SOA-C02 Route 53 Resolver outbound endpoint Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a VPC peering connection and use the on-premises DNS IP as the DHCP option set.

  Why it's wrong here

  VPC peering only connects two VPCs, not a VPC to an on-premises network, so it cannot provide the network path needed to reach the on-premises DNS server. Moreover, even if the DHCP option set points instances to the on-premises DNS IP, DHCP only tells instances which DNS server to use; it does not create a forwarding mechanism or route that allows the VPC to send queries to that IP over peering. Peering also lacks transitive routing and would not support forwarding through an intermediate VPC to reach on-premises.

• ✓

  Configure Route 53 Resolver outbound endpoint to forward queries to on-premises DNS.

  Why this is correct

  A Route 53 Resolver outbound endpoint is the correct answer because it allows DNS queries initiated from within the VPC to be forwarded to an on-premises DNS server via a forwarding rule. The endpoint consists of elastic network interfaces (ENIs) in your subnets that receive queries from instances, evaluate the forwarding rules (e.g., by domain name), and forward matching queries over your VPN or Direct Connect to the on-premises resolver. This enables AWS resources to resolve hostnames for on-premises servers, fulfilling the requirement directly.

• ✗

  Create a VPC peering connection to the on-premises network.

  Why it's wrong here

  This option is invalid because a VPC peering connection can only be established between two VPCs—it cannot connect a VPC to an on-premises data center. On-premises networks require a VPN connection or AWS Direct Connect to create the underlying Layer 3 connectivity. Even if such connectivity existed, a mere peering connection would not provide DNS forwarding; you would still need a Route 53 Resolver outbound endpoint or a custom DNS forwarder to resolve on-premises names.

• ✗

  Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.

  Why it's wrong here

  A Route 53 Resolver inbound endpoint is used to enable DNS resolution in the opposite direction: it allows on-premises DNS servers to forward queries into AWS so they can resolve records in your private hosted zones or custom DNS names. The question asks for AWS resources to resolve on-premises hostnames, which requires an outbound endpoint, not inbound. Confusing the two directions is a common pitfall; the direction of the endpoint determines which side initiates forwarding.

Go deeper

Related to this question