ANS-C01 Network Security, Compliance and Governance Practice Question

A company is using Amazon Route 53 for DNS resolution. They want to restrict access to a private hosted zone so that only authorized VPCs can query it. Which configuration should they use?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Associate the private hosted zone with the authorized VPCs

Associating a private hosted zone with authorized VPCs allows only those VPCs to resolve records within the zone, restricting access as required. Option A is incorrect because network ACLs control traffic at the subnet level but do not restrict DNS queries to a specific hosted zone. Option B is incorrect because IAM policies control permissions for API actions (e.g., creating or modifying hosted zones), not the actual DNS query traffic. Option C is incorrect because security groups regulate traffic to and from network interfaces, not the resolution of DNS records in Route 53.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure a network ACL to block UDP port 53 from other VPCs
Why it's wrong here
NACLs are subnet-level, but DNS queries are resolved by Route 53, not by instances.
✗
Create an IAM policy to deny DNS queries from other VPCs
Why it's wrong here
IAM policies do not apply to DNS queries; they apply to API calls.
✗
Configure a security group to block DNS traffic from other VPCs
Why it's wrong here
Security groups apply to EC2 instances, not Route 53.
✓
Associate the private hosted zone with the authorized VPCs
Why this is correct
Private hosted zones are accessible only to associated VPCs.

Visual reference

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question