SOA-C03 - Networking and Content Delivery (18% of the exam) - Section 5.3

Configure DNS and Amazon Route 53 routing policies, query logging and Route 53 Resolver for the required resolution behaviour.

Configure Amazon Route 53 routing policies - including latency, weighted, failover, and geolocation - to control how DNS queries are answered for different traffic management goals. Use Route 53 Resolver for hybrid DNS resolution between on-premises networks and VPCs, and enable query logging to audit DNS traffic.

Amazon Route 53Routing policiesRoute 53 ResolverQuery logging

Practice question for this objective

Free sampleNetworking and Content Deliverymedium

On-premises servers connected to a VPC over AWS Direct Connect must resolve records in a Route 53 private hosted zone that is associated with that VPC. DNS queries from the on-premises network currently fail because they cannot reach the VPC resolver. Which Route 53 Resolver configuration lets the on-premises servers resolve the private hosted zone names?

ACreate a Route 53 Resolver outbound endpoint in the VPC and add forwarding rules so VPC queries are forwarded to the on-premises DNS servers instead.
BEnable Route 53 Resolver query logging on the VPC so the private hosted zone records become reachable from the connected on-premises network.
CCreate a Route 53 Resolver inbound endpoint in the VPC and point the on-premises DNS servers at its IP addresses so their queries reach the VPC resolver. Correct
DAssociate the private hosted zone with a second VPC in another Region so the on-premises network can resolve the names through that additional association.

Use a Route 53 Resolver inbound endpoint so on-premises systems can forward DNS queries into a VPC and resolve private hosted zone records. A Route 53 Resolver inbound endpoint provisions elastic network interfaces with IP addresses inside the VPC that external networks can target. On-premises DNS servers forward queries to those addresses over Direct Connect or VPN, and the VPC resolver answers from any private hosted zone associated with the VPC. Outbound endpoints forward the other direction, query logging only records traffic, and extra VPC associations do not give on-premises a resolver to reach.

Why A is wrong: An outbound endpoint sends queries from the VPC out to external resolvers, which is the reverse of what is needed; it does not let on-premises servers query the VPC for private zone records.

Why B is wrong: Query logging only records the DNS queries the resolver handles for later analysis; it changes nothing about reachability and cannot make the private zone resolvable from on-premises.

Why C is correct: An inbound endpoint gives the VPC resolver IP addresses that on-premises servers can forward DNS queries to, letting them resolve the associated private hosted zone over the existing Direct Connect link.

Why D is wrong: Associating more VPCs only extends private resolution to those VPCs; on-premises servers still have no resolver endpoint to send their queries to, so resolution from on-premises continues to fail.

See more SOA-C03 practice questions, answers explained.

Exam traps in Networking and Content Delivery

Answers that look right on this material and are not. Each one is a distractor from a different question in the SOA-C03 bank for this domain.

Create a Route 53 private hosted zone for the on-premises domain, associate it with the VPC, and let the VPC resolver answer the internal names from records held in that hosted zone.
Why it is wrong: A private hosted zone would require recreating and maintaining every on-premises record in Route 53, which duplicates the authoritative data instead of forwarding live queries to the existing on-premises servers.
Enable VPC Flow Logs on the VPC and filter the captured records to the entries that show traffic to and from the resolver on UDP port 53.
Why it is wrong: VPC Flow Logs record IP-level metadata such as source, destination and ports but not the queried domain names or DNS record types, so they cannot supply the per-query DNS detail required.
Associate the on-premises domain as a second Route 53 private hosted zone with the VPC so the VPC resolver answers those names from its own records.
Why it is wrong: A private hosted zone holds records you author in Route 53, so it cannot mirror names that live only on the on-premises name servers and never forwards a query out.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.