SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure route propagation from the VPN to the VPC's route table.

  Why it's wrong here

  Route propagation in the VPC route table is a BGP-based mechanism for learning network routes from the VPN connection, not a DNS service. Adding propagated routes tells VPC routers how to send traffic to on-premises CIDRs, but it does not configure Route 53 to answer DNS queries on behalf of the on-premises network. VPC DNS resolution is governed by the VPC's DNS settings and Route 53 Resolver endpoints, not by route table advertisements.

• ✗

  Associate the private hosted zone with the on-premises network.

  Why it's wrong here

  A private hosted zone can be associated only with VPCs, using either a same-account association or an authorized cross-account VPC association. The on-premises network is not a VPC, so the association API will not accept it, and the zone has no ability to service DNS queries from outside the VPC(s) to which it is linked. To provide resolution for on-premises clients, you must expose the private zone through a Route 53 inbound resolver endpoint in the associated VPC.

• ✓

  Enable DNS resolution and DNS hostnames for the VPC.

  Why this is correct

  This is a required VPC setting: the VPC must have both DNS resolution (the Amazon-provided DNS server at the VPC CIDR + 2) and DNS hostnames enabled. When DNS resolution is enabled, Route 53 can answer queries against private hosted zones from instances or the VPC resolver; DNS hostnames is necessary for AWS to assign and use internal DNS names for instances. Without these settings, the VPC's resolver behavior is disabled and private-hosted-zone lookups fail.

• ✗

  Create a public hosted zone with the same name and associate it with the VPC.

  Why it's wrong here

  A public hosted zone is an internet-facing DNS namespace intended for routing traffic from resolvers outside AWS, and it cannot be 'associated with a VPC' in the way private hosted zones can. The association operation is only valid for private hosted zones, and a public hosted zone requires public DNS delegation via name servers, not a VPC attachment. Creating a public zone with the same name would not help private resolution and could actually confuse hybrid DNS routing.

• ✓

  Create a Route 53 inbound resolver endpoint in the VPC.

  Why this is correct

  A Route 53 inbound resolver endpoint provisions elastic network interfaces in the VPC with dedicated IP addresses that on-premises DNS resolvers can forward queries to via conditional forwarding. This endpoint accepts DNS traffic from the on-premises network and forwards it to the Route 53 private hosted zone's resolver, making hybrid name resolution possible. The endpoint is the missing piece for non-VPC clients to reach the private hosted zone without changing the zone's VPC association.

Go deeper

Related to this question