Design hybrid connectivity and name resolution between on-premises, co-location and AWS using AWS Direct Connect, AWS Site-to-Site VPN and Amazon Route 53 Resolver.

A manufacturer is migrating workloads to AWS and needs name resolution to work in both directions over its existing Direct Connect connection. Resources in its VPCs must resolve records hosted in the company's on-premises Active Directory DNS, and on-premises servers must resolve records in private hosted zones associated with the VPCs. The team wants a managed solution that avoids running and patching its own DNS forwarder fleet on EC2. Which Amazon Route 53 Resolver configuration MOST efficiently provides this bidirectional hybrid DNS?

• ADeploy a Route 53 Resolver inbound endpoint and forwarding rules pointing at the on-premises DNS servers so queries from both the VPCs and on-premises flow through the single inbound endpoint.
• BRun a pair of self-managed BIND forwarders on EC2 in each VPC that conditionally forward corporate-domain queries to Active Directory and answer all other queries from the Route 53 private hosted zones.
• CDeploy only a Route 53 Resolver outbound endpoint with forwarding rules for the corporate domain, relying on it to also receive and answer queries originating from the on-premises Active Directory servers.
• DDeploy a Route 53 Resolver outbound endpoint with forwarding rules for the corporate domain, plus an inbound endpoint that on-premises servers query to resolve the VPC private hosted zone records.check_circle Correct

Why A is wrong: An inbound endpoint only handles queries arriving from on-premises into Route 53, so on its own it cannot forward VPC queries out to Active Directory, leaving one direction of resolution broken.

Why B is wrong: Self-managed BIND forwarders can bridge both directions, but they reintroduce exactly the DNS server fleet the team wants to avoid patching and scaling, so they are not the managed answer.

Why C is wrong: An outbound endpoint with forwarding rules resolves the VPC-to-on-premises direction, but it cannot receive queries from on-premises, so Active Directory servers still have no way to resolve the private hosted zone records.

Why D is correct: An outbound endpoint with conditional forwarding rules sends corporate-domain queries from the VPCs to Active Directory, while an inbound endpoint gives on-premises servers a target to resolve private hosted zones, providing managed bidirectional resolution with no DNS fleet to maintain.