AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 70

A company is using Amazon Route 53 Resolver DNS Firewall in a VPC to block all domains except domains that are on an approved list. The company is concerned that if DNS Firewall is unresponsive, resources in the VPC might be affected if the network cannot resolve any DNS queries. To maintain application service level agreements, the company needs DNS queries to continue to resolve even if Route 53 Resolver does not receive a response from DNS Firewall.
Which change should a network engineer implement to meet these requirements?

Answer options

• A. Update the DNS Firewall VPC configuration to disable fail open for the VPC.
• B. Update the DNS Firewall VPC configuration to enable fail open for the VPC.
• C. Create a new DHCP options set with parameter dns_firewall_fail_open=false. Associate the new DHCP options set with the VPC.
• D. Create a new DHCP options set with parameter dns_firewall_fail_open=true. Associate the new DHCP options set with the VPC.

Correct answer: B

Explanation

Enabling fail open for the VPC allows DNS queries to be resolved even when the DNS Firewall is unresponsive, thus maintaining application availability. Disabling fail open would prevent queries from resolving and could lead to service interruptions. The DHCP options related to dns_firewall_fail_open are irrelevant since the correct method to achieve the desired behavior is through the VPC configuration directly.