ANS-C01 Network Design Practice Question
A company has a hub-and-spoke VPC architecture using AWS Transit Gateway. The hub VPC contains shared services (e.g., Active Directory). Spoke VPCs need to resolve DNS names from the hub VPC. The hub VPC has an Amazon Route 53 Resolver inbound endpoint. What is the correct configuration for the spoke VPCs to use this endpoint?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that VPC peering or DHCP options alone can forward DNS traffic, but Route 53 Resolver endpoints are required to intercept and forward DNS queries across VPCs in a hub-and-spoke architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an outbound endpoint in the spoke VPC and associate a resolver rule that forwards queries to the inbound endpoint in the hub VPC
It uses an outbound endpoint in the spoke VPC to forward DNS queries to the hub VPC's inbound endpoint via a Route 53 Resolver rule. This allows the spoke VPC to resolve private DNS names hosted in the hub VPC without requiring DHCP changes or additional inbound endpoints, leveraging the hub's existing DNS infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the spoke VPC's DHCP options set to use the hub VPC's CIDR as the domain name server
Why it's wrong here
DHCP options only accept IP addresses, not VPC CIDRs. The inbound endpoint IPs must be specified.
- ✗
Create an inbound endpoint in each spoke VPC
Why it's wrong here
Inbound endpoints are for receiving DNS queries from on-premises, not for forwarding to another VPC.
- ✗
Use VPC peering and configure the spoke VPC's route table to route DNS traffic to the hub VPC
Why it's wrong here
Routing DNS traffic over VPC peering is not sufficient; DNS resolution requires proper resolver configuration.
- ✓
Create an outbound endpoint in the spoke VPC and associate a resolver rule that forwards queries to the inbound endpoint in the hub VPC
Why this is correct
This configuration allows spoke VPCs to forward DNS queries to the hub's inbound endpoint for resolution.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.