How Should a Company Design High-Performance Hybrid DNS for cloud.example.com?
Answer
Correct answer: A — Associate the cloud.example.com private hosted zone with all VPCs and forward on-premises DNS to a Route 53 inbound Resolver endpoint in the shared services VPC.
A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs. The company has the following DNS resolution requirements: On-premises systems should be able to resolve and connect to cloud.example.com. All VPCs should be able to resolve cloud.example.com. There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway. Which architecture should the company use to meet these requirements with the HIGHEST performance?
Community Insight
The question tests whether you can combine Route 53 private hosted zone association with the correct directional Resolver endpoint for hybrid DNS, and the trap is choosing an outbound resolver or an EC2-based conditional forwarder that adds latency and management overhead.
This SAP-C02 hybrid DNS scenario requires cloud.example.com to resolve from every VPC and from on-premises over Direct Connect and Transit Gateway. The page establishes that option A is correct because associating the private hosted zone with all VPCs and forwarding on-premises queries to a Route 53 inbound Resolver endpoint delivers the highest performance.
A common wrong answer is D: it centralizes the private hosted zone and inbound resolver in the shared services VPC but associates the zone with only that VPC, so workloads in other VPCs cannot resolve cloud.example.com without additional Resolver forwarding rules.
Community Discussion (102 comments)
tutrieuchau
👍 1
Selected: A
I believe A is correct
HarryNZ1982
👍 3
Selected: A
Okay all. I gave the Exam yesterday and passed it. Thank you all for your contributions. I must say the exam was quite tough and there were a number of Gen AI related questions especially centred around AWS Bedrock APIs, Bedrock Guardrails , Denied Topics as well as content filtering
bb_08
👍 1
Selected: A
Associating the private hosted zone with all VPC ensures DNS resolution. Route 53 inbound resolver allows on-premises DNS servers to reach cloud. Transit Gateway connects all VPCs & on-premises to the shared services VPC hosting the inbound resolver.
2pk
👍 1
Selected: A
A is the correct answer. Because you should look at other sites which has these questions are available for free rather spend a fortune here. s c r i b d for example.
EzKkk
👍 2
Selected: A
- For PHZ, you have to associate VPCs so it could resolve the domain - On-prem should be able to resolve PHZ => Need inbound endpoint - Use Shared Service VPC to host inbound endpoint and use Transit Gateway to manage P2P connection => Scaleable solution
llapsiwala
👍 2
Selected: A
A: Private hosted zone should be associated with all VPCs for them to resolve cloud.example.com. Route 53 inbound resolver for on-prem to connect to route53. No C & D: The PHZ is only associated with the shared services VPC, so other VPCs won’t resolve cloud.example.com (PHZ lookups don’t traverse TGW). No B: B: Uses an EC2 conditional forwarder—adds latency, single points of failure, and admin overhead vs. the managed Resolver. Not “highest performance.
princajen
👍 2
Selected: A
Associating the private hosted zone with all Vpc's ensures native name resolution inside AWS without cross-VPC resolution challenges. Route 53 inbound resolver allows on-premises DNS servers to query Route 53 Private Hosted Zones over the Direct Connect link. Transit Gateway connects all VPCs and on-premises to the shared services VPC hosting the inbound resolver. This setup offers high performance and low complexity.
SofieneGh
👍 1
Selected: A
A is correct
CBMAN
👍 1
Selected: A
A is correct
diazed
👍 1
Selected: A
A is correct.
pekomari
👍 2
Selected: A
529問を全て行った結果合格できました！体感80%ほど似た問題があったので頑張ってください！
mssc
👍 3
Selected: A
I have just taken the exam and 75 percent of the questions were from here. Prepare well for these Questions. Good Luck!
FlyingHawk
👍 1
Selected: A
On-premises systems should be able to resolve and connect to cloud.example.com, it is inbound resolver, C is incorrect. All VPCS will need to associate their private zones to the Transit Gateway, associated only the shared VPC with TGW forces all the DNS query from other VPCS forward to shared VPC, add the latency. d is incorrect
pk0619
👍 1
Selected: A
When a Route 53 private hosted zone needs to be resolved in multiple VPCs and AWS accounts as described earlier, the most reliable pattern is to share the private hosted zone between accounts and associate it to each VPC that needs it.
jrheen
👍 1
A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
TariqKipkemei
👍 1
Selected: A
Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
to_to
👍 1
When I organized it slowly, I decided that it was "A" because it was attributed to an account, not a VPC.
to_to
👍 1
Selected: D
1-1. Private hosted zone One Account -> 2 Account PHZ is not Equals. 1-2. VPCs in Private hosted zone 2. On-Premise -> AWS Domain Name Query [ Route 53 Resolver ] 3. Private hosted zone - Route 53 Resolver
to_to
👍 1
Route 53 Resolver : inbound
veds85
👍 1
Selected: A
"All VPCs and only need inbound Resolver"
310e976
👍 1
Answer is A: Please see link below for the solution: https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html
masetromain
👍 1
Selected: A
The correct option would be option A: Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. This option will allow the on-premises systems to resolve and connect to cloud.example.com by forwarding the DNS queries to the inbound resolver in the shared services VPC, which will then forward the queries to the private hosted zone. All VPCs will be able to resolve cloud.example.com by resolving the queries through the private hosted zone associated to all VPCs. Additionally, this option takes advantage of the already existing AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway, which will provide the highest performance.
c73bf38
👍 1
Selected: A
The best architecture to meet the given requirements with the HIGHEST performance would be Option A: A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. This architecture ensures that all VPCs can resolve the cloud.example.com domain using the private hosted zone. Additionally, it creates a Route 53 inbound resolver in the shared services VPC that can handle DNS resolution requests from on-premises systems through the transit gateway. This setup allows for fast and efficient DNS resolution with minimal latency.
atirado
👍 3
Selected: A
All options mention a Shared Services VPC that is not in the question. This is used for Route 53 for cloud.example.com. Option A - Associating all VPCs with the private hosted zone allows resolution of cloud.example.com; an inbound resolves allows on-premise resource to resolve to cloud.example.com; the final bit of connectivity allows on-premise to connect and resolve to cloud.example.com Option B - An Amazon EC2 Conditional Forwarder does not apply in this situation because an Active Directory is not in play in this situation Option C - Would not work because it is relying on an Outbound resolver (from cloud to on-premise) Option D - Would not work because the other VPCs are not connected to the private zone. Moreover, connectivity is not complete because only the Shared Services VPC is connected to the Transit Gateway
higashikumi
👍 2
Selected: A
To achieve the highest performance hybrid DNS solution, the company should associate a Route 53 private hosted zone with "cloud.example.com" to all VPCs, then create a Route 53 inbound resolver in a shared services VPC. This inbound resolver is connected to the on-premises network via AWS Direct Connect and Transit Gateway, allowing on-premises systems to resolve the private hosted zone. Forwarding rules on the on-premises DNS server direct queries for "cloud.example.com" to the inbound resolver, ensuring seamless resolution for both on-premises and cloud resources.
amministrazione
👍 1
A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
fabriciollf
👍 2
Selected: D
"Inbound DNS resolution – Create Route 53 Resolver inbound endpoints in a centralized VPC and associate all the private hosted zones in your Landing Zone with this centralized VPC." Source: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/dns.html
robertohyena
👍 62
A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT B. EC2 conditional forwarder will not meet Highest performance requirement. NOT C. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT D. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
awsylum
👍 3
In your link, you missed this sentence: "The most reliable, performant and low-cost approach is to share and associate private hosted zones directly to all VPCs that need them." You share the PHZ via the Shared Services VPC. You use the .2 DNS Resolver Address in each VPC to connect to the PHZ in the shared services VPC for domain resolution.
alexkro
👍 1
You forgot an additional condition mentioned in the question: "All VPCs should be able to resolve cloud.example.com." Nobody said there are only shared VPCs there.
onlyvimal2103
👍 1
Inbound resolver + private zone
buiquangbk90
👍 1
Correct the answer: A
Helpnosense
👍 2
Selected: A
The 2nd requirement in the question is "All VPCs should be able to resolve cloud.example.com." So the answer is A, not D which is only one VPC not all VPCs.
AloraCloud
👍 1
Selected: A
You need to associate the private hosted zone to all the VPCs for them to be able to use it for DNS resolution.
ichi2kazu
👍 1
i think A.
jj888
👍 1
Selected: A
All VPC’s will need to associate their private hosted zones to all other VPC’s if required to
frmynd
👍 3
Selected: A
https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html
gofavad926
👍 1
Selected: A
By associating the Route 53 private hosted zone with all VPCs, resources within any of those VPCs can resolve domain names within the cloud.example.com domain.
MoT0ne
👍 1
Selected: D
Using "share service" is the magic word here
leoncao
👍 2
Selected: A
D is definitly wrong
Dgix
👍 1
A and B are out since they talk about attaching the private domain to all accounts. This is wrong; you attach it to the shared VPC in the networking account which then is used for any local VPCs. This reduces the question to whether we need an inbound or outbound resolver for the onprem infra; the answer is that for onprem to be able to resolve the domain, we need an inbound resolver. And therefore the only possible correct answer is D. I see that most people voted A, but I'm afraid that's wrong.
Shenannigan
👍 1
D is incorrect because - This would not provide the necessary DNS resolution for all VPCs, as only the shared services VPC would have the private hosted zone associated, limiting the resolution scope.
24Gel
👍 1
B C are definitely not answers
luis_guevara
👍 3
Selected: D
Most efficient way to get all the VPC's to be able to resolve the private domain is using a shared services VPC.
awsylum
👍 2
The answer is D. Why? Because you associate a single Private Hosted Zone with DNS Resolvers in multiple VPCs (.2 address). You don't associate a PHZ in each VPC. That's the point of each VPC having a DNS Resolver address. So, you use the Shared Services VPC to host the PHZ with the Route53 inbound endpoint. Each VPC uses the DNS Resolver address to connect to the Shared Services VPC. And on the flip side, the Transit Gateway allows the on-prem traffic to connect to all VPCs using the Route53 inbound endpoint. Scroll down to the On premises section of this page: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/
awsylum
👍 1
Just to clarify, the Transit Gateway is to provide Layer 3 networking between the on-prem and AWS environments, while the Inbound Route53 Endpoint is used to join the DNS of on-prem and AWS environments. I kind of mixed the two up in my explanation above.
awsgeek75
👍 3
Selected: A
BC don't have a resolver setup for on-prem traffic as outbound resolver is on AWS side. Even if D works, the traffic will have taken a longer route. D It is not connecting all the VPCs
GibaSP45
👍 3
Selected: A
https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
cgsoft
👍 1
Selected: A
All VPCs should be able to resolve cloud.example.com. This is possible if all VPCs are associated with the private hosted zone.
ninomfr64
👍 1
Selected: A
Not B. "EC2 conditional forwarder in the shared services VPC" as conditional forward is not needed in this scenario and also I am not aware of EC2 conditional forward (but I am not an expert) Not C. "private hosted zone to the shared services VPC" we need to have it attached to all VPCs and "Route 53 outbound resolver" is not needed as we do not need to resolve on-preme from VPCs in this scenario Not D. "private hosted zone to the shared services VPC" we need to have it attached to all VPCs, ref to https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html#:~:text=AWS%20Glossary-,Route%C2%A053%20Resolver%20endpoints%20and%20forwarding%20rules,-PDF (this is not super clear as diagrams do not include VPCs and steps do not refer to VPCs consistently) Thus A. is correct as we have all the key pieces needed listed there
abeb
👍 2
A is correct
KevinYao
👍 1
Selected: A
all vpc can access cloud.example.com domain name.
jainparag1
👍 1
D seems to be the right answer.
severlight
👍 1
Selected: A
DNS server aka 'Route 53 resolver' will only know how to resolve the hostname if you provide DNS table aka 'Route 53 PHZ' to it. Separate DNS server is available in all VPCs, hence you need to provide PHZ to all VPCs aka 'associate'.
rlf
👍 1
A. And this blog is also helpful to understand https://aws.amazon.com/blogs/architecture/using-route-53-private-hosted-zones-for-cross-account-multi-region-architectures/
puffetor
👍 1
Selected: A
https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
ansgohar
👍 2
Selected: A
A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
task_7
👍 3
Selected: D
D provides the best balance between performance, simplicity, and security, making it the most suitable choice for the given requirements. By using a Route 53 inbound resolver within the shared services VPC, you reduce the latency and complexity associated with forwarding DNS queries to other VPCs or EC2 instances.
Soweetadad
👍 1
Selected: A
Answer is A. In the link that someone posted, it says "When a Route 53 private hosted zone needs to be resolved in multiple VPCs and AWS accounts as described earlier, the most reliable pattern is to share the private hosted zone between accounts and associate it to each VPC that needs it." https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
career360guru
👍 1
Correct Answer is A. D does not meet the requirement of all VPC able to resolve example.com.
dimitry_khan_arc
👍 2
Selected: D
D is more suitable
vn_thanhtung
👍 1
https://aws.amazon.com/vi/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/#:~:text=Although%20it%20is%20possible%20to%20use%20forwarding%20rules%20to%20resolve%20private%20hosted%20zones%20in%20other%20VPCs%2C%20we%20do%20not%20recommend%20that.%20The%20most%20reliable%2C%20performant%20and%20low%2Dcost%20approach%20is%20to%20share%20and%20associate%20private%20hosted%20zones%20directly%20to%20all%20VPCs%20that%20need%20them Answer is A not D
weequan
👍 1
Selected: D
https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/
autobahn
👍 1
So which the correct answer? A or D? When most people have voted for A, should I take that as the correct answer?
chico2023
👍 1
Selected: A
Requirement 2: All VPCs should be able to resolve cloud.example.com.
Magoose
👍 2
Selected: A
Option D is incorrect because it associates the private hosted zone only with the shared services VPC, rather than all the VPCs. This does not meet the requirement of ensuring that all VPCs can resolve cloud.example.com
NikkyDicky
👍 1
Selected: A
it's a
Jonalb
👍 3
Selected: A
Its A https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html https://aws.amazon.com/pt/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
antonvigs
👍 2
Selected: A
"The most reliable, performant and low-cost approach is to share and associate private hosted zones directly to all VPCs that need them." Reference: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
antonvigs
👍 1
"The most reliable, performant and low-cost approach is to share and associate private hosted zones directly to all VPCs that need them." Ref:https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
tromyunpak
👍 1
all the vpc needs to reach the inbound resolver in the shared services vpc and so tgw attachments are needed. so IMO answer is A
Roontha
👍 1
Answer : A https://medium.com/tuimm/resolve-aws-private-hosted-zones-from-on-premise-with-route-53-inbound-resolver-ba683b371522
Roontha
👍 1
I go with D. AWS has given the info on this exact use case with Architecture diagram. https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
rtguru
👍 1
I go with D
dev112233xx
👍 1
Selected: D
A doesn't make sense! why attaching all the VPC to the TGW? was there a requirement in the question to share all VPC network? the requirement was to share only the PHZ with all VPCs and create inbound resolver for the On-premise, so i think D makes more sense.
dewlim
👍 1
exactly correct answer A.
Roontha
👍 1
@dewlim It seems to be answer D. Given AWS blog post explains with arch diagram https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
hellothereby
👍 1
A is correct.
RunkieMax
👍 1
Selected: A
A fit the best the question
Limlimwdwd
👍 1
Selected: A
should be for all VPC
AWS_Sam
👍 1
The correct answer is A. Another reason A is correct and D is wrong, because all VPCs need to be connected to the Transit Gateway for them to be able to communicate.
F_Eldin
👍 1
Selected: A
Option B is not optimal because the use of an EC2 conditional forwarder can introduce additional latency and potential points of failure. Option C is not optimal because it requires all VPCs to use the outbound resolver in the shared services VPC to resolve cloud.example.com, which may introduce additional latency. Option D is not optimal because it only allows the shared services VPC to resolve cloud.example.com, and all other VPCs and on-premises systems would have to forward DNS queries to the shared services VPC, which can introduce additional latency and potential points of failure.
God_Is_Love
👍 4
Selected: D
D is correct , not A https://d2908q01vomqb2.cloudfront.net/5b384ce32d8cdef02bc3a139d4cac0a22bb029e8 Route 53 private hosted zone ( example sqs.us-east-1.amazonaws.com) associated to the shared services VPC and (NOT all VPCs as in option A)
moses101
👍 1
A is the most correct Answer
rubio83
👍 1
Only with this dump its enough for the exam?
mfsec
👍 1
Selected: A
Associate the private hosted zone to all the VPCs.
IndreshKumar
👍 1
Selected: A
A. Correct answer
mKrishna
👍 1
Correct answer is A Why D is not correct - The transit gateway may need to forward requests to the inbound resolver in order to introduce additional latency.
kiran15789
👍 2
Selected: A
ttps://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
Jonalb
👍 1
On premises my friend.
krushna5966
👍 4
Every one has selected option A so why system is showing Option D can anyone explain
AWS_Sam
👍 1
I have the same question
gameoflove
👍 1
Selected: A
https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
Gabehcoud
👍 2
can I check with those who has written the exam, 1. was this question even there? 2. Was the answer A right?
ospherenet
👍 2
It appears that Option A is the correct answer. The company can associate the private hosted zone to all the VPCs and create a Route 53 inbound resolver in the shared services VPC. They can then attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. This will allow on-premises systems to resolve and connect to cloud.example.com and all VPCs to resolve cloud.example.com with the highest performance. Option B is incorrect because an EC2 conditional forwarder will not meet the highest performance requirement. Option C and D are incorrect because they both miss the requirement of associating the private hosted zone to all the VPCs.
Sarutobi
👍 1
Selected: A
A is correct.
Jacktheriser2019
👍 1
A answer
Nicocacik
👍 1
Selected: A
Definitely A
AjayD123
👍 1
Selected: A
A is correct answer as all VPCs need to be accessed
WuKongCoder
👍 2
A correct answer
arron86
👍 4
Selected: A
https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
zhangyu20000
👍 10
A because it requires all VPC can resolve the example.com. All VPCs must be associated with private hosted zone
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A satisfies both resolution requirements without introducing unnecessary query hairpins: associating the cloud.example.com private hosted zone with every VPC lets each VPC resolve the domain locally through Route 53. The Route 53 inbound Resolver endpoint in the shared services VPC gives on-premises DNS a managed, highly available target for forwarding cloud.example.com queries over the existing Direct Connect and Transit Gateway path. Attaching all VPCs to the transit gateway preserves the network path needed for on-premises clients to reach the inbound endpoint and for broader hybrid connectivity. Because VPC workloads resolve the private hosted zone directly and on-premises uses a native Route 53 endpoint rather than a self-managed forwarder, this is the highest-performance design among the choices.Why the Other Options Are Wrong
Option B replaces the managed Route 53 inbound Resolver endpoint with an Amazon EC2 conditional forwarder, which creates additional operational overhead, patching, scaling, and availability risk while not meeting the highest-performance requirement. Option C uses a Route 53 outbound Resolver, which is the wrong direction: an outbound endpoint forwards queries from VPCs to on-premises DNS, not from on-premises DNS into Route 53. Option C also fails to associate the private hosted zone with all VPCs. Option D associates the private hosted zone only with the shared services VPC and attaches only that VPC to the transit gateway, so other VPCs lack a described mechanism to resolve cloud.example.com and the design does not meet the all-VPC requirement.Community Comment Notes
robertohyena identifies A as correct and specifically rejects the EC2 conditional forwarder in B because it will not meet the highest-performance requirement. zhangyu20000 makes the key point that all VPCs must be associated with the private hosted zone so they can resolve cloud.example.com. awsylum highlights the AWS guidance to "share and associate private hosted zones directly to all VPCs that need them," which aligns with A's zone-association design. God_Is_Love argued for D using a diagram where the private hosted zone is associated with the shared services VPC, but that pattern depends on Resolver forwarding rules that option D does not include for the other VPCs.Official Reference
Exam Strategy
Focus on query direction: on-premises-to-Route 53 requires an inbound Resolver endpoint, while Route 53-to-on-premises requires an outbound endpoint. Then verify that every VPC needing the name is either associated with the private hosted zone or covered by explicit Resolver forwarding rules.
Frequently Asked Questions
Why is a Route 53 outbound resolver wrong for on-premises queries?
An outbound Resolver endpoint forwards DNS queries from VPCs to on-premises resolvers; on-premises systems need an inbound endpoint to query Route 53 private hosted zones.
Does associating the private hosted zone with every VPC reduce performance?
No. Local association lets each VPC answer cloud.example.com directly, avoiding hairpins through the shared services VPC and improving resolution performance.
Related Analysis
Practice All SAP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full SAP-C02 Practice Test →