How Do You Resolve an On-Premises SQL Server Name from a VPC?

SOA-C03 By islever Editorial Last updated

Configure domains, DNS services, and content delivery. Troubleshoot network connectivity issues.

Short answer

C Create a Route 53 Resolver outbound endpoint and associate a forwarding rule for example.com with the VPC so EC2 queries reach the on-premises DNS server.

Question

An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name.
Which solution will fix this problem?
  1. Create an Amazon Route 53 Resolver inbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
  2. Create an Amazon Route 53 Resolver inbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
  3. Create an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC. Correct Answer
  4. Create an Amazon Route 53 Resolver outbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.

Key Takeaways

The exam tests whether you know that VPC-initiated queries to on-premises DNS go through an outbound Resolver endpoint with a forwarding rule, while the common trap is confusing inbound endpoints or system rules with conditional forwarding.

Hybrid DNS resolution from a VPC to an on-premises Microsoft SQL Server requires a Route 53 Resolver outbound endpoint and a forwarding rule for example.com. This page explains why the outbound endpoint, not an inbound endpoint or system rule, is the correct fix and how the rule must be associated.

Common mistake: Many candidates choose an inbound endpoint because it sounds like the VPC needs to receive DNS, but inbound endpoints serve on-premises clients querying VPC names; the VPC's own query to mssql.example.com must leave through an outbound endpoint.

Expert Analysis

Why the Answer Is Correct

The EC2 instance uses the default DHCP option set, so its DNS queries go to the Amazon Route 53 Resolver in the VPC. Because mssql.example.com is hosted on-premises, Resolver has no authoritative record for it and must conditionally forward the example.com namespace to the on-premises DNS server. An outbound Resolver endpoint provides the ENIs in the VPC subnets that send those queries out, and the forwarding rule supplies the target IP addresses and is associated with the VPC so it applies to this instance. Option C combines exactly those two required elements.

Why the Other Options Are Wrong

Options A and B use an inbound Resolver endpoint, which is designed for the reverse direction: on-premises clients querying names hosted in the VPC or private hosted zones. Options B and D rely on a system rule, but system rules are created and managed by AWS for private hosted zones and cannot be repurposed to forward example.com to an on-premises Microsoft SQL Server. Option D has the correct outbound endpoint but pairs it with the wrong rule type, so the conditional forwarding for example.com still would not be configured.

Community Comment Notes

The single learner comment, posted by Bad_Mat, identifies C as the correct answer and describes creating an outbound Resolver endpoint plus a forwarding rule for example.com associated with the VPC. That matches the AWS hybrid-DNS design: outbound endpoint for VPC-originated queries, forwarding rule for the on-premises domain. No comment argues for an inbound endpoint or system rule, so the community record does not create a competing rationale.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Map the direction of the DNS query first: VPC to on-premises is outbound; on-premises to VPC is inbound. Then match the rule type—forwarding rules are for conditional forwarding of a domain such as example.com, while system rules are managed by AWS for private hosted zones.

Frequently Asked Questions

Why is an inbound Resolver endpoint wrong for mssql.example.com?

Inbound endpoints accept DNS queries from on-premises into the VPC; they do not forward the VPC's own queries out to the on-premises DNS server that knows mssql.example.com.

Can a system rule forward example.com to on-premises DNS?

No. System rules are AWS-managed rules for private hosted zones; forwarding example.com to on-premises DNS requires a forwarding rule used with an outbound Resolver endpoint.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Bad_Mat 👍 1 Answered C
    The correct answer is C. Create an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide