The correct answer is to configure a Route 53 Resolver inbound endpoint, because while the DHCP options set provides the on-premises DNS server IP to AWS resources, it only handles queries originating from within the VPC; the missing piece is the reverse path that allows on-premises DNS servers to forward queries to AWS for resolution of AWS-hosted names. This inbound endpoint acts as a bridge, receiving DNS queries from on-premises and resolving them against your private hosted zones in Route 53. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of hybrid DNS architectures and the distinction between outbound (AWS to on-premises) and inbound (on-premises to AWS) resolver endpoints. A common trap is assuming the DHCP options set alone enables bidirectional resolution, when it only handles the AWS-to-on-premises direction. Memory tip: think “inbound for incoming queries from on-premises to AWS,” like a one-way door that lets your local servers ask AWS for DNS answers.
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company needs to resolve DNS names for on-premises servers from AWS. They have set up a DHCP options set with the on-premises DNS server IP. Which additional step is required?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.
Option D is correct because the scenario requires resolving DNS names for on-premises servers from AWS. A Route 53 Resolver inbound endpoint allows on-premises DNS servers to forward queries to AWS, enabling resolution of AWS-hosted DNS names from on-premises. The DHCP options set already provides the on-premises DNS server IP to AWS resources, but the missing step is the reverse path: allowing on-premises to query AWS DNS, which the inbound endpoint facilitates.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Create a VPC peering connection and use the on-premises DNS IP as the DHCP option set.
Why it's wrong here
Peering is unnecessary; inbound endpoint solves it.
✗
Configure Route 53 Resolver outbound endpoint to forward queries to on-premises DNS.
Why it's wrong here
Outbound endpoint is for resolving AWS names on-premises.
✗
Create a VPC peering connection to the on-premises network.
Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.
Why this is correct
Inbound endpoint allows on-premises DNS to forward queries.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing the direction of DNS resolution; candidates often pick the outbound endpoint (Option B) thinking it forwards queries to on-premises, but the requirement is to resolve on-premises names from AWS, which actually requires an inbound endpoint to allow on-premises DNS to query AWS.
Detailed technical explanation
How to think about this question
Route 53 Resolver inbound endpoints use Elastic Network Interfaces (ENIs) in the VPC with private IP addresses, which on-premises DNS servers can target as forwarders. The DHCP options set assigns the on-premises DNS server IP to AWS instances, but for conditional forwarding (e.g., resolving custom domain names hosted in AWS), the inbound endpoint is essential. In real-world hybrid architectures, this setup often pairs with an outbound endpoint for bidirectional resolution, but the question specifically asks for resolving on-premises names from AWS, which requires the inbound endpoint.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Networking and Content Delivery — This question tests Networking and Content Delivery — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS. — Option D is correct because the scenario requires resolving DNS names for on-premises servers from AWS. A Route 53 Resolver inbound endpoint allows on-premises DNS servers to forward queries to AWS, enabling resolution of AWS-hosted DNS names from on-premises. The DHCP options set already provides the on-premises DNS server IP to AWS resources, but the missing step is the reverse path: allowing on-premises to query AWS DNS, which the inbound endpoint facilitates.
What should I do if I get this SOA-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.