On-premises servers connected to a VPC over AWS Direct Connect must resolve records in a Route 53 private hosted zone that is associated with that VPC. DNS queries from the on-premises network currently fail because they cannot reach the VPC resolver. Which Route 53 Resolver configuration lets the on-premises servers resolve the private hosted zone names?
- ACreate a Route 53 Resolver outbound endpoint in the VPC and add forwarding rules so VPC queries are forwarded to the on-premises DNS servers instead.
- BEnable Route 53 Resolver query logging on the VPC so the private hosted zone records become reachable from the connected on-premises network.
- CCreate a Route 53 Resolver inbound endpoint in the VPC and point the on-premises DNS servers at its IP addresses so their queries reach the VPC resolver. Correct
- DAssociate the private hosted zone with a second VPC in another Region so the on-premises network can resolve the names through that additional association.
Why A is wrong: An outbound endpoint sends queries from the VPC out to external resolvers, which is the reverse of what is needed; it does not let on-premises servers query the VPC for private zone records.
Why B is wrong: Query logging only records the DNS queries the resolver handles for later analysis; it changes nothing about reachability and cannot make the private zone resolvable from on-premises.
Why C is correct: An inbound endpoint gives the VPC resolver IP addresses that on-premises servers can forward DNS queries to, letting them resolve the associated private hosted zone over the existing Direct Connect link.
Why D is wrong: Associating more VPCs only extends private resolution to those VPCs; on-premises servers still have no resolver endpoint to send their queries to, so resolution from on-premises continues to fail.