SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?
⚠ Common exam trap
Watch out — candidates often confuse Route 53 Resolver rules (which forward queries to a target) with the need for both inbound and outbound endpoints to enable cross-account DNS resolution, leading them to choose Option A which lacks the necessary endpoint infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.
It uses Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account's private hosted zone, enabling centralized management of DNS records across accounts. This approach provides high availability and supports cross-account DNS resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.
Why it's wrong here
Resolver rules alone are not enough; the zone must be associated with a VPC.
- ✗
Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.
Why it's wrong here
Inbound endpoints accept queries from on-premises, not from other accounts.
- ✓
Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.
Why this is correct
Resolver endpoints enable cross-account DNS resolution.
- ✗
Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.
Why it's wrong here
Private hosted zones cannot be shared across accounts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.