SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?
⚠ Common exam trap
It's easy for candidates to assume associating the outbound endpoint with workload VPCs via RAM automatically forwards all DNS queries, but they forget that a forwarding rule is required to specify which domain names should be sent to the outbound endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.
The outbound endpoint forwards DNS queries from the workload VPCs to on-premises resolvers, but it does not automatically configure the workload VPCs to use it. A Route 53 Resolver rule must be created in each workload account (or centrally via RAM) to forward queries for the on-premises domain to the outbound endpoint. Without this rule, the workload VPCs will not send queries for on-premises hostnames to the outbound endpoint, so resolution fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Establish VPC peering between the workload VPCs and the networking account VPC.
Why it's wrong here
VPC peering is not needed for DNS forwarding when Transit Gateway is used.
- ✗
Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.
Why it's wrong here
Private hosted zone resolves domain names to AWS resources, not forwarding to on-premises.
- ✗
Create a Route 53 Resolver inbound endpoint in the networking account.
Why it's wrong here
Inbound endpoint is for on-premises to resolve AWS resources, not the other way.
- ✓
Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.
Why this is correct
Resolver rules determine how DNS queries are forwarded.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.