ANS-C01 VPC Peering DNS Resolution Practice Question
A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?
⚠ Common exam trap
A common pitfall is assuming the requester can enable DNS resolution by checking the option when creating the peering connection. In reality, the accepter must enable it when accepting or later. Also, candidates may forget to enable the VPC DNS attributes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.
To enable DNS resolution across a VPC peering connection, two conditions must be met. First, both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings, which requires both EnableDnsHostnames and EnableDnsSupport to be enabled (Option B). Second, the VPC peering connection itself must have DNS resolution enabled. This can be done by the accepter when accepting the peering connection or later by modifying the peering connection (Option D). Option A is incorrect because the requester does not accept the peering connection; the accepter does. Option C is not required for DNS resolution. Option E (route table entries) is necessary for connectivity but not specifically for DNS resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.
Why it's wrong here
Incorrect. The requester creates the peering request, but the accepter accepts it. The requester cannot accept the peering connection. Additionally, enabling DNS resolution can be done by either side, but the action must be performed by the accepter when accepting or later.
- ✓
Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.
Why this is correct
Correct. Both VPCs must have the EnableDnsHostnames and EnableDnsSupport attributes set to true to support DNS resolution.
- ✗
Ensure both VPCs are in the same AWS region.
Why it's wrong here
Incorrect. VPC peering can be cross-region, and DNS resolution works across regions with appropriate configuration.
- ✓
The accepter must modify the peering connection to enable DNS resolution from their side.
Why this is correct
Correct. The accepter must enable DNS resolution on the peering connection, either when accepting or by modifying the peering connection after acceptance.
- ✗
The route tables must include a route for the peered VPC's CIDR.
Why it's wrong here
Incorrect. Route table entries ensure network connectivity between VPCs but are not specifically required for DNS resolution.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?
hard- ✓ A.The DNS resolution settings for the VPC peering connection are not enabled.
- B.The route tables in the VPCs are not propagated to the subnets.
- C.The instances do not have ICMP traffic allowed.
- D.The VPC CIDR ranges overlap.
Why A: The most likely cause is that the VPC peering connection's DNS resolution settings are not enabled. While basic IP connectivity does not require DNS, if instances are using private DNS hostnames (a common default), DNS queries for the peered VPC will fail unless this setting is enabled. Since the route tables are correctly configured, security groups allow all traffic, and CIDR ranges do not overlap, the DNS resolution setting is the only remaining plausible cause from the options.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.