SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?
⚠ Common exam trap
A common mix-up: candidates confuse VPC peering with DNS resolution, assuming that network connectivity alone enables private hosted zone resolution, but Route 53 private hosted zones require explicit DNS query forwarding or association, which is not provided by peering alone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM
Route 53 Resolver outbound endpoints in the central account can forward DNS queries to the central private hosted zones, and the associated Resolver rules can be shared with other accounts via AWS Resource Access Manager (RAM). This provides a centralized, scalable DNS resolution architecture without requiring VPC peering or duplicating hosted zones across accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account
Why it's wrong here
This does not centralize DNS management.
- ✓
Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM
Why this is correct
This allows conditional forwarding of DNS queries to the central hosted zones.
- ✗
Create a VPC peering connection between each VPC and the central account's VPC
Why it's wrong here
VPC peering does not automatically resolve private hosted zones across accounts.
- ✗
Use AWS PrivateLink to connect VPCs to a central DNS service
Why it's wrong here
PrivateLink is for accessing services via NLB, not for DNS resolution.
Visual reference
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.