How Do You Resolve an On-Premises SQL Server Name from a VPC?
An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name. Which solution will fix this problem?
Community Insight
The exam tests whether you know that VPC-initiated queries to on-premises DNS go through an outbound Resolver endpoint with a forwarding rule, while the common trap is confusing inbound endpoints or system rules with conditional forwarding.
Hybrid DNS resolution from a VPC to an on-premises Microsoft SQL Server requires a Route 53 Resolver outbound endpoint and a forwarding rule for example.com. This page explains why the outbound endpoint, not an inbound endpoint or system rule, is the correct fix and how the rule must be associated.
Many candidates choose an inbound endpoint because it sounds like the VPC needs to receive DNS, but inbound endpoints serve on-premises clients querying VPC names; the VPC's own query to mssql.example.com must leave through an outbound endpoint.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The EC2 instance uses the default DHCP option set, so its DNS queries go to the Amazon Route 53 Resolver in the VPC. Because mssql.example.com is hosted on-premises, Resolver has no authoritative record for it and must conditionally forward the example.com namespace to the on-premises DNS server. An outbound Resolver endpoint provides the ENIs in the VPC subnets that send those queries out, and the forwarding rule supplies the target IP addresses and is associated with the VPC so it applies to this instance. Option C combines exactly those two required elements.Why the Other Options Are Wrong
Options A and B use an inbound Resolver endpoint, which is designed for the reverse direction: on-premises clients querying names hosted in the VPC or private hosted zones. Options B and D rely on a system rule, but system rules are created and managed by AWS for private hosted zones and cannot be repurposed to forward example.com to an on-premises Microsoft SQL Server. Option D has the correct outbound endpoint but pairs it with the wrong rule type, so the conditional forwarding for example.com still would not be configured.Community Comment Notes
The single learner comment, posted by Bad_Mat, identifies C as the correct answer and describes creating an outbound Resolver endpoint plus a forwarding rule for example.com associated with the VPC. That matches the AWS hybrid-DNS design: outbound endpoint for VPC-originated queries, forwarding rule for the on-premises domain. No comment argues for an inbound endpoint or system rule, so the community record does not create a competing rationale.Official Reference
Exam Strategy
Map the direction of the DNS query first: VPC to on-premises is outbound; on-premises to VPC is inbound. Then match the rule type—forwarding rules are for conditional forwarding of a domain such as example.com, while system rules are managed by AWS for private hosted zones.
Frequently Asked Questions
Why is an inbound Resolver endpoint wrong for mssql.example.com?
Inbound endpoints accept DNS queries from on-premises into the VPC; they do not forward the VPC's own queries out to the on-premises DNS server that knows mssql.example.com.
Can a system rule forward example.com to on-premises DNS?
No. System rules are AWS-managed rules for private hosted zones; forwarding example.com to on-premises DNS requires a forwarding rule used with an outbound Resolver endpoint.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →