AWS Certified Advanced Networking – Specialty (ANS-C00) — Question 47

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone `awscloud:internal` from the corporate network. An AWS Direct
Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for `awscloud.internal` to the IP address 192.168.0.2.
From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for `server.awscloud.internal`, the query times out. You receive no response.
How should you enable successful queries for `server.awscloud.internal`?

Answer options

• A. Attach an internet gateway to the VPC and create a default route.
• B. Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True
• C. Relocate the BIND DNS Resolver to the corporate network.
• D. Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.

Correct answer: B

Explanation

The correct answer is B because enabling DNS hostnames and support in the VPC settings allows the private DNS zone to resolve correctly. Option A is incorrect as an internet gateway is unnecessary for private DNS resolution. Option C is not a viable solution since the DNS Resolver needs to reside within the VPC to access the private zone. Option D does not address the root cause, which is related to the VPC settings rather than security group configurations.