Control Access to Route 53 Private Hosted Zone Across Accounts
A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)
Quick Answer
The answer is to use AWS RAM to share the private hosted zone with the other accounts, then restrict IAM permissions to control which VPCs can associate with the zone, and finally verify that the shared zone’s association authorization is properly configured. This approach works because AWS Resource Access Manager (RAM) enables cross-account sharing of Route 53 private hosted zones without duplicating DNS records, while IAM policies act as a gatekeeper to ensure only authorized principals can initiate VPC associations, preventing rogue VPCs from resolving internal records. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of the shared responsibility model for DNS resolution across organizational boundaries—a common trap is assuming VPC peering alone grants DNS access, when in fact RAM and IAM are required for explicit authorization. Remember the mnemonic “RAM to share, IAM to care” to recall that sharing the zone is not enough; you must also lock down who can associate VPCs.
⚠ Common exam trap
Test-takers frequently confuse VPC peering with DNS resolution; peering provides network connectivity but does not automatically grant DNS resolution from a private hosted zone, which requires explicit association or sharing via AWS RAM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.
Restricting IAM permissions ensures that only authorized users can associate VPCs with the private hosted zone, preventing unauthorized VPCs from resolving records. This is a fundamental security control for managing cross-account DNS resolution in Route 53.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.
Why it's wrong here
Resolver rules are for outbound queries, not for authorization.
- ✓
Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.
Why this is correct
IAM permissions control who can perform the association.
- ✓
Associate each VPC with the private hosted zone using the authorize zone association API.
Why this is correct
Authorization is required to associate VPCs from other accounts.
- ✓
Use AWS RAM to share the private hosted zone with the other accounts.
Why this is correct
RAM is used to share the hosted zone so that accounts can associate their VPCs.
- ✗
Create a VPC peering connection between the central account and each VPC.
Why it's wrong here
VPC peering is not needed for Route 53 private hosted zones.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?
medium- A.Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account
- ✓ B.Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM
- C.Create a VPC peering connection between each VPC and the central account's VPC
- D.Use AWS PrivateLink to connect VPCs to a central DNS service
Why B: Route 53 Resolver outbound endpoints in the central account can forward DNS queries to the central private hosted zones, and the associated Resolver rules can be shared with other accounts via AWS Resource Access Manager (RAM). This provides a centralized, scalable DNS resolution architecture without requiring VPC peering or duplicating hosted zones across accounts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.