How Should a Company Design High-Performance Hybrid DNS for cloud.example.com?

SAP-C02 By islever Editorial Last updated

Architect network connectivity strategies. Design a solution to meet performance objectives.

Short answer

A Associate the cloud.example.com private hosted zone with all VPCs and forward on-premises DNS to a Route 53 inbound Resolver endpoint in the shared services VPC.

Question

A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs.
The company has the following DNS resolution requirements:
On-premises systems should be able to resolve and connect to cloud.example.com.
All VPCs should be able to resolve cloud.example.com.
There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway.
Which architecture should the company use to meet these requirements with the HIGHEST performance?
  1. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. Correct Answer
  2. Associate the private hosted zone to all the VPCs. Deploy an Amazon EC2 conditional forwarder in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the conditional forwarder.
  3. Associate the private hosted zone to the shared services VPCreate a Route 53 outbound resolver in the shared services VPAttach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the outbound resolver.
  4. Associate the private hosted zone to the shared services VPC. Create a Route 53 inbound resolver in the shared services VPC. Attach the shared services VPC to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.

Key Takeaways

The question tests whether you can combine Route 53 private hosted zone association with the correct directional Resolver endpoint for hybrid DNS, and the trap is choosing an outbound resolver or an EC2-based conditional forwarder that adds latency and management overhead.

This SAP-C02 hybrid DNS scenario requires cloud.example.com to resolve from every VPC and from on-premises over Direct Connect and Transit Gateway. The page establishes that option A is correct because associating the private hosted zone with all VPCs and forwarding on-premises queries to a Route 53 inbound Resolver endpoint delivers the highest performance.

Common mistake: A common wrong answer is D: it centralizes the private hosted zone and inbound resolver in the shared services VPC but associates the zone with only that VPC, so workloads in other VPCs cannot resolve cloud.example.com without additional Resolver forwarding rules.

Expert Analysis

Why the Answer Is Correct

Option A satisfies both resolution requirements without introducing unnecessary query hairpins: associating the cloud.example.com private hosted zone with every VPC lets each VPC resolve the domain locally through Route 53. The Route 53 inbound Resolver endpoint in the shared services VPC gives on-premises DNS a managed, highly available target for forwarding cloud.example.com queries over the existing Direct Connect and Transit Gateway path. Attaching all VPCs to the transit gateway preserves the network path needed for on-premises clients to reach the inbound endpoint and for broader hybrid connectivity. Because VPC workloads resolve the private hosted zone directly and on-premises uses a native Route 53 endpoint rather than a self-managed forwarder, this is the highest-performance design among the choices.

Why the Other Options Are Wrong

Option B replaces the managed Route 53 inbound Resolver endpoint with an Amazon EC2 conditional forwarder, which creates additional operational overhead, patching, scaling, and availability risk while not meeting the highest-performance requirement. Option C uses a Route 53 outbound Resolver, which is the wrong direction: an outbound endpoint forwards queries from VPCs to on-premises DNS, not from on-premises DNS into Route 53. Option C also fails to associate the private hosted zone with all VPCs. Option D associates the private hosted zone only with the shared services VPC and attaches only that VPC to the transit gateway, so other VPCs lack a described mechanism to resolve cloud.example.com and the design does not meet the all-VPC requirement.

Community Comment Notes

robertohyena identifies A as correct and specifically rejects the EC2 conditional forwarder in B because it will not meet the highest-performance requirement. zhangyu20000 makes the key point that all VPCs must be associated with the private hosted zone so they can resolve cloud.example.com. awsylum highlights the AWS guidance to "share and associate private hosted zones directly to all VPCs that need them," which aligns with A's zone-association design. God_Is_Love argued for D using a diagram where the private hosted zone is associated with the shared services VPC, but that pattern depends on Resolver forwarding rules that option D does not include for the other VPCs.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Focus on query direction: on-premises-to-Route 53 requires an inbound Resolver endpoint, while Route 53-to-on-premises requires an outbound endpoint. Then verify that every VPC needing the name is either associated with the private hosted zone or covered by explicit Resolver forwarding rules.

Frequently Asked Questions

Why is a Route 53 outbound resolver wrong for on-premises queries?

An outbound Resolver endpoint forwards DNS queries from VPCs to on-premises resolvers; on-premises systems need an inbound endpoint to query Route 53 private hosted zones.

Does associating the private hosted zone with every VPC reduce performance?

No. Local association lets each VPC answer cloud.example.com directly, avoiding hairpins through the shared services VPC and improving resolution performance.

More SAP-C02 FAQ →

Discussion 94 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 94

  1. robertohyena 👍 62
    A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT B. EC2 conditional forwarder will not meet Highest performance requirement. NOT C. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT D. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
  2. zhangyu20000 👍 10
    A because it requires all VPC can resolve the example.com. All VPCs must be associated with private hosted zone
  3. God_Is_Love 👍 4 Answered D
    D is correct , not A https://d2908q01vomqb2.cloudfront.net/5b384ce32d8cdef02bc3a139d4cac0a22bb029e8 Route 53 private hosted zone ( example sqs.us-east-1.amazonaws.com) associated to the shared services VPC and (NOT all VPCs as in option A)
  4. krushna5966 👍 4
    Every one has selected option A so why system is showing Option D can anyone explain
  5. atirado 👍 3 Answered A
    All options mention a Shared Services VPC that is not in the question. This is used for Route 53 for cloud.example.com. Option A - Associating all VPCs with the private hosted zone allows resolution of cloud.example.com; an inbound resolves allows on-premise resource to resolve to cloud.example.com; the final bit of connectivity allows on-premise to connect and resolve to cloud.example.com Option B - An Amazon EC2 Conditional Forwarder does not apply in this situation because an Active Directory is not in play in this situation Option C - Would not work because it is relying on an Outbound resolver (from cloud to on-premise) Option D - Would not work because the other VPCs are not connected to the private zone. Moreover, connectivity is not complete because only the Shared Services VPC is connected to the Transit Gateway
Show 25 more comments
  1. awsylum 👍 3
    In your link, you missed this sentence: "The most reliable, performant and low-cost approach is to share and associate private hosted zones directly to all VPCs that need them." You share the PHZ via the Shared Services VPC. You use the .2 DNS Resolver Address in each VPC to connect to the PHZ in the shared services VPC for domain resolution.
  2. task_7 👍 3 Answered D
    D provides the best balance between performance, simplicity, and security, making it the most suitable choice for the given requirements. By using a Route 53 inbound resolver within the shared services VPC, you reduce the latency and complexity associated with forwarding DNS queries to other VPCs or EC2 instances.
  3. HarryNZ1982 👍 3 Answered A
    Okay all. I gave the Exam yesterday and passed it. Thank you all for your contributions. I must say the exam was quite tough and there were a number of Gen AI related questions especially centred around AWS Bedrock APIs, Bedrock Guardrails , Denied Topics as well as content filtering
  4. Jonalb 👍 3 Answered A
    Its A https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html https://aws.amazon.com/pt/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
  5. awsgeek75 👍 3 Answered A
    BC don't have a resolver setup for on-prem traffic as outbound resolver is on AWS side. Even if D works, the traffic will have taken a longer route. D It is not connecting all the VPCs
  6. GibaSP45 👍 3 Answered A
    https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
  7. frmynd 👍 3 Answered A
    https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html
  8. mssc 👍 3 Answered A
    I have just taken the exam and 75 percent of the questions were from here. Prepare well for these Questions. Good Luck!
  9. luis_guevara 👍 3 Answered D
    Most efficient way to get all the VPC's to be able to resolve the private domain is using a shared services VPC.
  10. ospherenet 👍 2
    It appears that Option A is the correct answer. The company can associate the private hosted zone to all the VPCs and create a Route 53 inbound resolver in the shared services VPC. They can then attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver. This will allow on-premises systems to resolve and connect to cloud.example.com and all VPCs to resolve cloud.example.com with the highest performance. Option B is incorrect because an EC2 conditional forwarder will not meet the highest performance requirement. Option C and D are incorrect because they both miss the requirement of associating the private hosted zone to all the VPCs.
  11. awsylum 👍 2
    The answer is D. Why? Because you associate a single Private Hosted Zone with DNS Resolvers in multiple VPCs (.2 address). You don't associate a PHZ in each VPC. That's the point of each VPC having a DNS Resolver address. So, you use the Shared Services VPC to host the PHZ with the Route53 inbound endpoint. Each VPC uses the DNS Resolver address to connect to the Shared Services VPC. And on the flip side, the Transit Gateway allows the on-prem traffic to connect to all VPCs using the Route53 inbound endpoint. Scroll down to the On premises section of this page: https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/
  12. higashikumi 👍 2 Answered A
    To achieve the highest performance hybrid DNS solution, the company should associate a Route 53 private hosted zone with "cloud.example.com" to all VPCs, then create a Route 53 inbound resolver in a shared services VPC. This inbound resolver is connected to the on-premises network via AWS Direct Connect and Transit Gateway, allowing on-premises systems to resolve the private hosted zone. Forwarding rules on the on-premises DNS server direct queries for "cloud.example.com" to the inbound resolver, ensuring seamless resolution for both on-premises and cloud resources.
  13. llapsiwala 👍 2 Answered A
    A: Private hosted zone should be associated with all VPCs for them to resolve cloud.example.com. Route 53 inbound resolver for on-prem to connect to route53. No C & D: The PHZ is only associated with the shared services VPC, so other VPCs won’t resolve cloud.example.com (PHZ lookups don’t traverse TGW). No B: B: Uses an EC2 conditional forwarder—adds latency, single points of failure, and admin overhead vs. the managed Resolver. Not “highest performance.
  14. princajen 👍 2 Answered A
    Associating the private hosted zone with all Vpc's ensures native name resolution inside AWS without cross-VPC resolution challenges. Route 53 inbound resolver allows on-premises DNS servers to query Route 53 Private Hosted Zones over the Direct Connect link. Transit Gateway connects all VPCs and on-premises to the shared services VPC hosting the inbound resolver. This setup offers high performance and low complexity.
  15. fabriciollf 👍 2 Answered D
    "Inbound DNS resolution – Create Route 53 Resolver inbound endpoints in a centralized VPC and associate all the private hosted zones in your Landing Zone with this centralized VPC." Source: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/dns.html
  16. antonvigs 👍 2 Answered A
    "The most reliable, performant and low-cost approach is to share and associate private hosted zones directly to all VPCs that need them." Reference: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
  17. EzKkk 👍 2 Answered A
    - For PHZ, you have to associate VPCs so it could resolve the domain - On-prem should be able to resolve PHZ => Need inbound endpoint - Use Shared Service VPC to host inbound endpoint and use Transit Gateway to manage P2P connection => Scaleable solution
  18. Magoose 👍 2 Answered A
    Option D is incorrect because it associates the private hosted zone only with the shared services VPC, rather than all the VPCs. This does not meet the requirement of ensuring that all VPCs can resolve cloud.example.com
  19. Helpnosense 👍 2 Answered A
    The 2nd requirement in the question is "All VPCs should be able to resolve cloud.example.com." So the answer is A, not D which is only one VPC not all VPCs.
  20. kiran15789 👍 2 Answered A
    ttps://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/
  21. Gabehcoud 👍 2
    can I check with those who has written the exam, 1. was this question even there? 2. Was the answer A right?
  22. pekomari 👍 2 Answered A
    529問を全て行った結果合格できました！体感80%ほど似た問題があったので頑張ってください！
  23. leoncao 👍 2 Answered A
    D is definitly wrong
  24. dimitry_khan_arc 👍 2 Answered D
    D is more suitable
  25. WuKongCoder 👍 2
    A correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cost-Effective Image Processing with SQS and S3 Lifecycle Policies

S-grade

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide