC https://aws.amazon.com/blogs/architecture/using-route-53-private-hosted-zones-for-cross-account-multi-region-architectures/
  3. anikolov 👍 5 Answered A
    Should be A "Create a Route 53 Resolver outbound endpoint."
  4. cjace 👍 3
    C. Create a Route 53 private hosted zone. Associate the private hosted zone with the VPC. This setup allows the application within the VPC to resolve DNS queries using private DNS records, ensuring that the communication remains within the AWS network and is not exposed to the public internet. Associating the private hosted zone with the VPC ensures that only the resources within the VPC can resolve the DNS queries, maintaining a secure environment for application and on-premises service communication. The outbound resolver endpoint and rule would be more relevant if the requirement was for resources within the VPC to resolve DNS queries for domain names that are located in the on-premises network. In that case, the outbound resolver would forward queries from the VPC to the on-premises DNS server for resolution. However, for private DNS communication from the VPC to on-premises services, the private hosted zone is the most secure method.
  5. Jacky_S 👍 3 Answered C
    The reason why i vote on C, because the question mentioned that "The company uses Amazon Route53 as it's DNS service" and did not mention that is using multiple accounts, so it should be the most secure way to just add the record in it's private host zone of it's own account due to dns poisoning concern. Of cause, i totally agree on A if the dns zone owner is in on-premises dns server which reduce the operation efforts.
Show 5 more comments
  1. MatAlves 👍 3 Answered A
    AWS <-> On-premises = Route 53 Resolver - Outbound Resolver = From your VPC (AWS) to On-premises or another VPC - Inbound Resolver = From on-premises network or another VPC TO your VPC.
  2. Joshua721 👍 2 Answered A
    Inbound Resolver endpoints allow DNS queries to your VPC from your on-premises network or another VPC. Outbound Resolver endpoints allow DNS queries from your VPC to your on-premises network or another VPC. Resolver rules enable you to create one forwarding rule for each domain name and specify the name of the domain for which you want to forward DNS queries from your VPC to an on-premises DNS resolver and from your on-premises to your VPC. Rules are applied directly to your VPC and can be shared across multiple accounts.
  3. Duddle88 👍 2 Answered C
    "The company uses Amazon Route 53 as its DNS service" THERE IS NO DNS ON-PREMISES Private DNS Resolution: It allows you to create DNS records that are only accessible within your VPC, ensuring secure and private communication between your AWS resources and on-premises network. Forwarding DNS Queries: This is useful if you need to forward DNS queries from your VPC to your on-premises DNS servers. It’s typically used when you have existing DNS infrastructure on-premises that you want to continue using.
  4. alawada 👍 2 Answered A
    Amazon Route 53 Resolver provides DNS resolution for VPCs and on-premises networks
  5. Andy_09 👍 2
    Looks correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide